@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/delegation.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Delegation Token API for background/scheduled tasks.
+ *
+ * Delegation tokens allow a user to create long-lived tokens
+ * that can be used by background jobs without requiring the
+ * user's session JWT at execution time.
+ */
+export interface DelegationToken {
+    delegationToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    expiresAt: string;
+    jti: string;
+    name: string;
+    scopes: string[];
+}
+export interface DelegationTokenInfo {
+    jti: string;
+    name: string;
+    scopes: string[];
+    expiresAt: string;
+    createdAt: string;
+    revoked: boolean;
+}
+/**
+ * Create a delegation token for background tasks.
+ *
+ * @param sessionJwt - The user's session JWT
+ * @param name - Human-readable name for the delegation
+ * @param scopes - Scopes to delegate (optional, defaults to all user's scopes)
+ * @param expiresInSeconds - TTL in seconds (default: 7 days)
+ */
+export declare function createDelegationToken(args: {
+    sessionJwt: string;
+    name: string;
+    scopes?: string[];
+    expiresInSeconds?: number;
+}): Promise<DelegationToken>;
+/**
+ * List active delegation tokens for the authenticated user.
+ */
+export declare function listDelegationTokens(sessionJwt: string): Promise<DelegationTokenInfo[]>;
+/**
+ * Revoke a delegation token.
+ */
+export declare function revokeDelegationToken(sessionJwt: string, jti: string): Promise<void>;
+//# sourceMappingURL=delegation.d.ts.map

package/dist/lib/authz/delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,eAAe,CAAC,CA2B3B;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAsBhC;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1F"}

package/dist/lib/authz/delegation.js

@@ -0,0 +1,82 @@
+/**
+ * Delegation Token API for background/scheduled tasks.
+ *
+ * Delegation tokens allow a user to create long-lived tokens
+ * that can be used by background jobs without requiring the
+ * user's session JWT at execution time.
+ */
+import { getAuthzBaseUrl } from './authz-url';
+/**
+ * Create a delegation token for background tasks.
+ *
+ * @param sessionJwt - The user's session JWT
+ * @param name - Human-readable name for the delegation
+ * @param scopes - Scopes to delegate (optional, defaults to all user's scopes)
+ * @param expiresInSeconds - TTL in seconds (default: 7 days)
+ */
+export async function createDelegationToken(args) {
+    const res = await fetch(`${getAuthzBaseUrl()}/oauth/delegation`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            subject_token: args.sessionJwt,
+            name: args.name,
+            scopes: args.scopes || [],
+            expires_in_seconds: args.expiresInSeconds || 604800,
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to create delegation token (${res.status}): ${text}`);
+    }
+    const data = await res.json();
+    return {
+        delegationToken: data.delegation_token,
+        tokenType: data.token_type,
+        expiresIn: data.expires_in,
+        expiresAt: data.expires_at,
+        jti: data.jti,
+        name: data.name,
+        scopes: data.scopes,
+    };
+}
+/**
+ * List active delegation tokens for the authenticated user.
+ */
+export async function listDelegationTokens(sessionJwt) {
+    const res = await fetch(`${getAuthzBaseUrl()}/oauth/delegations`, {
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${sessionJwt}`,
+        },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to list delegation tokens (${res.status}): ${text}`);
+    }
+    const data = await res.json();
+    return data.delegations.map((d) => ({
+        jti: d.jti,
+        name: d.name,
+        scopes: d.scopes,
+        expiresAt: d.expires_at,
+        createdAt: d.created_at,
+        revoked: d.revoked,
+    }));
+}
+/**
+ * Revoke a delegation token.
+ */
+export async function revokeDelegationToken(sessionJwt, jti) {
+    const res = await fetch(`${getAuthzBaseUrl()}/oauth/delegations/${jti}`, {
+        method: 'DELETE',
+        headers: {
+            Authorization: `Bearer ${sessionJwt}`,
+        },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to revoke delegation token (${res.status}): ${text}`);
+    }
+}
+//# sourceMappingURL=delegation.js.map

