@jazzmind/busibox-app 3.0.18

package/dist/lib/next/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/lib/next/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAmB,qBAAqB,EAAwC,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAG/D,8CAA8C;AAC9C,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,6DAA6D;AAC7D,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAoB;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,WAAW,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,SAAS,GAAG,CAAC,OAAoB,EAAE,GAAG,IAAe;IACnD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,KAAgD,CAAC;IAChE,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,MAAM,KAAK,4BAA4B,IAAI,MAAM,KAAK,2BAA2B;QAAE,OAAO,IAAI,CAAC;IAEnG,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACjD,GAAG,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,8BAA8B;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,SAAS,cAAc;IACrB,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IAanC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAoB;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,OAAO,EAAE,gDAAgD,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,EAAE,qDAAqD,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8CAA8C;QAC9C,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,GAAG,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8DAA8D;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAEjC,GAAG,CAAC,OAAO,EAAE,mDAAmD,EAAE,IAAI,CAAC,SAAS,CAAC;YAC/E,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,UAAU,EAAE,MAAM,CAAC,GAAG;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,KAAK,CAAC,MAAM;SAC1B,CAAC,CAAC,CAAC;QAEJ,sCAAsC;QACtC,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,EAAE,QAAQ,EAAE,mCAAmC;gBACrD,KAAK,EAAE,KAAK,EAAE,wBAAwB;aACvC;YACD,OAAO,EAAE;gBACP,EAAE,EAAE,MAAM,CAAC,GAAG;gBACd,KAAK,EAAE,YAAY,EAAE,iBAAiB;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB;IACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAErD,kEAAkE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAE1C,uEAAuE;IACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAwC,EAAE,EAAE;QAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QACpC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;QACzB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ;QACvC,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,MAAM,EAAE,IAAI;QACzB,SAAS,EAAE,MAAM,EAAE,UAAU;QAC7B,QAAQ,EAAE,MAAM,EAAE,WAAW;QAC7B,SAAS,EAAE,MAAM,EAAE,OAAO;QAC1B,aAAa,EAAE,MAAM,EAAE,cAAc;KACtC,CAAC;IAEF,GAAG,CAAC,OAAO,EAAE,oDAAoD,EAAE,IAAI,CAAC,SAAS,CAAC;QAChF,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;KAChC,CAAC,CAAC,CAAC;IAEJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB;IACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;KAC1B,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,MAAM,GAAG,MAAM,oCAAoC,EAAE,CAAC;IAC5D,OAAO,MAAM;QACX,CAAC,CAAC;YACE,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC;IACxD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAEtD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAErC,kEAAkE;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAEpC,uEAAuE;QACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAwC,EAAE,EAAE;YAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,OAAO;YACL,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,aAAa,EAAE,MAAM,CAAC,cAAc;YACpC,UAAU,EAAE,YAAY;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAoB;IAEpB,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoB;IAEpB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAE9C,0CAA0C;IAC1C,IAAI,UAAU,YAAY,YAAY,EAAE,CAAC;QACvC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAExC,iEAAiE;IACjE,MAAM,SAAS,GAAG,iEAAiE,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,wCAAwC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,EACnD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;IAErD,gGAAgG;IAChG,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,OAAO,EAAE,6DAA6D,CAAC,CAAC;QAC5E,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,OAAO,EAAE,6CAA6C,IAAI,CAAC,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3G,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAeD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAoB,EACpB,QAAwB,EACxB,MAAiB;IAEjB,MAAM,cAAc,GAAG,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAC,oBAAsC,IAAI,aAAa,CAAC;IAExG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAEpD,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;gBAEvF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;gBAE9C,OAAO;oBACL,IAAI,EAAE;wBACJ,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,WAAW;wBAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,gBAAgB;wBACxC,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAwC,EAAE,EAAE,CAC5E,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAC1C,CAAC,MAAM,CAAC,OAAO,CAAC;qBAClB;oBACD,UAAU,EAAE,cAAc;oBAC1B,QAAQ,EAAE,KAAK;oBACf,UAAU,EAAE,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,yHAAyH;aACnI,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAExC,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE;gBACrB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAwC,EAAE,EAAE,CAC5E,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAC1C,CAAC,MAAM,CAAC,OAAO