@xpert-ai/plugin-sdk 3.9.0-beta.2 → 3.9.0-beta.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @xpert-ai/plugin-sdk
 
+## 3.9.0-beta.3
+
+### Patch Changes
+
+- 4dcf5b5: add sso in plugin sdk
+- Updated dependencies [4dcf5b5]
+  - @xpert-ai/contracts@3.9.0-beta.3
+
 ## 3.9.0-beta.2
 
 ### Patch Changes

package/index.cjs.js

@@ -1090,6 +1090,18 @@ function getRequiredPermissionOperation(method, permissionType) {
  * Internal system token used by core to expose the handoff queue bridge.
  */ const HANDOFF_QUEUE_SERVICE_TOKEN = 'XPERT_HANDOFF_QUEUE_SERVICE';
 
+/**
+ * System token for resolving account binding permission service from plugin context.
+ */ const ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_ACCOUNT_BINDING_PERMISSION_SERVICE';
+
+/**
+ * System token for resolving bound identity login permission service from plugin context.
+ */ const BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE';
+
+/**
+ * System token for resolving the pending SSO binding challenge service from plugin context.
+ */ const SSO_BINDING_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_SSO_BINDING_PERMISSION_SERVICE';
+
 /**
  * System token for resolving user permission service from plugin context.
  */ const USER_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_USER_PERMISSION_SERVICE';
@@ -2865,6 +2877,22 @@ exports.FileUploadTargetRegistry = __decorate([
     ])
 ], exports.FileUploadTargetRegistry);
 
+const SSO_PROVIDER = 'SSO_PROVIDER';
+const SSOProviderStrategyKey = (provider)=>common.applyDecorators(common.SetMetadata(SSO_PROVIDER, provider), common.SetMetadata(STRATEGY_META_KEY, SSO_PROVIDER));
+
+exports.SSOProviderRegistry = class SSOProviderRegistry extends BaseStrategyRegistry {
+    constructor(discoveryService, reflector){
+        super(SSO_PROVIDER, discoveryService, reflector);
+    }
+};
+exports.SSOProviderRegistry = __decorate([
+    common.Injectable(),
+    __metadata("design:paramtypes", [
+        core.DiscoveryService,
+        core.Reflector
+    ])
+], exports.SSOProviderRegistry);
+
 const SANDBOX_SHELL_TIMEOUT_LIMITS_SEC = {
     min: 1,
     max: 3600
@@ -3892,6 +3920,7 @@ exports.ViewExtensionProviderRegistry = __decorate([
 
 const VIEW_EXTENSION_CACHE_SERVICE_TOKEN = 'XPERT_PLUGIN_VIEW_EXTENSION_CACHE_SERVICE';
 
+exports.ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN = ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN;
 exports.AGENT_CHAT_DISPATCH_MESSAGE_TYPE = AGENT_CHAT_DISPATCH_MESSAGE_TYPE;
 exports.AGENT_MIDDLEWARE_STRATEGY = AGENT_MIDDLEWARE_STRATEGY;
 exports.AIModelProviderNotFoundException = AIModelProviderNotFoundException;
@@ -3901,6 +3930,7 @@ exports.ANALYTICS_PERMISSION_SERVICE_TOKEN = ANALYTICS_PERMISSION_SERVICE_TOKEN;
 exports.AdapterDataSourceStrategy = AdapterDataSourceStrategy;
 exports.AgentMiddlewareStrategy = AgentMiddlewareStrategy;
 exports.AiModelNotFoundException = AiModelNotFoundException;
+exports.BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN = BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN;
 exports.BaseHTTPQueryRunner = BaseHTTPQueryRunner;
 exports.BaseQueryRunner = BaseQueryRunner;
 exports.BaseSQLQueryRunner = BaseSQLQueryRunner;
@@ -3974,6 +4004,9 @@ exports.RetrieverStrategy = RetrieverStrategy;
 exports.SANDBOX_PROVIDER = SANDBOX_PROVIDER;
 exports.SANDBOX_SHELL_TIMEOUT_LIMITS_SEC = SANDBOX_SHELL_TIMEOUT_LIMITS_SEC;
 exports.SKILL_SOURCE_PROVIDER = SKILL_SOURCE_PROVIDER;
+exports.SSOProviderStrategyKey = SSOProviderStrategyKey;
+exports.SSO_BINDING_PERMISSION_SERVICE_TOKEN = SSO_BINDING_PERMISSION_SERVICE_TOKEN;
+exports.SSO_PROVIDER = SSO_PROVIDER;
 exports.STRATEGY_META_KEY = STRATEGY_META_KEY;
 exports.SandboxProviderStrategy = SandboxProviderStrategy;
 exports.SkillSourceProviderStrategy = SkillSourceProviderStrategy;

