@tsg-dsp/tsg-sdk 0.0.0-stage → 0.20.1

package/dist/utils/shape-validation.d.ts

@@ -0,0 +1,59 @@
+export type JsonObject = Record<string, unknown>;
+/**
+ * Validate an object response with a caller-provided type guard.
+ * @param data - Untrusted response body.
+ * @param name - Response name used in errors.
+ * @param predicate - Structural type guard.
+ * @returns The validated response.
+ */
+export declare function requireObjectResponse<T extends object>(data: unknown, name: string, predicate: (value: JsonObject) => value is JsonObject & T): T;
+/**
+ * Validate every item in an array response.
+ * @param data - Untrusted response body.
+ * @param name - Response name used in errors.
+ * @param predicate - Structural item type guard.
+ * @returns The validated response array.
+ */
+export declare function requireArrayResponse<T>(data: unknown, name: string, predicate: (value: JsonObject) => value is JsonObject & T): T[];
+/**
+ * Require an object response without accepting arrays or null.
+ * @param data - Untrusted response body.
+ * @param name - Response name used in errors.
+ * @returns The object response.
+ */
+export declare function requireObject(data: unknown, name: string): JsonObject;
+/**
+ * Check whether a value is a JSON object.
+ * @param value - Candidate value.
+ * @returns Whether the value is a non-null, non-array object.
+ */
+export declare function isObject(value: unknown): value is JsonObject;
+/**
+ * Check for a non-empty string property.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is a non-empty string.
+ */
+export declare function hasString(value: JsonObject, key: string): boolean;
+/**
+ * Check for a finite number property.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is a finite number.
+ */
+export declare function hasNumber(value: JsonObject, key: string): boolean;
+/**
+ * Check for a boolean property.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is boolean.
+ */
+export declare function hasBoolean(value: JsonObject, key: string): boolean;
+/**
+ * Check for an array property and narrow its type.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is an array.
+ */
+export declare function hasArray<K extends string>(value: JsonObject, key: K): value is JsonObject & Record<K, unknown[]>;
+//# sourceMappingURL=shape-validation.d.ts.map

package/dist/utils/shape-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape-validation.d.ts","sourceRoot":"","sources":["../../src/utils/shape-validation.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,MAAM,EACpD,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,GACxD,CAAC,CAQH;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,KAAK,IAAI,UAAU,GAAG,CAAC,GACxD,CAAC,EAAE,CAWL;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAQrE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,EACvC,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,CAAC,GACL,KAAK,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAE5C"}

package/dist/utils/shape-validation.js

@@ -0,0 +1,85 @@
+import { SdkError, SdkErrorCode } from "./errors.js";
+/**
+ * Validate an object response with a caller-provided type guard.
+ * @param data - Untrusted response body.
+ * @param name - Response name used in errors.
+ * @param predicate - Structural type guard.
+ * @returns The validated response.
+ */
+export function requireObjectResponse(data, name, predicate) {
+    if (!isObject(data) || !predicate(data)) {
+        throw new SdkError(`Invalid ${name} response`, SdkErrorCode.VALIDATION_FAILED);
+    }
+    return data;
+}
+/**
+ * Validate every item in an array response.
+ * @param data - Untrusted response body.
+ * @param name - Response name used in errors.
+ * @param predicate - Structural item type guard.
+ * @returns The validated response array.
+ */
+export function requireArrayResponse(data, name, predicate) {
+    if (!Array.isArray(data) ||
+        !data.every((item) => isObject(item) && predicate(item))) {
+        throw new SdkError(`Invalid ${name} response`, SdkErrorCode.VALIDATION_FAILED);
+    }
+    return data;
+}
+/**
+ * Require an object response without accepting arrays or null.
+ * @param data - Untrusted response body.
+ * @param name - Response name used in errors.
+ * @returns The object response.
+ */
+export function requireObject(data, name) {
+    if (!isObject(data)) {
+        throw new SdkError(`Invalid ${name} response: expected an object`, SdkErrorCode.VALIDATION_FAILED);
+    }
+    return data;
+}
+/**
+ * Check whether a value is a JSON object.
+ * @param value - Candidate value.
+ * @returns Whether the value is a non-null, non-array object.
+ */
+export function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+ * Check for a non-empty string property.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is a non-empty string.
+ */
+export function hasString(value, key) {
+    return typeof value[key] === "string" && value[key].length > 0;
+}
+/**
+ * Check for a finite number property.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is a finite number.
+ */
+export function hasNumber(value, key) {
+    return typeof value[key] === "number" && Number.isFinite(value[key]);
+}
+/**
+ * Check for a boolean property.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is boolean.
+ */
+export function hasBoolean(value, key) {
+    return typeof value[key] === "boolean";
+}
+/**
+ * Check for an array property and narrow its type.
+ * @param value - Candidate object.
+ * @param key - Property name.
+ * @returns Whether the property is an array.
+ */
+export function hasArray(value, key) {
+    return Array.isArray(value[key]);
+}
+//# sourceMappingURL=shape-validation.js.map