,CAAC;aAClB;YACD,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAEtD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,qBAAqB,CAC1B,uDAAuD,EACtD,KAA2B,CAAC,IAAI,CAClC,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5E,OAAO,YAAY,CAAC,IAAI,CACtB;YACE,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,wGAAwG;YACjH,OAAO,EAAE,YAAY;SACtB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAoB,EACpB,QAAwB,EACxB,MAAiB;IAEjB,MAAM,cAAc,GAAG,QAAQ,IAAK,OAAO,CAAC,GAAG,CAAC,oBAAsC,IAAI,aAAa,CAAC;IAExG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAEpD,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;gBAE9C,OAAO;oBACL,IAAI,EAAE;wBACJ,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,WAAW;wBAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,gBAAgB;wBACxC,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAwC,EAAE,EAAE,CAC5E,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAC1C,CAAC,MAAM,CAAC,OAAO,CAAC;qBAClB;oBACD,UAAU,EAAE,cAAc;oBAC1B,QAAQ,EAAE,KAAK;oBACf,UAAU,EAAE,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAExC,OAAO;YACL,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE;gBACrB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;gBAC1B,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAwC,EAAE,EAAE,CAC5E,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAC1C,CAAC,MAAM,CAAC,OAAO,CAAC;aAClB;YACD,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAA8D;IACzF,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB;IAC/C,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAChC,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAI,IAAO,EAAE,MAAM,GAAG,GAAG;IACjD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EACvB,EAAE,MAAM,EAAE,CACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG;IAClD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EACzB,EAAE,MAAM,EAAE,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAkB;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAChC;QACE,OAAO,EAAE,KAAK;QACd,KAAK;QACL,SAAS;QACT,aAAa,EAAE,IAAI;KACpB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IAEF,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,EAAE;QAC1C,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,GAAG;KACV,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,cAAc,GAAG,mBAAmB;IACjF,wDAAwD;IACxD,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;QACjF,OAAO,qBAAqB,CAC1B,uDAAuD,EACtD,KAA2B,CAAC,IAAI,CAClC,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAoB;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAS,EACT,cAAwB;IAExB,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,2BAA2B,KAAK,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAE/E,OAAO,EACL,iCAAiC,EACjC,WAAW,GAEZ,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoB,EACpB,QAAuB,EACvB,MAAiB;IAEjB,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,iCAAiC,CAAC;YAC7C,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAuB,EACvB,MAAiB;IAEjB,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAEtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,iCAAiC,CAAC;YAC7C,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/next/passkey.d.ts

@@ -0,0 +1,78 @@
+/**
+ * WebAuthn / Passkey Utility Functions
+ *
+ * Implements passkey registration and authentication using the WebAuthn standard.
+ * Uses @simplewebauthn/server for server-side operations.
+ *
+ * NOTE: Passkey storage is now handled by the authz service.
+ * This module performs WebAuthn verification locally, then stores results via authz.
+ */
+import type { RegistrationResponseJSON, AuthenticationResponseJSON } from '@simplewebauthn/types';
+import { type Passkey } from '@jazzmind/busibox-app/lib/auth';
+import { type AuthzUser } from '../services/user-management';
+/**
+ * Generate registration options for a user to create a new passkey
+ * @param userId - User ID
+ * @param userEmail - User email
+ * @param sessionJwt - Session JWT for authentication with authz service
+ */
+export declare function generatePasskeyRegistrationOptions(userId: string, userEmail: string, sessionJwt: string): Promise<any>;
+/**
+ * Verify a registration response and store the new passkey
+ * @param userId - User ID
+ * @param response - Registration response from WebAuthn
+ * @param deviceName - Name for the passkey
+ * @param sessionJwt - Session JWT for authentication with authz service
+ */
+export declare function verifyPasskeyRegistration(userId: string, response: RegistrationResponseJSON, deviceName: string, sessionJwt: string): Promise<Passkey>;
+/**
+ * Generate authentication options for passkey login
+ *
+ * Note: We don't look up user by email here because:
+ * 1. During login, we don't have an access token yet
+ * 2. Modern browsers support "discoverable credentials" which auto-select the right passkey
+ * 3. Allowing any passkey is actually the correct UX for passkey authentication
+ */
+export declare function generatePasskeyAuthenticationOptions(_email?: string): Promise<any>;
+/**
+ * Verify an authentication response and return the user and session
+ */
+export declare function verifyPasskeyAuthentication(response: AuthenticationResponseJSON): Promise<{
+    passkey: Passkey & {
+        user_id: string;
+    };
+    user: AuthzUser;
