@memberjunction/server 5.38.0 → 5.40.0

package/dist/config.d.ts

@@ -487,6 +487,32 @@ declare const cacheSettingsSchema: z.ZodObject<{
     evictionSweepIntervalSeconds?: number;
     verboseLogging?: boolean;
 }>;
+declare const loggingSettingsSchema: z.ZodObject<{
+    graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /**
+         * When true, emit a redacted variables block per root resolver call via the
+         * type-graphql global middleware. Default: false in all environments regardless
+         * of NODE_ENV. Env override: `MJ_LOG_GRAPHQL_VARIABLES`.
+         *
+         * SECURITY: this is an opt-in verbose-echo path for developers debugging locally.
+         * The always-on request log line in `context.ts` does NOT emit variables — that
+         * is the load-bearing leak fix. This flag is additive on top of the always-on log.
+         */
+        logVariables: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    }, "strip", z.ZodTypeAny, {
+        logVariables?: boolean;
+    }, {
+        logVariables?: boolean;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    graphql?: {
+        logVariables?: boolean;
+    };
+}, {
+    graphql?: {
+        logVariables?: boolean;
+    };
+}>;
 declare const feedbackGithubSettingsSchema: z.ZodObject<{
     owner: z.ZodOptional<z.ZodString>;
     repo: z.ZodOptional<z.ZodString>;
@@ -556,6 +582,181 @@ declare const feedbackSettingsSchema: z.ZodObject<{
         assignees?: string[];
     };
 }>;
+declare const magicLinkSchema: z.ZodObject<{
+    /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * PEM-encoded RS256 private key used to sign session JWTs. May be raw PEM or
+     * base64-encoded PEM. If omitted, an ephemeral keypair is generated at startup
+     * (dev only — restarting the server invalidates all outstanding sessions).
+     */
+    rsaPrivateKey: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Hours an unredeemed invite link remains valid (hard expiry). Default 72. */
+    defaultExpiresInHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Hours the minted session JWT remains valid after redemption. No refresh tokens. Default 8. */
+    sessionTokenTtlHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Name of the restricted Role assigned to redeeming users when an invite does not specify one. */
+    restrictedRoleName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * Role names (besides Owner) whose members may issue invites via POST /create.
+     * Empty (default) means Owner-only — the secure default. The restricted role
+     * must never be listed here, or external users could mint their own invites.
+     */
+    inviteIssuerRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Role names an invite may grant, IN ADDITION to restrictedRoleName (which is
+     * always allowed). A caller-supplied roleId is rejected unless its role name is
+     * the restricted role or appears here. This is the guard that stops a caller
+     * from attaching a privileged role (e.g. Owner) to an external magic-link user.
+     */
+    grantableRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+    contextUserForProvisioning: z.ZodOptional<z.ZodString>;
+    /**
+     * Guard against bolting an external magic-link role/app onto an EXISTING account
+     * that is an Owner or already holds non-restricted ("real") roles. One mistyped
+     * recipient email is all it takes to hand a colleague an external role otherwise.
+     * `block` (default) refuses to provision onto such accounts; `warn` logs loudly
+     * and proceeds. Provisioning onto brand-new or already-external accounts is never
+     * affected.
+     */
+    provisioningGuard: z.ZodDefault<z.ZodOptional<z.ZodEnum<["block", "warn"]>>>;
+    /** CommunicationEngine provider name used to deliver invite emails (e.g. 'SendGrid', 'Microsoft Graph'). When unset, emails are not sent and the redemption link is returned to the caller instead. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address for invite emails. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /** Audience claim for minted JWTs and the auto-registered magic-link auth provider. */
+    audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Rate-limit window (ms) for the public /redeem and authenticated /create endpoints. Default 60s. */
+    rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Max /redeem attempts per IP per window. Default 20. */
+    redeemRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Max /create requests per IP per window. Default 30. */
+    createRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Base URL of the Explorer instance that redeems land in. When set, GET
+     * /magic-link/redeem 302-redirects the browser to `${explorerUrl}/#token=<jwt>`
+     * (Explorer's magic-link auth provider reads the fragment). When unset, redeem
+     * returns the token as JSON. Append `?format=json` to force JSON regardless.
+     */
+    explorerUrl: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * PEM-encoded RS256 private key used to sign session JWTs. May be raw PEM or
+     * base64-encoded PEM. If omitted, an ephemeral keypair is generated at startup
+     * (dev only — restarting the server invalidates all outstanding sessions).
