@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.3

package/dist/resolvers/UserResolver.js

@@ -10,51 +10,32 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Arg, Ctx, FieldResolver, Int, PubSub, PubSubEngine, Query, Resolver, Root } from '@memberjunction/server';
+import { Arg, Ctx, Field, Int, ObjectType, Query, Resolver } from '@memberjunction/server';
+import { RunView } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import { MJUser_, MJUserRole_, MJUserResolverBase } from '../generated/generated.js';
 import { GetReadOnlyProvider } from '../util.js';
+import { AssertRoleLoadSucceeded, RequireContextUser, RequireLoadedUser, RequireRoleProvider, UserIdExtraFilter, } from './currentUserRoles.js';
+/**
+ * CurrentUser payload. Extends the generated user type with a first-class `Roles`
+ * field — child-array FieldResolvers (`MJUserRoles_UserIDArray`) are no longer
+ * generated. Roles come from the request's `UserInfo` (so magic-link anonymous
+ * sessions keep their synthesized roles) or from a RunView on `MJ: User Roles`.
+ */
+let CurrentUserType = class CurrentUserType extends MJUser_ {
+};
+__decorate([
+    Field(() => [MJUserRole_]),
+    __metadata("design:type", Array)
+], CurrentUserType.prototype, "Roles", void 0);
+CurrentUserType = __decorate([
+    ObjectType()
+], CurrentUserType);
+export { CurrentUserType };
 let UserResolver = class UserResolver extends MJUserResolverBase {
-    /**
-     * Roles for the current user row.
-     *
-     * Overrides the generated field resolver to support ANONYMOUS magic-link sessions: those
-     * resolve to a shared Anonymous principal that holds NO roles in the database (by design —
-     * persisting them would let anonymous sessions accrete privileges across links). The roles
-     * are synthesized per-request in {@link buildMagicLinkSessionUser} and live only on the
-     * request's `UserInfo`. For the session's OWN user row we serve those synthesized roles
-     * directly, skipping the generated DB query (which returns empty) and its `MJ: User Roles`
-     * read-permission check (which the restricted anon role wouldn't pass). Every other case —
-     * named users, named magic-link users, listing other users' roles — falls through to the
-     * generated resolver unchanged, so there is no behavioral or security change off this path.
-     */
-    async MJUserRoles_UserIDArray(mjuser_, context, pubSub) {
-        const sessionUser = context.userPayload?.userRecord;
-        if (sessionUser?.IsMagicLinkAnonymous && UUIDsEqual(mjuser_.ID, sessionUser.ID)) {
-            const now = new Date();
-            // Build rows with the entity's RAW field names, then run them through the same
-            // name→code-name mapping the generated resolver uses (e.g. __mj_CreatedAt →
-            // _mj__CreatedAt). Returning raw names directly trips GraphQL's non-nullable check.
-            const rows = (sessionUser.UserRoles ?? []).map((r) => ({
-                ID: sessionUser.ID,
-                UserID: r.UserID,
-                RoleID: r.RoleID,
-                User: sessionUser.Name,
-                Role: r.RoleName ?? r.Role,
-                __mj_CreatedAt: now,
-                __mj_UpdatedAt: now,
-            }));
-            return this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', rows, sessionUser);
-        }
-        return super.MJUserRoles_UserIDArray(mjuser_, context, pubSub);
-    }
     async CurrentUser(context) {
-        // Check API key scope authorization for user read (self)
         await this.CheckAPIKeyScopeAuthorization('user:read', '*', context.userPayload);
-        // If userRecord is already available (e.g., from API key auth or system auth),
-        // use it directly instead of looking up by email again
         if (context.userPayload.userRecord) {
-            // Convert UserInfo to the GraphQL response format
             const userRecord = context.userPayload.userRecord;
             const userData = {
                 ID: userRecord.ID,
@@ -71,60 +52,78 @@ let UserResolver = class UserResolver extends MJUserResolverBase {
                 LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
                 __mj_CreatedAt: userRecord.__mj_CreatedAt,
                 __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
-                // Include the UserRoles sub-array for the GraphQL response
-                MJUserRoles_UserIDArray: userRecord.UserRoles?.map((r) => ({
-                    ID: r.ID,
-                    UserID: r.UserID,
-                    RoleID: r.RoleID,
-                    User: userRecord.Name,
-                    Role: r.RoleName,
-                    __mj_CreatedAt: r.__mj_CreatedAt,
-                    __mj_UpdatedAt: r.__mj_UpdatedAt,
-                })) || [],
             };
             console.log('CurrentUser (from userRecord)', userData.Email);