+    session: {
+        token: string;
+        expires_at: string;
+    };
+}>;
+/**
+ * Get all passkeys for a user
+ * @param userId - User ID
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function getUserPasskeys(userId: string, sessionJwt?: string): Promise<Passkey[]>;
+/**
+ * Delete a passkey
+ * @param userId - User ID (for ownership verification)
+ * @param passkeyId - Passkey ID to delete
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function deletePasskey(userId: string, passkeyId: string, sessionJwt?: string): Promise<Passkey>;
+/**
+ * Rename a passkey
+ * @param userId - User ID (for ownership verification)
+ * @param passkeyId - Passkey ID to rename
+ * @param newName - New name for the passkey
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function renamePasskey(userId: string, passkeyId: string, newName: string, sessionJwt?: string): Promise<Passkey>;
+/**
+ * Check if user has any passkeys
+ * @param userId - User ID
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function userHasPasskeys(userId: string, sessionJwt?: string): Promise<boolean>;
+export declare function cleanupExpiredChallenges(): Promise<any>;
+//# sourceMappingURL=passkey.d.ts.map

package/dist/lib/next/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/lib/next/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAG3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAML,KAAK,OAAO,EACb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAmC7D;;;;;GAKG;AACH,wBAAsB,kCAAkC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBA0C7G;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,oBAkDnB;AAMD;;;;;;;GAOG;AACH,wBAAsB,oCAAoC,CAAC,MAAM,CAAC,EAAE,MAAM,gBAmBzE;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC;IAC/F,OAAO,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD,CAAC,CAuID;AAMD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,sBAMxE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,oBAgBzF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkC7H;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3F;AAoBD,wBAAsB,wBAAwB,iBAgB7C"}

package/dist/lib/next/passkey.js

@@ -0,0 +1,380 @@
+/**
+ * WebAuthn / Passkey Utility Functions
+ *
+ * Implements passkey registration and authentication using the WebAuthn standard.
+ * Uses @simplewebauthn/server for server-side operations.
+ *
+ * NOTE: Passkey storage is now handled by the authz service.
+ * This module performs WebAuthn verification locally, then stores results via authz.
+ */
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from '@simplewebauthn/server';
+import { createPasskeyChallenge, registerPasskey as authzRegisterPasskey, listUserPasskeys as authzListUserPasskeys, deletePasskey as authzDeletePasskey, authenticateWithPasskey as authzAuthenticateWithPasskey, } from '@jazzmind/busibox-app/lib/auth';
+import { getAuthzOptions, getAuthzBaseUrl } from './authz-client';
+// RP (Relying Party) configuration
+// APP_URL is a runtime env var (server-side only) - it's NOT prefixed with NEXT_PUBLIC_
+// because we don't want it baked into the client bundle at build time.
+// This ensures the correct domain is used even if the build was done with different env vars.
+const getAppUrl = () => process.env.APP_URL || process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000';
+const getRpId = () => {
+    const url = getAppUrl();
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return 'localhost';
+    }
+};
+const getRpName = () => process.env.APP_NAME || 'Busibox Portal';
+const getOrigin = () => {
+    const url = getAppUrl();
+    try {
+        // WebAuthn origin must be protocol + hostname only (no path)
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.hostname}${parsed.port ? ':' + parsed.port : ''}`;
+    }
+    catch {
+        return 'http://localhost:3000';
+    }
+};
+// ============================================================================
+// Registration (adding a new passkey)
+// ============================================================================
+/**
+ * Generate registration options for a user to create a new passkey
+ * @param userId - User ID
+ * @param userEmail - User email
+ * @param sessionJwt - Session JWT for authentication with authz service
+ */
+export async function generatePasskeyRegistrationOptions(userId, userEmail, sessionJwt) {
+    // Use session JWT directly for self-service auth (no token exchange needed)
+    // The authz passkey endpoints support session JWT for users managing their own passkeys
+    const options = {
+        authzUrl: getAuthzBaseUrl(),
+        accessToken: sessionJwt, // Session JWT works for self-service
+    };
+    // Get existing passkeys for this user to exclude
+    const existingPasskeys = await authzListUserPasskeys(userId, options);
+    const excludeCredentials = existingPasskeys.map((passkey) => ({
+        id: passkey.credential_id,
+        type: 'public-key',
+        transports: (passkey.transports || []),
+    }));
+    const registrationOptions = await generateRegistrationOptions({
+        rpName: getRpName(),
+        rpID: getRpId(),
+        userID: new TextEncoder().encode(userId),
+        userName: userEmail,
+        userDisplayName: userEmail.split('@')[0],
