@tsg-dsp/tsg-sdk 0.0.0-stage → 0.21.0

package/dist/vendor/sso-bridge-dtos/users.dto.js

@@ -0,0 +1,173 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ApiProperty, ApiPropertyOptional, OmitType, PartialType } from "@nestjs/swagger";
+import { IsArray, IsBoolean, IsEmail, IsNotEmpty, IsOptional, IsString, IsUUID, Matches, MaxLength, MinLength } from "class-validator";
+export class UserDto {
+    platformAdministrator;
+    id;
+    username;
+    email;
+    permissions;
+    grants;
+    require2FA;
+}
+__decorate([
+    ApiPropertyOptional(),
+    IsBoolean(),
+    IsOptional(),
+    __metadata("design:type", Boolean)
+], UserDto.prototype, "platformAdministrator", void 0);
+__decorate([
+    ApiPropertyOptional({ example: "1" }),
+    IsString(),
+    IsOptional(),
+    __metadata("design:type", String)
+], UserDto.prototype, "id", void 0);
+__decorate([
+    ApiProperty({ example: "johndoe" }),
+    IsString(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], UserDto.prototype, "username", void 0);
+__decorate([
+    ApiProperty({ example: "johndoe@example.com" }),
+    IsEmail(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], UserDto.prototype, "email", void 0);
+__decorate([
+    ApiProperty({
+        example: ["manage:user", "read:config"],
+        description: "User permissions (can be permission strings or permission set names)"
+    }),
+    IsArray(),
+    IsNotEmpty(),
+    __metadata("design:type", Array)
+], UserDto.prototype, "permissions", void 0);
+__decorate([
+    ApiProperty({ example: ["read", "write"] }),
+    IsArray(),
+    IsNotEmpty(),
+    __metadata("design:type", Array)
+], UserDto.prototype, "grants", void 0);
+__decorate([
+    ApiPropertyOptional({ example: false }),
+    IsBoolean(),
+    IsOptional(),
+    __metadata("design:type", Boolean)
+], UserDto.prototype, "require2FA", void 0);
+export class UserWithPasswordDto extends UserDto {
+    password;
+}
+__decorate([
+    ApiPropertyOptional({ example: "strongpassword123" }),
+    IsString(),
+    IsOptional(),
+    __metadata("design:type", String)
+], UserWithPasswordDto.prototype, "password", void 0);
+export class CreateUserDto extends OmitType(UserWithPasswordDto, [
+    "id"
+]) {
+}
+export class UpdateUserDto extends PartialType(OmitType(UserWithPasswordDto, ["id"])) {
+}
+export class ChangePasswordDto {
+    currentPassword;
+    newPassword;
+}
+__decorate([
+    ApiProperty({ example: "currentpassword123" }),
+    IsString(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], ChangePasswordDto.prototype, "currentPassword", void 0);
+__decorate([
+    ApiProperty({ example: "newpassword456" }),
+    IsString(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], ChangePasswordDto.prototype, "newPassword", void 0);
+export class BootstrapSsoAccountDto {
+    operationId;
+    tenantId;
+    userId;
+    username;
+    email;
+}
+__decorate([
+    ApiProperty(),
+    IsUUID(),
+    __metadata("design:type", String)
+], BootstrapSsoAccountDto.prototype, "operationId", void 0);
+__decorate([
+    ApiProperty(),
+    IsUUID(),
+    __metadata("design:type", String)
+], BootstrapSsoAccountDto.prototype, "tenantId", void 0);
+__decorate([
+    ApiProperty(),
+    IsUUID(),
+    __metadata("design:type", String)
+], BootstrapSsoAccountDto.prototype, "userId", void 0);
+__decorate([
+    ApiProperty(),
+    Matches(/\S/),
+    IsString(),
+    IsNotEmpty(),
+    MaxLength(100),
+    __metadata("design:type", String)
+], BootstrapSsoAccountDto.prototype, "username", void 0);
+__decorate([
+    ApiProperty(),
+    IsEmail(),
+    MaxLength(254),
+    __metadata("design:type", String)
+], BootstrapSsoAccountDto.prototype, "email", void 0);
+export class ResolveSsoAccountDto {
+    issuer;
+    subject;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], ResolveSsoAccountDto.prototype, "issuer", void 0);
+__decorate([
+    ApiProperty(),
+    IsString(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], ResolveSsoAccountDto.prototype, "subject", void 0);
+export class SetupLinkRequestDto {
+    tenantId;
+}
+__decorate([
+    ApiProperty(),
+    IsUUID(),
+    __metadata("design:type", String)
+], SetupLinkRequestDto.prototype, "tenantId", void 0);
+export class SetupAccountDto {
+    token;
+    newPassword;
+}
+__decorate([
+    ApiProperty(),
+    IsString(),
+    IsNotEmpty(),
+    __metadata("design:type", String)
+], SetupAccountDto.prototype, "token", void 0);
+__decorate([
+    ApiProperty({ minLength: 12, maxLength: 256 }),
+    IsString(),
+    MinLength(12),
+    MaxLength(256),
+    __metadata("design:type", String)
+], SetupAccountDto.prototype, "newPassword", void 0);

