@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/zero-trust.js

@@ -0,0 +1,344 @@
+/**
+ * Zero Trust Token Exchange for Server-Side Applications
+ *
+ * This module provides server-side token exchange using the Zero Trust pattern:
+ * - Uses session JWT as subject_token (cryptographic proof of user identity)
+ * - NO client credentials required for user operations
+ * - Follows RFC 8693 token exchange grant type
+ *
+ * Architecture:
+ * 1. User authenticates with authz service, receives session JWT
+ * 2. Frontend apps (portal, busibox-agents) call this to exchange for downstream tokens
+ * 3. No client secrets needed - the session JWT proves user identity
+ *
+ * Usage:
+ * ```typescript
+ * import { exchangeTokenZeroTrust, createZeroTrustClient } from '@jazzmind/busibox-app/lib/authz';
+ *
+ * // Direct function call
+ * const token = await exchangeTokenZeroTrust({
+ *   sessionJwt: 'eyJ...',
+ *   audience: 'agent-api',
+ *   scopes: ['agents:read'],
+ * });
+ *
+ * // Or create a client instance
+ * const authzClient = createZeroTrustClient({
+ *   authzBaseUrl: 'http://authz-api:8010',
+ * });
+ * const token = await authzClient.exchangeToken({ sessionJwt, audience: 'agent-api' });
+ * ```
+ */
+// OAuth2 constants
+const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange';
+const SUBJECT_TOKEN_TYPE_JWT = 'urn:ietf:params:oauth:token-type:jwt';
+// =============================================================================
+// Error Classes
+// =============================================================================
+/**
+ * Error thrown when token exchange fails due to an invalid or expired session.
+ * This indicates the user should be logged out and redirected to login.
+ */
+export class InvalidSessionError extends Error {
+    constructor(message, code, status = 401) {
+        super(message);
+        this.name = 'InvalidSessionError';
+        this.code = code;
+        this.status = status;
+        // These error codes indicate the session is permanently invalid
+        this.shouldLogout = [
+            'invalid_subject_token_key', // Signing key changed (server restart with new keys)
+            'subject_token_expired', // Token expired
+            'invalid_subject_token', // Token is malformed or invalid
+            'subject_token_revoked', // Token was revoked
+            'session_revoked', // Session revoked server-side
+        ].includes(code);
+    }
+}
+/**
+ * Check if an error indicates the user should be logged out.
+ */
+export function isInvalidSessionError(error) {
+    return error instanceof InvalidSessionError && error.shouldLogout;
+}
+// Global token cache keyed by "userId:audience:scopes"
+const tokenCache = new Map();
+// Default expiry buffer (refresh 60 seconds before expiry)
+const DEFAULT_EXPIRY_BUFFER_MS = 60 * 1000;
+function getCacheKey(userId, audience, scopes) {
+    const sortedScopes = [...scopes].sort().join(',');
+    return `${userId}:${audience}:${sortedScopes}`;
+}
+function getCachedToken(userId, audience, scopes, bufferMs = DEFAULT_EXPIRY_BUFFER_MS) {
+    const key = getCacheKey(userId, audience, scopes);
+    const cached = tokenCache.get(key);
+    if (!cached)
+        return null;
+    // Check if token is still valid (with buffer)
+    if (Date.now() >= cached.expiresAt - bufferMs) {
+        tokenCache.delete(key);
+        return null;
+    }
+    return cached;
+}
+function setCachedToken(userId, token) {
+    const scopes = token.scope.split(' ').filter(Boolean);
+    const key = getCacheKey(userId, token.audience, scopes);
+    tokenCache.set(key, token);
+}
+function invalidateCachedToken(userId, audience, scopes) {
+    const key = getCacheKey(userId, audience, scopes);
+    tokenCache.delete(key);
+}
+function invalidateAllCachedTokens() {
+    tokenCache.clear();
+}
+function parseJwtClaims(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return null;
+        const payload = parts[1];
+        const decoded = Buffer.from(payload, 'base64url').toString('utf-8');
+        return JSON.parse(decoded);
+    }
+    catch {
+        return null;
+    }
+}
+function isJwtFormat(token) {
+    const parts = token.split('.');
+    return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+// =============================================================================
+// Environment Configuration
+// =============================================================================
+function getAuthzBaseUrl(configUrl) {
+    if (configUrl)
+        return configUrl;
+    return process.env.AUTHZ_BASE_URL || 'http://authz-api:8010';
+}
+// =============================================================================
+// Zero Trust Token Exchange
+// =============================================================================
+/**
+ * Exchange a session JWT for a downstream access token (Zero Trust mode).
