@jazzmind/busibox-app 3.0.18

package/dist/lib/services/service-client.js

@@ -0,0 +1,146 @@
+/**
+ * Service client helpers for calling downstream Busibox services.
+ *
+ * Provides utilities for:
+ * - Obtaining authz-issued access tokens for specific services (Zero Trust)
+ * - Making authenticated requests to data-api, search-api, agent-api
+ * - Handling token caching and refresh
+ *
+ * Zero Trust Architecture:
+ * - Requires session JWT for token exchange (cryptographic proof of identity)
+ * - NO client credentials required for user operations
+ */
+import { getAuthorizationHeaderWithSession } from '../authz/next-client';
+/**
+ * Get the base URL for a service from environment variables.
+ */
+export function getServiceBaseUrl(service) {
+    switch (service) {
+        case 'data-api': {
+            const host = process.env.DATA_API_HOST || '10.96.200.206';
+            const port = process.env.DATA_API_PORT || '8002';
+            return `http://${host}:${port}`;
+        }
+        case 'search-api': {
+            const host = process.env.SEARCH_API_HOST || '10.96.200.204';
+            const port = process.env.SEARCH_API_PORT || '8003';
+            return `http://${host}:${port}`;
+        }
+        case 'agent-api': {
+            const host = process.env.AGENT_API_HOST || '10.96.200.202';
+            const port = process.env.AGENT_API_PORT || '8000';
+            return `http://${host}:${port}`;
+        }
+    }
+}
+/**
+ * Get default scopes for a service.
+ *
+ * Note: Currently returns empty arrays because scopes are not enforced
+ * by the downstream services. Authorization is handled via RBAC and
+ * audience-bound tokens.
+ */
+export function getDefaultScopes(service) {
+    // Scopes are not currently enforced - return empty array
+    // to avoid authz client scope validation errors
+    return [];
+}
+/**
+ * Create authenticated headers for calling a downstream service.
+ *
+ * This obtains an authz-issued access token and returns headers
+ * suitable for fetch() calls.
+ *
+ * @example
+ * ```typescript
+ * const headers = await createServiceHeaders({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   scopes: ['read'],
+ * });
+ *
+ * const response = await fetch(`${getServiceBaseUrl('search-api')}/search`, {
+ *   method: 'POST',
+ *   headers,
+ *   body: JSON.stringify({ query: 'example' }),
+ * });
+ * ```
+ */
+export async function createServiceHeaders(options) {
+    const { sessionJwt, userId, service, scopes, purpose } = options;
+    // Use Zero Trust token exchange (no client credentials)
+    const authorization = await getAuthorizationHeaderWithSession({
+        sessionJwt,
+        userId,
+        audience: service,
+        scopes: scopes ?? getDefaultScopes(service),
+        purpose: purpose ?? `busibox-portal.${service}`,
+    });
+    return {
+        'Content-Type': 'application/json',
+        Authorization: authorization,
+    };
+}
+/**
+ * Make an authenticated request to a downstream service.
+ *
+ * This is a convenience wrapper around fetch() that:
+ * - Obtains an authz-issued access token
+ * - Constructs the full URL
+ * - Sets appropriate headers
+ * - Returns the response
+ *
+ * @example
+ * ```typescript
+ * const response = await callService({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   path: '/search',
+ *   method: 'POST',
+ *   body: { query: 'example' },
+ * });
+ *
+ * if (!response.ok) {
+ *   throw new Error(`Search failed: ${response.statusText}`);
+ * }
+ *
+ * const data = await response.json();
+ * ```
+ */
+export async function callService(options) {
+    const { sessionJwt, userId, service, scopes, purpose, path, method = 'GET', body, extraHeaders } = options;
+    const baseUrl = getServiceBaseUrl(service);
+    const url = `${baseUrl}${path}`;
+    const headers = await createServiceHeaders({
+        sessionJwt,
+        userId,
+        service,
+        scopes,
+        purpose,
+    });
+    // Merge extra headers
+    if (extraHeaders) {
+        Object.assign(headers, extraHeaders);
+    }
+    const fetchOptions = {
+        method,
+        headers,
+    };
+    if (body && (method === 'POST' || method === 'PUT' || method === 'PATCH')) {
+        fetchOptions.body = JSON.stringify(body);
+    }
+    return fetch(url, fetchOptions);
+}
+/**
+ * Legacy compatibility: create headers with X-User-Id.
+ *
+ * @deprecated Use createServiceHeaders() instead. This is only for
+ * gradual migration of existing routes.
+ */
+export function createLegacyHeaders(userId) {
+    return {
+        'Content-Type': 'application/json',
+        'X-User-Id': userId,
+    };
+}
+//# sourceMappingURL=service-client.js.map