+     */
+    rsaPrivateKey: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Hours an unredeemed invite link remains valid (hard expiry). Default 72. */
+    defaultExpiresInHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Hours the minted session JWT remains valid after redemption. No refresh tokens. Default 8. */
+    sessionTokenTtlHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Name of the restricted Role assigned to redeeming users when an invite does not specify one. */
+    restrictedRoleName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * Role names (besides Owner) whose members may issue invites via POST /create.
+     * Empty (default) means Owner-only — the secure default. The restricted role
+     * must never be listed here, or external users could mint their own invites.
+     */
+    inviteIssuerRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Role names an invite may grant, IN ADDITION to restrictedRoleName (which is
+     * always allowed). A caller-supplied roleId is rejected unless its role name is
+     * the restricted role or appears here. This is the guard that stops a caller
+     * from attaching a privileged role (e.g. Owner) to an external magic-link user.
+     */
+    grantableRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+    contextUserForProvisioning: z.ZodOptional<z.ZodString>;
+    /**
+     * Guard against bolting an external magic-link role/app onto an EXISTING account
+     * that is an Owner or already holds non-restricted ("real") roles. One mistyped
+     * recipient email is all it takes to hand a colleague an external role otherwise.
+     * `block` (default) refuses to provision onto such accounts; `warn` logs loudly
+     * and proceeds. Provisioning onto brand-new or already-external accounts is never
+     * affected.
+     */
+    provisioningGuard: z.ZodDefault<z.ZodOptional<z.ZodEnum<["block", "warn"]>>>;
+    /** CommunicationEngine provider name used to deliver invite emails (e.g. 'SendGrid', 'Microsoft Graph'). When unset, emails are not sent and the redemption link is returned to the caller instead. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address for invite emails. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /** Audience claim for minted JWTs and the auto-registered magic-link auth provider. */
+    audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Rate-limit window (ms) for the public /redeem and authenticated /create endpoints. Default 60s. */
+    rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Max /redeem attempts per IP per window. Default 20. */
+    redeemRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Max /create requests per IP per window. Default 30. */
+    createRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Base URL of the Explorer instance that redeems land in. When set, GET
+     * /magic-link/redeem 302-redirects the browser to `${explorerUrl}/#token=<jwt>`
+     * (Explorer's magic-link auth provider reads the fragment). When unset, redeem
+     * returns the token as JSON. Append `?format=json` to force JSON regardless.
+     */
+    explorerUrl: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
+    enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+    /**
+     * PEM-encoded RS256 private key used to sign session JWTs. May be raw PEM or
+     * base64-encoded PEM. If omitted, an ephemeral keypair is generated at startup
+     * (dev only — restarting the server invalidates all outstanding sessions).
+     */
+    rsaPrivateKey: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Hours an unredeemed invite link remains valid (hard expiry). Default 72. */
+    defaultExpiresInHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Hours the minted session JWT remains valid after redemption. No refresh tokens. Default 8. */
+    sessionTokenTtlHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Name of the restricted Role assigned to redeeming users when an invite does not specify one. */
+    restrictedRoleName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /**
+     * Role names (besides Owner) whose members may issue invites via POST /create.
+     * Empty (default) means Owner-only — the secure default. The restricted role
+     * must never be listed here, or external users could mint their own invites.
+     */
+    inviteIssuerRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /**
+     * Role names an invite may grant, IN ADDITION to restrictedRoleName (which is
+     * always allowed). A caller-supplied roleId is rejected unless its role name is
+     * the restricted role or appears here. This is the guard that stops a caller
+     * from attaching a privileged role (e.g. Owner) to an external magic-link user.
+     */
+    grantableRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+    contextUserForProvisioning: z.ZodOptional<z.ZodString>;
+    /**
+     * Guard against bolting an external magic-link role/app onto an EXISTING account
+     * that is an Owner or already holds non-restricted ("real") roles. One mistyped
+     * recipient email is all it takes to hand a colleague an external role otherwise.
+     * `block` (default) refuses to provision onto such accounts; `warn` logs loudly
+     * and proceeds. Provisioning onto brand-new or already-external accounts is never
+     * affected.