package/index.esm.js

@@ -1069,6 +1069,18 @@ function getRequiredPermissionOperation(method, permissionType) {
  * Internal system token used by core to expose the handoff queue bridge.
  */ const HANDOFF_QUEUE_SERVICE_TOKEN = 'XPERT_HANDOFF_QUEUE_SERVICE';
 
+/**
+ * System token for resolving account binding permission service from plugin context.
+ */ const ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_ACCOUNT_BINDING_PERMISSION_SERVICE';
+
+/**
+ * System token for resolving bound identity login permission service from plugin context.
+ */ const BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE';
+
+/**
+ * System token for resolving the pending SSO binding challenge service from plugin context.
+ */ const SSO_BINDING_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_SSO_BINDING_PERMISSION_SERVICE';
+
 /**
  * System token for resolving user permission service from plugin context.
  */ const USER_PERMISSION_SERVICE_TOKEN = 'XPERT_PLUGIN_USER_PERMISSION_SERVICE';
@@ -2844,6 +2856,22 @@ FileUploadTargetRegistry = __decorate([
     ])
 ], FileUploadTargetRegistry);
 
+const SSO_PROVIDER = 'SSO_PROVIDER';
+const SSOProviderStrategyKey = (provider)=>applyDecorators(SetMetadata(SSO_PROVIDER, provider), SetMetadata(STRATEGY_META_KEY, SSO_PROVIDER));
+
+let SSOProviderRegistry = class SSOProviderRegistry extends BaseStrategyRegistry {
+    constructor(discoveryService, reflector){
+        super(SSO_PROVIDER, discoveryService, reflector);
+    }
+};
+SSOProviderRegistry = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [
+        DiscoveryService,
+        Reflector
+    ])
+], SSOProviderRegistry);
+
 const SANDBOX_SHELL_TIMEOUT_LIMITS_SEC = {
     min: 1,
     max: 3600
@@ -3871,4 +3899,4 @@ ViewExtensionProviderRegistry = __decorate([
 
 const VIEW_EXTENSION_CACHE_SERVICE_TOKEN = 'XPERT_PLUGIN_VIEW_EXTENSION_CACHE_SERVICE';
 