-            return this.MapFieldNamesToCodeNames('MJ: Users', userData);
+            const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+            const mapped = await this.MapFieldNamesToCodeNames('MJ: Users', userData, userRecord, provider);
+            return {
+                ...mapped,
+                Roles: await this.mapRolesFromUserInfo(userRecord.UserRoles ?? [], userRecord, userRecord, provider),
+            };
         }
-        // Fall back to email lookup for JWT-based auth
-        const result = await this.UserByEmail(context.userPayload.email, context);
-        console.log('CurrentUser (from email lookup)', result?.Email);
-        return result;
+        const result = RequireLoadedUser(await this.UserByEmail(context.userPayload.email, context), context.userPayload.email);
+        console.log('CurrentUser (from email lookup)', result.Email);
+        return {
+            ...result,
+            Roles: await this.loadRolesForUser(result, context),
+        };
     }
     async UserByID(ID, { providers, userPayload }) {
-        // Check API key scope authorization for user read
         await this.CheckAPIKeyScopeAuthorization('user:read', ID.toString(), userPayload);
         const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
         const retVal = super.safeFirstArrayElement(await this.findBy(provider, 'MJ: Users', { ID }, userPayload.userRecord));
         return this.MapFieldNamesToCodeNames('MJ: Users', retVal);
     }
     async UserByEmployeeID(EmployeeID, { providers, userPayload }) {
-        // Check API key scope authorization for user read
         await this.CheckAPIKeyScopeAuthorization('user:read', EmployeeID.toString(), userPayload);
         const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
         const retVal = super.safeFirstArrayElement(await this.findBy(provider, 'MJ: Users', { EmployeeID }, userPayload.userRecord));
         return this.MapFieldNamesToCodeNames('MJ: Users', retVal);
     }
     async UserByEmail(Email, { providers, userPayload }) {
-        // Check API key scope authorization for user read
         await this.CheckAPIKeyScopeAuthorization('user:read', Email, userPayload);
-        // const searchEmail = userEmailMap[Email] ?? Email;
         const searchEmail = Email;
         const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
         const returnVal = super.safeFirstArrayElement(await this.findBy(provider, 'MJ: Users', { Email: searchEmail }, userPayload.userRecord));
         return this.MapFieldNamesToCodeNames('MJ: Users', returnVal);
     }
+    /**
+     * Magic-link anonymous sessions hold synthesized roles on UserInfo that are
+     * not persisted. Always prefer those when the requested row is the session
+     * user. Everyone else loads `MJ: User Roles` via RunView.
+     */
+    async loadRolesForUser(user, context) {
+        const contextUser = RequireContextUser(this.GetUserFromPayload(context.userPayload));
+        if (contextUser.IsMagicLinkAnonymous && UUIDsEqual(user.ID, contextUser.ID)) {
+            const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
+            return await this.mapRolesFromUserInfo(contextUser.UserRoles ?? [], contextUser, contextUser, provider);
+        }
+        const provider = RequireRoleProvider(GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true }));
+        const rv = RunView.FromMetadataProvider(provider);
+        const result = await rv.RunView({
+            EntityName: 'MJ: User Roles',
+            ExtraFilter: UserIdExtraFilter(user.ID),
+            ResultType: 'simple',
+        }, contextUser);
+        AssertRoleLoadSucceeded(result, user.ID);
+        return await this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', result.Results ?? [], contextUser, provider);
+    }
+    async mapRolesFromUserInfo(roles, user, contextUser, provider) {
+        const now = new Date();
+        const rows = roles.map((r) => ({
+            ID: r.ID ?? user.ID,
+            UserID: r.UserID,
+            RoleID: r.RoleID,
+            User: user.Name,
+            Role: r.RoleName ?? r.Role,
+            __mj_CreatedAt: r.__mj_CreatedAt ?? now,
+            __mj_UpdatedAt: r.__mj_UpdatedAt ?? now,
+        }));
+        return await this.ArrayMapFieldNamesToCodeNames('MJ: User Roles', rows, contextUser, provider);
+    }
 };
 __decorate([
-    FieldResolver(() => [MJUserRole_]),
-    __param(0, Root()),
-    __param(1, Ctx()),
-    __param(2, PubSub()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [MJUser_, Object, PubSubEngine]),
-    __metadata("design:returntype", Promise)
-], UserResolver.prototype, "MJUserRoles_UserIDArray", null);
-__decorate([
-    Query(() => MJUser_),
+    Query(() => CurrentUserType),
     __param(0, Ctx()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),