+     */
+    provisioningGuard: z.ZodDefault<z.ZodOptional<z.ZodEnum<["block", "warn"]>>>;
+    /** CommunicationEngine provider name used to deliver invite emails (e.g. 'SendGrid', 'Microsoft Graph'). When unset, emails are not sent and the redemption link is returned to the caller instead. */
+    communicationProvider: z.ZodOptional<z.ZodString>;
+    /** From address for invite emails. */
+    fromAddress: z.ZodOptional<z.ZodString>;
+    /** Audience claim for minted JWTs and the auto-registered magic-link auth provider. */
+    audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** Rate-limit window (ms) for the public /redeem and authenticated /create endpoints. Default 60s. */
+    rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Max /redeem attempts per IP per window. Default 20. */
+    redeemRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Max /create requests per IP per window. Default 30. */
+    createRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /**
+     * Base URL of the Explorer instance that redeems land in. When set, GET
+     * /magic-link/redeem 302-redirects the browser to `${explorerUrl}/#token=<jwt>`
+     * (Explorer's magic-link auth provider reads the fragment). When unset, redeem
+     * returns the token as JSON. Append `?format=json` to force JSON regardless.
+     */
+    explorerUrl: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
 declare const configInfoSchema: z.ZodObject<{
     userHandling: z.ZodObject<{
         autoCreateNewUsers: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -588,6 +789,181 @@ declare const configInfoSchema: z.ZodObject<{
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
     }>;
+    magicLink: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * PEM-encoded RS256 private key used to sign session JWTs. May be raw PEM or
+         * base64-encoded PEM. If omitted, an ephemeral keypair is generated at startup
+         * (dev only — restarting the server invalidates all outstanding sessions).
+         */
+        rsaPrivateKey: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Hours an unredeemed invite link remains valid (hard expiry). Default 72. */
+        defaultExpiresInHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Hours the minted session JWT remains valid after redemption. No refresh tokens. Default 8. */
+        sessionTokenTtlHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Name of the restricted Role assigned to redeeming users when an invite does not specify one. */
+        restrictedRoleName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * Role names (besides Owner) whose members may issue invites via POST /create.
+         * Empty (default) means Owner-only — the secure default. The restricted role
+         * must never be listed here, or external users could mint their own invites.
+         */
+        inviteIssuerRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Role names an invite may grant, IN ADDITION to restrictedRoleName (which is
+         * always allowed). A caller-supplied roleId is rejected unless its role name is
+         * the restricted role or appears here. This is the guard that stops a caller
+         * from attaching a privileged role (e.g. Owner) to an external magic-link user.
+         */
+        grantableRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+        contextUserForProvisioning: z.ZodOptional<z.ZodString>;
+        /**
+         * Guard against bolting an external magic-link role/app onto an EXISTING account
+         * that is an Owner or already holds non-restricted ("real") roles. One mistyped
+         * recipient email is all it takes to hand a colleague an external role otherwise.
+         * `block` (default) refuses to provision onto such accounts; `warn` logs loudly
+         * and proceeds. Provisioning onto brand-new or already-external accounts is never
+         * affected.
+         */
+        provisioningGuard: z.ZodDefault<z.ZodOptional<z.ZodEnum<["block", "warn"]>>>;
+        /** CommunicationEngine provider name used to deliver invite emails (e.g. 'SendGrid', 'Microsoft Graph'). When unset, emails are not sent and the redemption link is returned to the caller instead. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address for invite emails. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /** Audience claim for minted JWTs and the auto-registered magic-link auth provider. */
+        audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Rate-limit window (ms) for the public /redeem and authenticated /create endpoints. Default 60s. */
+        rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Max /redeem attempts per IP per window. Default 20. */
+        redeemRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Max /create requests per IP per window. Default 30. */
+        createRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Base URL of the Explorer instance that redeems land in. When set, GET
+         * /magic-link/redeem 302-redirects the browser to `${explorerUrl}/#token=<jwt>`
+         * (Explorer's magic-link auth provider reads the fragment). When unset, redeem
+         * returns the token as JSON. Append `?format=json` to force JSON regardless.
+         */
+        explorerUrl: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * PEM-encoded RS256 private key used to sign session JWTs. May be raw PEM or
+         * base64-encoded PEM. If omitted, an ephemeral keypair is generated at startup
+         * (dev only — restarting the server invalidates all outstanding sessions).
+         */
+        rsaPrivateKey: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Hours an unredeemed invite link remains valid (hard expiry). Default 72. */
+        defaultExpiresInHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Hours the minted session JWT remains valid after redemption. No refresh tokens. Default 8. */
+        sessionTokenTtlHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Name of the restricted Role assigned to redeeming users when an invite does not specify one. */
+        restrictedRoleName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * Role names (besides Owner) whose members may issue invites via POST /create.