+ *
+ * This is the core function that implements RFC 8693 token exchange:
+ * - Uses subject_token (the session JWT) to prove user identity
+ * - NO client credentials required
+ * - The session JWT cryptographically proves who the user is
+ *
+ * @param request - Token exchange request
+ * @param config - Optional configuration overrides
+ * @returns Token exchange response with access token
+ */
+export async function exchangeTokenZeroTrust(request, config) {
+    const { sessionJwt, audience, scopes = [], purpose, resourceId } = request;
+    const { authzBaseUrl, verbose = false, expiryBufferSeconds = 60 } = config || {};
+    // Validate session JWT format
+    if (!isJwtFormat(sessionJwt)) {
+        throw new Error('Invalid session token format: expected JWT');
+    }
+    // Parse claims to get user ID for caching
+    const claims = parseJwtClaims(sessionJwt);
+    if (!claims || !claims.sub) {
+        throw new Error('Invalid session token: missing subject claim');
+    }
+    // Check if token is expired
+    if (claims.exp * 1000 < Date.now()) {
+        throw new Error('Session token has expired');
+    }
+    const userId = claims.sub;
+    const scopeArray = scopes.filter(Boolean);
+    const scopeString = scopeArray.join(' ');
+    // For app-scoped tokens, include resourceId in cache key
+    const cacheKey = resourceId
+        ? `${audience}:${resourceId}`
+        : audience;
+    // Check cache
+    const cached = getCachedToken(userId, cacheKey, scopeArray, expiryBufferSeconds * 1000);
+    if (cached) {
+        if (verbose) {
+            console.log('[ZERO-TRUST] Using cached token for:', { userId, audience, resourceId });
+        }
+        return {
+            accessToken: cached.accessToken,
+            tokenType: cached.tokenType,
+            expiresIn: Math.floor((cached.expiresAt - Date.now()) / 1000),
+            scope: cached.scope,
+            expiresAt: cached.expiresAt,
+        };
+    }
+    // Build token exchange request (Zero Trust - no client credentials)
+    const params = new URLSearchParams({
+        grant_type: TOKEN_EXCHANGE_GRANT,
+        subject_token: sessionJwt,
+        subject_token_type: SUBJECT_TOKEN_TYPE_JWT,
+        audience,
+        scope: scopeString,
+    });
+    // Add optional purpose for audit
+    if (purpose) {
+        params.set('requested_purpose', purpose);
+    }
+    // Add resourceId for app-scoped tokens
+    // Authz will verify user has access to this app via RBAC bindings
+    if (resourceId) {
+        params.set('resource_id', resourceId);
+    }
+    const baseUrl = getAuthzBaseUrl(authzBaseUrl);
+    if (verbose) {
+        console.log('[ZERO-TRUST] Token exchange request:', {
+            url: `${baseUrl}/oauth/token`,
+            grant_type: TOKEN_EXCHANGE_GRANT,
+            audience,
+            scope: scopeString,
+            resourceId,
+            mode: 'subject_token (Zero Trust)',
+        });
+    }
+    // Make the exchange request
+    const response = await fetch(`${baseUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        console.error('[ZERO-TRUST] Token exchange failed:', {
+            status: response.status,
+            body: text,
+            userId,
+            audience,
+        });
+        // Parse error code from response body
+        let errorCode = 'unknown_error';
+        try {
+            const errorData = JSON.parse(text);
+            errorCode = errorData.detail || errorData.error || 'unknown_error';
+        }
+        catch {
+            // Body is not JSON, use the text as-is
+            errorCode = text;
+        }
+        // Check for session-related errors that indicate the user should be logged out
+        const sessionErrors = [
+            'invalid_subject_token_key',
+            'subject_token_expired',
+            'invalid_subject_token',