package/dist/lib/authz/delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../../src/lib/authz/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAqB9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAK3C;IACC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,EAAE,mBAAmB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,IAAI,MAAM;SACpD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,EAAE,oBAAoB,EAAE;QAChE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,UAAU,EAAE;SACtC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QACvC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB,EAAE,GAAW;IACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,EAAE,sBAAsB,GAAG,EAAE,EAAE;QACvE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,UAAU,EAAE;SACtC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/lib/authz/email-validation.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Email Domain Validation
+ *
+ * Validates email addresses against allowed domains from environment variable.
+ * Auto-creates user accounts for allowed domains, rejects others.
+ */
+/**
+ * Check if email domain is allowed
+ *
+ * @param email - Email address to validate
+ * @returns true if domain is allowed, false otherwise
+ */
+export declare function isEmailDomainAllowed(email: string): boolean;
+/**
+ * Get rejection message for disallowed email domain
+ *
+ * @param email - Email address that was rejected
+ * @returns User-friendly error message
+ */
+export declare function getEmailDomainRejectionMessage(email: string): string;
+/**
+ * Get list of allowed domains (for display purposes)
+ *
+ * @returns Array of allowed domain strings
+ */
+export declare function getAllowedDomains(): string[];
+/**
+ * Check if domain restrictions are enabled
+ *
+ * @returns true if restrictions are active, false if all domains allowed
+ */
+export declare function isDomainRestrictionEnabled(): boolean;
+//# sourceMappingURL=email-validation.d.ts.map

package/dist/lib/authz/email-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-validation.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/email-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAkB3D;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASpE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAGpD"}

package/dist/lib/authz/email-validation.js

@@ -0,0 +1,70 @@
+/**
+ * Email Domain Validation
+ *
+ * Validates email addresses against allowed domains from environment variable.
+ * Auto-creates user accounts for allowed domains, rejects others.
+ */
+/**
+ * Get allowed domains from environment variable
+ * @returns Array of normalized allowed domains
+ */
+function getAllowedDomainsFromEnv() {
+    const domainsEnv = process.env.ALLOWED_EMAIL_DOMAINS || '';
+    if (!domainsEnv.trim()) {
+        return [];
+    }
+    return domainsEnv.split(',').map(d => d.trim().toLowerCase()).filter(Boolean);
+}
+/**
+ * Check if email domain is allowed
+ *
+ * @param email - Email address to validate
+ * @returns true if domain is allowed, false otherwise
+ */
+export function isEmailDomainAllowed(email) {
+    const emailLower = email.toLowerCase();
+    const parts = emailLower.split('@');
+    // Basic email validation: must have exactly 2 parts (username@domain)
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        return false;
+    }
+    const domain = parts[1];
+    const allowedDomains = getAllowedDomainsFromEnv();
+    // If no domains configured or wildcard, allow all
+    if (allowedDomains.length === 0 || allowedDomains.includes('*')) {
+        return true;
+    }
+    return allowedDomains.includes(domain);
+}
+/**
+ * Get rejection message for disallowed email domain
+ *
+ * @param email - Email address that was rejected
+ * @returns User-friendly error message
+ */
+export function getEmailDomainRejectionMessage(email) {
+    const domain = email.split('@')[1];
+    const allowedDomains = getAllowedDomainsFromEnv();
+    if (allowedDomains.length === 0) {
+        return 'Email registration is currently disabled. Please contact your administrator.';
+    }
+    return `Email domain "@${domain}" is not allowed. Only ${allowedDomains.join(', ')} email addresses are allowed.`;
+}
+/**
+ * Get list of allowed domains (for display purposes)
+ *
+ * @returns Array of allowed domain strings
+ */
+export function getAllowedDomains() {
+    return getAllowedDomainsFromEnv();
+}
+/**
+ * Check if domain restrictions are enabled
+ *
+ * @returns true if restrictions are active, false if all domains allowed
+ */
+export function isDomainRestrictionEnabled() {
+    const allowedDomains = getAllowedDomainsFromEnv();
+    return allowedDomains.length > 0 && !allowedDomains.includes('*');
+}
+//# sourceMappingURL=email-validation.js.map

package/dist/lib/authz/email-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-validation.js","sourceRoot":"","sources":["../../../src/lib/authz/email-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,SAAS,wBAAwB;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpC,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;IAElD,kDAAkD;IAClD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;IAElD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,8EAA8E,CAAC;IACxF,CAAC;IAED,OAAO,kBAAkB,MAAM,0BAA0B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AACpH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,wBAAwB,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;IAClD,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC"}