+         * Empty (default) means Owner-only — the secure default. The restricted role
+         * must never be listed here, or external users could mint their own invites.
+         */
+        inviteIssuerRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Role names an invite may grant, IN ADDITION to restrictedRoleName (which is
+         * always allowed). A caller-supplied roleId is rejected unless its role name is
+         * the restricted role or appears here. This is the guard that stops a caller
+         * from attaching a privileged role (e.g. Owner) to an external magic-link user.
+         */
+        grantableRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+        contextUserForProvisioning: z.ZodOptional<z.ZodString>;
+        /**
+         * Guard against bolting an external magic-link role/app onto an EXISTING account
+         * that is an Owner or already holds non-restricted ("real") roles. One mistyped
+         * recipient email is all it takes to hand a colleague an external role otherwise.
+         * `block` (default) refuses to provision onto such accounts; `warn` logs loudly
+         * and proceeds. Provisioning onto brand-new or already-external accounts is never
+         * affected.
+         */
+        provisioningGuard: z.ZodDefault<z.ZodOptional<z.ZodEnum<["block", "warn"]>>>;
+        /** CommunicationEngine provider name used to deliver invite emails (e.g. 'SendGrid', 'Microsoft Graph'). When unset, emails are not sent and the redemption link is returned to the caller instead. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address for invite emails. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /** Audience claim for minted JWTs and the auto-registered magic-link auth provider. */
+        audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Rate-limit window (ms) for the public /redeem and authenticated /create endpoints. Default 60s. */
+        rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Max /redeem attempts per IP per window. Default 20. */
+        redeemRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Max /create requests per IP per window. Default 30. */
+        createRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Base URL of the Explorer instance that redeems land in. When set, GET
+         * /magic-link/redeem 302-redirects the browser to `${explorerUrl}/#token=<jwt>`
+         * (Explorer's magic-link auth provider reads the fragment). When unset, redeem
+         * returns the token as JSON. Append `?format=json` to force JSON regardless.
+         */
+        explorerUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Master switch for the magic-link feature. When false, routes are not mounted and the auth provider is not registered. */
+        enabled: z.ZodDefault<z.ZodEffects<z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodBoolean, z.ZodString, z.ZodNumber]>>>, boolean, string | number | boolean>>;
+        /**
+         * PEM-encoded RS256 private key used to sign session JWTs. May be raw PEM or
+         * base64-encoded PEM. If omitted, an ephemeral keypair is generated at startup
+         * (dev only — restarting the server invalidates all outstanding sessions).
+         */
+        rsaPrivateKey: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Hours an unredeemed invite link remains valid (hard expiry). Default 72. */
+        defaultExpiresInHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Hours the minted session JWT remains valid after redemption. No refresh tokens. Default 8. */
+        sessionTokenTtlHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Name of the restricted Role assigned to redeeming users when an invite does not specify one. */
+        restrictedRoleName: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /**
+         * Role names (besides Owner) whose members may issue invites via POST /create.
+         * Empty (default) means Owner-only — the secure default. The restricted role
+         * must never be listed here, or external users could mint their own invites.
+         */
+        inviteIssuerRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /**
+         * Role names an invite may grant, IN ADDITION to restrictedRoleName (which is
+         * always allowed). A caller-supplied roleId is rejected unless its role name is
+         * the restricted role or appears here. This is the guard that stops a caller
+         * from attaching a privileged role (e.g. Owner) to an external magic-link user.
+         */
+        grantableRoleNames: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        /** Email of the internal user whose context provisions magic-link users (falls back to userHandling.contextUserForNewUserCreation). */
+        contextUserForProvisioning: z.ZodOptional<z.ZodString>;
+        /**
+         * Guard against bolting an external magic-link role/app onto an EXISTING account
+         * that is an Owner or already holds non-restricted ("real") roles. One mistyped
+         * recipient email is all it takes to hand a colleague an external role otherwise.
+         * `block` (default) refuses to provision onto such accounts; `warn` logs loudly
+         * and proceeds. Provisioning onto brand-new or already-external accounts is never
+         * affected.