package/dist/resolvers/UserResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAc,GAAG,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAC/H,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAG1C,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,kBAAkB;IAElD;;;;;;;;;;;;OAYG;IAEG,AAAN,KAAK,CAAC,uBAAuB,CAAS,OAAgB,EAAS,OAAmB,EAAY,MAAoB;QAChH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC;QACpD,IAAI,WAAW,EAAE,oBAAoB,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAChF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,+EAA+E;YAC/E,4EAA4E;YAC5E,oFAAoF;YACpF,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAuE,EAAE,EAAE,CAAC,CAAC;gBAC3H,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI;gBAC1B,cAAc,EAAE,GAAG;gBACnB,cAAc,EAAE,GAAG;aACpB,CAAC,CAAC,CAAC;YACJ,OAAO,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,KAAK,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAEK,AAAN,KAAK,CAAC,WAAW,CAAQ,OAAmB;QAC1C,yDAAyD;QACzD,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,+EAA+E;QAC/E,uDAAuD;QACvD,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACnC,kDAAkD;YAClD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,MAAM,QAAQ,GAAG;gBACf,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,2DAA2D;gBAC3D,uBAAuB,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAkH,EAAE,EAAE,CAAC,CAAC;oBAC1K,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ;oBAChB,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,cAAc,EAAE,CAAC,CAAC,cAAc;iBACjC,CAAC,CAAC,IAAI,EAAE;aACV,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAED,+CAA+C;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAuB,EAAU,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QAC5F,kDAAkD;QAClD,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAA+B,UAAkB,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACpH,kDAAkD;QAClD,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAA6B,KAAa,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACxG,kDAAkD;QAClD,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE1E,oDAAoD;QACpD,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AAjGO;IADL,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACJ,WAAA,IAAI,EAAE,CAAA;IAAoB,WAAA,GAAG,EAAE,CAAA;IAAuB,WAAA,MAAM,EAAE,CAAA;;qCAA9C,OAAO,UAAgD,YAAY;;2DAmBjH;AAEK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,EAAE,CAAA;;;;+CA2CvB;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACL,WAAA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAc,WAAA,GAAG,EAAE,CAAA;;;;4CAOtD;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACG,WAAA,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAsB,WAAA,GAAG,EAAE,CAAA;;;;oDAO9E;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAAiB,WAAA,GAAG,EAAE,CAAA;;;;+CASlE;AAhHU,YAAY;IADxB,QAAQ,CAAC,OAAO,CAAC;GACL,YAAY,CAiHxB;;AACD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"UserResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAc,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAwB,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EAAqB,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,OAAO;CAG3C,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;;8CACN;AAFV,eAAe;IAD3B,UAAU,EAAE;GACA,eAAe,CAG3B;;AAaM,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,kBAAkB;IAG5C,AAAN,KAAK,CAAC,WAAW,CAAQ,OAAmB;QAC1C,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,MAAM,QAAQ,GAAG;gBACf,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;aAC1C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAY,CAAC;YAC3G,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;aACrG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAC1D,OAAO,CAAC,WAAW,CAAC,KAAK,CAC1B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAuB,EAAU,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QAC5F,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAA+B,UAAkB,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACpH,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAA6B,KAAa,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACxG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAa,EAAE,OAAmB;QAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAErF,IAAI,WAAW,CAAC,oBAAoB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAClC,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAa;YAC1C,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,EAAE,WAAW,CAAC,CAAC;QAEhB,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAC7C,gBAAgB,EAChB,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,WAAW,EACX,QAAQ,CACQ,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAAmB,EACnB,IAAmC,EACnC,WAAsB,EACtB,QAA4B;QAE5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;YACvC,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;SACxC,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAkB,CAAC;IAClH,CAAC;CACF,CAAA;AAvHO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC;IACV,WAAA,GAAG,EAAE,CAAA;;;;+CAuCvB;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACL,WAAA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAc,WAAA,GAAG,EAAE,CAAA;;;;4CAMtD;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACG,WAAA,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAsB,WAAA,GAAG,EAAE,CAAA;;;;oDAM9E;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAAiB,WAAA,GAAG,EAAE,CAAA;;;;+CAOlE;AAtEU,YAAY;IADxB,QAAQ,CAAC,OAAO,CAAC;GACL,YAAY,CA0HxB;;AACD,eAAe,YAAY,CAAC"}