package/dist/utils/shape-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shape-validation.js","sourceRoot":"","sources":["../../src/utils/shape-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIrD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAa,EACb,IAAY,EACZ,SAAyD;IAEzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAChB,WAAW,IAAI,WAAW,EAC1B,YAAY,CAAC,iBAAiB,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,IAAY,EACZ,SAAyD;IAEzD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EACxD,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,WAAW,IAAI,WAAW,EAC1B,YAAY,CAAC,iBAAiB,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,IAAY;IACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAChB,WAAW,IAAI,+BAA+B,EAC9C,YAAY,CAAC,iBAAiB,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAiB,EAAE,GAAW;IACtD,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAiB,EAAE,GAAW;IACtD,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB,EAAE,GAAW;IACvD,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAiB,EACjB,GAAM;IAEN,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/utils/validate.d.ts

@@ -0,0 +1,47 @@
+import { ContextDto, SerializableClass } from "@tsg-dsp/common-dsp";
+import { type ClassConstructor } from "class-transformer";
+/**
+ * Infer the raw DTO type from a JSON-LD serializable class.
+ *
+ * For example, `DtoOf<Catalog>` resolves to `CatalogDto`.
+ */
+export type DtoOf<T> = T extends SerializableClass<infer DTO> ? DTO : never;
+/**
+ * Validate an API response against a DTO class.
+ *
+ * Creates a class instance from the plain data, runs `class-validator` checks,
+ * and throws a descriptive error if validation fails. Returns the transformed
+ * class instance so `class-transformer` conversions such as `Date` coercion are
+ * preserved for SDK consumers.
+ * @typeParam T - The DTO class type.
+ * @param dto - The class constructor to validate against.
+ * @param data - The plain object received from the API.
+ * @returns A validated instance of `T`.
+ * @throws Throws an {@link SdkError} with code {@link SdkErrorCode.VALIDATION_FAILED} if validation errors are found.
+ */
+export declare function validateResponse<T extends object>(dto: ClassConstructor<T>, data: object): T;
+/**
+ * Validate an array of API responses against a DTO class.
+ *
+ * Each item is validated individually using {@link validateResponse}.
+ * @typeParam T - The DTO class type.
+ * @param dto - The class constructor to validate against.
+ * @param data - The array of plain objects received from the API.
+ * @returns An array of validated instances of `T`.
+ * @throws Throws an {@link SdkError} with code {@link SdkErrorCode.VALIDATION_FAILED} if any item fails validation.
+ */
+export declare function validateResponseArray<T extends object>(dto: ClassConstructor<T>, data: object[]): T[];
+/**
+ * Deserialize and validate a JSON-LD API response.
+ *
+ * Uses the `@tsg-dsp/common-dsp` deserializer to convert JSON-LD payloads
+ * into typed class instances.
+ * @typeParam T - The target serializable class type.
+ * @param data - The raw JSON-LD data from the API.
+ * @param returnDto - When `true`, returns the raw DTO-shaped data instead of the deserialized class instance.
+ * @returns The deserialized class instance, or the raw DTO when `returnDto` is `true`.
+ */
+export declare function validateJsonLD<T extends SerializableClass<ContextDto>>(data: unknown, returnDto: true): Promise<DtoOf<T>>;
+export declare function validateJsonLD<T extends SerializableClass<ContextDto>>(data: unknown, returnDto?: false): Promise<T>;
+export declare function validateJsonLD<T extends SerializableClass<ContextDto>>(data: unknown, returnDto: boolean): Promise<T | DtoOf<T>>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/utils/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/utils/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EAEV,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,gBAAgB,EAAmB,MAAM,mBAAmB,CAAC;AA6B3E;;;;GAIG;AACH,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,iBAAiB,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC;AAE5E;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAC/C,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,MAAM,GACX,CAAC,CAcH;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,MAAM,EACpD,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,MAAM,EAAE,GACb,CAAC,EAAE,CAEL;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,CAAC,UAAU,CAAC,EAC1E,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,wBAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,CAAC,UAAU,CAAC,EAC1E,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,KAAK,GAChB,OAAO,CAAC,CAAC,CAAC,CAAC;AACd,wBAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,CAAC,UAAU,CAAC,EAC1E,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/utils/validate.js