+         */
+        provisioningGuard: z.ZodDefault<z.ZodOptional<z.ZodEnum<["block", "warn"]>>>;
+        /** CommunicationEngine provider name used to deliver invite emails (e.g. 'SendGrid', 'Microsoft Graph'). When unset, emails are not sent and the redemption link is returned to the caller instead. */
+        communicationProvider: z.ZodOptional<z.ZodString>;
+        /** From address for invite emails. */
+        fromAddress: z.ZodOptional<z.ZodString>;
+        /** Audience claim for minted JWTs and the auto-registered magic-link auth provider. */
+        audience: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        /** Rate-limit window (ms) for the public /redeem and authenticated /create endpoints. Default 60s. */
+        rateLimitWindowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Max /redeem attempts per IP per window. Default 20. */
+        redeemRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /** Max /create requests per IP per window. Default 30. */
+        createRateLimitMax: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        /**
+         * Base URL of the Explorer instance that redeems land in. When set, GET
+         * /magic-link/redeem 302-redirects the browser to `${explorerUrl}/#token=<jwt>`
+         * (Explorer's magic-link auth provider reads the fragment). When unset, redeem
+         * returns the token as JSON. Append `?format=json` to force JSON regardless.
+         */
+        explorerUrl: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>>>;
     databaseSettings: z.ZodObject<{
         connectionTimeout: z.ZodNumber;
         requestTimeout: z.ZodNumber;
@@ -1010,6 +1386,32 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
     }>>>;
+    loggingSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+        graphql: z.ZodDefault<z.ZodOptional<z.ZodObject<{
+            /**
+             * When true, emit a redacted variables block per root resolver call via the
+             * type-graphql global middleware. Default: false in all environments regardless
+             * of NODE_ENV. Env override: `MJ_LOG_GRAPHQL_VARIABLES`.
+             *
+             * SECURITY: this is an opt-in verbose-echo path for developers debugging locally.
+             * The always-on request log line in `context.ts` does NOT emit variables — that
+             * is the load-bearing leak fix. This flag is additive on top of the always-on log.
+             */
+            logVariables: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        }, "strip", z.ZodTypeAny, {
+            logVariables?: boolean;
+        }, {
+            logVariables?: boolean;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        graphql?: {
+            logVariables?: boolean;
+        };
+    }, {
+        graphql?: {
+            logVariables?: boolean;
+        };
+    }>>>;
     feedbackSettings: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         /** Org-level kill switch for the in-app feedback feature. Defaults to true (enabled). */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -1093,6 +1495,26 @@ declare const configInfoSchema: z.ZodObject<{
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
     };
+    magicLink?: {
+        enabled?: boolean;
+        audience?: string;
+        rsaPrivateKey?: string;
+        defaultExpiresInHours?: number;
+        sessionTokenTtlHours?: number;
+        restrictedRoleName?: string;
+        inviteIssuerRoleNames?: string[];
+        grantableRoleNames?: string[];