+        // Timeout after 5 minutes
+        timeout: 300000,
+        // Prefer platform authenticators (Face ID, Touch ID, Windows Hello)
+        authenticatorSelection: {
+            authenticatorAttachment: 'platform',
+            residentKey: 'preferred',
+            userVerification: 'preferred',
+        },
+        // Don't re-register existing authenticators
+        excludeCredentials,
+        // Request attestation for device info
+        attestationType: 'none',
+    });
+    // Store challenge for verification via authz
+    await createPasskeyChallenge('registration', userId, options);
+    return registrationOptions;
+}
+/**
+ * Verify a registration response and store the new passkey
+ * @param userId - User ID
+ * @param response - Registration response from WebAuthn
+ * @param deviceName - Name for the passkey
+ * @param sessionJwt - Session JWT for authentication with authz service
+ */
+export async function verifyPasskeyRegistration(userId, response, deviceName, sessionJwt) {
+    // Use session JWT directly for self-service auth (no token exchange needed)
+    // The authz passkey endpoints support session JWT for users managing their own passkeys
+    const options = {
+        authzUrl: getAuthzBaseUrl(),
+        accessToken: sessionJwt, // Session JWT works for self-service
+    };
+    // Get the challenge from authz (we use the user's most recent challenge)
+    // Since authz stores challenges separately, we need to fetch it
+    // For now, we'll pass the expected challenge from the client
+    // This is a simplification - in production, you'd want to fetch the challenge
+    // Note: The challenge is in the response's clientDataJSON
+    // We need to extract it and verify against what we stored
+    const clientDataJSON = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64').toString());
+    const expectedChallenge = clientDataJSON.challenge;
+    // Verify the registration response
+    const verification = await verifyRegistrationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin: getOrigin(),
+        expectedRPID: getRpId(),
+        requireUserVerification: false,
+    });
+    if (!verification.verified || !verification.registrationInfo) {
+        throw new Error('Registration verification failed');
+    }
+    const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+    // Store the new passkey via authz
+    const passkey = await authzRegisterPasskey({
+        userId,
+        credentialId: bufferToBase64Url(credential.id),
+        credentialPublicKey: bufferToBase64Url(credential.publicKey),
+        counter: credential.counter,
+        deviceType: credentialDeviceType,
+        backedUp: credentialBackedUp,
+        transports: response.response.transports || [],
+        aaguid: verification.registrationInfo.aaguid,
+        name: deviceName,
+    }, options);
+    return passkey;
+}
+// ============================================================================
+// Authentication (signing in with a passkey)
+// ============================================================================
+/**
+ * Generate authentication options for passkey login
+ *
+ * Note: We don't look up user by email here because:
+ * 1. During login, we don't have an access token yet
+ * 2. Modern browsers support "discoverable credentials" which auto-select the right passkey
+ * 3. Allowing any passkey is actually the correct UX for passkey authentication
+ */
+export async function generatePasskeyAuthenticationOptions(_email) {
+    const options = getAuthzOptions();
+    // We don't restrict to specific credentials - the browser will show
+    // all available passkeys for this RP (discoverable credentials)
+    // This is the correct behavior for passkey authentication
+    const authOptions = await generateAuthenticationOptions({
+        rpID: getRpId(),
+        timeout: 300000,
+        userVerification: 'preferred',
+        // undefined means allow any passkey (discoverable credential)
+        allowCredentials: undefined,
+    });
+    // Store challenge for verification via authz (userId is null because we don't know the user yet)
+    await createPasskeyChallenge('authentication', undefined, options);
+    return authOptions;
+}
+/**
+ * Verify an authentication response and return the user and session
+ */
+export async function verifyPasskeyAuthentication(response) {
+    const options = getAuthzOptions();
+    // Extract the challenge from the response first (needed for verification)
+    const clientDataJSON = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64').toString());
+    const expectedChallenge = clientDataJSON.challenge;
+    // Find the passkey by credential ID via authz
+    // The credential ID should match what was stored during registration
+    // During registration, we store: bufferToBase64Url(credential.id)
+    // During authentication, response.id and response.rawId should both be Base64URL-encoded
+    // Use rawId if available, otherwise fall back to id
+    const credentialId = response.rawId || response.id;
+    if (!credentialId) {
+        throw new Error('Missing credential ID in authentication response');
+    }
+    // Log for debugging