package/dist/lib/services/service-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.js","sourceRoot":"","sources":["../../../src/lib/services/service-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iCAAiC,EAAsB,MAAM,sBAAsB,CAAC;AAiB7F;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,eAAe,CAAC;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC;YACjD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;YACnD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC;YAClD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,yDAAyD;IACzD,gDAAgD;IAChD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA6B;IACtE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEjE,wDAAwD;IACxD,MAAM,aAAa,GAAG,MAAM,iCAAiC,CAAC;QAC5D,UAAU;QACV,MAAM;QACN,QAAQ,EAAE,OAAwB;QAClC,MAAM,EAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,OAAO,IAAI,kBAAkB,OAAO,EAAE;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,aAAa;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAKC;IAED,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAC9F,OAAO,CAAC;IAEV,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,UAAU;QACV,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO;KACR,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAgB;QAChC,MAAM;QACN,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;QAC1E,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE,MAAM;KACpB,CAAC;AACJ,CAAC"}

package/dist/lib/services/tags.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Tag utilities for document libraries.
+ *
+ * Tag data comes from data-api document metadata (extractedKeywords).
+ * getLibraryTagGroups aggregates extractedKeywords from library documents
+ * and returns tag groups for the Tags tab.
+ */
+export interface TagGroup {
+    name: string;
+    tags: string[];
+    confidence?: number;
+    documentCount?: number;
+}
+/**
+ * Classify tags into semantic groups using Agent API
+ */
+export declare function classifyTags(tags: string[], options?: {
+    maxGroups?: number;
+    context?: string;
+    userId?: string;
+}): Promise<TagGroup[]>;
+/**
+ * Get tag groups for a library from extractedKeywords.
+ *
+ * Uses classifyTags (Agent API) to group related tags semantically when possible.
+ * Falls back to one-tag-per-group if classification fails or returns empty.
+ * Each group includes documentCount (docs containing any tag in the group).
+ */
+export declare function getLibraryTagGroups(libraryId: string, _refresh: boolean, options: {
+    sessionJwt: string;
+    userId: string;
+}): Promise<TagGroup[]>;
+/**
+ * Invalidate tag cache for a library (no-op).
+ */
+export declare function invalidateTagCache(_libraryId: string): Promise<void>;
+//# sourceMappingURL=tags.d.ts.map

package/dist/lib/services/tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../../src/lib/services/tags.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAiCrB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,OAAO,EACjB,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C,OAAO,CAAC,QAAQ,EAAE,CAAC,CA4ErB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1E"}