@@ -0,0 +1,68 @@
+import { deserialize } from "@tsg-dsp/common-dsp";
+import { plainToInstance } from "class-transformer";
+import { validateSync } from "class-validator";
+import { SdkError, SdkErrorCode } from "./errors.js";
+/**
+ * Validation error messages for a class-validator ValidationError array.
+ *
+ * Recursively traverses the ValidationError tree and returns a flat array of
+ * messages with the property path prepended to each message.
+ * @param errors - The array of ValidationError objects to process.
+ * @param parentPath - The property path of the parent object, used for recursion. Defaults to an empty string.
+ * @returns An array of strings containing the validation error messages with property paths.
+ */
+function validationMessages(errors, parentPath = "") {
+    return errors.flatMap((error) => {
+        const path = parentPath
+            ? `${parentPath}.${error.property}`
+            : error.property;
+        const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);
+        return [...ownMessages, ...validationMessages(error.children ?? [], path)];
+    });
+}
+/**
+ * Validate an API response against a DTO class.
+ *
+ * Creates a class instance from the plain data, runs `class-validator` checks,
+ * and throws a descriptive error if validation fails. Returns the transformed
+ * class instance so `class-transformer` conversions such as `Date` coercion are
+ * preserved for SDK consumers.
+ * @typeParam T - The DTO class type.
+ * @param dto - The class constructor to validate against.
+ * @param data - The plain object received from the API.
+ * @returns A validated instance of `T`.
+ * @throws Throws an {@link SdkError} with code {@link SdkErrorCode.VALIDATION_FAILED} if validation errors are found.
+ */
+export function validateResponse(dto, data) {
+    const instance = plainToInstance(dto, data);
+    const errors = validateSync(instance, {
+        whitelist: false,
+        forbidUnknownValues: false
+    });
+    if (errors.length > 0) {
+        const messages = validationMessages(errors);
+        throw new SdkError(`Invalid ${dto.name} response: ${messages.join("; ") || "validation failed"}`, SdkErrorCode.VALIDATION_FAILED);
+    }
+    return instance;
+}
+/**
+ * Validate an array of API responses against a DTO class.
+ *
+ * Each item is validated individually using {@link validateResponse}.
+ * @typeParam T - The DTO class type.
+ * @param dto - The class constructor to validate against.
+ * @param data - The array of plain objects received from the API.
+ * @returns An array of validated instances of `T`.
+ * @throws Throws an {@link SdkError} with code {@link SdkErrorCode.VALIDATION_FAILED} if any item fails validation.
+ */
+export function validateResponseArray(dto, data) {
+    return data.map((item) => validateResponse(dto, item));
+}
+export async function validateJsonLD(data, returnDto = false) {
+    const deserialized = await deserialize(data);
+    if (returnDto) {
+        return data;
+    }
+    return deserialized;
+}
+//# sourceMappingURL=validate.js.map

package/dist/utils/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/utils/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAyB,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAwB,MAAM,iBAAiB,CAAC;AAErE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,MAAyB,EACzB,UAAU,GAAG,EAAE;IAEf,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,UAAU;YACrB,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE;YACnC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnB,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAC5D,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CACnC,CAAC;QACF,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAwB,EACxB,IAAY;IAEZ,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE;QACpC,SAAS,EAAE,KAAK;QAChB,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,QAAQ,CAChB,WAAW,GAAG,CAAC,IAAI,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,EAC7E,YAAY,CAAC,iBAAiB,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAwB,EACxB,IAAc;IAEd,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,YAAqB,KAAK;IAE1B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAI,IAAI,CAAC,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/vendor/common-dtos/abac.policy.d.ts