-export { AGENT_CHAT_DISPATCH_MESSAGE_TYPE, AGENT_MIDDLEWARE_STRATEGY, AIModelProviderNotFoundException, AIModelProviderRegistry, AIModelProviderStrategy, AI_MODEL_PROVIDER, ANALYTICS_PERMISSION_SERVICE_TOKEN, AdapterDataSourceStrategy, AgentMiddlewareRegistry, AgentMiddlewareStrategy, AiModelNotFoundException, BaseHTTPQueryRunner, BaseQueryRunner, BaseSQLQueryRunner, BaseSandbox, BaseStrategyRegistry, BaseTool, BaseToolset, BuiltinToolset, CHAT_CHANNEL, CHAT_CHANNEL_TEXT_LIMITS, CancelConversationCommand, ChatChannel, ChatChannelRegistry, ChatOAICompatReasoningModel, CommonParameterRules, CreateModelClientCommand, CredentialsValidateFailedError, DATASOURCE_STRATEGY, DBCreateTableMode, DBProtocolEnum, DBSyntaxEnum, DBTableAction, DBTableDataAction, DEFAULT_EXECUTION_CONFIG, DEFAULT_SANDBOX_EXECUTION_MAX_OUTPUT_BYTES, DEFAULT_SANDBOX_FILE_OPERATION_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_SEC, DEFAULT_SANDBOX_FILE_SEARCH_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_SEC, DEFAULT_SANDBOX_SHELL_EXECUTION_OPTIONS, DEFAULT_SANDBOX_SHELL_TIMEOUT_MS, DEFAULT_SANDBOX_SHELL_TIMEOUT_SEC, DOCUMENT_SOURCE_STRATEGY, DOCUMENT_TRANSFORMER_STRATEGY, DataSourceStrategy, DataSourceStrategyRegistry, DocumentSourceRegistry, DocumentSourceStrategy, DocumentTransformerRegistry, DocumentTransformerStrategy, FILE_STORAGE_PROVIDER, FILE_UPLOAD_TARGET_STRATEGY, FileStorageProvider, FileStorageProviderRegistry, FileUploadTargetRegistry, FileUploadTargetStrategy, GLOBAL_ORGANIZATION_SCOPE, HANDOFF_PERMISSION_SERVICE_TOKEN, HANDOFF_PROCESSOR_STRATEGY, HANDOFF_QUEUE_SERVICE_TOKEN, HandoffProcessorRegistry, HandoffProcessorStrategy, IMAGE_UNDERSTANDING_STRATEGY, INTEGRATION_PERMISSION_SERVICE_TOKEN, INTEGRATION_STRATEGY, ImageUnderstandingRegistry, ImageUnderstandingStrategy, IntegrationStrategyKey, IntegrationStrategyRegistry, JUMP_TO_TARGETS, JsonSchemaValidator, KNOWLEDGE_STRATEGY, KnowledgeStrategyKey, KnowledgeStrategyRegistry, LLMUsage, LargeLanguageModel, ModelProvider, ORGANIZATION_METADATA_KEY, OpenAICompatibleReranker, PERMISSION_OPERATION_METADATA_KEY, PLUGIN_CONFIG_RESOLVER_TOKEN, PLUGIN_METADATA, PLUGIN_METADATA_KEY, PROVIDE_AI_MODEL_LLM, PROVIDE_AI_MODEL_MODERATION, PROVIDE_AI_MODEL_RERANK, PROVIDE_AI_MODEL_SPEECH2TEXT, PROVIDE_AI_MODEL_TEXT_EMBEDDING, PROVIDE_AI_MODEL_TTS, RETRIEVER_STRATEGY, RequestContext, RequestContextMiddleware, RequirePermissionOperation, RerankModel, RetrieverRegistry, RetrieverStrategy, SANDBOX_PROVIDER, SANDBOX_SHELL_TIMEOUT_LIMITS_SEC, SKILL_SOURCE_PROVIDER, STRATEGY_META_KEY, SandboxProviderRegistry, SandboxProviderStrategy, SkillSourceProviderRegistry, SkillSourceProviderStrategy, Speech2TextChatModel, SpeechToTextModel, StrategyBus, TEXT_SPLITTER_STRATEGY, TOOLSET_STRATEGY, TextEmbeddingModelManager, TextSplitterRegistry, TextSplitterStrategy, TextToSpeechModel, ToolsetRegistry, ToolsetStrategy, USER_PERMISSION_SERVICE_TOKEN, VECTOR_STORE_STRATEGY, VIEW_EXTENSION_CACHE_SERVICE_TOKEN, VIEW_EXTENSION_PROVIDER, VectorStoreRegistry, VectorStoreStrategy, ViewExtensionProvider, ViewExtensionProviderRegistry, WORKFLOW_NODE_STRATEGY, WORKFLOW_TRIGGER_STRATEGY, WorkflowNodeRegistry, WorkflowNodeStrategy, WorkflowTriggerRegistry, WorkflowTriggerStrategy, WrapWorkflowNodeExecutionCommand, XpFileSystem, XpertServerPlugin, als, appendSandboxMessage, buildSandboxTimeoutMessage, calcTokenUsage, chunkText, countTokensSafe, createI18nInstance, createPluginLogger, defineAgentMessageType, defineChannelMessageType, downloadRemoteFile, formatSandboxTimeout, getErrorMessage, getModelContextSize, getPermissionOperationMetadata, getPositionList, getPositionMap, getRequestContext, getRequiredPermissionOperation, isRemoteFile, isSandboxBackend, isStructuredMessageType, loadYamlFile, mergeCredentials, mergeParentChildChunks, normalizeContextSize, resolveSandboxBackend, resolveSandboxExecutionOptions, runWithRequestContext, secondsToMilliseconds, sumTokenUsage };