+            'subject_token_revoked',
+            'session_revoked',
+        ];
+        if (sessionErrors.includes(errorCode)) {
+            throw new InvalidSessionError(`Session is invalid: ${errorCode}`, errorCode, response.status);
+        }
+        throw new Error(`Token exchange failed (${response.status}): ${text}`);
+    }
+    const data = (await response.json());
+    const expiresIn = data.expires_in ?? 900;
+    const expiresAt = Date.now() + expiresIn * 1000;
+    // Cache the token (use modified cache key for app-scoped tokens)
+    const cachedToken = {
+        accessToken: data.access_token,
+        tokenType: data.token_type ?? 'bearer',
+        expiresAt,
+        scope: data.scope ?? scopeString,
+        audience: cacheKey, // Use cacheKey which includes resourceId for app-scoped tokens
+    };
+    setCachedToken(userId, cachedToken);
+    if (verbose) {
+        console.log('[ZERO-TRUST] Token cached:', { userId, audience, resourceId, expiresIn });
+    }
+    return {
+        accessToken: data.access_token,
+        tokenType: data.token_type ?? 'bearer',
+        expiresIn,
+        scope: data.scope ?? scopeString,
+        expiresAt,
+    };
+}
+/**
+ * Get an authorization header (Bearer token) using Zero Trust exchange.
+ *
+ * @param request - Token exchange request
+ * @param config - Optional configuration
+ * @returns Authorization header string (e.g., "Bearer eyJ...")
+ */
+export async function getAuthHeaderZeroTrust(request, config) {
+    const token = await exchangeTokenZeroTrust(request, config);
+    return `Bearer ${token.accessToken}`;
+}
+/**
+ * Create a Zero Trust client instance with fixed configuration.
+ *
+ * This is useful when you want to reuse the same config across multiple calls.
+ *
+ * @param config - Client configuration
+ * @returns Zero Trust client instance
+ */
+export function createZeroTrustClient(config) {
+    return {
+        async exchangeToken(request) {
+            return exchangeTokenZeroTrust(request, config);
+        },
+        async getAuthHeader(request) {
+            return getAuthHeaderZeroTrust(request, config);
+        },
+        invalidateToken(audience, scopes = []) {
+            // We need a userId to invalidate, but we don't have it here
+            // This clears ALL tokens for this audience (could be improved with userId param)
+            for (const [key] of tokenCache) {
+                if (key.includes(`:${audience}:`)) {
+                    tokenCache.delete(key);
+                }
+            }
+        },
+        invalidateAllTokens() {
+            invalidateAllCachedTokens();
+        },
+    };
+}
+/**
+ * Invalidate a cached token for a specific user/audience/scopes combination.
+ *
+ * @param userId - User ID
+ * @param audience - Target audience
+ * @param scopes - Scopes (optional)
+ */
+export function invalidateZeroTrustToken(userId, audience, scopes = []) {
+    invalidateCachedToken(userId, audience, scopes);
+}
+/**
+ * Clear all cached Zero Trust tokens.
+ */
+export function clearZeroTrustTokenCache() {
+    invalidateAllCachedTokens();
+}
+// =============================================================================
+// Utilities
+// =============================================================================
+/**
+ * Check if a token string is in JWT format.
+ */
+export function isValidJwtFormat(token) {
+    return isJwtFormat(token);
+}
+/**
+ * Parse JWT claims without verification.
+ * Use for extracting user ID, expiry, etc. - actual verification is done by authz.
+ */
+export function parseJwtClaimsUnsafe(token) {
+    return parseJwtClaims(token);
+}
+/**
+ * Extract user ID from a session JWT (server-only, checks "sub" only).
+ *
+ * For isomorphic code that also handles legacy tokens with "user_id" claim,
+ * see getUserIdFromToken in auth-helper.ts.