@@ -0,0 +1,60 @@
+import { Action, PermissionString, RESERVED_SCOPES, Resource } from "./permissions.js";
+export type ActorType = "user" | "service" | "system";
+export interface RequestActor {
+    sub: string;
+    type: ActorType;
+    serviceName?: string;
+    permissions?: PermissionString[];
+    didId?: string;
+    username?: string;
+    [key: string]: unknown;
+}
+export interface SubjectAttributes extends RequestActor {
+    permissions: PermissionString[];
+}
+export interface DelegationContext {
+    originalActor: RequestActor;
+    delegationChain: RequestActor[];
+    originTimestamp: Date;
+    correlationId: string;
+    effectivePermissions: PermissionString[];
+}
+export interface ResourceAttributes {
+    type: Resource;
+    id?: string;
+    ownerId?: string;
+    ownerIdentifier?: string;
+    tenantId?: string;
+    [key: string]: unknown;
+}
+export interface EnvironmentAttributes {
+    timestamp: Date;
+    ipAddress?: string;
+    userAgent?: string;
+    requestPath?: string;
+    requestMethod?: string;
+    correlationId?: string;
+    [key: string]: unknown;
+}
+export interface RequestContext {
+    caller: RequestActor;
+    delegation?: DelegationContext;
+    isOnBehalfOf: boolean;
+    environment: EnvironmentAttributes;
+}
+export interface PolicyContext {
+    subject: SubjectAttributes;
+    action: Action;
+    resource: ResourceAttributes;
+    environment: EnvironmentAttributes;
+    delegation?: DelegationContext;
+}
+export type EffectiveScope = typeof RESERVED_SCOPES.ALL | typeof RESERVED_SCOPES.OWN | "specific";
+export interface PolicyResult {
+    allowed: boolean;
+    reason?: string;
+    matchedPermission?: PermissionString;
+    effectiveScope?: EffectiveScope;
+    allowedResourceIds?: string[];
+}
+//# sourceMappingURL=abac.policy.d.ts.map

package/dist/vendor/common-dtos/abac.policy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=abac.policy.js.map

package/dist/vendor/common-dtos/audit.types.d.ts

@@ -0,0 +1,74 @@
+import { Action, Resource } from "./permissions.js";
+type AuditFilterValue<T> = T | T[];
+export declare enum AuditSeverity {
+    DEBUG = "debug",
+    INFO = "info",
+    WARNING = "warning",
+    ERROR = "error",
+    CRITICAL = "critical"
+}
+export interface AuditLogEntry {
+    timestamp: Date;
+    severity: AuditSeverity;
+    correlationId?: string;
+    caller: {
+        sub: string;
+        type: "user" | "service" | "system";
+        serviceName?: string;
+        username?: string;
+        didId?: string;
+    };
+    onBehalfOf?: {
+        sub: string;
+        username?: string;
+        didId?: string;
+    };
+    delegationChain?: string[];
+    action: Action;
+    resource: {
+        type: Resource;
+        id?: string;
+    };
+    environment: {
+        ipAddress?: string;
+        userAgent?: string;
+        requestPath?: string;
+        requestMethod?: string;
+    };
+    result: {
+        allowed: boolean;
+        reason?: string;
+        matchedPermission?: string;
+        effectiveScope?: string;
+    };
+}
+export interface AuditLogConfig {
+    enabled: boolean;
+    minSeverity: AuditSeverity;
+    logDenied: boolean;
+    logDelegated: boolean;
+    logMutations: boolean;
+    logExecute: boolean;
+    logReads: boolean;
+    sensitiveResources?: Resource[];
+}
+export interface AuditLogQueryParams {
+    page?: number;
+    perPage?: number;
+    orderBy?: string;
+    order?: "ASC" | "DESC";
+    severity?: AuditFilterValue<AuditSeverity>;
+    callerSub?: string;
+    callerType?: "user" | "service" | "system";
+    action?: AuditFilterValue<Action>;
+    resourceType?: AuditFilterValue<Resource | string>;
+    resultAllowed?: boolean;
+    correlationId?: string;
+    ipAddress?: string;
+    requestPath?: string;
+    from?: string;
+    to?: string;
+    search?: string;
+}
+export {};
+//# sourceMappingURL=audit.types.d.ts.map