package/dist/resolvers/currentUserRoles.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Guards and filter builders for CurrentUser role loading.
+ * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
+ * without importing generated GraphQL types or the Apollo config bootstrap.
+ */
+export declare function RequireLoadedUser<T extends {
+    ID?: string;
+}>(user: T | null | undefined, email: string | undefined): T & {
+    ID: string;
+};
+export declare function RequireContextUser<T>(user: T | null | undefined): T;
+export declare function RequireRoleProvider<T>(provider: T | null | undefined): T;
+/** Quote-escape a server-resolved user id for an ExtraFilter literal. */
+export declare function UserIdExtraFilter(userId: string): string;
+export declare function AssertRoleLoadSucceeded(result: {
+    Success: boolean;
+    ErrorMessage?: string | null;
+}, userId: string): void;
+//# sourceMappingURL=currentUserRoles.d.ts.map

package/dist/resolvers/currentUserRoles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentUserRoles.d.ts","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACzD,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAKpB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKxE;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1D,MAAM,EAAE,MAAM,GACb,IAAI,CAMN"}

package/dist/resolvers/currentUserRoles.js

@@ -0,0 +1,36 @@
+import { LogError } from '@memberjunction/core';
+/**
+ * Guards and filter builders for CurrentUser role loading.
+ * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
+ * without importing generated GraphQL types or the Apollo config bootstrap.
+ */
+export function RequireLoadedUser(user, email) {
+    if (!user?.ID) {
+        throw new Error(`CurrentUser: no user found for email '${email ?? ''}'`);
+    }
+    return user;
+}
+export function RequireContextUser(user) {
+    if (!user) {
+        throw new Error('CurrentUser: authenticated context user is required to load roles');
+    }
+    return user;
+}
+export function RequireRoleProvider(provider) {
+    if (!provider) {
+        throw new Error('CurrentUser: no data provider available to load roles');
+    }
+    return provider;
+}
+/** Quote-escape a server-resolved user id for an ExtraFilter literal. */
+export function UserIdExtraFilter(userId) {
+    return `UserID='${userId.replace(/'/g, "''")}'`;
+}
+export function AssertRoleLoadSucceeded(result, userId) {
+    if (!result.Success) {
+        const message = result.ErrorMessage ?? 'unknown error';
+        LogError(`CurrentUser: failed to load roles for user ${userId}: ${message}`);
+        throw new Error(`CurrentUser: failed to load roles: ${message}`);
+    }
+}
+//# sourceMappingURL=currentUserRoles.js.map

package/dist/resolvers/currentUserRoles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"currentUserRoles.js","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;GAIG;AAEH,MAAM,UAAU,iBAAiB,CAC/B,IAA0B,EAC1B,KAAyB;IAEzB,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,IAA0B;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,QAA8B;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0D,EAC1D,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;QACvD,QAAQ,CAAC,8CAA8C,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/rest/MediaAccessKeys.d.ts

@@ -18,6 +18,8 @@
 import { BaseSingleton } from '@memberjunction/global';
 /** The token's `typ` claim — the route rejects any token whose `typ` differs. */
 export declare const MEDIA_ACCESS_TOKEN_TYPE = "media-access";
+/** The upload staging token's `typ` claim. */
+export declare const MEDIA_UPLOAD_ACCESS_TOKEN_TYPE = "media-upload";
 /** Default media-access token lifetime (hours). Long enough to cover a full playback session. */
 export declare const MEDIA_ACCESS_DEFAULT_TTL_HOURS = 4;
 /** The claims carried by a media-access token. */
@@ -59,6 +61,21 @@ export declare class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyM
         Token: string;
         ExpiresAt: Date;
     };
+    /**
+     * Mints a signed upload staging token for a user, expiring after `ttlMinutes` (default 10 minutes).
+     */
+    SignUpload(userId: string, ttlMinutes?: number): {
+        Token: string;
+        ExpiresAt: Date;
+    };
+    /**
+     * Verifies an upload staging token.
+     */
+    VerifyUpload(token: string): {
+        Valid: boolean;
+        UserId?: string;
+        Error?: string;
+    };
     /**
      * Verifies a token's signature, expiry, and `typ`. Returns the typed claims on
      * success. Never throws — an invalid/expired/malformed token returns `{ Valid: false }`.