+        contextUserForProvisioning?: string;
+        provisioningGuard?: "block" | "warn";
+        communicationProvider?: string;
+        fromAddress?: string;
+        rateLimitWindowMs?: number;
+        redeemRateLimitMax?: number;
+        createRateLimitMax?: number;
+        explorerUrl?: string;
+    } & {
+        [k: string]: unknown;
+    };
     databaseSettings?: {
         connectionTimeout?: number;
         requestTimeout?: number;
@@ -1223,6 +1645,11 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
     };
+    loggingSettings?: {
+        graphql?: {
+            logVariables?: boolean;
+        };
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {
@@ -1267,6 +1694,26 @@ declare const configInfoSchema: z.ZodObject<{
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
     };
+    magicLink?: {
+        enabled?: string | number | boolean;
+        audience?: string;
+        rsaPrivateKey?: string;
+        defaultExpiresInHours?: number;
+        sessionTokenTtlHours?: number;
+        restrictedRoleName?: string;
+        inviteIssuerRoleNames?: string[];
+        grantableRoleNames?: string[];
+        contextUserForProvisioning?: string;
+        provisioningGuard?: "block" | "warn";
+        communicationProvider?: string;
+        fromAddress?: string;
+        rateLimitWindowMs?: number;
+        redeemRateLimitMax?: number;
+        createRateLimitMax?: number;
+        explorerUrl?: string;
+    } & {
+        [k: string]: unknown;
+    };
     databaseSettings?: {
         connectionTimeout?: number;
         requestTimeout?: number;
@@ -1397,6 +1844,11 @@ declare const configInfoSchema: z.ZodObject<{
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
     };
+    loggingSettings?: {
+        graphql?: {
+            logVariables?: boolean;
+        };
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {
@@ -1428,6 +1880,7 @@ declare const configInfoSchema: z.ZodObject<{
     mjCoreSchema?: string;
 }>;
 export type UserHandlingInfo = z.infer<typeof userHandlingInfoSchema>;
+export type MagicLinkConfig = z.infer<typeof magicLinkSchema>;
 export type DatabaseSettingsInfo = z.infer<typeof databaseSettingsInfoSchema>;
 export type ViewingSystemSettingsInfo = z.infer<typeof viewingSystemInfoSchema>;
 export type RESTApiOptions = z.infer<typeof restApiOptionsSchema>;
@@ -1442,6 +1895,7 @@ export type QueryDialectConfig = z.infer<typeof queryDialectSchema>;
 export type MultiTenancyConfig = z.infer<typeof multiTenancySchema>;
 export type ServerExtensionConfig = z.infer<typeof serverExtensionSchema>;
 export type CacheSettingsConfig = z.infer<typeof cacheSettingsSchema>;
+export type LoggingSettingsConfig = z.infer<typeof loggingSettingsSchema>;
 export type FeedbackGithubSettingsConfig = z.infer<typeof feedbackGithubSettingsSchema>;
 export type FeedbackSettingsConfig = z.infer<typeof feedbackSettingsSchema>;
 export type ConfigInfo = z.infer<typeof configInfoSchema>;
@@ -1481,6 +1935,26 @@ export declare function loadConfig(): {
         CreateUserApplicationRecords?: boolean;
         UserApplications?: string[];
     };
+    magicLink?: {
+        enabled?: boolean;
+        audience?: string;
+        rsaPrivateKey?: string;
+        defaultExpiresInHours?: number;
+        sessionTokenTtlHours?: number;
+        restrictedRoleName?: string;
+        inviteIssuerRoleNames?: string[];
+        grantableRoleNames?: string[];
+        contextUserForProvisioning?: string;
+        provisioningGuard?: "block" | "warn";
+        communicationProvider?: string;