package/dist/vendor/tenant-dtos/authorization.dto.d.ts

@@ -0,0 +1,46 @@
+import type { AuthenticatedActorType, PermissionString } from "../common-dtos/index.js";
+import type { TenantMembership, TenantServiceGrant } from "./membership.dto.js";
+import type { PrincipalMapping } from "./principal.dto.js";
+import type { TenantState } from "./tenant.dto.js";
+/** Authority-issued lifetime, measured from snapshot creation, not delivery. */
+export declare const TENANT_AUTHORIZATION_FRESHNESS_MS = 50000;
+export declare const TENANT_AUTHORIZATION_RENEWAL_MS = 20000;
+/** Consumer acceptance ceiling only; this never extends a snapshot's validUntil. */
+export declare const TENANT_AUTHORIZATION_CLOCK_SKEW_MS = 10000;
+/**
+ * A complete snapshot for one target service instance. Tenant Management sends
+ * the same revision/content to that service and to SSO for token issuance.
+ * An SSO copy retains the target's local identity mappings; copying it does not
+ * make SSO the target or a second membership authority.
+ */
+export interface TenantAuthorizationProjection {
+    contractVersion: 1;
+    tenantId: string;
+    serviceInstanceId: string;
+    authorizationRevision: number;
+    state: TenantState;
+    memberships: TenantMembership[];
+    grants: TenantServiceGrant[];
+    principalMappings: PrincipalMapping[];
+    /** ISO timestamp from the authority; replay must never extend this deadline. */
+    validUntil: string;
+}
+/**
+ * Verified API access-token payload; ID tokens do not implement this contract.
+ * Managed browser backends retain the access token separately from the login
+ * session, bound to this issuer/subject, client, tenant and audience. Each API
+ * request still validates the token and current authorization projection.
+ */
+export interface TenantAccessTokenClaims {
+    iss: string;
+    sub: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    jti: string;
+    client_id: string;
+    actor_type: AuthenticatedActorType;
+    tenant_id: string;
+    authorization_revision: number;
+    permissions: PermissionString[];
+}

package/dist/vendor/tenant-dtos/authorization.dto.js

@@ -0,0 +1,5 @@
+/** Authority-issued lifetime, measured from snapshot creation, not delivery. */
+export const TENANT_AUTHORIZATION_FRESHNESS_MS = 50_000;
+export const TENANT_AUTHORIZATION_RENEWAL_MS = 20_000;
+/** Consumer acceptance ceiling only; this never extends a snapshot's validUntil. */
+export const TENANT_AUTHORIZATION_CLOCK_SKEW_MS = 10_000;

