@tsg-dsp/tsg-sdk 0.20.1 → 0.21.0

package/dist/vendor/common-dtos/dataplane.dto.d.ts

@@ -3,4 +3,3 @@ export declare class DataPlaneStateDto {
     id: string;
     details: DataPlaneDetailsDto;
 }
-//# sourceMappingURL=dataplane.dto.d.ts.map

package/dist/vendor/common-dtos/dataplane.dto.js

@@ -26,4 +26,3 @@ __decorate([
     Type(() => DataPlaneDetailsDto),
     __metadata("design:type", DataPlaneDetailsDto)
 ], DataPlaneStateDto.prototype, "details", void 0);
-//# sourceMappingURL=dataplane.dto.js.map

package/dist/vendor/common-dtos/dcp.dto.d.ts

@@ -87,4 +87,3 @@ export declare class CredentialStatus {
     holderPid: string;
     status: "RECEIVED" | "REJECTED" | "ISSUED";
 }
-//# sourceMappingURL=dcp.dto.d.ts.map

package/dist/vendor/common-dtos/dcp.dto.js

@@ -487,4 +487,3 @@ CredentialStatus = __decorate([
     ApiSchema({ name: "DCPCredentialStatus" })
 ], CredentialStatus);
 export { CredentialStatus };
-//# sourceMappingURL=dcp.dto.js.map

package/dist/vendor/common-dtos/dcql.dto.d.ts

@@ -86,4 +86,3 @@ export declare class OID4VPAuthorizationResponse {
     vp_token: VpToken;
     state: string;
 }
-//# sourceMappingURL=dcql.dto.d.ts.map

package/dist/vendor/common-dtos/dcql.dto.js

@@ -447,4 +447,3 @@ __decorate([
     IsString(),
     __metadata("design:type", String)
 ], OID4VPAuthorizationResponse.prototype, "state", void 0);
-//# sourceMappingURL=dcql.dto.js.map

package/dist/vendor/common-dtos/did.schemas.d.ts

@@ -37,4 +37,3 @@ export declare class DIDDocumentDto implements DIDDocument {
     capabilityInvocation?: (string | VerificationMethod)[];
     capabilityDelegation?: (string | VerificationMethod)[];
 }
-//# sourceMappingURL=did.schemas.d.ts.map

package/dist/vendor/common-dtos/did.schemas.js

@@ -257,4 +257,3 @@ DIDDocumentDto = __decorate([
     ApiExtraModels(VerificationMethodDto)
 ], DIDDocumentDto);
 export { DIDDocumentDto };
-//# sourceMappingURL=did.schemas.js.map

package/dist/vendor/common-dtos/index.d.ts

@@ -9,6 +9,7 @@ export * from "./dcql.dto.js";
 export * from "./did.schemas.js";
 export * from "./metadata.dto.js";
 export * from "./negotiations.dto.js";
+export * from "./permission-resources.js";
 export * from "./permissions.js";
 export * from "./presentation.request.dto.js";
 export * from "./presentation.status.dto.js";
@@ -16,4 +17,3 @@ export * from "./presentationdefinition.dto.js";
 export * from "./signatures.dto.js";
 export * from "./transfer.dto.js";
 export * from "./utils.swagger.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/vendor/common-dtos/index.js

@@ -9,6 +9,7 @@ export * from "./dcql.dto.js";
 export * from "./did.schemas.js";
 export * from "./metadata.dto.js";
 export * from "./negotiations.dto.js";
+export * from "./permission-resources.js";
 export * from "./permissions.js";
 export * from "./presentation.request.dto.js";
 export * from "./presentation.status.dto.js";
@@ -16,4 +17,3 @@ export * from "./presentationdefinition.dto.js";
 export * from "./signatures.dto.js";
 export * from "./transfer.dto.js";
 export * from "./utils.swagger.js";
-//# sourceMappingURL=index.js.map

package/dist/vendor/common-dtos/metadata.dto.d.ts

@@ -3,4 +3,3 @@ export declare class MetadataDto {
     agreement: AgreementDto;
     dataset: DatasetDto;
 }
-//# sourceMappingURL=metadata.dto.d.ts.map