package/dist/rest/MediaAccessKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MediaAccessKeys.d.ts","sourceRoot":"","sources":["../../src/rest/MediaAccessKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKvD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,EAAE,OAAO,uBAAuB,CAAC;CACrC;AAED,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAC/C;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAErB;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,qBAAqB,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,YAAY,CAAS;;IAO7B,WAAkB,QAAQ,IAAI,qBAAqB,CAElD;IAED,mFAAmF;IACnF,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAuC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE;IASlI;;;OAGG;IACI,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB;CAmBrD"}
+{"version":3,"file":"MediaAccessKeys.d.ts","sourceRoot":"","sources":["../../src/rest/MediaAccessKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKvD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,8CAA8C;AAC9C,eAAO,MAAM,8BAA8B,iBAAiB,CAAC;AAE7D,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,EAAE,OAAO,uBAAuB,CAAC;CACrC;AAED,iDAAiD;AACjD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAC/C;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AAErB;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,qBAAqB,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,YAAY,CAAS;;IAO7B,WAAkB,QAAQ,IAAI,qBAAqB,CAElD;IAED,mFAAmF;IACnF,OAAO,CAAC,YAAY;IA2BpB;;;;OAIG;IACI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAuC,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE;IASlI;;OAEG;IACI,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE;IAS9F;;OAEG;IACI,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAkBvF;;;OAGG;IACI,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB;CAmBrD"}

package/dist/rest/MediaAccessKeys.js

@@ -21,6 +21,8 @@ import { randomBytes } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 /** The token's `typ` claim — the route rejects any token whose `typ` differs. */
 export const MEDIA_ACCESS_TOKEN_TYPE = 'media-access';
+/** The upload staging token's `typ` claim. */
+export const MEDIA_UPLOAD_ACCESS_TOKEN_TYPE = 'media-upload';
 /** Default media-access token lifetime (hours). Long enough to cover a full playback session. */
 export const MEDIA_ACCESS_DEFAULT_TTL_HOURS = 4;
 /**
@@ -42,7 +44,13 @@ export class MediaAccessKeyManager extends BaseSingleton {
     }
     /** Resolves the signing secret once, preferring the deployment's symmetric key. */
     ensureSecret() {
-        if (this._initialized) {
+        if (this._initialized && this.secret) {
+            return;
+        }
+        const store = this.GetGlobalObjectStore();
+        if (store && typeof store['___MEDIA_ACCESS_SECRET___'] === 'string') {
+            this.secret = store['___MEDIA_ACCESS_SECRET___'];
+            this._initialized = true;
             return;
         }
         const configured = process.env.MJ_BASE_ENCRYPTION_KEY?.trim();
@@ -55,6 +63,9 @@ export class MediaAccessKeyManager extends BaseSingleton {
                 'media-access tokens. Outstanding media URLs will be invalidated on restart. Set ' +
                 'MJ_BASE_ENCRYPTION_KEY for stable signing.');
         }
+        if (store) {
+            store['___MEDIA_ACCESS_SECRET___'] = this.secret;
+        }
         this._initialized = true;
     }
     /**
@@ -70,6 +81,36 @@ export class MediaAccessKeyManager extends BaseSingleton {
         const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
         return { Token: token, ExpiresAt: expiresAt };
     }
+    /**
+     * Mints a signed upload staging token for a user, expiring after `ttlMinutes` (default 10 minutes).
+     */
+    SignUpload(userId, ttlMinutes = 10) {
+        this.ensureSecret();
+        const claims = { fileId: '*', userId, typ: MEDIA_UPLOAD_ACCESS_TOKEN_TYPE };
+        const expiresInSeconds = Math.floor(ttlMinutes * 60);
+        const token = jwt.sign(claims, this.secret, { algorithm: 'HS256', expiresIn: expiresInSeconds });
+        const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
+        return { Token: token, ExpiresAt: expiresAt };
+    }
+    /**
+     * Verifies an upload staging token.
+     */
+    VerifyUpload(token) {
+        this.ensureSecret();
+        try {
+            const decoded = jwt.verify(token, this.secret, { algorithms: ['HS256'] });
+            if (typeof decoded === 'object' && decoded !== null &&
+                decoded.typ === MEDIA_UPLOAD_ACCESS_TOKEN_TYPE &&
+                typeof decoded.userId === 'string') {
+                return { Valid: true, UserId: decoded.userId };
+            }
+            return { Valid: false, Error: 'Invalid token payload format or claim mismatch' };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { Valid: false, Error: msg };
+        }
+    }
     /**
      * Verifies a token's signature, expiry, and `typ`. Returns the typed claims on
      * success. Never throws — an invalid/expired/malformed token returns `{ Valid: false }`.