package/dist/vendor/tenant-dtos/consumer.dto.d.ts

@@ -0,0 +1,29 @@
+import type { EnsureTenantRequest, TenantProvisioningResult, WalletProvisioningOutputs } from "./provisioning.dto.js";
+/** Operator-selected Wallet seed profile. Imported private keys are never accepted here. */
+export interface WalletTenantConfiguration {
+    profile: "default";
+    localTenantId?: string;
+    localTenantSlug?: string;
+    controlPlaneUrl?: string;
+}
+export type EnsureWalletTenantRequest = EnsureTenantRequest<WalletTenantConfiguration>;
+export interface TenantWorkloadCredential {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret: string;
+    audience: string;
+    tenantId: string;
+    revision: number;
+}
+/** The manager consumes actual Wallet outputs; consumers validate these against operator registrations. */
+export interface ControlPlaneTenantConfiguration {
+    wallet: WalletProvisioningOutputs;
+    walletCredential: TenantWorkloadCredential;
+    localTenantId?: string;
+    localTenantSlug?: string;
+    profile: string;
+}
+export type EnsureControlPlaneTenantRequest = EnsureTenantRequest<ControlPlaneTenantConfiguration>;
+export type ConsumerProvisioningResult<T> = TenantProvisioningResult<T> & {
+    appliedLifecycleRevision: number;
+};

package/dist/vendor/tenant-dtos/consumer.dto.js

@@ -0,0 +1 @@
+export {};

package/dist/vendor/tenant-dtos/fixtures.d.ts

@@ -0,0 +1,15 @@
+import type { TenantAuthorizationProjection } from "./authorization.dto.js";
+export declare const tenantContractFixtures: {
+    readonly tenantA: "019a0010-0000-7000-8000-000000000001";
+    readonly tenantB: "019a0010-0000-7000-8000-000000000002";
+    readonly alice: {
+        readonly issuer: "https://sso.example";
+        readonly subject: "alice";
+    };
+    readonly bob: {
+        readonly issuer: "https://sso.example";
+        readonly subject: "bob";
+    };
+};
+/** Fresh objects for contract tests in SSO, consumers and the future manager. */
+export declare function authorizationFixture(serviceInstanceId: string, validUntil: string): TenantAuthorizationProjection;

package/dist/vendor/tenant-dtos/fixtures.js

@@ -0,0 +1,48 @@
+export const tenantContractFixtures = {
+    tenantA: "019a0010-0000-7000-8000-000000000001",
+    tenantB: "019a0010-0000-7000-8000-000000000002",
+    alice: { issuer: "https://sso.example", subject: "alice" },
+    bob: { issuer: "https://sso.example", subject: "bob" }
+};
+/** Fresh objects for contract tests in SSO, consumers and the future manager. */
+export function authorizationFixture(serviceInstanceId, validUntil) {
+    const { tenantA, alice, bob } = tenantContractFixtures;
+    return {
+        contractVersion: 1,
+        tenantId: tenantA,
+        serviceInstanceId,
+        authorizationRevision: 1,
+        state: "active",
+        validUntil,
+        memberships: [
+            { tenantId: tenantA, principal: alice, role: "owner", status: "active" },
+            { tenantId: tenantA, principal: bob, role: "member", status: "active" }
+        ],
+        grants: [
+            {
+                tenantId: tenantA,
+                principal: alice,
+                serviceInstanceId,
+                permissions: ["manage:w.key"]
+            },
+            {
+                tenantId: tenantA,
+                principal: bob,
+                serviceInstanceId,
+                permissions: ["read:w.key"]
+            }
+        ],
+        principalMappings: [
+            {
+                principal: alice,
+                localSubject: "alice-local",
+                ownershipAliases: ["user:alice-local"]
+            },
+            {
+                principal: bob,
+                localSubject: "bob-local",
+                ownershipAliases: ["user:bob-local"]
+            }
+        ]
+    };
+}

package/dist/vendor/tenant-dtos/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./authorization.dto.js";
+export * from "./consumer.dto.js";
+export * from "./management.dto.js";
+export * from "./membership.dto.js";
+export * from "./principal.dto.js";
+export * from "./provisioning.dto.js";
+export * from "./service-binding.dto.js";
+export * from "./tenant.dto.js";

package/dist/vendor/tenant-dtos/index.js

@@ -0,0 +1,8 @@
+export * from "./authorization.dto.js";
+export * from "./consumer.dto.js";
+export * from "./management.dto.js";
+export * from "./membership.dto.js";
+export * from "./principal.dto.js";
+export * from "./provisioning.dto.js";
+export * from "./service-binding.dto.js";
+export * from "./tenant.dto.js";