package/dist/vendor/common-dtos/metadata.dto.js

@@ -27,4 +27,3 @@ __decorate([
     ValidateNested(),
     __metadata("design:type", Object)
 ], MetadataDto.prototype, "dataset", void 0);
-//# sourceMappingURL=metadata.dto.js.map

package/dist/vendor/common-dtos/negotiations.dto.d.ts

@@ -1,11 +1,11 @@
-import { AgreementDto, ContractAgreementVerificationMessageDto, ContractNegotiationState, HashedMessage, MultilanguageDto, OfferDto } from "@tsg-dsp/common-dsp";
+import { AgreementDto, ContractAgreementVerificationMessageDto, ContractNegotiationState, HashedMessage, OfferDto } from "@tsg-dsp/common-dsp";
 export type NegotiationRole = "provider" | "consumer";
 export declare class NegotiationProcessEventDto {
     time: Date;
     state: ContractNegotiationState;
     localMessage?: string;
     code?: string;
-    reason?: MultilanguageDto[];
+    reason?: unknown[];
     agreementMessage?: string;
     verification?: ContractAgreementVerificationMessageDto;
     hashedMessage?: HashedMessage;
@@ -26,4 +26,3 @@ export declare class NegotiationDetailDto extends NegotiationStatusDto {
     agreement?: AgreementDto;
     events: Array<NegotiationProcessEventDto>;
 }
-//# sourceMappingURL=negotiations.dto.d.ts.map

package/dist/vendor/common-dtos/negotiations.dto.js

@@ -8,9 +8,9 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
-import { AgreementSchema, ContractAgreementVerificationMessageSchema, ContractNegotiationState, HashedMessageSchema, MultilanguageSchema, OfferSchema } from "@tsg-dsp/common-dsp";
+import { AgreementSchema, ContractAgreementVerificationMessageSchema, ContractNegotiationState, HashedMessageSchema, OfferSchema } from "@tsg-dsp/common-dsp";
 import { Type } from "class-transformer";
-import { IsDate, IsEnum, IsOptional, IsString, ValidateNested } from "class-validator";
+import { IsArray, IsDate, IsEnum, IsOptional, IsString, ValidateNested } from "class-validator";
 export class NegotiationProcessEventDto {
     time;
     state;
@@ -56,12 +56,12 @@ __decorate([
 ], NegotiationProcessEventDto.prototype, "code", void 0);
 __decorate([
     ApiPropertyOptional({
-        type: () => [MultilanguageSchema],
-        example: []
+        type: "array",
+        items: {},
+        example: ["Negotiation terminated by remote participant"]
     }),
     IsOptional(),
-    ValidateNested({ each: true }),
-    Type(() => MultilanguageSchema),
+    IsArray(),
     __metadata("design:type", Array)
 ], NegotiationProcessEventDto.prototype, "reason", void 0);
 __decorate([
@@ -202,4 +202,3 @@ __decorate([
     Type(() => NegotiationProcessEventDto),
     __metadata("design:type", Array)
 ], NegotiationDetailDto.prototype, "events", void 0);
-//# sourceMappingURL=negotiations.dto.js.map

package/dist/vendor/common-dtos/permission-resources.d.ts

@@ -0,0 +1,3 @@
+import { type PermissionString } from "./permissions.js";
+/** Configuration shorthand expands to concrete resources before entering canonical grants. */
+export declare function expandPermissionResources(values: readonly PermissionString[]): PermissionString[];

package/dist/vendor/common-dtos/permission-resources.js

@@ -0,0 +1,18 @@
+import { parsePermission, permission, Resource } from "./permissions.js";
+/** Configuration shorthand expands to concrete resources before entering canonical grants. */
+export function expandPermissionResources(values) {
+    return [
+        ...new Set(values.flatMap((value) => {
+            const parsed = parsePermission(value);
+            if (!parsed.resource.includes("*"))
+                return [value];
+            const pattern = new RegExp(`^${parsed.resource
+                .split("*")
+                .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+                .join(".*")}$`);
+            return Object.values(Resource)
+                .filter((resource) => pattern.test(resource))
+                .map((resource) => permission(parsed.action, resource, parsed.scope));
+        }))
+    ];
+}