package/dist/lib/authz/email.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Email Sending — Bridge API Client
+ *
+ * All outbound email is delegated to the Bridge API service.
+ * Busibox Portal no longer holds SMTP or Resend secrets.
+ *
+ * Bridge API endpoints (internal network, no auth required):
+ *   POST /api/v1/email/send-magic-link        — magic link + TOTP code
+ *   POST /api/v1/email/send-magic-link-simple  — simple magic link
+ *   POST /api/v1/email/send                    — generic email
+ *   POST /api/v1/email/send-welcome            — welcome email
+ *   POST /api/v1/email/send-account-deactivated
+ *   POST /api/v1/email/send-account-reactivated
+ *   POST /api/v1/email/test                    — test email
+ */
+/**
+ * Send a magic-link + TOTP code email via Bridge API.
+ */
+export declare function sendMagicLinkWithCodeEmail(email: string, magicLinkUrl: string, totpCode: string): Promise<{
+    data: any;
+    error: null;
+}>;
+/**
+ * Send a simple magic-link email (no TOTP) via Bridge API.
+ */
+export declare function sendMagicLinkEmail(email: string, magicLinkUrl: string): Promise<{
+    data: any;
+    error: null;
+}>;
+/**
+ * Send a welcome email via Bridge API.
+ */
+export declare function sendWelcomeEmail(email: string, userName?: string): Promise<{
+    data: any;
+    error: null;
+}>;
+/**
+ * Send an account-deactivated email via Bridge API.
+ */
+export declare function sendAccountDeactivatedEmail(email: string): Promise<{
+    data: any;
+    error: null;
+}>;
+/**
+ * Send an account-reactivated email via Bridge API.
+ */
+export declare function sendAccountReactivatedEmail(email: string): Promise<{
+    data: any;
+    error: null;
+}>;
+/**
+ * Send a test email via Bridge API.
+ * Returns the provider that was used.
+ */
+export declare function sendTestEmail(to: string): Promise<{
+    provider: string;
+}>;
+/**
+ * Send a generic email via Bridge API.
+ */
+export declare function sendEmail(to: string, subject: string, html: string, text: string): Promise<{
+    data: any;
+    error: null;
+}>;
+//# sourceMappingURL=email.d.ts.map

package/dist/lib/authz/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiCH;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM;;;GASjB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;;GAO3E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM;;;GAStE;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM;;;GAK9D;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM;;;GAQ9D;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAM7E;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;;;GAIb"}

package/dist/lib/authz/email.js

@@ -0,0 +1,112 @@
+/**
+ * Email Sending — Bridge API Client
+ *
+ * All outbound email is delegated to the Bridge API service.
+ * Busibox Portal no longer holds SMTP or Resend secrets.
+ *
+ * Bridge API endpoints (internal network, no auth required):
+ *   POST /api/v1/email/send-magic-link        — magic link + TOTP code
+ *   POST /api/v1/email/send-magic-link-simple  — simple magic link
+ *   POST /api/v1/email/send                    — generic email
+ *   POST /api/v1/email/send-welcome            — welcome email
+ *   POST /api/v1/email/send-account-deactivated
+ *   POST /api/v1/email/send-account-reactivated
+ *   POST /api/v1/email/test                    — test email
+ */
+import { getBridgeApiUrl } from '../next/api-url';
+// ---------------------------------------------------------------------------
+// Low-level bridge call
+// ---------------------------------------------------------------------------
+async function bridgePost(path, body) {
+    const url = `${getBridgeApiUrl()}${path}`;
+    const resp = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        let detail = text;
+        try {
+            const json = JSON.parse(text);
+            detail = json.detail || json.error || text;
+        }
+        catch { /* use raw text */ }
+        throw new Error(`Bridge API ${resp.status} ${path}: ${detail}`);
+    }
+    return resp.json();
+}
+// ---------------------------------------------------------------------------
+// Public API — mirrors the old email.ts exports
+// ---------------------------------------------------------------------------
+/**
+ * Send a magic-link + TOTP code email via Bridge API.
+ */
+export async function sendMagicLinkWithCodeEmail(email, magicLinkUrl, totpCode) {
+    console.log('[EMAIL] Sending magic link + TOTP via Bridge API for', email);
+    const result = await bridgePost('/api/v1/email/send-magic-link', {
+        to: email,
+        magic_link_url: magicLinkUrl,
+        totp_code: totpCode,
+    });
+    return { data: result, error: null };
+}
+/**
+ * Send a simple magic-link email (no TOTP) via Bridge API.
+ */
+export async function sendMagicLinkEmail(email, magicLinkUrl) {
+    console.log('[EMAIL] Sending magic link via Bridge API for', email);
+    const result = await bridgePost('/api/v1/email/send-magic-link-simple', {
+        to: email,
+        magic_link_url: magicLinkUrl,
+    });
+    return { data: result, error: null };
+}
+/**
+ * Send a welcome email via Bridge API.
+ */
+export async function sendWelcomeEmail(email, userName) {
+    const portalUrl = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000';
+    const result = await bridgePost('/api/v1/email/send-welcome', {
+        to: email,
+        user_name: userName || null,
+        portal_url: portalUrl,
+    });
+    return { data: result, error: null };
+}
+/**
+ * Send an account-deactivated email via Bridge API.
+ */
+export async function sendAccountDeactivatedEmail(email) {
+    const result = await bridgePost('/api/v1/email/send-account-deactivated', {
+        to: email,
+    });
+    return { data: result, error: null };
+}
+/**
+ * Send an account-reactivated email via Bridge API.
+ */
+export async function sendAccountReactivatedEmail(email) {
+    const portalUrl = process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000';
+    const result = await bridgePost('/api/v1/email/send-account-reactivated', {
+        to: email,
+        portal_url: portalUrl,
+    });
+    return { data: result, error: null };
+}
+/**
+ * Send a test email via Bridge API.
+ * Returns the provider that was used.
+ */
+export async function sendTestEmail(to) {
+    const result = await bridgePost('/api/v1/email/test', { to });
+    return { provider: result.provider };
+}
+/**
+ * Send a generic email via Bridge API.
+ */
+export async function sendEmail(to, subject, html, text) {
+    const result = await bridgePost('/api/v1/email/send', { to, subject, html, text });
+    return { data: result, error: null };
+}
+//# sourceMappingURL=email.js.map