package/dist/lib/services/tags.js

@@ -0,0 +1,189 @@
+/**
+ * Tag utilities for document libraries.
+ *
+ * Tag data comes from data-api document metadata (extractedKeywords).
+ * getLibraryTagGroups aggregates extractedKeywords from library documents
+ * and returns tag groups for the Tags tab.
+ */
+import { agentFetch } from '../agent/app-client';
+import { getLibraryDocuments } from './libraries';
+/**
+ * Classify tags into semantic groups using Agent API
+ */
+export async function classifyTags(tags, options = {}) {
+    if (tags.length === 0) {
+        return [];
+    }
+    try {
+        const response = await agentFetch('POST /api/classify-tags - classify document tags', '/classify-tags', {
+            method: 'POST',
+            userId: options.userId,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                tags,
+                maxGroups: options.maxGroups || 10,
+                context: options.context,
+            }),
+        });
+        const data = await response.json();
+        return data.groups || [];
+    }
+    catch (error) {
+        // 404 is expected when Agent API doesn't have classify-tags (optional feature)
+        const is404 = error instanceof Error && error.message.includes('404');
+        if (!is404) {
+            console.error('[TAGS] Classification error:', error);
+        }
+        return fallbackGrouping(tags);
+    }
+}
+/**
+ * Get tag groups for a library from extractedKeywords.
+ *
+ * Uses classifyTags (Agent API) to group related tags semantically when possible.
+ * Falls back to one-tag-per-group if classification fails or returns empty.
+ * Each group includes documentCount (docs containing any tag in the group).
+ */
+export async function getLibraryTagGroups(libraryId, _refresh, options) {
+    const { sessionJwt, userId } = options;
+    if (!sessionJwt || !userId) {
+        return [];
+    }
+    try {
+        const documents = await getLibraryDocuments(libraryId, {
+            sortBy: 'createdAt',
+            sortOrder: 'desc',
+            sessionJwt,
+            userId,
+        });
+        const keywordToDocCount = new Map();
+        const docKeywords = new Map(); // docId -> Set of keywords
+        for (const doc of documents) {
+            const docId = String(doc.id ?? '');
+            const keywords = doc.extractedKeywords ?? doc.extracted_keywords ?? [];
+            const kwList = Array.isArray(keywords) ? keywords : [];
+            const seen = new Set();
+            const docKws = new Set();
+            for (const kw of kwList) {
+                const k = String(kw).trim();
+                if (k && !seen.has(k)) {
+                    seen.add(k);
+                    docKws.add(k);
+                    keywordToDocCount.set(k, (keywordToDocCount.get(k) ?? 0) + 1);
+                }
+            }
+            docKeywords.set(docId, docKws);
+        }
+        const allKeywords = Array.from(keywordToDocCount.keys());
+        if (allKeywords.length === 0)
+            return [];
+        // Try semantic grouping via Agent API (groups related tags together)
+        // Fall back to heuristic grouping (prefix/root) when Agent classify-tags is unavailable
+        let tagGroups;
+        try {
+            const classified = await classifyTags(allKeywords, {
+                maxGroups: Math.min(15, Math.max(5, Math.ceil(allKeywords.length / 3))),
+                context: 'library document keywords',
+                userId,
+            });
+            if (classified.length > 0) {
+                tagGroups = classified;
+            }
+            else {
+                tagGroups = heuristicTagGrouping(allKeywords);
+            }
+        }
+        catch {
+            tagGroups = heuristicTagGrouping(allKeywords);
+        }
+        // Compute documentCount for each group: docs that have ANY tag in the group
+        const tagSet = new Set(allKeywords);
+        for (const group of tagGroups) {
+            const groupTags = group.tags.filter(t => tagSet.has(t));
+            if (groupTags.length === 0) {
+                group.documentCount = 0;
+                continue;
+            }
+            let count = 0;
+            for (const docKws of docKeywords.values()) {
+                if (groupTags.some(t => docKws.has(t)))
+                    count++;
+            }
+            group.documentCount = count;
+        }
+        return tagGroups
+            .filter(g => (g.documentCount ?? 0) > 0)
+            .sort((a, b) => (b.documentCount ?? 0) - (a.documentCount ?? 0));
+    }
+    catch (error) {
+        console.error('[TAGS] getLibraryTagGroups error:', error);
+        return [];
+    }
+}
+/**
+ * Invalidate tag cache for a library (no-op).
+ */
+export async function invalidateTagCache(_libraryId) {
+    // No-op: no Prisma cache to invalidate
+}
+function fallbackGrouping(tags) {
+    return tags
+        .map((tag) => ({
+        name: tag,
+        tags: [tag],
+        confidence: 0.6,
+    }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+ * Semantic clusters for common terms (used when first-word heuristic would split related tags).
+ * E.g. "cash" and "credit" both map to "Financial".
+ */
+const SEMANTIC_CLUSTERS = {
+    cash: 'Financial',
+    credit: 'Financial',
+    tax: 'Financial',
+    payment: 'Financial',
+    budget: 'Financial',
+    invoice: 'Financial',
+    cost: 'Financial',
+    price: 'Financial',
+    funding: 'Financial',
+    renewable: 'Energy',
+    solar: 'Energy',
+    wind: 'Energy',
+    energy: 'Energy',
+    freeze: 'Process',
+    thaw: 'Process',
+    dewater: 'Process',
+    pour: 'Process',
+    record: 'Process',
+};
+/**
+ * Group tags by semantic clusters first, then by common first word.
+ * E.g. "cash", "credit" -> Financial; "tax", "tax credit" -> Financial; "freeze", "thaw" -> Process.
+ */
+function heuristicTagGrouping(tags) {
+    if (tags.length === 0)
+        return [];
+    const byCluster = new Map();
+    for (const tag of tags) {
+        const lower = tag.toLowerCase();
+        const firstWord = tag.split(/\s+/)[0]?.toLowerCase() || lower;
+        const cluster = SEMANTIC_CLUSTERS[firstWord] ?? SEMANTIC_CLUSTERS[lower] ?? firstWord;
+        const list = byCluster.get(cluster) ?? [];
+        if (!list.includes(tag))
+            list.push(tag);
+        byCluster.set(cluster, list);
+    }
+    return Array.from(byCluster.entries())
+        .map(([name, groupTags]) => ({
+        name,
+        tags: groupTags.sort((a, b) => a.localeCompare(b)),
+        confidence: 0.6,
+    }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+//# sourceMappingURL=tags.js.map