+ */
+export function getUserIdFromSessionJwt(sessionJwt) {
+    const claims = parseJwtClaims(sessionJwt);
+    return claims?.sub ?? null;
+}
+//# sourceMappingURL=zero-trust.js.map

package/dist/lib/authz/zero-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-trust.js","sourceRoot":"","sources":["../../../src/lib/authz/zero-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,mBAAmB;AACnB,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAEtE,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAK5C,YAAY,OAAe,EAAE,IAAY,EAAE,SAAiB,GAAG;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,gEAAgE;QAChE,IAAI,CAAC,YAAY,GAAG;YAClB,2BAA2B,EAAG,qDAAqD;YACnF,uBAAuB,EAAQ,gBAAgB;YAC/C,uBAAuB,EAAQ,gCAAgC;YAC/D,uBAAuB,EAAQ,oBAAoB;YACnD,iBAAiB,EAAc,8BAA8B;SAC9D,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,YAAY,CAAC;AACpE,CAAC;AAkED,uDAAuD;AACvD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;AAElD,2DAA2D;AAC3D,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,SAAS,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAgB;IACrE,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,QAAgB,EAChB,MAAgB,EAChB,WAAmB,wBAAwB;IAE3C,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,8CAA8C;IAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;QAC9C,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,KAAkB;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAgB;IAC/E,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,yBAAyB;IAChC,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAiBD,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,SAAS,eAAe,CAAC,SAAkB;IACzC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAiC,EACjC,MAA8B;IAE9B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC3E,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,mBAAmB,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAEjF,8BAA8B;IAC9B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,0CAA0C;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,4BAA4B;IAC5B,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzC,yDAAyD;IACzD,MAAM,QAAQ,GAAG,UAAU;QACzB,CAAC,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE;QAC7B,CAAC,CAAC,QAAQ,CAAC;IAEb,cAAc;IACd,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACxF,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;YAC7D,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,UAAU,EAAE,oBAAoB;QAChC,aAAa,EAAE,UAAU;QACzB,kBAAkB,EAAE,sBAAsB;QAC1C,QAAQ;QACR,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IAEH,iCAAiC;IACjC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,uCAAuC;IACvC,kEAAkE;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAE9C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE;YAClD,GAAG,EAAE,GAAG,OAAO,cAAc;YAC7B,UAAU,EAAE,oBAAoB;YAChC,QAAQ;YACR,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,IAAI,EAAE,4BAA4B;SACnC,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE;YACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,IAAI;YACV,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,SAAS,GAAG,eAAe,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,SAAS,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,IAAI,eAAe,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;YACvC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,+EAA+E;QAC/E,MAAM,aAAa,GAAG;YACpB,2BAA2B;YAC3B,uBAAuB;YACvB,uBAAuB;YACvB,uBAAuB;YACvB,iBAAiB;SAClB,CAAC;QAEF,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,SAAS,EAAE,EAClC,SAAS,EACT,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAEhD,iEAAiE;IACjE,MAAM,WAAW,GAAgB;QAC/B,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;QACtC,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,WAAW;QAChC,QAAQ,EAAE,QAAQ,EAAE,+DAA+D;KACpF,CAAC;IACF,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEpC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;QACtC,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,WAAW;QAChC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAiC,EACjC,MAA8B;IAE9B,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,OAAiC;YACnD,OAAO,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,OAAiC;YACnD,OAAO,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,eAAe,CAAC,QAAgB,EAAE,SAAmB,EAAE;YACrD,4DAA4D;YAC5D,iFAAiF;YACjF,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAClC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB;YACjB,yBAAyB,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,QAAgB,EAChB,SAAmB,EAAE;IAErB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB;IACtC,yBAAyB,EAAE,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/dist/lib/bridge/config.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Bridge Configuration Store
+ *
+ * Persists Bridge channel/integration settings in deploy-api's config store.
+ * These settings are applied to bridge runtime env via deploy-api config apply.