+    console.log('[PASSKEY] Authentication response credential IDs:', {
+        id: response.id,
+        rawId: response.rawId,
+        using: credentialId,
+        id_length: response.id?.length,
+        rawId_length: response.rawId?.length,
+    });
+    // Get passkey details from authz via HTTP call
+    // Zero Trust: This is a public endpoint during authentication - no auth needed
+    const authzUrl = getAuthzBaseUrl();
+    // Credential ID is already Base64URL-encoded, but we need to URL-encode it for the path
+    const encodedCredentialId = encodeURIComponent(credentialId);
+    console.log('[PASSKEY] Looking up passkey with credential ID:', credentialId.substring(0, 30) + '...');
+    const passkeyResponse = await fetch(`${authzUrl}/auth/passkeys/by-credential/${encodedCredentialId}`);
+    if (!passkeyResponse.ok) {
+        const errorText = await passkeyResponse.text().catch(() => 'Unknown error');
+        console.error(`[PASSKEY] Failed to get passkey by credential ID: ${passkeyResponse.status} - ${errorText}`);
+        console.error(`[PASSKEY] Credential ID: ${credentialId.substring(0, 20)}...`);
+        throw new Error('Passkey not found');
+    }
+    const passkeyData = await passkeyResponse.json();
+    // Validate that user_id exists in the response
+    if (!passkeyData.user_id) {
+        console.error('[PASSKEY] Passkey lookup response missing user_id:', passkeyData);
+        throw new Error('Passkey lookup returned invalid data: missing user_id');
+    }
+    const passkey = passkeyData;
+    // Log the passkey data for debugging
+    console.log('[PASSKEY] Passkey lookup result:', {
+        passkey_id: passkey.passkey_id,
+        user_id: passkey.user_id,
+        user_id_type: typeof passkey.user_id,
+        credential_id: passkey.credential_id?.substring(0, 20) + '...',
+    });
+    // Verify the authentication response
+    const verification = await verifyAuthenticationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin: getOrigin(),
+        expectedRPID: getRpId(),
+        credential: {
+            id: passkey.credential_id,
+            publicKey: base64UrlToBuffer(passkey.credential_public_key),
+            counter: passkey.counter,
+            transports: (passkey.transports || []),
+        },
+        requireUserVerification: false,
+    });
+    if (!verification.verified) {
+        throw new Error('Authentication verification failed');
+    }
+    // Authenticate with authz - this updates the counter, creates a session, and returns user info
+    // This is a public endpoint - no access token needed (the passkey signature is the proof)
+    const authResult = await authzAuthenticateWithPasskey(credentialId, verification.authenticationInfo.newCounter, options);
+    if (!authResult) {
+        throw new Error('Passkey authentication failed - counter replay or invalid passkey');
+    }
+    // The authResult already has the user info - no need to call getUser separately
+    // Get user ID - authz API may return 'id' or 'user_id' depending on endpoint
+    const authUser = authResult.user;
+    const resolvedUserId = authUser.id || authUser.user_id;
+    if (!resolvedUserId) {
+        throw new Error('Passkey authentication failed - no user ID in response');
+    }
+    // Map the roles to include required fields (authz returns minimal role info)
+    const user = {
+        id: resolvedUserId,
+        email: authResult.user.email,
+        status: authResult.user.status,
+        roles: authResult.user.roles.map(r => ({
+            id: r.id,
+            name: r.name,
+            created_at: '', // Not returned by auth endpoint
+            updated_at: '', // Not returned by auth endpoint
+        })),
+        created_at: '', // Not returned by auth endpoint
+        updated_at: '', // Not returned by auth endpoint
+    };
+    // Extract session info from authResult
+    const session = {
+        token: authResult.session.token,
+        expires_at: authResult.session.expires_at,
+    };
+    console.log('[PASSKEY] Authentication successful:', {
+        user_id: user.id,
+        email: user.email,
+        roles: user.roles?.map(r => r.name),
+        session_token_length: session.token?.length,
+    });
+    return { passkey, user, session };
+}
+// ============================================================================
+// Passkey Management
+// ============================================================================
+/**
+ * Get all passkeys for a user
+ * @param userId - User ID
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export async function getUserPasskeys(userId, sessionJwt) {
+    const options = {
+        ...getAuthzOptions(),
+        ...(sessionJwt && { accessToken: sessionJwt }),
+    };
+    return authzListUserPasskeys(userId, options);
+}
+/**
+ * Delete a passkey
+ * @param userId - User ID (for ownership verification)
+ * @param passkeyId - Passkey ID to delete
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export async function deletePasskey(userId, passkeyId, sessionJwt) {
+    const options = {
+        ...getAuthzOptions(),
+        ...(sessionJwt && { accessToken: sessionJwt }),
+    };
+    // First verify the passkey belongs to this user