package/dist/vendor/tenant-dtos/management.dto.d.ts

@@ -0,0 +1,137 @@
+import type { PermissionString } from "../common-dtos/index.js";
+import type { TenantMembership, TenantServiceGrant } from "./membership.dto.js";
+import type { PrincipalMapping, PrincipalRef } from "./principal.dto.js";
+import type { TenantProvisioningResult } from "./provisioning.dto.js";
+import type { TenantState } from "./tenant.dto.js";
+export interface CreateManagedTenant {
+    name: string;
+    slug: string;
+    profile: string;
+}
+export type TenantAccountSelector = {
+    kind: "existing";
+    principal: PrincipalRef;
+} | {
+    kind: "new";
+    username: string;
+    email: string;
+};
+export interface CreatePlatformTenant extends CreateManagedTenant {
+    owner: TenantAccountSelector;
+}
+export interface AddManagedTenantAccount {
+    revision: number;
+    account: TenantAccountSelector;
+    role: "admin" | "member";
+    grants: Array<{
+        serviceInstanceId: string;
+        permissions: PermissionString[];
+    }>;
+}
+export interface AccountSetupLink {
+    /** Present only when email delivery is disabled. */
+    url?: string;
+    expiresAt: number;
+    notificationSent: boolean;
+}
+export interface TenantManagementCapabilities {
+    canCreate: boolean;
+    isPlatformAdministrator?: boolean;
+    profileOwnerGrants?: Record<string, Record<string, PermissionString[]>>;
+    profiles: string[];
+    applications?: Array<{
+        id: string;
+        name: string;
+        uiUrl: string;
+        serviceInstanceId: string;
+        profiles: string[];
+        permissions: PermissionString[];
+    }>;
+    services: Array<{
+        serviceInstanceId: string;
+        kind: "wallet" | "control-plane" | "generic" | "sso";
+        uiUrl?: string;
+    }>;
+}
+export interface TenantAuditEntry {
+    id: string;
+    tenantId: string;
+    revision: number;
+    action: string;
+    principal: PrincipalRef;
+    occurredAt: number;
+}
+export interface ManagedTenantSummary {
+    id: string;
+    slug: string;
+    name: string;
+    profile: string;
+    state: TenantState;
+    desiredState: TenantState;
+    revision: number;
+    authorizationRevision: number;
+    configurationRevision: number;
+    memberships: TenantMembership[];
+    /** Human-readable metadata from the tenant's registered identity provider. Never an authorization selector. */
+    principalNames?: PrincipalDisplayName[];
+    grants: TenantServiceGrant[];
+    mappings: Record<string, PrincipalMapping[]>;
+    bindings: Array<{
+        serviceInstanceId: string;
+        configurationRevision: number;
+        localTenantId?: string;
+        observed?: TenantProvisioningResult<Record<string, unknown>>;
+    }>;
+}
+export interface PrincipalDisplayName {
+    principal: PrincipalRef;
+    name: string;
+    /** Account was created through manager provisioning and has not completed setup. */
+    setupPending?: boolean;
+    /** The current tenant initiated provisioning, so its admins may issue a setup link. */
+    canIssueSetupLink?: boolean;
+}
+export interface TenantOperationSummary {
+    id: string;
+    tenantId: string;
+    kind: TenantOperationKind;
+    revision: number;
+    state: "pending" | "running" | "succeeded" | "superseded" | "failed";
+    attempts: number;
+    nextAttemptAt: number;
+    errorCode?: string | null;
+    /** Epoch milliseconds. */
+    createdAt: number;
+    /** Epoch milliseconds. */
+    updatedAt: number;
+}
+export type TenantOperationKind = "create" | "import" | "configuration" | "membership" | "ownership" | "grant" | "rotation" | "lifecycle";
+export interface ManagedTenantAccepted {
+    tenantId: string;
+    operationId: string;
+    state: string;
+}
+export interface ImportManagedTenant extends CreateManagedTenant {
+    tenantId: string;
+    memberships: TenantMembership[];
+    grants: TenantServiceGrant[];
+    mappings: Record<string, PrincipalMapping[]>;
+    localTenantIds: Record<string, string>;
+    localTenantSlugs: Record<string, string>;
+    /** Preserve pending invitations with an explicit, independently shared possession proof. */
+    invitations?: PendingTenantInvitation[];
+}
+export interface PendingTenantInvitation {
+    /** SHA-256 hex digest of the possession token; never an email or raw token. */
+    tokenHash: string;
+    role: "admin" | "member";
+    principal?: PrincipalRef;
+    expiresAt: number;
+}
+export interface ManagedInvitationSummary {
+    id: string;
+    role: "admin" | "member";
+    principal?: PrincipalRef | null;
+    expiresAt: number;
+    state: "pending" | "expired" | "closed";
+}