+ */
+export { isMaskedValue } from './masking';
+export type BridgeConfig = {
+    signalEnabled: boolean;
+    signalPhoneNumber: string | null;
+    allowedPhoneNumbers: string | null;
+    telegramEnabled: boolean;
+    telegramBotToken: string | null;
+    telegramPollInterval: number | null;
+    telegramPollTimeout: number | null;
+    telegramAllowedChatIds: string | null;
+    discordEnabled: boolean;
+    discordBotToken: string | null;
+    discordPollInterval: number | null;
+    discordChannelIds: string | null;
+    whatsappEnabled: boolean;
+    whatsappVerifyToken: string | null;
+    whatsappAccessToken: string | null;
+    whatsappPhoneNumberId: string | null;
+    whatsappApiVersion: string | null;
+    whatsappAllowedPhoneNumbers: string | null;
+    channelUserBindings: string | null;
+    defaultAgentId: string | null;
+    emailInboundEnabled: boolean;
+    imapHost: string | null;
+    imapPort: number | null;
+    imapUser: string | null;
+    imapPassword: string | null;
+    imapUseSsl: boolean;
+    imapFolder: string | null;
+    emailInboundPollInterval: number | null;
+    emailAllowedSenders: string | null;
+};
+export declare function maskBridgeConfig(config: BridgeConfig): BridgeConfig;
+export declare function getBridgeConfigToken(userId: string, sessionJwt: string): Promise<string>;
+export declare function getBridgeConfigFromDeployApi(token: string, raw?: boolean): Promise<BridgeConfig>;
+export declare function saveBridgeConfigToDeployApi(token: string, updates: Partial<BridgeConfig>): Promise<BridgeConfig>;
+export declare function getDefaultBridgeConfig(): BridgeConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/lib/bridge/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/lib/bridge/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAI1C,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,CAAC;AAgGF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CASnE;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9F;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,MAAM,EACb,GAAG,UAAQ,GACV,OAAO,CAAC,YAAY,CAAC,CA4BvB;AAgDD,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,GAC7B,OAAO,CAAC,YAAY,CAAC,CA2BvB;AAED,wBAAgB,sBAAsB,IAAI,YAAY,CAErD"}

package/dist/lib/bridge/config.js

@@ -0,0 +1,201 @@
+/**
+ * Bridge Configuration Store
+ *
+ * Persists Bridge channel/integration settings in deploy-api's config store.
+ * These settings are applied to bridge runtime env via deploy-api config apply.
+ */
+import { getDeployApiToken, bulkSetConfigs, listConfigs, getConfigRaw, } from '../deploy/client';
+import { maskValue } from './masking';
+export { isMaskedValue } from './masking';
+const CONFIG_CATEGORY = 'bridge';
+const DEFAULT_CONFIG = {
+    signalEnabled: false,
+    signalPhoneNumber: null,
+    allowedPhoneNumbers: null,
+    telegramEnabled: false,
+    telegramBotToken: null,
+    telegramPollInterval: 1.0,
+    telegramPollTimeout: 25,
+    telegramAllowedChatIds: null,
+    discordEnabled: false,
+    discordBotToken: null,
+    discordPollInterval: 2.0,
+    discordChannelIds: null,
+    whatsappEnabled: false,
+    whatsappVerifyToken: null,
+    whatsappAccessToken: null,
+    whatsappPhoneNumberId: null,
+    whatsappApiVersion: 'v22.0',
+    whatsappAllowedPhoneNumbers: null,
+    channelUserBindings: null,
+    defaultAgentId: 'chat-agent',
+    emailInboundEnabled: false,
+    imapHost: null,
+    imapPort: 993,
+    imapUser: null,
+    imapPassword: null,
+    imapUseSsl: true,
+    imapFolder: 'INBOX',
+    emailInboundPollInterval: 30.0,
+    emailAllowedSenders: null,
+};
+const FIELD_TO_KEY = {
+    signalEnabled: 'SIGNAL_ENABLED',
+    signalPhoneNumber: 'SIGNAL_PHONE_NUMBER',
+    allowedPhoneNumbers: 'ALLOWED_PHONE_NUMBERS',
+    telegramEnabled: 'TELEGRAM_ENABLED',
+    telegramBotToken: 'TELEGRAM_BOT_TOKEN',
+    telegramPollInterval: 'TELEGRAM_POLL_INTERVAL',