package/dist/vendor/common-dtos/permissions.d.ts

@@ -77,10 +77,16 @@ export interface Permission {
 export type PermissionString = `${Action}:${Resource}` | `${Action}:${Resource}:${string}`;
 export declare function permission(action: Action, resource: Resource, scope?: string | string[]): PermissionString;
 export declare function parsePermission(perm: PermissionString): Permission;
+/** Validate permission syntax consistently before issuing or consuming grants. */
+export declare function validatePermission(perm: PermissionString): void;
 export declare function permissionAllowsResourceId(perm: Permission, resourceId: string): boolean;
 export declare function isOwnScope(perm: Permission): boolean;
 export declare function isAllScope(perm: Permission): boolean;
 export declare function isSpecificScope(perm: Permission): boolean;
+/** Whether a permission is bounded by the union of the existing grants. */
+export declare function permissionIsCovered(requested: PermissionString, granted: readonly PermissionString[]): boolean;
+/** Intersect action/resource scopes without widening either set of grants. */
+export declare function intersectPermissions(requested: readonly PermissionString[], granted: readonly PermissionString[]): PermissionString[];
 export declare const Permissions: {
     readonly CP_CATALOG_READ: PermissionString;
     readonly CP_CATALOG_CREATE: PermissionString;
@@ -234,4 +240,3 @@ export declare const Permissions: {
     readonly SSO_AUDIT_LOG_READ: PermissionString;
     readonly SSO_AUDIT_LOG_MANAGE: PermissionString;
 };
-//# sourceMappingURL=permissions.d.ts.map

package/dist/vendor/common-dtos/permissions.js

@@ -133,6 +133,14 @@ export function parsePermission(perm) {
     }
     return result;
 }
+/** Validate permission syntax consistently before issuing or consuming grants. */
+export function validatePermission(perm) {
+    const parsed = parsePermission(perm);
+    if (!Object.values(Action).includes(parsed.action) ||
+        !parsed.resource ||
+        (Array.isArray(parsed.scope) && parsed.scope.some((scope) => !scope)))
+        throw new Error(`Invalid permission format: ${perm}`);
+}
 export function permissionAllowsResourceId(perm, resourceId) {
     if (!perm.scope || perm.scope === RESERVED_SCOPES.ALL) {
         return true;
@@ -160,6 +168,71 @@ export function isSpecificScope(perm) {
         return false;
     return true;
 }
+/** Whether a permission is bounded by the union of the existing grants. */
+export function permissionIsCovered(requested, granted) {
+    try {
+        const required = parsePermission(requested);
+        if (!Object.values(Action).includes(required.action) || !required.resource)
+            return false;
+        const candidates = granted
+            .map(parsePermission)
+            .filter((p) => p.resource === required.resource &&
+            (p.action === required.action ||
+                (p.action === Action.MANAGE && required.action !== Action.MANAGE)));
+        if (candidates.some(isAllScope))
+            return true;
+        if (isAllScope(required))
+            return false;
+        if (isOwnScope(required))
+            return candidates.some(isOwnScope);
+        const ids = Array.isArray(required.scope)
+            ? required.scope
+            : [required.scope];
+        return ids.every((id) => candidates.some((p) => permissionAllowsResourceId(p, id)));
+    }
+    catch {
+        return false;
+    }
+}
+/** Intersect action/resource scopes without widening either set of grants. */
+export function intersectPermissions(requested, granted) {
+    const result = new Set();
+    for (const requestedPermission of requested) {
+        const required = parsePermission(requestedPermission);
+        for (const grantedPermission of granted) {
+            const grant = parsePermission(grantedPermission);
+            if (required.resource !== grant.resource ||
+                !Object.values(Action).includes(required.action) ||
+                !Object.values(Action).includes(grant.action))
+                continue;
+            const action = required.action === Action.MANAGE
+                ? grant.action
+                : grant.action === Action.MANAGE || grant.action === required.action
+                    ? required.action
+                    : undefined;
+            if (!action)
+                continue;
+            if (isAllScope(required)) {
+                result.add(permission(action, grant.resource, grant.scope));
+            }
+            else if (isAllScope(grant)) {
+                result.add(permission(action, required.resource, required.scope));
+            }
+            else if (isOwnScope(required) || isOwnScope(grant)) {
+                // Ownership cannot be inferred from an explicit resource ID alone.
+                if (isOwnScope(required) && isOwnScope(grant)) {
+                    result.add(permission(action, required.resource, RESERVED_SCOPES.OWN));
+                }
+            }
+            else {
+                const ids = (Array.isArray(required.scope) ? required.scope : [required.scope]).filter((id) => permissionAllowsResourceId(grant, id));
+                if (ids.length)
+                    result.add(permission(action, required.resource, ids));
+            }
+        }
+    }
+    return [...result];
+}
 export const Permissions = {
     // ===========================================
     // Control Plane Permissions (cp.*)
@@ -334,4 +407,3 @@ export const Permissions = {
     SSO_AUDIT_LOG_READ: permission(Action.READ, Resource.SSO_AUDIT_LOG),
     SSO_AUDIT_LOG_MANAGE: permission(Action.MANAGE, Resource.SSO_AUDIT_LOG)
 };
-//# sourceMappingURL=permissions.js.map