+        fromAddress?: string;
+        rateLimitWindowMs?: number;
+        redeemRateLimitMax?: number;
+        createRateLimitMax?: number;
+        explorerUrl?: string;
+    } & {
+        [k: string]: unknown;
+    };
     databaseSettings?: {
         connectionTimeout?: number;
         requestTimeout?: number;
@@ -1611,6 +2085,11 @@ export declare function loadConfig(): {
         evictionSweepIntervalSeconds?: number;
         verboseLogging?: boolean;
     };
+    loggingSettings?: {
+        graphql?: {
+            logVariables?: boolean;
+        };
+    };
     feedbackSettings?: {
         enabled?: boolean;
         github?: {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU1B,CAAC;AAEH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AAEH,QAAA,MAAM,uBAAuB;;;;;;EAE3B,CAAC;AAEH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;EAMxB,CAAC;AA2BH,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEH,QAAA,MAAM,uBAAuB;;;;IAI3B;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;EAMH,CAAC;AAEH,QAAA,MAAM,gBAAgB;;;;;;QAdpB;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAeH,CAAC;AAEH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAUR,CAAC;AAEjB,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAab,CAAC;AAEjB,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;EAMvB,CAAC;AAEH,QAAA,MAAM,kBAAkB;IACtB,sGAAsG;;IAEtG,sFAAsF;;;;;;;;EAEtF,CAAC;AAEH,QAAA,MAAM,kBAAkB;IACtB,2EAA2E;;IAE3E,uDAAuD;;IAEvD,2DAA2D;;IAE3D,+EAA+E;;IAE/E,gFAAgF;;IAEhF,4EAA4E;;IAE5E,2DAA2D;;IAE3D,sFAAsF;;IAEtF,kDAAkD;;IAElD,mFAAmF;;;;;;;;;;;;;;;;;;;;;;;;EAEnF,CAAC;AAEH,QAAA,MAAM,eAAe;;;;;;;;;EAKnB,CAAC;AAEH,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;gCAKX,CAAC;AAEjB,QAAA,MAAM,mBAAmB;IACvB,4HAA4H;;IAE5H,oHAAoH;;IAEpH,wFAAwF;;IAExF,+FAA+F;;IAE/F,8EAA8E;;;;;;;;;;;;;;EAE9E,CAAC;AAEH,QAAA,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;EAOhC,CAAC;AAEH,QAAA,MAAM,sBAAsB;IAC1B,yFAAyF;;IAEzF,uEAAuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvE,CAAC;AAEH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAnIpB;;;;;;eAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAqDH,sGAAsG;;QAEtG,sFAAsF;;;;;;;;;;QAKtF,2EAA2E;;QAE3E,uDAAuD;;QAEvD,2DAA2D;;QAE3D,+EAA+E;;QAE/E,gFAAgF;;QAEhF,4EAA4E;;QAE5E,2DAA2D;;QAE3D,sFAAsF;;QAEtF,kDAAkD;;QAElD,mFAAmF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmBnF,4HAA4H;;QAE5H,oHAAoH;;QAEpH,wFAAwF;;QAExF,+FAA+F;;QAE/F,8EAA8E;;;;;;;;;;;;;;;;QAc9E,yFAAyF;;QAEzF,uEAAuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkDvE,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAC1E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AACxF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,UAAU,CA6JrD,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,UAAyB,CAAC;AAEnD,eAAO,MACL,UAAU,UACV,UAAU,UACV,MAAM,UACN,UAAU,UACV,MAAM,UACN,wBAAwB,aACxB,cAAc,UACd,WAAW,UACX,gBAAgB,UAChB,iBAAiB,UACjB,4BAA4B,UAC5B,eAAe,UACf,mBAAmB,WACnB,qBAAqB,UACrB,YAAY,0BACZ,MAAM,UACN,OAAO,UACP,SAAS,UACK,cAAc,UAC5B,kBAAkB,UAClB,kBAAkB,UACF,cAAc;;;;;;CAClB,CAAC;AAEf,wBAAgB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBzB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU1B,CAAC;AAEH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AAEH,QAAA,MAAM,uBAAuB;;;;;;EAE3B,CAAC;AAEH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;EAMxB,CAAC;AA2BH,QAAA,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEH,QAAA,MAAM,uBAAuB;;;;IAI3B;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;EAMH,CAAC;AAEH,QAAA,MAAM,gBAAgB;;;;;;QAdpB;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAeH,CAAC;AAEH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAUR,CAAC;AAEjB,QAAA,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAab,CAAC;AAEjB,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;EAMvB,CAAC;AAEH,QAAA,MAAM,kBAAkB;IACtB,sGAAsG;;IAEtG,sFAAsF;;;;;;;;EAEtF,CAAC;AAEH,QAAA,MAAM,kBAAkB;IACtB,2EAA2E;;IAE3E,uDAAuD;;IAEvD,2DAA2D;;IAE3D,+EAA+E;;IAE/E,gFAAgF;;IAEhF,4EAA4E;;IAE5E,2DAA2D;;IAE3D,sFAAsF;;IAEtF,kDAAkD;;IAElD,mFAAmF;;;;;;;;;;;;;;;;;;;;;;;;EAEnF,CAAC;AAEH,QAAA,MAAM,eAAe;;;;;;;;;EAKnB,CAAC;AAEH,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;gCAKX,CAAC;AAEjB,QAAA,MAAM,mBAAmB;IACvB,4HAA4H;;IAE5H,oHAAoH;;IAEpH,wFAAwF;;IAExF,+FAA+F;;IAE/F,8EAA8E;;;;;;;;;;;;;;EAE9E,CAAC;AAEH,QAAA,MAAM,qBAAqB;;QAEvB;;;;;;;;WAQG;;;;;;;;;;;;;;;EAGL,CAAC;AAEH,QAAA,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;EAOhC,CAAC;AAEH,QAAA,MAAM,sBAAsB;IAC1B,yFAAyF;;IAEzF,uEAAuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvE,CAAC;AAEH,QAAA,MAAM,eAAe;IACnB,4HAA4H;;IAE5H;;;;OAIG;;IAEH,+EAA+E;;IAE/E,iGAAiG;;IAEjG,mGAAmG;;IAEnG;;;;OAIG;;IAEH;;;;;OAKG;;IAEH,uIAAuI;;IAEvI;;;;;;;OAOG;;IAEH,uMAAuM;;IAEvM,sCAAsC;;IAEtC,uFAAuF;;IAEvF,sGAAsG;;IAEtG,0DAA0D;;IAE1D,0DAA0D;;IAE1D;;;;;OAKG;;;IAvDH,4HAA4H;;IAE5H;;;;OAIG;;IAEH,+EAA+E;;IAE/E,iGAAiG;;IAEjG,mGAAmG;;IAEnG;;;;OAIG;;IAEH;;;;;OAKG;;IAEH,uIAAuI;;IAEvI;;;;;;;OAOG;;IAEH,uMAAuM;;IAEvM,sCAAsC;;IAEtC,uFAAuF;;IAEvF,sGAAsG;;IAEtG,0DAA0D;;IAE1D,0DAA0D;;IAE1D;;;;;OAKG;;;IAvDH,4HAA4H;;IAE5H;;;;OAIG;;IAEH,+EAA+E;;IAE/E,iGAAiG;;IAEjG,mGAAmG;;IAEnG;;;;OAIG;;IAEH;;;;;OAKG;;IAEH,uIAAuI;;IAEvI;;;;;;;OAOG;;IAEH,uMAAuM;;IAEvM,sCAAsC;;IAEtC,uFAAuF;;IAEvF,sGAAsG;;IAEtG,0DAA0D;;IAE1D,0DAA0D;;IAE1D;;;;;OAKG;;gCAEW,CAAC;AAEjB,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA3DpB,4HAA4H;;QAE5H;;;;WAIG;;QAEH,+EAA+E;;QAE/E,iGAAiG;;QAEjG,mGAAmG;;QAEnG;;;;WAIG;;QAEH;;;;;WAKG;;QAEH,uIAAuI;;QAEvI;;;;;;;WAOG;;QAEH,uMAAuM;;QAEvM,sCAAsC;;QAEtC,uFAAuF;;QAEvF,sGAAsG;;QAEtG,0DAA0D;;QAE1D,0DAA0D;;QAE1D;;;;;WAKG;;;QAvDH,4HAA4H;;QAE5H;;;;WAIG;;QAEH,+EAA+E;;QAE/E,iGAAiG;;QAEjG,mGAAmG;;QAEnG;;;;WAIG;;QAEH;;;;;WAKG;;QAEH,uIAAuI;;QAEvI;;;;;;;WAOG;;QAEH,uMAAuM;;QAEvM,sCAAsC;;QAEtC,uFAAuF;;QAEvF,sGAAsG;;QAEtG,0DAA0D;;QAE1D,0DAA0D;;QAE1D;;;;;WAKG;;;QAvDH,4HAA4H;;QAE5H;;;;WAIG;;QAEH,+EAA+E;;QAE/E,iGAAiG;;QAEjG,mGAAmG;;QAEnG;;;;WAIG;;QAEH;;;;;WAKG;;QAEH,uIAAuI;;QAEvI;;;;;;;WAOG;;QAEH,uMAAuM;;QAEvM,sCAAsC;;QAEtC,uFAAuF;;QAEvF,sGAAsG;;QAEtG,0DAA0D;;QAE1D,0DAA0D;;QAE1D;;;;;WAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA1MH;;;;;;eAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAqDH,sGAAsG;;QAEtG,sFAAsF;;;;;;;;;;QAKtF,2EAA2E;;QAE3E,uDAAuD;;QAEvD,2DAA2D;;QAE3D,+EAA+E;;QAE/E,gFAAgF;;QAEhF,4EAA4E;;QAE5E,2DAA2D;;QAE3D,sFAAsF;;QAEtF,kDAAkD;;QAElD,mFAAmF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmBnF,4HAA4H;;QAE5H,oHAAoH;;QAEpH,wFAAwF;;QAExF,+FAA+F;;QAE/F,8EAA8E;;;;;;;;;;;;;;;;;YAM5E;;;;;;;;eAQG;;;;;;;;;;;;;;;;;QAeL,yFAAyF;;QAEzF,uEAAuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgHvE,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAC1E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AACxF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAuKrD,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,UAAyB,CAAC;AAEnD,eAAO,MACL,UAAU,UACV,UAAU,UACV,MAAM,UACN,UAAU,UACV,MAAM,UACN,wBAAwB,aACxB,cAAc,UACd,WAAW,UACX,gBAAgB,UAChB,iBAAiB,UACjB,4BAA4B,UAC5B,eAAe,UACf,mBAAmB,WACnB,qBAAqB,UACrB,YAAY,0BACZ,MAAM,UACN,OAAO,UACP,SAAS,UACK,cAAc,UAC5B,kBAAkB,UAClB,kBAAkB,UACF,cAAc;;;;;;CAClB,CAAC;AAEf,wBAAgB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBzB"}