+export { ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN, AGENT_CHAT_DISPATCH_MESSAGE_TYPE, AGENT_MIDDLEWARE_STRATEGY, AIModelProviderNotFoundException, AIModelProviderRegistry, AIModelProviderStrategy, AI_MODEL_PROVIDER, ANALYTICS_PERMISSION_SERVICE_TOKEN, AdapterDataSourceStrategy, AgentMiddlewareRegistry, AgentMiddlewareStrategy, AiModelNotFoundException, BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN, BaseHTTPQueryRunner, BaseQueryRunner, BaseSQLQueryRunner, BaseSandbox, BaseStrategyRegistry, BaseTool, BaseToolset, BuiltinToolset, CHAT_CHANNEL, CHAT_CHANNEL_TEXT_LIMITS, CancelConversationCommand, ChatChannel, ChatChannelRegistry, ChatOAICompatReasoningModel, CommonParameterRules, CreateModelClientCommand, CredentialsValidateFailedError, DATASOURCE_STRATEGY, DBCreateTableMode, DBProtocolEnum, DBSyntaxEnum, DBTableAction, DBTableDataAction, DEFAULT_EXECUTION_CONFIG, DEFAULT_SANDBOX_EXECUTION_MAX_OUTPUT_BYTES, DEFAULT_SANDBOX_FILE_OPERATION_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_OPERATION_TIMEOUT_SEC, DEFAULT_SANDBOX_FILE_SEARCH_EXECUTION_OPTIONS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_MS, DEFAULT_SANDBOX_FILE_SEARCH_TIMEOUT_SEC, DEFAULT_SANDBOX_SHELL_EXECUTION_OPTIONS, DEFAULT_SANDBOX_SHELL_TIMEOUT_MS, DEFAULT_SANDBOX_SHELL_TIMEOUT_SEC, DOCUMENT_SOURCE_STRATEGY, DOCUMENT_TRANSFORMER_STRATEGY, DataSourceStrategy, DataSourceStrategyRegistry, DocumentSourceRegistry, DocumentSourceStrategy, DocumentTransformerRegistry, DocumentTransformerStrategy, FILE_STORAGE_PROVIDER, FILE_UPLOAD_TARGET_STRATEGY, FileStorageProvider, FileStorageProviderRegistry, FileUploadTargetRegistry, FileUploadTargetStrategy, GLOBAL_ORGANIZATION_SCOPE, HANDOFF_PERMISSION_SERVICE_TOKEN, HANDOFF_PROCESSOR_STRATEGY, HANDOFF_QUEUE_SERVICE_TOKEN, HandoffProcessorRegistry, HandoffProcessorStrategy, IMAGE_UNDERSTANDING_STRATEGY, INTEGRATION_PERMISSION_SERVICE_TOKEN, INTEGRATION_STRATEGY, ImageUnderstandingRegistry, ImageUnderstandingStrategy, IntegrationStrategyKey, IntegrationStrategyRegistry, JUMP_TO_TARGETS, JsonSchemaValidator, KNOWLEDGE_STRATEGY, KnowledgeStrategyKey, KnowledgeStrategyRegistry, LLMUsage, LargeLanguageModel, ModelProvider, ORGANIZATION_METADATA_KEY, OpenAICompatibleReranker, PERMISSION_OPERATION_METADATA_KEY, PLUGIN_CONFIG_RESOLVER_TOKEN, PLUGIN_METADATA, PLUGIN_METADATA_KEY, PROVIDE_AI_MODEL_LLM, PROVIDE_AI_MODEL_MODERATION, PROVIDE_AI_MODEL_RERANK, PROVIDE_AI_MODEL_SPEECH2TEXT, PROVIDE_AI_MODEL_TEXT_EMBEDDING, PROVIDE_AI_MODEL_TTS, RETRIEVER_STRATEGY, RequestContext, RequestContextMiddleware, RequirePermissionOperation, RerankModel, RetrieverRegistry, RetrieverStrategy, SANDBOX_PROVIDER, SANDBOX_SHELL_TIMEOUT_LIMITS_SEC, SKILL_SOURCE_PROVIDER, SSOProviderRegistry, SSOProviderStrategyKey, SSO_BINDING_PERMISSION_SERVICE_TOKEN, SSO_PROVIDER, STRATEGY_META_KEY, SandboxProviderRegistry, SandboxProviderStrategy, SkillSourceProviderRegistry, SkillSourceProviderStrategy, Speech2TextChatModel, SpeechToTextModel, StrategyBus, TEXT_SPLITTER_STRATEGY, TOOLSET_STRATEGY, TextEmbeddingModelManager, TextSplitterRegistry, TextSplitterStrategy, TextToSpeechModel, ToolsetRegistry, ToolsetStrategy, USER_PERMISSION_SERVICE_TOKEN, VECTOR_STORE_STRATEGY, VIEW_EXTENSION_CACHE_SERVICE_TOKEN, VIEW_EXTENSION_PROVIDER, VectorStoreRegistry, VectorStoreStrategy, ViewExtensionProvider, ViewExtensionProviderRegistry, WORKFLOW_NODE_STRATEGY, WORKFLOW_TRIGGER_STRATEGY, WorkflowNodeRegistry, WorkflowNodeStrategy, WorkflowTriggerRegistry, WorkflowTriggerStrategy, WrapWorkflowNodeExecutionCommand, XpFileSystem, XpertServerPlugin, als, appendSandboxMessage, buildSandboxTimeoutMessage, calcTokenUsage, chunkText, countTokensSafe, createI18nInstance, createPluginLogger, defineAgentMessageType, defineChannelMessageType, downloadRemoteFile, formatSandboxTimeout, getErrorMessage, getModelContextSize, getPermissionOperationMetadata, getPositionList, getPositionMap, getRequestContext, getRequiredPermissionOperation, isRemoteFile, isSandboxBackend, isStructuredMessageType, loadYamlFile, mergeCredentials, mergeParentChildChunks, normalizeContextSize, resolveSandboxBackend, resolveSandboxExecutionOptions, runWithRequestContext, secondsToMilliseconds, sumTokenUsage };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpert-ai/plugin-sdk",
-  "version": "3.9.0-beta.2",
+  "version": "3.9.0-beta.3",
   "license": "AGPL-3.0",
   "repository": {
     "type": "git",