package/dist/lib/services/tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../../src/lib/services/tags.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AASlD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAc,EACd,UAAqE,EAAE;IAEvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAC/B,kDAAkD,EAClD,gBAAgB,EAChB;YACE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;gBAClC,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC;SACH,CACF,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,+EAA+E;QAC/E,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,QAAiB,EACjB,OAA+C;IAE/C,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACrD,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,MAAM;YACjB,UAAU;YACV,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC,CAAC,2BAA2B;QAC/E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;YACjC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACd,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAExC,qEAAqE;QACrE,wFAAwF;QACxF,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE;gBACjD,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvE,OAAO,EAAE,2BAA2B;gBACpC,MAAM;aACP,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,SAAS,GAAG,UAAU,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;QAED,4EAA4E;QAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAAE,KAAK,EAAE,CAAC;YAClD,CAAC;YACD,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC;QAC9B,CAAC;QAED,OAAO,SAAS;aACb,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;aACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,uCAAuC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,CAAC,GAAG,CAAC;QACX,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GAA2B;IAChD,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,WAAW;IACnB,GAAG,EAAE,WAAW;IAChB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,WAAW;IACpB,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,WAAW;IACpB,SAAS,EAAE,QAAQ;IACnB,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAc;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC;QAC9D,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QACtF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,IAAI;QACJ,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAClD,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/lib/services/url-validation.d.ts

@@ -0,0 +1,22 @@
+/**
+ * URL Validation Utilities
+ *
+ * Validates URLs for external apps with special handling for localhost and private networks.
+ */
+/**
+ * Validate external app URL
+ *
+ * Rules:
+ * - Must be a valid URL
+ * - Must use HTTPS for public addresses
+ * - Can use HTTP for localhost and private network addresses
+ */
+export declare function validateExternalAppUrl(url: string, devMode?: boolean): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Get a user-friendly description of allowed URL formats
+ */
+export declare function getUrlValidationHelp(): string;
+//# sourceMappingURL=url-validation.d.ts.map

package/dist/lib/services/url-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validation.d.ts","sourceRoot":"","sources":["../../../src/lib/services/url-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmCH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,OAAe,GAAG;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CA0CA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/lib/services/url-validation.js

@@ -0,0 +1,86 @@
+/**
+ * URL Validation Utilities
+ *
+ * Validates URLs for external apps with special handling for localhost and private networks.
+ */
+/**
+ * Check if a hostname is localhost or a private network address
+ */
+function isLocalOrPrivateAddress(hostname) {
+    // Localhost variants
+    if (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1' ||
+        hostname.endsWith('.localhost')) {
+        return true;
+    }
+    // Private IPv4 ranges
+    const privateIPv4Patterns = [
+        /^10\./, // 10.0.0.0/8
+        /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0/12
+        /^192\.168\./, // 192.168.0.0/16
+    ];
+    if (privateIPv4Patterns.some(pattern => pattern.test(hostname))) {
+        return true;
+    }
+    // Private IPv6 ranges (basic check)
+    if (hostname.startsWith('fc') || hostname.startsWith('fd')) {
+        return true; // Unique Local Addresses (fc00::/7)
+    }
+    return false;
+}
+/**
+ * Validate external app URL
+ *
+ * Rules:
+ * - Must be a valid URL
+ * - Must use HTTPS for public addresses
+ * - Can use HTTP for localhost and private network addresses
+ */
+export function validateExternalAppUrl(url, devMode = false) {
+    // Allow local-dev:// protocol for development mode
+    if (url.startsWith('local-dev://')) {
+        if (!devMode) {
+            return {
+                valid: false,
+                error: 'local-dev:// URLs are only valid when Development Mode is enabled',
+            };
+        }
+        return { valid: true };
+    }
+    try {
+        const urlObj = new URL(url);
+        const protocol = urlObj.protocol;
+        const hostname = urlObj.hostname;
+        // Check if protocol is http or https
+        if (protocol !== 'http:' && protocol !== 'https:') {
+            return {
+                valid: false,
+                error: 'URL must use HTTP or HTTPS protocol',
+            };
+        }
+        // If using HTTP, validate it's for localhost or private network
+        if (protocol === 'http:') {
+            if (!isLocalOrPrivateAddress(hostname)) {
+                return {
+                    valid: false,
+                    error: 'HTTP is only allowed for localhost and private networks (10.*, 172.16-31.*, 192.168.*). Public URLs must use HTTPS.',
+                };
+            }
+        }
+        return { valid: true };
+    }
+    catch {
+        return {
+            valid: false,
+            error: 'Invalid URL format',
+        };
+    }
+}
+/**
+ * Get a user-friendly description of allowed URL formats
+ */
+export function getUrlValidationHelp() {
+    return 'HTTPS required for public URLs. HTTP allowed for localhost and private networks (10.*, 172.16-31.*, 192.168.*).';
+}
+//# sourceMappingURL=url-validation.js.map