package/dist/rest/MediaAccessKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"MediaAccessKeys.js","sourceRoot":"","sources":["../../src/rest/MediaAccessKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAiBhD;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,aAAoC;IAI7E,gFAAgF;IAChF;QACE,KAAK,EAAE,CAAC;QALF,WAAM,GAAG,EAAE,CAAC;QACZ,iBAAY,GAAG,KAAK,CAAC;IAK7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,qBAAqB,CAAC,WAAW,EAAyB,CAAC;IACpE,CAAC;IAED,mFAAmF;IAC3E,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjD,SAAS,CACP,+FAA+F;gBAC/F,kFAAkF;gBAClF,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,WAAmB,8BAA8B;QAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;QACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAa;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1E,IACE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAC9C,OAA6B,CAAC,GAAG,KAAK,uBAAuB;gBAC9D,OAAQ,OAAgC,CAAC,MAAM,KAAK,QAAQ;gBAC5D,OAAQ,OAAgC,CAAC,MAAM,KAAK,QAAQ,EAC5D,CAAC;gBACD,MAAM,CAAC,GAAG,OAA6C,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAE,CAAC;YACvG,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"MediaAccessKeys.js","sourceRoot":"","sources":["../../src/rest/MediaAccessKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,8BAA8B,GAAG,cAAc,CAAC;AAE7D,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAiBhD;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,aAAoC;IAI7E,gFAAgF;IAChF;QACE,KAAK,EAAE,CAAC;QALF,WAAM,GAAG,EAAE,CAAC;QACZ,iBAAY,GAAG,KAAK,CAAC;IAK7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,qBAAqB,CAAC,WAAW,EAAyB,CAAC;IACpE,CAAC;IAED,mFAAmF;IAC3E,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1C,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,2BAA2B,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACjD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjD,SAAS,CACP,+FAA+F;gBAC/F,kFAAkF;gBAClF,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,2BAA2B,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,IAAI,CAAC,MAAc,EAAE,MAAc,EAAE,WAAmB,8BAA8B;QAC3F,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;QACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,UAAU,CAAC,MAAc,EAAE,aAAqB,EAAE;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,8BAA8B,EAAE,CAAC;QAC5E,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,YAAY,CAAC,KAAa;QAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1E,IACE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAC9C,OAA6B,CAAC,GAAG,KAAK,8BAA8B;gBACrE,OAAQ,OAAgC,CAAC,MAAM,KAAK,QAAQ,EAC5D,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAG,OAA8B,CAAC,MAAM,EAAE,CAAC;YACzE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAa;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1E,IACE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAC9C,OAA6B,CAAC,GAAG,KAAK,uBAAuB;gBAC9D,OAAQ,OAAgC,CAAC,MAAM,KAAK,QAAQ;gBAC5D,OAAQ,OAAgC,CAAC,MAAM,KAAK,QAAQ,EAC5D,CAAC;gBACD,MAAM,CAAC,GAAG,OAA6C,CAAC;gBACxD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAE,CAAC;YACvG,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/rest/MediaStreamHandler.d.ts

@@ -19,8 +19,9 @@
  */
 import { type Router } from 'express';
 /**
- * Builds the Express router exposing `GET /media/:fileId`. Stateless — verification
- * and byte-source resolution happen per request.
+ * Builds the Express router exposing:
+ * - `GET /media/:fileId` and `GET /media/:fileId/:filename` (Range streaming)
+ * - `POST /media/upload-stage` (Raw binary upload staging)
  */
 export declare function createMediaStreamRouter(): Router;
 //# sourceMappingURL=MediaStreamHandler.d.ts.map

package/dist/rest/MediaStreamHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MediaStreamHandler.d.ts","sourceRoot":"","sources":["../../src/rest/MediaStreamHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAgB,EAAE,KAAK,MAAM,EAA+B,MAAM,SAAS,CAAC;AAiB5E;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAMhD"}
+{"version":3,"file":"MediaStreamHandler.d.ts","sourceRoot":"","sources":["../../src/rest/MediaStreamHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAgB,EAAE,KAAK,MAAM,EAA+B,MAAM,SAAS,CAAC;AAkB5E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAkBhD"}