+    const passkeys = await authzListUserPasskeys(userId, options);
+    const passkey = passkeys.find(p => p.passkey_id === passkeyId);
+    if (!passkey) {
+        throw new Error('Passkey not found');
+    }
+    await authzDeletePasskey(passkeyId, options);
+    return passkey;
+}
+/**
+ * Rename a passkey
+ * @param userId - User ID (for ownership verification)
+ * @param passkeyId - Passkey ID to rename
+ * @param newName - New name for the passkey
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export async function renamePasskey(userId, passkeyId, newName, sessionJwt) {
+    const options = {
+        ...getAuthzOptions(),
+        ...(sessionJwt && { accessToken: sessionJwt }),
+    };
+    // First verify the passkey belongs to this user
+    const passkeys = await authzListUserPasskeys(userId, options);
+    const passkey = passkeys.find(p => p.passkey_id === passkeyId);
+    if (!passkey) {
+        throw new Error('Passkey not found');
+    }
+    // Update the passkey name via authz
+    const authzUrl = getAuthzBaseUrl();
+    const headers = {
+        'Content-Type': 'application/json',
+    };
+    if (sessionJwt) {
+        headers['Authorization'] = `Bearer ${sessionJwt}`;
+    }
+    const response = await fetch(`${authzUrl}/auth/passkeys/${passkeyId}`, {
+        method: 'PATCH',
+        headers,
+        body: JSON.stringify({ name: newName }),
+    });
+    if (!response.ok) {
+        throw new Error('Failed to rename passkey');
+    }
+    return response.json();
+}
+/**
+ * Check if user has any passkeys
+ * @param userId - User ID
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export async function userHasPasskeys(userId, sessionJwt) {
+    const options = {
+        ...getAuthzOptions(),
+        ...(sessionJwt && { accessToken: sessionJwt }),
+    };
+    const passkeys = await authzListUserPasskeys(userId, options);
+    return passkeys.length > 0;
+}
+// ============================================================================
+// Utility Functions
+// ============================================================================
+function bufferToBase64Url(input) {
+    const buffer = typeof input === 'string' ? base64UrlToBuffer(input) : input;
+    return Buffer.from(buffer).toString('base64url');
+}
+function base64UrlToBuffer(base64url) {
+    return new Uint8Array(Buffer.from(base64url, 'base64url'));
+}
+// ============================================================================
+// Challenge Cleanup (should be run periodically)
+// ============================================================================
+export async function cleanupExpiredChallenges() {
+    const options = getAuthzOptions();
+    // Call the authz cleanup endpoint
+    // Zero Trust: This is a maintenance endpoint - should be called with service account JWT
+    const authzUrl = getAuthzBaseUrl();
+    const response = await fetch(`${authzUrl}/auth/cleanup`, {
+        method: 'POST',
+    });
+    if (!response.ok) {
+        throw new Error('Failed to cleanup expired challenges');
+    }
+    const result = await response.json();
+    return result.passkeyChallengesDeleted || 0;
+}
+//# sourceMappingURL=passkey.js.map

package/dist/lib/next/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../../src/lib/next/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,sBAAsB,EACtB,eAAe,IAAI,oBAAoB,EACvC,gBAAgB,IAAI,qBAAqB,EACzC,aAAa,IAAI,kBAAkB,EACnC,uBAAuB,IAAI,4BAA4B,GAExD,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,eAAe,EAA4B,MAAM,gBAAgB,CAAC;AAE5F,mCAAmC;AACnC,wFAAwF;AACxF,uEAAuE;AACvE,8FAA8F;AAC9F,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;AAE1G,MAAM,OAAO,GAAG,GAAG,EAAE;IACnB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,gBAAgB,CAAC;AAEjE,MAAM,SAAS,GAAG,GAAG,EAAE;IACrB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,sCAAsC;AACtC,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,MAAc,EAAE,SAAiB,EAAE,UAAkB;IAC5G,4EAA4E;IAC5E,wFAAwF;IACxF,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,eAAe,EAAE;QAC3B,WAAW,EAAE,UAAU,EAAG,qCAAqC;KAChE,CAAC;IAEF,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEtE,MAAM,kBAAkB,GACtB,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjC,EAAE,EAAE,OAAO,CAAC,aAAa;QACzB,IAAI,EAAE,YAAY;QAClB,UAAU,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAmC;KACzE,CAAC,CAAC,CAAC;IAEN,MAAM,mBAAmB,GAAG,MAAM,2BAA2B,CAAC;QAC5D,MAAM,EAAE,SAAS,EAAE;QACnB,IAAI,EAAE,OAAO,EAAE;QACf,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,QAAQ,EAAE,SAAS;QACnB,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxC,0BAA0B;QAC1B,OAAO,EAAE,MAAM;QACf,oEAAoE;QACpE,sBAAsB,EAAE;YACtB,uBAAuB,EAAE,UAAU;YACnC,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;SAC9B;QACD,4CAA4C;QAC5C,kBAAkB;QAClB,sCAAsC;QACtC,eAAe,EAAE,MAAM;KACxB,CAAC,CAAC;IAEH,6CAA6C;IAC7C,MAAM,sBAAsB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,QAAkC,EAClC,UAAkB,EAClB,UAAkB;IAElB,4EAA4E;IAC5E,wFAAwF;IACxF,MAAM,OAAO,GAAG;QACd,QAAQ,EAAE,eAAe,EAAE;QAC3B,WAAW,EAAE,UAAU,EAAG,qCAAqC;KAChE,CAAC;IAEF,yEAAyE;IACzE,gEAAgE;IAChE,6DAA6D;IAC7D,8EAA8E;IAE9E,0DAA0D;IAC1D,0DAA0D;IAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACnE,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC;IAEnD,mCAAmC;IACnC,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;QACpD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,SAAS,EAAE;QAC3B,YAAY,EAAE,OAAO,EAAE;QACvB,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;IAE/F,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,MAAM;QACN,YAAY,EAAE,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9C,mBAAmB,EAAE,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC5D,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,oBAAoB;QAChC,QAAQ,EAAE,kBAAkB;QAC5B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;QAC9C,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;QAC5C,IAAI,EAAE,UAAU;KACjB,EAAE,OAAO,CAAC,CAAC;IAEZ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,MAAe;IACxE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,oEAAoE;IACpE,gEAAgE;IAChE,0DAA0D;IAE1D,MAAM,WAAW,GAAG,MAAM,6BAA6B,CAAC;QACtD,IAAI,EAAE,OAAO,EAAE;QACf,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,WAAW;QAC7B,8DAA8D;QAC9D,gBAAgB,EAAE,SAAS;KAC5B,CAAC,CAAC;IAEH,iGAAiG;IACjG,MAAM,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEnE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,QAAoC;IAKpF,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,0EAA0E;IAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACnE,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,CAAC;IAEnD,8CAA8C;IAC9C,qEAAqE;IACrE,kEAAkE;IAClE,yFAAyF;IACzF,oDAAoD;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;IAEnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,GAAG,CAAC,mDAAmD,EAAE;QAC/D,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM;QAC9B,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;KACrC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,wFAAwF;IACxF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;IACvG,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,gCAAgC,mBAAmB,EAAE,CAAC,CAAC;IAEtG,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QAC5E,OAAO,CAAC,KAAK,CAAC,qDAAqD,eAAe,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,KAAK,CAAC,4BAA4B,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC;IAEjD,+CAA+C;IAC/C,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,WAIf,CAAC;IAEF,qCAAqC;IACrC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,OAAO,CAAC,OAAO;QACpC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;KAC/D,CAAC,CAAC;IAEH,qCAAqC;IACrC,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,SAAS,EAAE;QAC3B,YAAY,EAAE,OAAO,EAAE;QACvB,UAAU,EAAE;YACV,EAAE,EAAE,OAAO,CAAC,aAAa;YACzB,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,qBAAqB,CAAQ;YAClE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAmC;SACzE;QACD,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,YAAY,EACZ,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAC1C,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,gFAAgF;IAChF,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAoH,CAAC;IACjJ,MAAM,cAAc,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;IAEvD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,6EAA6E;IAC7E,MAAM,IAAI,GAAc;QACtB,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK;QAC5B,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAA8C;QACtE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,EAAE,EAAE,gCAAgC;YAChD,UAAU,EAAE,EAAE,EAAE,gCAAgC;SACjD,CAAC,CAAC;QACH,UAAU,EAAE,EAAE,EAAE,gCAAgC;QAChD,UAAU,EAAE,EAAE,EAAE,gCAAgC;KACjD,CAAC;IAEF,uCAAuC;IACvC,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;QAC/B,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU;KAC1C,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE;QAClD,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,oBAAoB,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM;KAC5C,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,UAAmB;IACvE,MAAM,OAAO,GAAG;QACd,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAC/C,CAAC;IACF,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,UAAmB;IACxF,MAAM,OAAO,GAAG;QACd,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAC/C,CAAC;IAEF,gDAAgD;IAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe,EAAE,UAAmB;IACzG,MAAM,OAAO,GAAG;QACd,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAC/C,CAAC;IAEF,gDAAgD;IAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,UAAU,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,kBAAkB,SAAS,EAAE,EAAE;QACrE,MAAM,EAAE,OAAO;QACf,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACxC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAsB,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,UAAmB;IACvE,MAAM,OAAO,GAAG;QACd,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,UAAU,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;KAC/C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,KAA0B;IACnD,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,iDAAiD;AACjD,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,kCAAkC;IAClC,yFAAyF;IACzF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,eAAe,EAAE;QACvD,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,MAAM,CAAC,wBAAwB,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/lib/next/service-client.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Service client helpers for calling downstream Busibox services.
