@memberjunction/server 6.1.0-edge.5 → 6.1.0-edge.7

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { DatabasePlatform } from '@memberjunction/core';
 import { Application } from 'express';
 import 'reflect-metadata';
 import { RESTApiOptions } from './config.js';
-import { ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+import { ServerExtensionLoader, ServerExtensionConfig } from '@memberjunction/server-extensions-core';
 export { MetadataCacheRefreshIntervalSeconds } from './providerConfigUnits.js';
 /**
  * Returns the configured database platform from the `DB_PLATFORM` environment
@@ -22,8 +22,8 @@ export * from 'type-graphql';
 export { Int, Float, ID } from 'type-graphql';
 export { NewUserBase } from './auth/newUsers.js';
 export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
-export { ServerExtensionLoader, BaseServerExtension } from '@memberjunction/server-extensions-core';
-export type { ServerExtensionConfig, ExtensionInitResult, ExtensionHealthResult } from '@memberjunction/server-extensions-core';
+export { ServerExtensionLoader, BaseServerExtension, DefaultServerExtensionServiceRegistry } from '@memberjunction/server-extensions-core';
+export type { ServerExtensionConfig, ServerExtensionPhase, ServerExtensionServiceRegistry, ServerExtensionInitContext, ExtensionInitResult, ExtensionHealthResult, LoadExtensionsOptions, } from '@memberjunction/server-extensions-core';
 export * from './directives/index.js';
 export { NoLog, hasNoLogParameter, getNoLogFields } from './logging/NoLog.js';
 export * from './entitySubclasses/MJEntityPermissionEntityServer.server.js';
@@ -31,11 +31,19 @@ export * from './types.js';
 export { getSystemUser, getSigningKeys, extractUserInfoFromPayload, verifyUserRecord, } from './auth/index.js';
 export * from './auth/APIKeyScopeAuth.js';
 export * from './auth/actingContextResolver.js';
+export { ResolveConfiguredPrincipal, resolvePrincipalFrom } from './auth/principals.js';
+export type { ResolvablePrincipal, PrincipalResolution, PrincipalResolutionReason } from './auth/principals.js';
 export { CloneUserForSessionContext } from './auth/sessionUserClone.js';
+/**
+ * Returns the active ServerExtensionLoader instance for the running server.
+ * Returns null if the server has not been started yet.
+ */
+export declare function GetServerExtensionLoader(): ServerExtensionLoader | null;
 export * from './generic/PushStatusResolver.js';
 export * from './generic/PubSubManager.js';
 export * from './generic/CacheInvalidationResolver.js';
 export * from './generic/ResolverBase.js';
+export * from './generic/refusalExtensions.js';
 export * from './generic/RunViewResolver.js';
 export * from './resolvers/RunTemplateResolver.js';
 export * from './resolvers/RunAIPromptResolver.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAY,gBAAgB,EAAuI,MAAM,sBAAsB,CAAC;AAUvM,OAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAQ/C,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,EAA2I,cAAc,EAAE,MAAM,aAAa,CAAC;AAmDtL,OAAO,EAAyB,qBAAqB,EAA4F,MAAM,wCAAwC,CAAC;AAMhM,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAC;AAE/E;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,cAAc,cAAc,CAAC;AAI7B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AACpG,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAChI,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACH,aAAa,EACb,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,GACnB,MAAM,iBAAiB,CAAC;AACzB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAExE,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AAGjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iDAAiD,CAAC;AAChE,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErH,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AAStC,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,EAAE,CAAC;CAC5C,CAAC;AAUF,eAAO,MAAM,SAAS,QAAO,WAAwB,CAAC;AAoBtD,eAAO,MAAM,KAAK,GAAU,eAAe,KAAK,CAAC,MAAM,CAAC,EAAE,MAAK,WAAyB,EAAE,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAw0CjI,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAY,gBAAgB,EAAuI,MAAM,sBAAsB,CAAC;AAUvM,OAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAQ/C,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,EAA2I,cAAc,EAAE,MAAM,aAAa,CAAC;AA+CtL,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAA4I,MAAM,wCAAwC,CAAC;AAMhP,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAC;AAE/E;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,cAAc,cAAc,CAAC;AAI7B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAC;AAC3I,YAAY,EACR,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,wCAAwC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACH,aAAa,EACb,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,GACnB,MAAM,iBAAiB,CAAC;AACzB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAOhD,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAChH,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAIxE;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,qBAAqB,GAAG,IAAI,CAEvE;AAED,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AAGjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iDAAiD,CAAC;AAChE,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErH,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AAStC,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,EAAE,CAAC;CAC5C,CAAC;AAUF,eAAO,MAAM,SAAS,QAAO,WAAwB,CAAC;AAoBtD,eAAO,MAAM,KAAK,GAAU,eAAe,KAAK,CAAC,MAAM,CAAC,EAAE,MAAK,WAAyB,EAAE,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAq2CjI,CAAC"}

package/dist/index.js

@@ -41,13 +41,10 @@ import { setupRESTEndpoints } from './rest/setupRESTEndpoints.js';
 import { createOAuthCallbackHandler } from './rest/OAuthCallbackHandler.js';
 import { createSignatureWebhookHandler } from './rest/SignatureWebhookHandler.js';
 import { createMediaStreamRouter } from './rest/MediaStreamHandler.js';
+import { createRealtimeSdpBrokerRouter } from './rest/RealtimeSdpBrokerHandler.js';
+import { REALTIME_SDP_EXCHANGE_PATH } from '@memberjunction/ai';
 import { createMagicLinkHandler, createMagicLinkJwksRouter, registerMagicLinkAuthProvider, MAGIC_LINK_MOUNT_PATH } from './auth/magicLink/index.js';
 import { createWidgetHandler, WIDGET_MOUNT_PATH } from './realtimeWidget/index.js';
-import { createTwilioTelephonyHandler, TWILIO_TELEPHONY_MOUNT_PATH, SetTwilioTelephonyService } from './telephony/index.js';
-import { createVonageTelephonyHandler, VONAGE_TELEPHONY_MOUNT_PATH, SetVonageTelephonyService } from './telephony/index.js';
-import { RingCentralTelephonyService, SetRingCentralTelephonyService } from './telephony/index.js';
-import { createTeamsMeetingsHandler, TEAMS_MEETINGS_MOUNT_PATH, SetTeamsMeetingsService, GetTeamsMeetingsService, StartCalendarScheduler } from './telephony/index.js';
-import { InstallMediaUpgradeDispatcher, IsGraphQLWsPath } from './telephony/index.js';
 import { resolve } from 'node:path';
 import { DataSourceInfo, raiseEvent } from './types.js';
 import { ScheduledJobsService } from './services/ScheduledJobsService.js';
@@ -67,7 +64,7 @@ import { StartTaskGraphDispatcher } from './services/StartTaskGraphDispatcher.js
 import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
-import { ServerExtensionLoader, mergeServerExtensionConfigs, prepareServerExtensionConfigs, describeServerExtensionMount } from '@memberjunction/server-extensions-core';
+import { ServerExtensionLoader, mergeServerExtensionConfigs, prepareServerExtensionConfigs, describeServerExtensionMount, InstallMediaUpgradeDispatcher, IsGraphQLWsPath } from '@memberjunction/server-extensions-core';
 import { coreReservedServerExtensionRoots } from './serverExtensionReservedRoots.js';
 import { MetadataCacheRefreshIntervalSeconds } from './providerConfigUnits.js';
 const cacheRefreshInterval = configInfo.databaseSettings.metadataCacheRefreshInterval;
@@ -95,7 +92,7 @@ export * from 'type-graphql';
 export { Int, Float, ID } from 'type-graphql';
 export { NewUserBase } from './auth/newUsers.js';
 export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
-export { ServerExtensionLoader, BaseServerExtension } from '@memberjunction/server-extensions-core';
+export { ServerExtensionLoader, BaseServerExtension, DefaultServerExtensionServiceRegistry } from '@memberjunction/server-extensions-core';
 export * from './directives/index.js';
 export { NoLog, hasNoLogParameter, getNoLogFields } from './logging/NoLog.js';
 export * from './entitySubclasses/MJEntityPermissionEntityServer.server.js';
@@ -103,11 +100,27 @@ export * from './types.js';
 export { getSystemUser, getSigningKeys, extractUserInfoFromPayload, verifyUserRecord, } from './auth/index.js';
 export * from './auth/APIKeyScopeAuth.js';
 export * from './auth/actingContextResolver.js';
+// The context-user ladder (#4209). Public because `auth/exampleNewUserSubClass.ts` — the template
+// integrators are told to copy into their OWN package — resolves through it, and `package.json`
+// publishes only "."; without this the example compiles here and cannot be reused anywhere else.