package/dist/rest/MediaStreamHandler.js

@@ -22,18 +22,94 @@ import { LogError, Metadata } from '@memberjunction/core';
 import { FileStorageEngine } from '@memberjunction/storage';
 import { getSystemUser } from '../auth/index.js';
 import { MediaAccessKeyManager } from './MediaAccessKeys.js';
+import { UploadTokenManager } from './UploadTokenManager.js';
 import { parseRange, parseRangeHeaderLoose } from './mediaRange.js';
 /**
- * Builds the Express router exposing `GET /media/:fileId`. Stateless — verification
- * and byte-source resolution happen per request.
+ * Builds the Express router exposing:
+ * - `GET /media/:fileId` and `GET /media/:fileId/:filename` (Range streaming)
+ * - `POST /media/upload-stage` (Raw binary upload staging)
  */
 export function createMediaStreamRouter() {
     const router = express.Router();
+    router.post('/upload-stage', express.raw({ type: () => true, limit: '100mb' }), async (req, res) => {
+        await handleUploadStageRequest(req, res);
+    });
     router.get('/:fileId', async (req, res) => {
         await handleMediaRequest(req, res);
     });
+    router.get('/:fileId/:filename', async (req, res) => {
+        await handleMediaRequest(req, res);
+    });
     return router;
 }
+/**
+ * Authenticated raw binary upload staging handler (`POST /media/upload-stage`).
+ *
+ * Accepts raw file binary bytes directly in request body, stages in UploadTokenManager
+ * memory cache, and returns an ephemeral single-use upload token for the GraphQL mutation.
+ *
+ * Security: Requires a cryptographically signed media-upload token minted by `CreateUploadStageToken`
+ * (verified via `MediaAccessKeyManager.Instance.VerifyUpload`).
+ */
+async function handleUploadStageRequest(req, res) {
+    // Never let CDNs or shared caches retain upload endpoints
+    res.setHeader('Cache-Control', 'private, no-store');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    // 1. Resolve signed upload token strictly from Authorization header (avoids bearer token in URL logs)
+    const authHeader = req.headers.authorization || '';
+    const token = authHeader.startsWith('Bearer ') ? authHeader.substring(7).trim() : authHeader.trim();
+    if (!token) {
+        console.warn('[MediaStreamHandler] POST /media/upload-stage: Missing or empty Authorization header');
+        res.status(401).json({ Success: false, ErrorMessage: 'Authorization header with Bearer token required.' });
+        return;
+    }
+    // Cryptographically verify token signature, expiry, and 'media-upload' typ claim
+    const uploadVerify = MediaAccessKeyManager.Instance.VerifyUpload(token);
+    if (!uploadVerify.Valid || !uploadVerify.UserId) {
+        console.warn(`[MediaStreamHandler] POST /media/upload-stage: Token verification failed: ${uploadVerify.Error || 'invalid or expired'}`);
+        res.status(401).json({ Success: false, ErrorMessage: `Invalid or expired upload token: ${uploadVerify.Error || 'unauthorized'}` });
+        return;
+    }
+    const userId = uploadVerify.UserId;
+    // 2. Validate binary body
+    const buffer = req.body;
+    if (!buffer || !Buffer.isBuffer(buffer) || buffer.length === 0) {
+        res.status(400).json({ Success: false, ErrorMessage: 'Empty or invalid file payload.' });
+        return;
+    }
+    // 3. Extract and sanitize metadata
+    const rawFileName = req.headers['x-file-name'] || req.query.fileName || 'upload.bin';
+    let fileName = 'upload.bin';
+    try {
+        fileName = decodeURIComponent(rawFileName);
+    }
+    catch {
+        fileName = rawFileName;
+    }
+    // Sanitize filename: remove directory traversal, leading slashes, control chars
+    fileName = fileName.replace(/[/\\]+/g, '_').replace(/^\.+/, '').replace(/[\x00-\x1f\x7f]/g, '').trim() || 'upload.bin';
+    const mimeType = req.headers['content-type'] || req.query.mimeType || 'application/octet-stream';
+    try {
+        const uploadToken = UploadTokenManager.Instance.Stage({
+            buffer,
+            fileName,
+            mimeType,
+            userId,
+        });
+        res.status(200).json({
+            Success: true,
+            UploadToken: uploadToken,
+            FileName: fileName,
+            MimeType: mimeType,
+            ContentLength: buffer.length,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        LogError(`[MediaStream] Upload staging failed for '${fileName}': ${message}`);
+        res.status(400).json({ Success: false, ErrorMessage: message });
+    }
+}
 /** Top-level request handler: verify token → resolve bytes → stream/buffer with Range support. */
 async function handleMediaRequest(req, res) {
     // Express type defs allow req.params values to be string | string[]; normalize to string
@@ -117,6 +193,7 @@ async function resolveFileBytesSource(fileId) {
         driver,
         providerKey: file.ProviderKey,
         contentType: file.ContentType ?? 'application/octet-stream',
+        fileName: file.Name || 'file',
     };
 }
 /**
@@ -143,6 +220,8 @@ async function serveViaStream(res, source, rangeHeader) {
     const result = await source.driver.GetObjectStream({ fullPath: source.providerKey, Range: streamRange });
     res.setHeader('Accept-Ranges', 'bytes');
     res.setHeader('Content-Type', result.ContentType ?? source.contentType);
+    res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(source.fileName)}"`);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
     if (result.ContentLength != null) {
         res.setHeader('Content-Length', String(result.ContentLength));
     }
@@ -173,6 +252,8 @@ async function serveViaBuffer(res, source, rangeHeader) {
     const total = buffer.length;
     res.setHeader('Accept-Ranges', 'bytes');
     res.setHeader('Content-Type', source.contentType);
+    res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(source.fileName)}"`);
+    res.setHeader('X-Content-Type-Options', 'nosniff');
     if (!rangeHeader) {
         res.status(200);
         res.setHeader('Content-Length', String(total));