package/dist/vendor/common-dtos/presentation.request.dto.d.ts

@@ -6,4 +6,3 @@ export declare class CreatePresentationJwtRequest {
     format?: "vp+jwt" | "enveloped" | "jwt_vp";
     nonce?: string;
 }
-//# sourceMappingURL=presentation.request.dto.d.ts.map

package/dist/vendor/common-dtos/presentation.request.dto.js

@@ -52,4 +52,3 @@ __decorate([
     IsOptional(),
     __metadata("design:type", String)
 ], CreatePresentationJwtRequest.prototype, "nonce", void 0);
-//# sourceMappingURL=presentation.request.dto.js.map

package/dist/vendor/common-dtos/presentation.status.dto.d.ts

@@ -10,4 +10,3 @@ export declare class VerifiedCredentialStatus {
     status: boolean;
     message?: string;
 }
-//# sourceMappingURL=presentation.status.dto.d.ts.map

package/dist/vendor/common-dtos/presentation.status.dto.js

@@ -80,4 +80,3 @@ __decorate([
     IsString(),
     __metadata("design:type", String)
 ], VerifiedCredentialStatus.prototype, "message", void 0);
-//# sourceMappingURL=presentation.status.dto.js.map

package/dist/vendor/common-dtos/presentationdefinition.dto.d.ts

@@ -72,4 +72,3 @@ export declare class DescriptorMap {
 export declare class AuthorizationResponse extends PresentationResponse {
     state: string;
 }
-//# sourceMappingURL=presentationdefinition.dto.d.ts.map

package/dist/vendor/common-dtos/presentationdefinition.dto.js

@@ -445,4 +445,3 @@ __decorate([
     IsString(),
     __metadata("design:type", String)
 ], AuthorizationResponse.prototype, "state", void 0);
-//# sourceMappingURL=presentationdefinition.dto.js.map

package/dist/vendor/common-dtos/signatures.dto.d.ts

@@ -29,4 +29,3 @@ export declare class SignRequestJwt {
     subject?: string;
     typ?: string;
 }
-//# sourceMappingURL=signatures.dto.d.ts.map

package/dist/vendor/common-dtos/signatures.dto.js

@@ -207,4 +207,3 @@ __decorate([
     IsOptional(),
     __metadata("design:type", String)
 ], SignRequestJwt.prototype, "typ", void 0);
-//# sourceMappingURL=signatures.dto.js.map

package/dist/vendor/common-dtos/transfer.dto.d.ts

@@ -14,4 +14,3 @@ export declare class TransferDto {
     modifiedDate: Date;
     deletedDate: Date;
 }
-//# sourceMappingURL=transfer.dto.d.ts.map

package/dist/vendor/common-dtos/transfer.dto.js

@@ -99,4 +99,3 @@ __decorate([
     Type(() => Date),
     __metadata("design:type", Date)
 ], TransferDto.prototype, "deletedDate", void 0);
-//# sourceMappingURL=transfer.dto.js.map