package/dist/vendor/tenant-dtos/management.dto.js

@@ -0,0 +1 @@
+export {};

package/dist/vendor/tenant-dtos/membership.dto.d.ts

@@ -0,0 +1,22 @@
+import type { PermissionString } from "../common-dtos/index.js";
+import type { PrincipalRef } from "./principal.dto.js";
+export type TenantRole = "owner" | "admin" | "member";
+export interface TenantMembership {
+    tenantId: string;
+    principal: PrincipalRef;
+    role: TenantRole;
+    status: "active" | "revoked";
+}
+export interface TenantServiceGrant {
+    tenantId: string;
+    principal: PrincipalRef;
+    serviceInstanceId: string;
+    permissions: PermissionString[];
+}
+export declare const TENANT_ADMINISTRATION_ROLES: {
+    readonly read: readonly ["owner", "admin", "member"];
+    readonly update: readonly ["owner", "admin"];
+    readonly manageMembers: readonly ["owner", "admin"];
+    readonly transferOwnership: readonly ["owner"];
+    readonly delete: readonly ["owner"];
+};

package/dist/vendor/tenant-dtos/membership.dto.js

@@ -0,0 +1,7 @@
+export const TENANT_ADMINISTRATION_ROLES = {
+    read: ["owner", "admin", "member"],
+    update: ["owner", "admin"],
+    manageMembers: ["owner", "admin"],
+    transferOwnership: ["owner"],
+    delete: ["owner"]
+};

package/dist/vendor/tenant-dtos/principal.dto.d.ts

@@ -0,0 +1,13 @@
+export interface PrincipalRef {
+    issuer: string;
+    subject: string;
+}
+/** Operator-confirmed mapping; never inferred from email or username. */
+export interface PrincipalMapping {
+    principal: PrincipalRef;
+    /** Local to the snapshot's target service, including when SSO stores a copy. */
+    localSubject: string;
+    ownershipAliases: string[];
+}
+export declare function samePrincipal(a: PrincipalRef, b: PrincipalRef): boolean;
+export declare function principalKey(principal: PrincipalRef): string;

package/dist/vendor/tenant-dtos/principal.dto.js

@@ -0,0 +1,6 @@
+export function samePrincipal(a, b) {
+    return a.issuer === b.issuer && a.subject === b.subject;
+}
+export function principalKey(principal) {
+    return JSON.stringify([principal.issuer, principal.subject]);
+}

package/dist/vendor/tenant-dtos/provisioning.dto.d.ts

@@ -0,0 +1,47 @@
+import type { PrincipalRef } from "./principal.dto.js";
+import type { TenantState } from "./tenant.dto.js";
+export type ProvisioningOperation = "configuration" | "status" | "authorization" | "lifecycle" | "account";
+/** Configured by operators, independently of tenant creation. */
+export interface ProvisioningIdentity {
+    principal: PrincipalRef;
+    audience: string;
+    serviceInstanceId: string;
+    operations: ProvisioningOperation[];
+}
+export interface EnsureTenantRequest<TConfig> {
+    contractVersion: 1;
+    operationId: string;
+    tenantId: string;
+    slug: string;
+    name: string;
+    configurationRevision: number;
+    configuration: TConfig;
+}
+export interface TenantLifecycleRequest {
+    contractVersion: 1;
+    operationId: string;
+    tenantId: string;
+    revision: number;
+    state: TenantState;
+}
+export interface TenantProvisioningResult<TOutputs> {
+    tenantId: string;
+    localTenantId: string;
+    appliedConfigurationRevision: number;
+    readiness: "pending" | "ready" | "failed";
+    /** Identifiers/endpoints only; no keys or raw client secrets. */
+    outputs?: TOutputs;
+    error?: {
+        code: string;
+        retryable: boolean;
+        message: string;
+    };
+}
+export interface WalletProvisioningOutputs {
+    /** Preserved target-local URL slug; may differ from the canonical organization's slug after import. */
+    tenantSlug?: string;
+    did: string;
+    managementUrl: string;
+    presentationUrl: string;
+    verificationUrl: string;
+}