+// `ReportedMisconfigurationCount` / `MAX_REPORTED_MISCONFIGURATIONS` are deliberately NOT here:
+// they exist so the LRU's bound is assertable, the tests import them from the module directly, and
+// a published export is a maintenance commitment no caller asked for.
+export { ResolveConfiguredPrincipal, resolvePrincipalFrom } from './auth/principals.js';
 export { CloneUserForSessionContext } from './auth/sessionUserClone.js';
+let _currentExtensionLoader = null;
+/**
+ * Returns the active ServerExtensionLoader instance for the running server.
+ * Returns null if the server has not been started yet.
+ */
+export function GetServerExtensionLoader() {
+    return _currentExtensionLoader;
+}
 export * from './generic/PushStatusResolver.js';
 export * from './generic/PubSubManager.js';
 export * from './generic/CacheInvalidationResolver.js';
 export * from './generic/ResolverBase.js';
+export * from './generic/refusalExtensions.js';
 export * from './generic/RunViewResolver.js';
 export * from './resolvers/RunTemplateResolver.js';
 export * from './resolvers/RunAIPromptResolver.js';
@@ -989,6 +1002,14 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         app.use('/oauth', oauthCors, callbackRouter);
         startupLog.LogIf('verbose', '[OAuth] Callback route registered at /oauth/callback');
     }
+    // ─── Core HTTP Routes (Static Core Infrastructure) ─────────────────────────
+    // IMPORTANT ARCHITECTURAL NOTE:
+    // The route mounts below are strictly reserved for core framework infrastructure (OAuth, eSignature,
+    // media streaming, realtime WebRTC broker, magic-link, widgets).
+    // ALL new custom routes, external webhooks, vendor adapters, and application integrations MUST be
+    // implemented as Server Extensions (subclasses of BaseServerExtension in @memberjunction/server-extensions-core)
+    // mounted via ServerExtensionLoader — NEVER hardcoded as ad-hoc app.use() in serve().
+    // See guides/SERVER_EXTENSIONS_GUIDE.md for complete patterns and best practices.
     // ─── eSignature webhook (unauthenticated, registered BEFORE auth) ─────
     // Called by external signature providers (DocuSign Connect, etc.) without an MJ bearer token.
     // The provider DRIVER verifies the payload signature/HMAC; MJ auth does not apply here.
@@ -1000,6 +1021,11 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     // auth middleware (an <audio>/<video> element can't send Authorization headers).
     app.use('/media', cors(), createMediaStreamRouter());
     startupLog.LogIf('verbose', '[Media] Streaming route registered at /media/:fileId');
+    // ─── Realtime WebRTC SDP broker (ticket-gated, registered BEFORE auth) ───────
+    if (configInfo.realtime?.enabled) {
+        app.use(REALTIME_SDP_EXCHANGE_PATH, cors(), createRealtimeSdpBrokerRouter());
+        startupLog.LogIf('verbose', `[Realtime] WebRTC SDP broker registered at ${REALTIME_SDP_EXCHANGE_PATH}`);
+    }
     // ─── Magic-link routes (MJ-issued, app-scoped external access) ───────────
     // Public router (JWKS + redeem) mounts BEFORE the auth middleware; the
     // authenticated invite-creation router mounts AFTER it (see below).