package/dist/vendor/common-dtos/utils.swagger.d.ts

@@ -10,4 +10,3 @@ export declare const ApiNotFoundResponseDefault: (options?: ApiResponseOptions)
 export declare const ApiConflictResponseDefault: (options?: ApiResponseOptions) => MethodDecorator & ClassDecorator;
 export declare const ApiForbiddenResponseDefault: (options?: ApiResponseOptions) => MethodDecorator & ClassDecorator;
 export declare const ApiBadRequestResponseDefault: (options?: ApiResponseOptions) => MethodDecorator & ClassDecorator;
-//# sourceMappingURL=utils.swagger.d.ts.map

package/dist/vendor/common-dtos/utils.swagger.js

@@ -60,4 +60,3 @@ export const ApiBadRequestResponseDefault = (options = {}) => ApiResponse({
     status: HttpStatus.BAD_REQUEST,
     type: ErrorDto
 });
-//# sourceMappingURL=utils.swagger.js.map

package/dist/vendor/control-plane-dtos/index.d.ts

@@ -2,4 +2,3 @@ export * from "./registry/registry.dto.js";
 export * from "./registry/registry.search.dto.js";
 export * from "./ssi/verifiablePresentations.dto.js";
 export * from "./status/status.dto.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/vendor/control-plane-dtos/index.js

@@ -2,4 +2,3 @@ export * from "./registry/registry.dto.js";
 export * from "./registry/registry.search.dto.js";
 export * from "./ssi/verifiablePresentations.dto.js";
 export * from "./status/status.dto.js";
-//# sourceMappingURL=index.js.map

package/dist/vendor/control-plane-dtos/registry/registry.dto.d.ts

@@ -2,4 +2,3 @@ export declare class CredentialAddress {
     didId: string;
     address: string;
 }
-//# sourceMappingURL=registry.dto.d.ts.map

package/dist/vendor/control-plane-dtos/registry/registry.dto.js

@@ -23,4 +23,3 @@ __decorate([
     IsString(),
     __metadata("design:type", String)
 ], CredentialAddress.prototype, "address", void 0);
-//# sourceMappingURL=registry.dto.js.map

package/dist/vendor/control-plane-dtos/registry/registry.search.dto.d.ts

@@ -26,4 +26,3 @@ export declare class RegistryCatalogSearchResultDto {
     datasetScores: Record<string, number>;
     catalog: CatalogSchema;
 }
-//# sourceMappingURL=registry.search.dto.d.ts.map

package/dist/vendor/control-plane-dtos/registry/registry.search.dto.js

@@ -124,4 +124,3 @@ __decorate([
     ApiProperty({ type: () => CatalogSchema }),
     __metadata("design:type", CatalogSchema)
 ], RegistryCatalogSearchResultDto.prototype, "catalog", void 0);
-//# sourceMappingURL=registry.search.dto.js.map

package/dist/vendor/control-plane-dtos/ssi/verifiablePresentations.dto.d.ts

@@ -7,4 +7,3 @@ export declare class KeyInfo {
     created: Date;
     modified: Date;
 }
-//# sourceMappingURL=verifiablePresentations.dto.d.ts.map

package/dist/vendor/control-plane-dtos/ssi/verifiablePresentations.dto.js

@@ -41,4 +41,3 @@ __decorate([
     IsDate(),
     __metadata("design:type", Date)
 ], KeyInfo.prototype, "modified", void 0);
-//# sourceMappingURL=verifiablePresentations.dto.js.map

package/dist/vendor/control-plane-dtos/status/status.dto.d.ts

@@ -35,4 +35,3 @@ export declare class StatusDto {
     negotiations: StatusNegotiationDto[];
     transfers: StatusTransferDto[];
 }
-//# sourceMappingURL=status.dto.d.ts.map

package/dist/vendor/control-plane-dtos/status/status.dto.js

@@ -170,4 +170,3 @@ __decorate([
     ApiProperty({ type: () => StatusTransferDto }),
     __metadata("design:type", Array)
 ], StatusDto.prototype, "transfers", void 0);
-//# sourceMappingURL=status.dto.js.map