package/src/index.d.ts

@@ -15,5 +15,6 @@ export * from './lib/agent/index';
 export * from './lib/channel/index';
 export * from './lib/file/index';
 export * from './lib/strategy';
+export * from './lib/sso/index';
 export * from './lib/sandbox/index';
 export * from './lib/view-extension/index';

package/src/lib/core/permissions/account-binding.d.ts

@@ -0,0 +1,36 @@
+import type { IUser } from '@xpert-ai/contracts';
+import type { BasePermission } from './general';
+export type AccountBindingPermissionOperation = 'read' | 'write' | 'delete';
+/**
+ * Account Binding Permission
+ * Example: { type: 'account_binding', operations: ['write'], providers: ['feishu'] }
+ */
+export interface AccountBindingPermission extends BasePermission {
+    type: 'account_binding';
+    operations?: AccountBindingPermissionOperation[];
+    providers?: string[];
+    scope?: string[];
+}
+/**
+ * System token for resolving account binding permission service from plugin context.
+ */
+export declare const ACCOUNT_BINDING_PERMISSION_SERVICE_TOKEN = "XPERT_PLUGIN_ACCOUNT_BINDING_PERMISSION_SERVICE";
+export interface BindCurrentUserInput {
+    provider: string;
+    subjectId: string;
+    profile?: Record<string, any>;
+}
+export interface ResolveBoundUserInput {
+    provider: string;
+    subjectId: string;
+    tenantId?: string;
+}
+export interface BoundIdentityRef {
+    provider: string;
+    subjectId: string;
+}
+export interface AccountBindingPermissionService {
+    bindCurrentUser(input: BindCurrentUserInput): Promise<BoundIdentityRef>;
+    resolveBoundUser<TUser = IUser>(input: ResolveBoundUserInput): Promise<TUser | null>;
+    unbindCurrentUser(provider: string): Promise<void>;
+}

package/src/lib/core/permissions/auth-login.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Shared auth token payload returned by host-controlled login flows.
+ */
+export interface IssuedAuthTokens {
+    jwt: string;
+    refreshToken: string;
+    userId: string;
+}

package/src/lib/core/permissions/bound-identity-login.d.ts

@@ -0,0 +1,25 @@
+import type { IssuedAuthTokens } from './auth-login';
+import type { BasePermission } from './general';
+export type BoundIdentityLoginPermissionOperation = 'create';
+/**
+ * Bound identity login permission
+ * Example: { type: 'bound_identity_login', operations: ['create'], providers: ['lark'] }
+ */
+export interface BoundIdentityLoginPermission extends BasePermission {
+    type: 'bound_identity_login';
+    operations?: BoundIdentityLoginPermissionOperation[];
+    providers?: string[];
+}
+/**
+ * System token for resolving bound identity login permission service from plugin context.
+ */
+export declare const BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE_TOKEN = "XPERT_PLUGIN_BOUND_IDENTITY_LOGIN_PERMISSION_SERVICE";
+export interface BoundIdentityLoginInput {
+    provider: string;
+    subjectId: string;
+    tenantId: string;
+    organizationId?: string | null;
+}
+export interface BoundIdentityLoginPermissionService {
+    loginWithBoundIdentity(input: BoundIdentityLoginInput): Promise<IssuedAuthTokens | null>;
+}