package/dist/vendor/common-dtos/audit.types.js

@@ -0,0 +1,9 @@
+export var AuditSeverity;
+(function (AuditSeverity) {
+    AuditSeverity["DEBUG"] = "debug";
+    AuditSeverity["INFO"] = "info";
+    AuditSeverity["WARNING"] = "warning";
+    AuditSeverity["ERROR"] = "error";
+    AuditSeverity["CRITICAL"] = "critical";
+})(AuditSeverity || (AuditSeverity = {}));
+//# sourceMappingURL=audit.types.js.map

package/dist/vendor/common-dtos/credential-requirements.d.ts

@@ -0,0 +1,19 @@
+import type { CredentialRequirement, CredentialRequirementSet, CredentialRequirementSetCreate, RequirementEvaluation } from "./credential-requirements.dto.js";
+export type CredentialRecord = Record<string, unknown>;
+export interface CredentialMatchContext {
+    remoteParticipant?: string;
+    localParticipant?: string;
+    holder?: string;
+    now?: Date;
+}
+export interface CredentialMatchResult {
+    satisfied: boolean;
+    requirements: RequirementEvaluation[];
+    usableCredentialIds: string[];
+    missingRequirementIds: string[];
+}
+export declare function lintCredentialRequirementSet(requirementSet: CredentialRequirementSet | CredentialRequirementSetCreate): string[];
+export declare function credentialMismatch(requirement: CredentialRequirement, credential: CredentialRecord, context?: CredentialMatchContext): string | undefined;
+export declare function findCandidateCredentials(requirement: CredentialRequirement, credentials: CredentialRecord[], context?: CredentialMatchContext): CredentialRecord[];
+export declare function matchCredentialRequirements(requirementSet: Pick<CredentialRequirementSet, "logic" | "requirements">, credentials: CredentialRecord[], context?: CredentialMatchContext): CredentialMatchResult;
+//# sourceMappingURL=credential-requirements.d.ts.map

package/dist/vendor/common-dtos/credential-requirements.dto.d.ts

@@ -0,0 +1,47 @@
+import { PresentationDefinition } from "./presentationdefinition.dto.js";
+export declare class ProfileRef {
+    id: string;
+    version: string;
+    digest?: string;
+}
+export declare class VersionedRef {
+    id: string;
+    revision: number;
+    digest: string;
+}
+export declare class CredentialClaimConstraint {
+    path: string[];
+    operator: "eq" | "in" | "exists";
+    value?: string | number | boolean | Array<string | number | boolean>;
+}
+export declare class CredentialRequirement {
+    id: string;
+    credentialTypes: string[];
+    acceptedIssuers?: string[];
+    holderBinding?: "required" | "not-required";
+    subjectBinding?: "remoteParticipant" | "localParticipant" | "none";
+    claimConstraints?: CredentialClaimConstraint[];
+    status?: "valid";
+}
+export declare class CredentialRequirementSetCreate {
+    id: string;
+    profile: ProfileRef;
+    logic: "all" | "any";
+    requirements: CredentialRequirement[];
+}
+export declare class CredentialRequirementSet extends CredentialRequirementSetCreate {
+    revision: number;
+    presentationDefinition: PresentationDefinition;
+    digest: string;
+}
+export declare class CredentialRequirementSetPage {
+    data: CredentialRequirementSet[];
+    total: number;
+}
+export declare class RequirementEvaluation {
+    id: string;
+    satisfied: boolean;
+    matchedCredentialIds: string[];
+    reason?: string;
+}
+//# sourceMappingURL=credential-requirements.dto.d.ts.map