package/dist/vendor/sso-bridge-dtos/clients.dto.d.ts

@@ -1,15 +1,19 @@
-import { ClientAuthMethod, GrantType } from "./grants.js";
+import { ClientAuthMethod, ClientKind, GrantType } from "./grants.js";
 export declare class ClientDto {
+    kind: ClientKind;
+    tenantId?: string;
+    audiences?: string[];
+    scopes?: string[];
     id?: string;
     name: string;
-    secretName: string;
+    secretName?: string;
     description: string;
     clientId: string;
     clientSecret?: string;
     tokenEndpointAuthMethod?: ClientAuthMethod;
     jwk?: Record<string, any>;
     permissions: string[];
-    grants: GrantType[];
+    grants?: GrantType[];
     redirectUris: string[];
 }
 declare const CreateClientDto_base: import("@nestjs/common").Type<Omit<ClientDto, "id">>;
@@ -19,4 +23,3 @@ declare const UpdateClientDto_base: import("@nestjs/common").Type<Partial<Omit<C
 export declare class UpdateClientDto extends UpdateClientDto_base {
 }
 export {};
-//# sourceMappingURL=clients.dto.d.ts.map

package/dist/vendor/sso-bridge-dtos/clients.dto.js

@@ -10,6 +10,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import { ApiProperty, ApiPropertyOptional, OmitType, PartialType } from "@nestjs/swagger";
 import { IsArray, IsIn, IsNotEmpty, IsObject, IsOptional, IsString } from "class-validator";
 export class ClientDto {
+    kind;
+    tenantId;
+    audiences;
+    scopes;
     id;
     name;
     secretName;
@@ -22,6 +26,33 @@ export class ClientDto {
     grants;
     redirectUris;
 }
+__decorate([
+    ApiProperty({ enum: ["shared", "workload", "platform"] }),
+    IsIn(["shared", "workload", "platform"]),
+    __metadata("design:type", String)
+], ClientDto.prototype, "kind", void 0);
+__decorate([
+    ApiPropertyOptional({
+        description: "Canonical tenant UUID for a workload client"
+    }),
+    IsString(),
+    IsOptional(),
+    __metadata("design:type", String)
+], ClientDto.prototype, "tenantId", void 0);
+__decorate([
+    ApiPropertyOptional({ description: "Registered resource audiences" }),
+    IsString({ each: true }),
+    IsArray(),
+    IsOptional(),
+    __metadata("design:type", Array)
+], ClientDto.prototype, "audiences", void 0);
+__decorate([
+    ApiPropertyOptional({ description: "Allowed OAuth scopes" }),
+    IsString({ each: true }),
+    IsArray(),
+    IsOptional(),
+    __metadata("design:type", Array)
+], ClientDto.prototype, "scopes", void 0);
 __decorate([
     ApiPropertyOptional({ example: "1" }),
     IsString(),
@@ -35,9 +66,9 @@ __decorate([
     __metadata("design:type", String)
 ], ClientDto.prototype, "name", void 0);
 __decorate([
-    ApiProperty({ example: "SecretExample" }),
+    ApiPropertyOptional({ example: "SecretExample" }),
     IsString(),
-    IsNotEmpty(),
+    IsOptional(),
     __metadata("design:type", String)
 ], ClientDto.prototype, "secretName", void 0);
 __decorate([
@@ -96,9 +127,13 @@ __decorate([
     __metadata("design:type", Array)
 ], ClientDto.prototype, "permissions", void 0);
 __decorate([
-    ApiProperty({ example: ["authorization_code", "client_credentials"] }),
+    ApiPropertyOptional({
+        example: ["client_credentials", "authorization_code", "refresh_token"],
+        description: "On creation, defaults to authorization_code and refresh_token for shared clients; client_credentials for workload/platform clients. Omission during updates preserves the stored policy."
+    }),
     IsArray(),
     IsNotEmpty(),
+    IsOptional(),
     __metadata("design:type", Array)
 ], ClientDto.prototype, "grants", void 0);
 __decorate([
@@ -110,4 +145,3 @@ export class CreateClientDto extends OmitType(ClientDto, ["id"]) {
 }
 export class UpdateClientDto extends PartialType(OmitType(ClientDto, ["id"])) {
 }
-//# sourceMappingURL=clients.dto.js.map