package/dist/lib/authz/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/lib/authz/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,KAAK,UAAU,UAAU,CAAU,IAAY,EAAE,IAA6B;IAC5E,MAAM,GAAG,GAAG,GAAG,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC5B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EACb,YAAoB,EACpB,QAAgB;IAEhB,OAAO,CAAC,GAAG,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,+BAA+B,EAAE;QAC/D,EAAE,EAAE,KAAK;QACT,cAAc,EAAE,YAAY;QAC5B,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,YAAoB;IAC1E,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,sCAAsC,EAAE;QACtE,EAAE,EAAE,KAAK;QACT,cAAc,EAAE,YAAY;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAiB;IACrE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,4BAA4B,EAAE;QAC5D,EAAE,EAAE,KAAK;QACT,SAAS,EAAE,QAAQ,IAAI,IAAI;QAC3B,UAAU,EAAE,SAAS;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAa;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,wCAAwC,EAAE;QACxE,EAAE,EAAE,KAAK;KACV,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAa;IAC7D,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,wCAAwC,EAAE;QACxE,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,SAAS;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,oBAAoB,EACpB,EAAE,EAAE,EAAE,CACP,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAU,EACV,OAAe,EACf,IAAY,EACZ,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC"}

package/dist/lib/authz/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * AuthZ module — everything related to the authz service.
+ *
+ * Includes: zero-trust token exchange, delegation tokens, SSO validation,
+ * SSO generation, session client, auth helpers, RBAC, audit, passkeys,
+ * permissions, user management, email validation.
+ */
+export { exchangeTokenZeroTrust, getAuthHeaderZeroTrust, createZeroTrustClient, invalidateZeroTrustToken, clearZeroTrustTokenCache, isValidJwtFormat, parseJwtClaimsUnsafe, getUserIdFromSessionJwt, InvalidSessionError, isInvalidSessionError, type AuthzAudience, type ZeroTrustExchangeRequest, type ZeroTrustExchangeResponse, type ZeroTrustClientConfig, type ZeroTrustClient, } from './zero-trust';
+export { createDelegationToken, listDelegationTokens, revokeDelegationToken, type DelegationToken, type DelegationTokenInfo, } from './delegation';
+export { sanitizeAppName, getTokenFromRequest, getSessionFromRequest, requireToken, getAuthHeaders, getSSEHeaders, hasToken, parseJWTPayload, isTokenExpired, getTokenExpiration, getUserIdFromToken, getUserEmailFromToken, getUserRolesFromToken, tokenHasRole, tokenIsAdmin, shouldRefreshToken, getScopesFromToken, hasScope, hasAllScopes, } from './auth-helper';
+export { createAuthStateManager, getGlobalAuthManager, setGlobalAuthManager, clearGlobalAuthManager, isAuthInitializing, setAuthInitializing, type AuthState, type AuthStateManagerConfig, type AuthEventType, type AuthStateManager, } from './auth-state-manager';
+export { createSession, validateSession, deleteSession, deleteUserSessions, createMagicLink, validateMagicLink, useMagicLink, createTotpCode, verifyTotpCode, createPasskeyChallenge, registerPasskey, listUserPasskeys, deletePasskey, authenticateWithPasskey, initiateLogin, cleanupExpired, type Session, type CreateSessionParams, type MagicLink, type Passkey, type AuthClientOptions, } from './session-client';
+export { validateSSOToken, createSessionFromSSO, invalidateJwksCache, hasSessionRole, hasSessionScope, isSessionAdmin, type SSOValidationOptions, type SSOValidationResult, type SSOSessionData, type AppTokenPayload, } from './sso';