+    telegramPollTimeout: 'TELEGRAM_POLL_TIMEOUT',
+    telegramAllowedChatIds: 'TELEGRAM_ALLOWED_CHAT_IDS',
+    discordEnabled: 'DISCORD_ENABLED',
+    discordBotToken: 'DISCORD_BOT_TOKEN',
+    discordPollInterval: 'DISCORD_POLL_INTERVAL',
+    discordChannelIds: 'DISCORD_CHANNEL_IDS',
+    whatsappEnabled: 'WHATSAPP_ENABLED',
+    whatsappVerifyToken: 'WHATSAPP_VERIFY_TOKEN',
+    whatsappAccessToken: 'WHATSAPP_ACCESS_TOKEN',
+    whatsappPhoneNumberId: 'WHATSAPP_PHONE_NUMBER_ID',
+    whatsappApiVersion: 'WHATSAPP_API_VERSION',
+    whatsappAllowedPhoneNumbers: 'WHATSAPP_ALLOWED_PHONE_NUMBERS',
+    channelUserBindings: 'CHANNEL_USER_BINDINGS',
+    defaultAgentId: 'DEFAULT_AGENT_ID',
+    emailInboundEnabled: 'EMAIL_INBOUND_ENABLED',
+    imapHost: 'IMAP_HOST',
+    imapPort: 'IMAP_PORT',
+    imapUser: 'IMAP_USER',
+    imapPassword: 'IMAP_PASSWORD',
+    imapUseSsl: 'IMAP_USE_SSL',
+    imapFolder: 'IMAP_FOLDER',
+    emailInboundPollInterval: 'EMAIL_INBOUND_POLL_INTERVAL',
+    emailAllowedSenders: 'EMAIL_ALLOWED_SENDERS',
+};
+const KEY_TO_FIELD = Object.fromEntries(Object.entries(FIELD_TO_KEY).map(([field, key]) => [key, field]));
+const ENCRYPTED_KEYS = new Set([
+    'TELEGRAM_BOT_TOKEN',
+    'DISCORD_BOT_TOKEN',
+    'WHATSAPP_VERIFY_TOKEN',
+    'WHATSAPP_ACCESS_TOKEN',
+    'IMAP_PASSWORD',
+]);
+const SENSITIVE_FIELDS = [
+    'telegramBotToken',
+    'discordBotToken',
+    'whatsappVerifyToken',
+    'whatsappAccessToken',
+    'imapPassword',
+];
+export function maskBridgeConfig(config) {
+    const out = { ...config };
+    for (const field of SENSITIVE_FIELDS) {
+        const val = out[field];
+        if (typeof val === 'string') {
+            out[field] = maskValue(val);
+        }
+    }
+    return out;
+}
+export async function getBridgeConfigToken(userId, sessionJwt) {
+    return getDeployApiToken(userId, sessionJwt);
+}
+export async function getBridgeConfigFromDeployApi(token, raw = false) {
+    try {
+        const listing = await listConfigs(token, CONFIG_CATEGORY);
+        if (!listing.configs || listing.configs.length === 0) {
+            return { ...DEFAULT_CONFIG };
+        }
+        const values = {};
+        if (raw) {
+            for (const cfg of listing.configs) {
+                try {
+                    const rawResp = await getConfigRaw(token, cfg.key);
+                    values[rawResp.key] = rawResp.value;
+                }
+                catch {
+                    // Ignore deleted/failed keys
+                }
+            }
+        }
+        else {
+            for (const cfg of listing.configs) {
+                values[cfg.key] = cfg.value;
+            }
+        }
+        return configValuesToBridgeConfig(values);
+    }
+    catch (error) {
+        console.warn('[BRIDGE-CONFIG] Failed to read bridge config from deploy-api:', error);
+        return { ...DEFAULT_CONFIG };
+    }
+}
+function configValuesToBridgeConfig(values) {
+    const config = { ...DEFAULT_CONFIG };
+    for (const [key, rawValue] of Object.entries(values)) {
+        const field = KEY_TO_FIELD[key];
+        if (!field)
+            continue;
+        if (rawValue === '********') {
+            config[field] = '********';
+            continue;
+        }
+        if (rawValue === '' && typeof DEFAULT_CONFIG[field] !== 'string') {
+            continue;
+        }
+        switch (field) {
+            case 'signalEnabled':
+            case 'telegramEnabled':
+            case 'discordEnabled':
+            case 'whatsappEnabled':
+            case 'emailInboundEnabled':
+            case 'imapUseSsl':
+                config[field] = rawValue === 'true';
+                break;
+            case 'telegramPollInterval':
+            case 'discordPollInterval':
+            case 'emailInboundPollInterval': {
+                const n = Number.parseFloat(rawValue);