package/dist/vendor/sso-bridge-dtos/grants.d.ts

@@ -1,3 +1,4 @@
 export type GrantType = "authorization_code" | "refresh_token" | "client_credentials" | "password";
 export type ClientAuthMethod = "client_secret_post" | "private_key_jwt" | "none";
-//# sourceMappingURL=grants.d.ts.map
+export type ClientKind = "shared" | "workload" | "platform";
+export declare function getDefaultClientGrants(kind: ClientKind): GrantType[];

package/dist/vendor/sso-bridge-dtos/grants.js

@@ -1,2 +1,7 @@
-export {};
-//# sourceMappingURL=grants.js.map
+export function getDefaultClientGrants(kind) {
+    if (kind === "shared")
+        return ["authorization_code", "refresh_token"];
+    if (kind === "workload" || kind === "platform")
+        return ["client_credentials"];
+    throw new Error("Explicit valid client kind required");
+}

package/dist/vendor/sso-bridge-dtos/index.d.ts

@@ -1,5 +1,5 @@
 import "reflect-metadata";
 export * from "./clients.dto.js";
 export * from "./grants.js";
+export * from "./tenant.dto.js";
 export * from "./users.dto.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/vendor/sso-bridge-dtos/index.js

@@ -1,5 +1,5 @@
 import "reflect-metadata";
 export * from "./clients.dto.js";
 export * from "./grants.js";
+export * from "./tenant.dto.js";
 export * from "./users.dto.js";
-//# sourceMappingURL=index.js.map

package/dist/vendor/sso-bridge-dtos/tenant.dto.d.ts

@@ -0,0 +1,70 @@
+import type { EnsureTenantRequest, PrincipalRef, TenantProvisioningResult, TenantRole, TenantState } from "../tenant-dtos/index.js";
+import type { CreateClientDto } from "./clients.dto.js";
+export interface SsoServiceBinding {
+    serviceInstanceId: string;
+    audience: string;
+    localTenantSlug?: string;
+}
+export interface SsoTenantConfiguration {
+    services: SsoServiceBinding[];
+    /** Workload credentials only. Global browser/platform clients are operator-controlled. */
+    clients: CreateClientDto[];
+}
+export type EnsureSsoTenantRequest = EnsureTenantRequest<SsoTenantConfiguration>;
+export type SsoTenantProvisioningResult = TenantProvisioningResult<{
+    issuer: string;
+    clientIds: string[];
+}> & {
+    appliedLifecycleRevision: number;
+};
+export interface SsoTenantSummary {
+    id: string;
+    slug: string;
+    name: string;
+    permissions: string[];
+}
+export interface SsoTenantMembershipSummary {
+    tenantId: string;
+    name: string;
+    slug: string;
+    role: TenantRole;
+    status: "active" | "revoked";
+    tenantState: TenantState;
+    authorizationStatus: "current" | "stale";
+}
+export interface SsoPlatformTenantSummary {
+    id: string;
+    name: string;
+    slug: string;
+    state: TenantState;
+    memberCount: number;
+    authorizationStatus: "current" | "stale" | "unavailable";
+}
+export interface ResolveSsoAccountRequest {
+    principal: PrincipalRef;
+}
+export interface SsoAccountSummary {
+    principal: PrincipalRef;
+    name: string;
+}
+export interface LookupSsoAccountRequest {
+    username: string;
+}
+export interface BootstrapSsoAccountRequest {
+    operationId: string;
+    tenantId: string;
+    userId: string;
+    username: string;
+    email: string;
+}
+export interface BootstrapSsoAccountResult {
+    principal: PrincipalRef;
+    setupPending: boolean;
+    notificationSent: boolean;
+}
+export interface SsoAccountSetupLink {
+    /** Present only when email delivery is disabled. */
+    url?: string;
+    expiresAt: number;
+    notificationSent: boolean;
+}

package/dist/vendor/sso-bridge-dtos/tenant.dto.js

@@ -0,0 +1 @@
+export {};