package/src/lib/core/permissions/index.d.ts

@@ -9,15 +9,22 @@ export * from './general';
 export * from './analytics';
 export * from './operation';
 export * from './handoff';
+export * from './account-binding';
+export * from './auth-login';
+export * from './bound-identity-login';
+export * from './sso-binding';
 export * from './user';
 import type { FileSystemPermission, IntegrationPermission, KnowledgePermission, LLMPermission, VectorStorePermission } from './general';
 import type { AnalyticsPermission } from './analytics';
+import type { AccountBindingPermission } from './account-binding';
+import type { BoundIdentityLoginPermission } from './bound-identity-login';
 import type { HandoffPermission } from './handoff';
+import type { SsoBindingPermission } from './sso-binding';
 import type { UserPermission } from './user';
 /**
  * Union type for all permissions
  */
-export type Permission = LLMPermission | VectorStorePermission | KnowledgePermission | FileSystemPermission | IntegrationPermission | AnalyticsPermission | UserPermission | HandoffPermission;
+export type Permission = LLMPermission | VectorStorePermission | KnowledgePermission | FileSystemPermission | IntegrationPermission | AnalyticsPermission | AccountBindingPermission | BoundIdentityLoginPermission | SsoBindingPermission | UserPermission | HandoffPermission;
 /**
  * Permissions array type
  */

package/src/lib/core/permissions/sso-binding.d.ts

@@ -0,0 +1,33 @@
+import type { BasePermission } from './general';
+export type SsoBindingPermissionOperation = 'create';
+/**
+ * SSO Binding Permission
+ * Example: { type: 'sso_binding', operations: ['create'], providers: ['lark'] }
+ */
+export interface SsoBindingPermission extends BasePermission {
+    type: 'sso_binding';
+    operations?: SsoBindingPermissionOperation[];
+    providers?: string[];
+}
+/**
+ * System token for resolving the pending SSO binding challenge service from plugin context.
+ */
+export declare const SSO_BINDING_PERMISSION_SERVICE_TOKEN = "XPERT_PLUGIN_SSO_BINDING_PERMISSION_SERVICE";
+export type PendingSsoBindingFlow = 'anonymous_bind' | 'current_user_confirm';
+export interface CreatePendingBindingInput {
+    provider: string;
+    subjectId: string;
+    tenantId: string;
+    organizationId?: string | null;
+    displayName?: string | null;
+    avatarUrl?: string | null;
+    profile?: Record<string, any> | null;
+    returnTo?: string | null;
+    flow?: PendingSsoBindingFlow;
+}
+export interface CreatedPendingBindingRef {
+    ticket: string;
+}
+export interface SsoBindingPermissionService {
+    createPendingBinding(input: CreatePendingBindingInput): Promise<CreatedPendingBindingRef>;
+}

package/src/lib/sso/index.d.ts

@@ -0,0 +1,3 @@
+export * from './strategy.decorator';
+export * from './strategy.interface';
+export * from './strategy.registry';

package/src/lib/sso/strategy.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const SSO_PROVIDER = "SSO_PROVIDER";
+export declare const SSOProviderStrategyKey: (provider: string) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;

package/src/lib/sso/strategy.interface.d.ts

@@ -0,0 +1,15 @@
+export interface ISSOProviderDescriptor {
+    provider: string;
+    displayName: string;
+    icon: string;
+    order: number;
+    startUrl: string;
+}
+export interface ISSOProviderContext {
+    tenantId: string;
+    organizationId?: string | null;
+    requestBaseUrl: string;
+}
+export interface ISSOProviderStrategy {
+    describe(context: ISSOProviderContext): ISSOProviderDescriptor | null | Promise<ISSOProviderDescriptor | null>;
+}

package/src/lib/sso/strategy.registry.d.ts

@@ -0,0 +1,6 @@
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import { BaseStrategyRegistry } from '../strategy';
+import { ISSOProviderStrategy } from './strategy.interface';
+export declare class SSOProviderRegistry extends BaseStrategyRegistry<ISSOProviderStrategy> {
+    constructor(discoveryService: DiscoveryService, reflector: Reflector);
+}