@@ -1031,99 +1057,101 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         }
         startupLog.LogIf('verbose', `[Widget] Public routes registered at ${WIDGET_MOUNT_PATH}/session and ${WIDGET_MOUNT_PATH}/session/refresh`);
     }
-    // ─── Telephony (Twilio) ingress: inbound voice webhook + Media-Streams WSS (PUBLIC) ──
-    // Carriers cannot present an MJ JWT — the X-Twilio-Signature HMAC is the gate. The
-    // public webhook router mounts BEFORE the auth middleware; the Media-Streams WSS attaches
-    // to the shared HTTP server. The outbound PlaceTwilioCall mutation reuses the same service.
-    if (configInfo.telephony?.enabled && configInfo.telephony.twilio) {
-        const twilioHandler = createTwilioTelephonyHandler(oauthPublicUrl, configInfo.telephony.twilio);
-        app.use(TWILIO_TELEPHONY_MOUNT_PATH, cors(), twilioHandler.publicRouter);
-        twilioHandler.attachMediaStreamServer();
-        SetTwilioTelephonyService(twilioHandler.service);
-        startupLog.LogIf('verbose', `[Telephony] Twilio routes registered at ${TWILIO_TELEPHONY_MOUNT_PATH}/voice + Media-Streams WSS`);
-    }
-    // ─── Telephony (Vonage) ingress: inbound answer/event webhooks + media WSS (PUBLIC) ──
-    // Carriers cannot present an MJ JWT — the Vonage signed-request HMAC / webhook JWT is the gate.
-    // The public router mounts BEFORE the auth middleware; the media WSS attaches to the shared
-    // HTTP server. The outbound PlaceVonageCall mutation reuses the same service.
-    if (configInfo.telephony?.enabled && configInfo.telephony.vonage) {
-        const vonageHandler = createVonageTelephonyHandler(oauthPublicUrl, configInfo.telephony.vonage);
-        app.use(VONAGE_TELEPHONY_MOUNT_PATH, cors(), vonageHandler.publicRouter);
-        vonageHandler.attachMediaStreamServer();
-        SetVonageTelephonyService(vonageHandler.service);
-        startupLog.LogIf('verbose', `[Telephony] Vonage routes registered at ${VONAGE_TELEPHONY_MOUNT_PATH}/answer + /event + media WSS`);
-    }
-    // ─── Telephony (RingCentral) ingress: SIP softphone registration (no HTTP webhook / media WSS) ──
-    // RingCentral's only bidirectional-audio transport is a registered SIP softphone — inbound calls arrive
-    // as SIP INVITEs on its own SIP/TLS connection, so there is no public webhook or media WSS to mount.
-    // start() registers the softphone fire-and-forget so SIP registration never blocks boot; the outbound
-    // PlaceRingCentralCall mutation reuses the same service via the runtime holder.