package/dist/vendor/tenant-dtos/provisioning.dto.js

@@ -0,0 +1 @@
+export {};

package/dist/vendor/tenant-dtos/service-binding.dto.d.ts

@@ -0,0 +1,9 @@
+import type { TenantProvisioningResult } from "./provisioning.dto.js";
+export interface TenantServiceBinding<TConfig, TOutputs> {
+    tenantId: string;
+    serviceInstanceId: string;
+    required: boolean;
+    configurationRevision: number;
+    configuration: TConfig;
+    observed?: TenantProvisioningResult<TOutputs>;
+}

package/dist/vendor/tenant-dtos/service-binding.dto.js

@@ -0,0 +1 @@
+export {};

package/dist/vendor/tenant-dtos/tenant.dto.d.ts

@@ -0,0 +1,15 @@
+export type TenantState = "provisioning" | "active" | "suspended" | "deleting" | "deleted";
+export interface Tenant {
+    /** Canonical UUID; resource foreign keys continue to use localTenantId. */
+    id: string;
+    /** Immutable and never recycled, including after deletion. */
+    slug: string;
+    name: string;
+    state: TenantState;
+    revision: number;
+}
+export interface ResolvedTenantContext {
+    canonicalTenantId: string;
+    localTenantId: string;
+    slug: string;
+}

package/dist/vendor/tenant-dtos/tenant.dto.js

@@ -0,0 +1 @@
+export {};

package/dist/vendor/wallet-dtos/clients.dto.d.ts

@@ -0,0 +1,21 @@
+import { PermissionString } from "../common-dtos/index.js";
+export declare enum AppRole {
+    VIEW_DID = "wallet_view_did",
+    MANAGE_KEYS = "wallet_manage_keys",
+    USE_KEYS = "wallet_use_keys",
+    VIEW_OWN_CREDENTIALS = "wallet_view_own_credentials",
+    VIEW_ALL_CREDENTIALS = "wallet_view_all_credentials",
+    MANAGE_OWN_CREDENTIALS = "wallet_manage_own_credentials",
+    MANAGE_ALL_CREDENTIALS = "wallet_manage_all_credentials",
+    ISSUE_CREDENTIALS = "wallet_issue_credentials",
+    VIEW_PRESENTATIONS = "wallet_view_presentations",
+    READONLY_USER = "readonly_user"
+}
+export interface ClientInfo {
+    sub: string;
+    name: string;
+    email: string;
+    didId: string;
+    permissions: PermissionString[];
+    refreshToken?: string;
+}

package/dist/vendor/wallet-dtos/clients.dto.js

@@ -0,0 +1,13 @@
+export var AppRole;
+(function (AppRole) {
+    AppRole["VIEW_DID"] = "wallet_view_did";
+    AppRole["MANAGE_KEYS"] = "wallet_manage_keys";
+    AppRole["USE_KEYS"] = "wallet_use_keys";
+    AppRole["VIEW_OWN_CREDENTIALS"] = "wallet_view_own_credentials";
+    AppRole["VIEW_ALL_CREDENTIALS"] = "wallet_view_all_credentials";
+    AppRole["MANAGE_OWN_CREDENTIALS"] = "wallet_manage_own_credentials";
+    AppRole["MANAGE_ALL_CREDENTIALS"] = "wallet_manage_all_credentials";
+    AppRole["ISSUE_CREDENTIALS"] = "wallet_issue_credentials";
+    AppRole["VIEW_PRESENTATIONS"] = "wallet_view_presentations";
+    AppRole["READONLY_USER"] = "readonly_user";
+})(AppRole || (AppRole = {}));