package/dist/lib/services/url-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validation.js","sourceRoot":"","sources":["../../../src/lib/services/url-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,qBAAqB;IACrB,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sBAAsB;IACtB,MAAM,mBAAmB,GAAG;QAC1B,OAAO,EAAqB,aAAa;QACzC,gCAAgC,EAAE,gBAAgB;QAClD,aAAa,EAAe,iBAAiB;KAC9C,CAAC;IAEF,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,CAAC,oCAAoC;IACnD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,UAAmB,KAAK;IAI1E,mDAAmD;IACnD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mEAAmE;aAC3E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,qCAAqC;QACrC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qCAAqC;aAC7C,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,qHAAqH;iBAC7H,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,iHAAiH,CAAC;AAC3H,CAAC"}

package/dist/lib/services/user-management.d.ts

@@ -0,0 +1,81 @@
+/**
+ * User Management Client
+ *
+ * Zero Trust Architecture:
+ * All user CRUD operations go through authz. Authentication is handled via:
+ * - User operations: Pass the user's session JWT (exchanged for access token)
+ * - Login flows: Authz endpoints are unauthenticated (they ARE the authentication)
+ *
+ * There are NO admin tokens or client credentials. All operations are either:
+ * 1. User-initiated (with user's JWT) - user's scopes determine access
+ * 2. Service account (with service account JWT) - for background operations
+ */
+import { type RbacUser, type UserListResponse, type CreateUserParams, type UpdateUserParams, type ListUsersParams } from '@jazzmind/busibox-app';
+/**
+ * AuthzUser type - the user type returned by the authz service.
+ * This is explicitly named to avoid conflict with busibox-portal's local User type.
+ */
+export type AuthzUser = RbacUser;
+export type { UserListResponse, CreateUserParams, UpdateUserParams, ListUsersParams };
+/**
+ * Exchange a session JWT for an authz-api access token.
+ * Use this at the API route level before calling user management functions.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * the scopes parameter. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - User's session JWT
+ * @returns Access token for authz-api
+ */
+export declare function getAuthzAccessToken(sessionJwt: string): Promise<string>;
+/**
+ * Create a new user in authz
+ */
+export declare function createUser(params: {
+    email: string;
+    roleIds?: string[];
+    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
+    assignedBy?: string;
+}, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Update a user in authz
+ */
+export declare function updateUser(userId: string, updates: UpdateUserParams, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Delete a user from authz
+ */
+export declare function deleteUser(userId: string, accessToken?: string): Promise<void>;
+/**
+ * Activate a pending user
+ */
+export declare function activateUser(userId: string, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Deactivate an active user
+ */
+export declare function deactivateUser(userId: string, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Reactivate a deactivated user
+ */
+export declare function reactivateUser(userId: string, accessToken?: string): Promise<AuthzUser>;
+/**
+ * List users with pagination
+ */
+export declare function listUsers(params?: ListUsersParams, accessToken?: string): Promise<UserListResponse>;
+/**
+ * Get a single user by ID
+ */
+export declare function getUser(userId: string, accessToken?: string): Promise<AuthzUser | null>;
+/**
+ * Get a user by email address
+ * Returns null if user not found
+ */
+export declare function getUserByEmail(email: string, accessToken?: string): Promise<AuthzUser | null>;
+/**
+ * Add a role to a user
+ */
+export declare function addUserRole(userId: string, roleId: string, accessToken?: string): Promise<void>;
+/**
+ * Remove a role from a user
+ */
+export declare function removeUserRole(userId: string, roleId: string, accessToken?: string): Promise<void>;
+//# sourceMappingURL=user-management.d.ts.map

package/dist/lib/services/user-management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAYL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAGrB,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;AAGjC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AA0BtF;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE;IACN,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAWpB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG3F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG7F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG7F;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,MAAM,CAAC,EAAE,eAAe,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAgBD;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAI7F;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAGnG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf"}