-    if (configInfo.telephony?.enabled && configInfo.telephony.ringcentral) {
-        const ringCentralService = new RingCentralTelephonyService(configInfo.telephony.ringcentral);
-        SetRingCentralTelephonyService(ringCentralService);
-        void ringCentralService.start();
-        startupLog.LogIf('verbose', `[Telephony] RingCentral SIP softphone starting (codec ${configInfo.telephony.ringcentral.codec ?? 'OPUS/16000'})`);
+    // ─── Server extensions loader & shared service registry ───────────────────
+    const extensionLoader = new ServerExtensionLoader();
+    _currentExtensionLoader = extensionLoader;
+    // Open App packages publish their extensions; host mj.config.cjs overlays by DriverClass
+    // Backwards-compatibility shim: synthesize ServerExtensionConfig entries from legacy configInfo.telephony
+    const telephonyExtensionConfigs = [];
+    if (configInfo.telephony?.enabled) {
+        if (configInfo.telephony.twilio) {
+            telephonyExtensionConfigs.push({
+                Enabled: true,
+                DriverClass: 'TwilioTelephonyExtension',
+                RootPath: '/telephony/twilio',
+                Phase: 'pre-auth',
+                Settings: configInfo.telephony.twilio,
+            });
+        }
+        if (configInfo.telephony.vonage) {
+            telephonyExtensionConfigs.push({
+                Enabled: true,
+                DriverClass: 'VonageTelephonyExtension',
+                RootPath: '/telephony/vonage',
+                Phase: 'pre-auth',
+                Settings: configInfo.telephony.vonage,
+            });
+        }
+        if (configInfo.telephony.ringcentral) {
+            telephonyExtensionConfigs.push({
+                Enabled: true,
+                DriverClass: 'RingCentralTelephonyExtension',
+                RootPath: '/telephony/ringcentral',
+                Phase: 'pre-auth',
+                Settings: configInfo.telephony.ringcentral,
+            });
+        }
+        if (configInfo.telephony.teams?.enabled) {
+            telephonyExtensionConfigs.push({
+                Enabled: true,
+                DriverClass: 'TeamsMeetingsExtension',
+                RootPath: '/meetings/teams',
+                Phase: 'pre-auth',
+                Settings: configInfo.telephony.teams,
+            });
+        }
     }
-    // ─── Teams meetings ingress: Graph change-notification webhook (PUBLIC) ──────────────
-    // Graph cannot present an MJ JWT — the subscription validationToken handshake + the per-
-    // notification clientState shared secret are the gate. The public webhook router mounts
-    // BEFORE the auth middleware. The ACS application-hosted-media audio plane is owned by the
-    // server's native ACS media adapter, which attaches transports to the shared registry
-    // (a media WSS is not needed here). The StartTeamsMeetingSession mutation reuses the same
-    // service via the runtime holder.
-    if (configInfo.telephony?.enabled && configInfo.telephony.teams?.enabled) {
-        const teamsHandler = createTeamsMeetingsHandler(configInfo.telephony.teams);
-        app.use(TEAMS_MEETINGS_MOUNT_PATH, cors(), teamsHandler.publicRouter);
-        SetTeamsMeetingsService(teamsHandler.service);
-        startupLog.LogIf('verbose', `[Meetings] Teams routes registered at ${TEAMS_MEETINGS_MOUNT_PATH}/notifications`);
+    const rawHostExtensions = (configInfo.serverExtensions ?? []);
+    const mergedHostExtensions = mergeServerExtensionConfigs(telephonyExtensionConfigs, rawHostExtensions);
+    // Open App packages publish their extensions; host mj.config.cjs overlays by DriverClass
+    // (and remains the only source for host-only extensions such as Slack/Teams).
+    // extraReservedRoots is derived from the mounts registered above plus graphqlRootPath
+    // so a new pre-auth app.use(...) in serve() must also be added to
+    // coreReservedServerExtensionRoots() — otherwise an Open App can claim it.
+    const extensionConfigs = prepareServerExtensionConfigs(mergeServerExtensionConfigs(options?.serverExtensions ?? [], mergedHostExtensions), {
+        onInvalid: (message) => LogError(message),
+        onOverlap: (message) => LogStatus(message),
+        extraReservedRoots: coreReservedServerExtensionRoots(graphqlRootPath),
+    });
+    for (const cfg of extensionConfigs) {
+        LogStatus(`Server extension ${describeServerExtensionMount(cfg)}`);
     }
-    // Install the single path-routing WebSocket-upgrade dispatcher AFTER all media WSS routes have
-    // registered. ws 8.x has each {server}-bound WebSocketServer 400 paths it doesn't own, so the GraphQL
-    // socket and the telephony media sockets cannot coexist as separate {server} servers — this strips the
-    // auto-listeners and routes upgrades by path. No-op when no media routes registered (telephony off).