+                if (Number.isFinite(n))
+                    config[field] = n;
+                break;
+            }
+            case 'telegramPollTimeout':
+            case 'imapPort': {
+                const n = Number.parseInt(rawValue, 10);
+                if (Number.isFinite(n))
+                    config[field] = n;
+                break;
+            }
+            default:
+                config[field] = rawValue || null;
+        }
+    }
+    return config;
+}
+export async function saveBridgeConfigToDeployApi(token, updates) {
+    const configs = {};
+    for (const [field, configKey] of Object.entries(FIELD_TO_KEY)) {
+        const value = updates[field];
+        if (value === undefined)
+            continue;
+        const strValue = typeof value === 'boolean'
+            ? String(value)
+            : value === null
+                ? ''
+                : String(value);
+        configs[configKey] = {
+            value: strValue,
+            encrypted: ENCRYPTED_KEYS.has(configKey),
+            category: CONFIG_CATEGORY,
+            description: `Bridge integration setting: ${field}`,
+        };
+    }
+    if (Object.keys(configs).length === 0) {
+        return getBridgeConfigFromDeployApi(token, true);
+    }
+    await bulkSetConfigs(token, { configs });
+    return getBridgeConfigFromDeployApi(token, true);
+}
+export function getDefaultBridgeConfig() {
+    return { ...DEFAULT_CONFIG };
+}
+//# sourceMappingURL=config.js.map

package/dist/lib/bridge/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/bridge/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,eAAe,GAAG,QAAQ,CAAC;AAuCjC,MAAM,cAAc,GAAiB;IACnC,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,IAAI;IACvB,mBAAmB,EAAE,IAAI;IAEzB,eAAe,EAAE,KAAK;IACtB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,GAAG;IACzB,mBAAmB,EAAE,EAAE;IACvB,sBAAsB,EAAE,IAAI;IAE5B,cAAc,EAAE,KAAK;IACrB,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,IAAI;IAEvB,eAAe,EAAE,KAAK;IACtB,mBAAmB,EAAE,IAAI;IACzB,mBAAmB,EAAE,IAAI;IACzB,qBAAqB,EAAE,IAAI;IAC3B,kBAAkB,EAAE,OAAO;IAC3B,2BAA2B,EAAE,IAAI;IAEjC,mBAAmB,EAAE,IAAI;IACzB,cAAc,EAAE,YAAY;IAE5B,mBAAmB,EAAE,KAAK;IAC1B,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,GAAG;IACb,QAAQ,EAAE,IAAI;IACd,YAAY,EAAE,IAAI;IAClB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,OAAO;IACnB,wBAAwB,EAAE,IAAI;IAC9B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,MAAM,YAAY,GAAuC;IACvD,aAAa,EAAE,gBAAgB;IAC/B,iBAAiB,EAAE,qBAAqB;IACxC,mBAAmB,EAAE,uBAAuB;IAE5C,eAAe,EAAE,kBAAkB;IACnC,gBAAgB,EAAE,oBAAoB;IACtC,oBAAoB,EAAE,wBAAwB;IAC9C,mBAAmB,EAAE,uBAAuB;IAC5C,sBAAsB,EAAE,2BAA2B;IAEnD,cAAc,EAAE,iBAAiB;IACjC,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,uBAAuB;IAC5C,iBAAiB,EAAE,qBAAqB;IAExC,eAAe,EAAE,kBAAkB;IACnC,mBAAmB,EAAE,uBAAuB;IAC5C,mBAAmB,EAAE,uBAAuB;IAC5C,qBAAqB,EAAE,0BAA0B;IACjD,kBAAkB,EAAE,sBAAsB;IAC1C,2BAA2B,EAAE,gCAAgC;IAE7D,mBAAmB,EAAE,uBAAuB;IAC5C,cAAc,EAAE,kBAAkB;IAElC,mBAAmB,EAAE,uBAAuB;IAC5C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,aAAa;IACzB,wBAAwB,EAAE,6BAA6B;IACvD,mBAAmB,EAAE,uBAAuB;CAC7C,CAAC;AAEF,MAAM,YAAY,GAAuC,MAAM,CAAC,WAAW,CACzE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAA2B,CAAC,CAAC,CACvF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;IACvB,uBAAuB;IACvB,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAA2B;IAC/C,kBAAkB;IAClB,iBAAiB;IACjB,qBAAqB;IACrB,qBAAqB;IACrB,cAAc;CACf,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,MAAoB;IACnD,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3B,GAA+B,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,UAAkB;IAC3E,OAAO,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAa,EACb,GAAG,GAAG,KAAK;IAEX,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,6BAA6B;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAA8B;IAChE,MAAM,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAkC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;YACxD,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,KAAK,EAAE,IAAI,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjE,SAAS;QACX,CAAC;QAED,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,eAAe,CAAC;YACrB,KAAK,iBAAiB,CAAC;YACvB,KAAK,gBAAgB,CAAC;YACtB,KAAK,iBAAiB,CAAC;YACvB,KAAK,qBAAqB,CAAC;YAC3B,KAAK,YAAY;gBACd,MAAkC,CAAC,KAAK,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC;gBACjE,MAAM;YACR,KAAK,sBAAsB,CAAC;YAC5B,KAAK,qBAAqB,CAAC;YAC3B,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAG,MAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvE,MAAM;YACR,CAAC;YACD,KAAK,qBAAqB,CAAC;YAC3B,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAG,MAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACvE,MAAM;YACR,CAAC;YACD;gBACG,MAAkC,CAAC,KAAK,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAa,EACb,OAA8B;IAE9B,MAAM,OAAO,GAAqC,EAAE,CAAC;IAErD,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAElC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,SAAS;YACzC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,KAAK,KAAK,IAAI;gBACd,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpB,OAAO,CAAC,SAAS,CAAC,GAAG;YACnB,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;YACxC,QAAQ,EAAE,eAAe;YACzB,WAAW,EAAE,+BAA+B,KAAK,EAAE;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzC,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;AAC/B,CAAC"}

package/dist/lib/bridge/email-config.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Email Configuration Store
+ *
+ * Persists email provider settings (SMTP / Resend) in config-api's
+ * config_entries table so admins can manage them from the UI.
+ *
+ * Bridge reads these settings on demand from config-api using a
+ * scope-restricted token (config.email.read), so no restart is needed.
+ *
+ * Admin flow:
+ *   Admin saves settings via UI  ->  PATCH /api/admin/email-settings
+ *   -> bulk-set in config-api config store
+ */
+export { isMaskedValue } from './masking';
+export type EmailConfig = {
+    smtpEnabled: boolean;
+    smtpHost: string | null;
+    smtpPort: number | null;
+    smtpUser: string | null;
+    smtpPassword: string | null;
+    smtpSecure: boolean;
+    resendEnabled: boolean;
+    emailFrom: string | null;
+    resendApiKey: string | null;
+};
+export declare function maskEmailConfig(config: EmailConfig): EmailConfig;
+/**
+ * Get a config-api scoped token for an authenticated admin user.
+ */
+export declare function getEmailConfigToken(userId: string, sessionJwt: string): Promise<string>;
+/**
+ * Read email config from config-api config store.
+ *
+ * @param token - config-api scoped JWT (from admin user)
+ * @param raw   - if true, fetches raw (unmasked) values
+ */
+export declare function getEmailConfigFromDeployApi(token: string, raw?: boolean): Promise<EmailConfig>;
+/**
+ * Save email config to config-api config store (bulk upsert).
+ *
+ * @param token   - config-api scoped JWT (from admin user)
+ * @param updates - partial EmailConfig to save
+ */
+export declare function saveEmailConfigToDeployApi(token: string, updates: Partial<EmailConfig>): Promise<EmailConfig>;
+export declare function getDefaultEmailConfig(): EmailConfig;
+//# sourceMappingURL=email-config.d.ts.map

package/dist/lib/bridge/email-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-config.d.ts","sourceRoot":"","sources":["../../../src/lib/bridge/email-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAoC1C,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAoBF,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAShE;AAMD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAMD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,GAAG,UAAQ,GACV,OAAO,CAAC,WAAW,CAAC,CA8BtB;AAuDD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,WAAW,CAAC,CA8BtB;AAMD,wBAAgB,qBAAqB,IAAI,WAAW,CAEnD"}