+ *
+ * Provides utilities for:
+ * - Obtaining authz-issued access tokens for specific services (Zero Trust)
+ * - Making authenticated requests to data-api, search-api, agent-api
+ * - Handling token caching and refresh
+ *
+ * Zero Trust Architecture:
+ * - Requires session JWT for token exchange (cryptographic proof of identity)
+ * - NO client credentials required for user operations
+ */
+export type ServiceName = 'data-api' | 'search-api' | 'agent-api';
+export type ServiceClientOptions = {
+    /** Session JWT from authz (required for Zero Trust) */
+    sessionJwt: string;
+    /** User ID */
+    userId: string;
+    /** Target service */
+    service: ServiceName;
+    /** OAuth2 scopes (optional) */
+    scopes?: string[];
+    /** Purpose label for audit/debug (optional) */
+    purpose?: string;
+};
+/**
+ * Get the base URL for a service from environment variables.
+ */
+export declare function getServiceBaseUrl(service: ServiceName): string;
+/**
+ * Get default scopes for a service.
+ *
+ * Note: Currently returns empty arrays because scopes are not enforced
+ * by the downstream services. Authorization is handled via RBAC and
+ * audience-bound tokens.
+ */
+export declare function getDefaultScopes(service: ServiceName): string[];
+/**
+ * Create authenticated headers for calling a downstream service.
+ *
+ * This obtains an authz-issued access token and returns headers
+ * suitable for fetch() calls.
+ *
+ * @example
+ * ```typescript
+ * const headers = await createServiceHeaders({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   scopes: ['read'],
+ * });
+ *
+ * const response = await fetch(`${getServiceBaseUrl('search-api')}/search`, {
+ *   method: 'POST',
+ *   headers,
+ *   body: JSON.stringify({ query: 'example' }),
+ * });
+ * ```
+ */
+export declare function createServiceHeaders(options: ServiceClientOptions): Promise<Record<string, string>>;
+/**
+ * Make an authenticated request to a downstream service.
+ *
+ * This is a convenience wrapper around fetch() that:
+ * - Obtains an authz-issued access token
+ * - Constructs the full URL
+ * - Sets appropriate headers
+ * - Returns the response
+ *
+ * @example
+ * ```typescript
+ * const response = await callService({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   path: '/search',
+ *   method: 'POST',
+ *   body: { query: 'example' },
+ * });
+ *
+ * if (!response.ok) {
+ *   throw new Error(`Search failed: ${response.statusText}`);
+ * }
+ *
+ * const data = await response.json();
+ * ```
+ */
+export declare function callService(options: ServiceClientOptions & {
+    path: string;
+    method?: string;
+    body?: unknown;
+    extraHeaders?: Record<string, string>;
+}): Promise<Response>;
+/**
+ * Legacy compatibility: create headers with X-User-Id.
+ *
+ * @deprecated Use createServiceHeaders() instead. This is only for
+ * gradual migration of existing routes.
+ */
+export declare function createLegacyHeaders(userId: string): Record<string, string>;
+//# sourceMappingURL=service-client.d.ts.map

package/dist/lib/next/service-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.d.ts","sourceRoot":"","sources":["../../../src/lib/next/service-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAAG;IACjC,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAkB9D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,EAAE,CAI/D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBzG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACA,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1E"}