+export { createSSOGetHandler, createSSOPostHandler, type SSOHandlerOptions, type SSOPostResult, } from './sso-route-handler';
+export * from './email-validation';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/authz/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,KAAK,OAAO,EACZ,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,OAAO,CAAC;AAGf,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAG7B,cAAc,oBAAoB,CAAC"}

package/dist/lib/authz/index.js

@@ -0,0 +1,24 @@
+/**
+ * AuthZ module — everything related to the authz service.
+ *
+ * Includes: zero-trust token exchange, delegation tokens, SSO validation,
+ * SSO generation, session client, auth helpers, RBAC, audit, passkeys,
+ * permissions, user management, email validation.
+ */
+// Zero Trust token exchange
+export { exchangeTokenZeroTrust, getAuthHeaderZeroTrust, createZeroTrustClient, invalidateZeroTrustToken, clearZeroTrustTokenCache, isValidJwtFormat, parseJwtClaimsUnsafe, getUserIdFromSessionJwt, InvalidSessionError, isInvalidSessionError, } from './zero-trust';
+// Delegation tokens
+export { createDelegationToken, listDelegationTokens, revokeDelegationToken, } from './delegation';
+// Auth helpers (JWT parsing, token extraction)
+export { sanitizeAppName, getTokenFromRequest, getSessionFromRequest, requireToken, getAuthHeaders, getSSEHeaders, hasToken, parseJWTPayload, isTokenExpired, getTokenExpiration, getUserIdFromToken, getUserEmailFromToken, getUserRolesFromToken, tokenHasRole, tokenIsAdmin, shouldRefreshToken, getScopesFromToken, hasScope, hasAllScopes, } from './auth-helper';
+// Auth state manager (client-side)
+export { createAuthStateManager, getGlobalAuthManager, setGlobalAuthManager, clearGlobalAuthManager, isAuthInitializing, setAuthInitializing, } from './auth-state-manager';
+// Session client (sessions, magic links, TOTP, passkeys via authz)
+export { createSession, validateSession, deleteSession, deleteUserSessions, createMagicLink, validateMagicLink, useMagicLink, createTotpCode, verifyTotpCode, createPasskeyChallenge, registerPasskey, listUserPasskeys, deletePasskey, authenticateWithPasskey, initiateLogin, cleanupExpired, } from './session-client';
+// SSO validation
+export { validateSSOToken, createSessionFromSSO, invalidateJwksCache, hasSessionRole, hasSessionScope, isSessionAdmin, } from './sso';
+// SSO route handlers
+export { createSSOGetHandler, createSSOPostHandler, } from './sso-route-handler';
+// Email validation
+export * from './email-validation';
+//# sourceMappingURL=index.js.map

package/dist/lib/authz/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/authz/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,4BAA4B;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GAMtB,MAAM,cAAc,CAAC;AAEtB,oBAAoB;AACpB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,GAGtB,MAAM,cAAc,CAAC;AAEtB,+CAA+C;AAC/C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,QAAQ,EACR,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,GAKpB,MAAM,sBAAsB,CAAC;AAE9B,mEAAmE;AACnE,OAAO,EACL,aAAa,EACb,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,aAAa,EACb,cAAc,GAMf,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,cAAc,GAKf,MAAM,OAAO,CAAC;AAEf,qBAAqB;AACrB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GAGrB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,cAAc,oBAAoB,CAAC"}