package/dist/rest/MediaStreamHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"MediaStreamHandler.js","sourceRoot":"","sources":["../../src/rest/MediaStreamHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,OAAqD,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAUpE;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa;IAC3D,yFAAyF;IACzF,yGAAyG;IACzG,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,MAAM,MAAM,GAAW,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uFAAuF;QACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,sCAAsC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2FAA2F;IAC3F,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,UAAU,GAAa,MAAM,aAAa,EAAE,CAAC;IAEnD,6FAA6F;IAC7F,2DAA2D;IAC3D,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,6EAA6E;IACxG,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAe,WAAW,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAClF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B;KAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,MAAuB;IAChF,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACpC,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,MAAuB,EAAE,WAA+B;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,2FAA2F;IAC3F,MAAM,WAAW,GAA0B,KAAK;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzG,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,6EAA6E;IAC7E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAChC,QAAQ,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,MAAuB,EAAE,WAA+B;IACnG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAE5B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAElD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"file":"MediaStreamHandler.js","sourceRoot":"","sources":["../../src/rest/MediaStreamHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,OAAqD,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAEpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAUpE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,IAAI,CACT,eAAe,EACf,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EACjD,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpC,MAAM,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3D,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACrE,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB,CAAC,GAAY,EAAE,GAAa;IACjE,0DAA0D;IAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAEnD,sGAAsG;IACtG,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAEpG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QACrG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,kDAAkD,EAAE,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IAED,iFAAiF;IACjF,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,6EAA6E,YAAY,CAAC,KAAK,IAAI,oBAAoB,EAAE,CAAC,CAAC;QACxI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,oCAAoC,YAAY,CAAC,KAAK,IAAI,cAAc,EAAE,EAAE,CAAC,CAAC;QACnI,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEnC,0BAA0B;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAc,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IAED,mCAAmC;IACnC,MAAM,WAAW,GAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAY,IAAK,GAAG,CAAC,KAAK,CAAC,QAAmB,IAAI,YAAY,CAAC;IAC7G,IAAI,QAAQ,GAAG,YAAY,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,WAAW,CAAC;IACzB,CAAC;IACD,gFAAgF;IAChF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;IAEvH,MAAM,QAAQ,GAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY,IAAK,GAAG,CAAC,KAAK,CAAC,QAAmB,IAAI,0BAA0B,CAAC;IAEzH,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpD,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,MAAM,CAAC,MAAM;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,QAAQ,CAAC,4CAA4C,QAAQ,MAAM,OAAO,EAAE,CAAC,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa;IAC3D,yFAAyF;IACzF,yGAAyG;IACzG,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACpC,MAAM,MAAM,GAAW,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uFAAuF;QACvF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,sCAAsC,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2FAA2F;IAC3F,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,UAAU,GAAa,MAAM,aAAa,EAAE,CAAC;IAEnD,6FAA6F;IAC7F,2DAA2D;IAC3D,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,6EAA6E;IACxG,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAe,WAAW,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAClF,OAAO;QACL,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B;QAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM;KAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,MAAuB;IAChF,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACpC,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,MAAuB,EAAE,WAA+B;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,2FAA2F;IAC3F,MAAM,WAAW,GAA0B,KAAK;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzG,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;IACxE,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClG,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,6EAA6E;IAC7E,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAChC,QAAQ,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,cAAc,CAAC,GAAa,EAAE,MAAuB,EAAE,WAA+B;IACnG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAE5B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClG,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAEnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,+EAA+E;QAC/E,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC"}