package/dist/lib/authz/next-client.d.ts

@@ -0,0 +1,101 @@
+/**
+ * AuthZ client (server-side only)
+ *
+ * Zero Trust Authentication Architecture:
+ * - AuthZ issues RS256-signed session JWTs
+ * - busibox-portal exchanges session JWTs for downstream access tokens
+ * - NO client credentials required for user operations
+ *
+ * This module uses the shared Zero Trust functions from busibox-app.
+ */
+import { clearZeroTrustTokenCache, getUserIdFromSessionJwt, InvalidSessionError, isInvalidSessionError, type AuthzAudience as SharedAuthzAudience } from '@jazzmind/busibox-app';
+export { InvalidSessionError, isInvalidSessionError };
+export type AuthzAudience = SharedAuthzAudience;
+import { getAuthzBaseUrl } from './authz-url';
+export { getAuthzBaseUrl };
+/**
+ * Get standard RBAC client options for authz service calls.
+ * Zero Trust: Only authzUrl is needed - no admin tokens or client credentials.
+ *
+ * Import this instead of duplicating getAuthzOptions() in every route file.
+ */
+export declare function getAuthzOptions(): {
+    authzUrl: string;
+};
+/**
+ * Get RBAC client options with an exchanged access token for admin operations.
+ *
+ * Use this for admin routes that need to access user management or RBAC APIs.
+ * Exchanges the session JWT for an authz-api access token.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * this request. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - The admin user's session JWT from requireAdminAuth()
+ * @returns Options object with authzUrl and accessToken for busibox-app RBAC functions
+ */
+export declare function getAuthzOptionsWithToken(sessionJwt: string): Promise<{
+    authzUrl: string;
+    accessToken: string;
+}>;
+/**
+ * Exchange session JWT for a downstream access token and return just the token string.
+ *
+ * Thin wrapper around exchangeTokenZeroTrust for the common case where you
+ * only need the access token, not the full response.
+ *
+ * @param sessionJwt - Session JWT from busibox-session cookie
+ * @param audience - Target service (e.g., 'agent-api', 'data-api')
+ * @param scopes - Optional scopes to request
+ * @returns Access token string
+ */
+export declare function getApiToken(sessionJwt: string, audience: AuthzAudience, scopes?: string[]): Promise<string>;
+/**
+ * Exchange a session JWT for a downstream access token (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ * The session JWT cryptographically proves user identity.
+ *
+ * @param args.userId - Deprecated and ignored. User ID is extracted from the
+ *   session JWT by the authz service. Kept for backward compatibility.
+ */
+export declare function exchangeWithSubjectToken(args: {
+    sessionJwt: string;
+    /** @deprecated Ignored -- user ID is extracted from the session JWT. */
+    userId?: string;
+    audience: AuthzAudience;
+    scopes?: string[];
+    purpose?: string;
+}): Promise<{
+    accessToken: string;
+    tokenType: 'bearer';
+    expiresIn: number;
+    scope: string;
+}>;
+/**
+ * Get authorization header using session JWT (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ *
+ * @param args.userId - Deprecated and ignored. User ID is extracted from the
+ *   session JWT by the authz service. Kept for backward compatibility.
+ */
+export declare function getAuthorizationHeaderWithSession(args: {
+    sessionJwt: string;
+    /** @deprecated Ignored -- user ID is extracted from the session JWT. */
+    userId?: string;
+    audience: AuthzAudience;
+    scopes?: string[];
+    purpose?: string;
+}): Promise<string>;
+/**
+ * Invalidate a cached downstream token.
+ */
+export declare function invalidateDownstreamToken(userId: string, audience: AuthzAudience, scopes?: string[]): void;
+/**
+ * Clear all cached tokens.
+ */
+export { clearZeroTrustTokenCache };
+export { createDelegationToken, listDelegationTokens, revokeDelegationToken, } from './delegation';
+export { getUserIdFromSessionJwt };
+//# sourceMappingURL=next-client.d.ts.map

package/dist/lib/authz/next-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-client.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/next-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,aAAa,IAAI,mBAAmB,EAE1C,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC;AAGtD,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAWhD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAItD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,MAAM,CAAC,CAejB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B1F;AAED;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CAAC,IAAI,EAAE;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,IAAI,CAGN;AAED;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAMpC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAMtB,OAAO,EAAE,uBAAuB,EAAE,CAAC"}