-    InstallMediaUpgradeDispatcher(httpServer, webSocketServer, graphqlRootPath);
     // ─── Global CORS (before auth so 401 responses include CORS headers) ─────
     // Without this, the browser blocks 401 responses from the auth middleware
     // because they lack Access-Control-Allow-Origin headers, preventing the
     // client from reading the error code and triggering token refresh.
     const corsAllowed = configInfo.cors?.allowedOrigins ?? ['*'];
+    const corsWildcard = corsAllowed.includes('*');
+    // SECURITY: never combine credentials with a wildcard/reflect-any-origin policy. When
+    // allowedOrigins is ['*'] the origin callback reflects the caller's Origin, and pairing that
+    // with Access-Control-Allow-Credentials: true lets any site a signed-in user visits make
+    // credentialed cross-origin reads. MJ's primary auth is a Bearer token (not auto-sent
+    // cross-origin), so dropping credentials under the wildcard default is safe; deployments that
+    // genuinely need credentialed CORS must configure an explicit allowedOrigins list.
     app.use(cors({
         origin: (origin, callback) => {
             // Allow all origins when ['*'] (default/backward-compatible),
             // or when no Origin header (server-to-server calls).
-            if (corsAllowed.includes('*') || !origin || corsAllowed.includes(origin)) {
+            if (corsWildcard || !origin || corsAllowed.includes(origin)) {
                 callback(null, true);
             }
             else {
                 callback(new Error(`Origin ${origin} not allowed by CORS`));
             }
         },
-        credentials: configInfo.cors?.allowCredentials ?? true,
+        credentials: corsWildcard ? false : (configInfo.cors?.allowCredentials ?? true),
         maxAge: configInfo.cors?.maxAge ?? 86400,
     }));
-    // ─── Server extensions (before auth — extensions handle their own auth) ─────
+    // ─── Pre-auth server extensions (before auth — extensions handle their own auth) ─────
     // Slack uses HMAC signature verification, Teams uses Bot Framework JWT validation.
     // These must be registered before the unified auth middleware so webhook
     // requests aren't rejected for lacking an MJ bearer token.
-    const extensionLoader = new ServerExtensionLoader();
-    // Open App packages publish their extensions; host mj.config.cjs overlays by DriverClass
-    // (and remains the only source for host-only extensions such as Slack/Teams).
-    // extraReservedRoots is derived from the mounts registered above plus graphqlRootPath
-    // so a new pre-auth app.use(...) in serve() must also be added to
-    // coreReservedServerExtensionRoots() — otherwise an Open App can claim it.
-    const extensionConfigs = prepareServerExtensionConfigs(mergeServerExtensionConfigs(options?.serverExtensions ?? [], (configInfo.serverExtensions ?? [])), {
-        onInvalid: (message) => LogError(message),
-        onOverlap: (message) => LogStatus(message),
-        extraReservedRoots: coreReservedServerExtensionRoots(graphqlRootPath),
-    });
-    // These routes mount BEFORE createUnifiedAuthMiddleware. Name every one so an
-    // operator who installed an Open App for its entities can see the pre-auth HTTP
-    // surface and suppress it with host serverExtensions[].Enabled = false.
-    for (const cfg of extensionConfigs) {
-        LogStatus(`Server extension ${describeServerExtensionMount(cfg)}`);
-    }
     if (extensionConfigs.length > 0) {
-        await extensionLoader.LoadExtensions(app, extensionConfigs);
+        await extensionLoader.LoadExtensions(app, extensionConfigs, {
+            phase: 'pre-auth',
+            httpServer,
+            publicUrl: oauthPublicUrl,
+        });
     }
     // Extension health endpoint (always available, returns empty array if no extensions)
     app.get('/health/extensions', async (_req, res) => {
@@ -1165,6 +1193,31 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         app.use(WIDGET_MOUNT_PATH, cors(), widgetAuthenticatedRouter);
         startupLog.LogIf('verbose', `[Widget] Authenticated route registered at ${WIDGET_MOUNT_PATH}/resolve-identity`);
     }
+    // ─── Post-auth server extensions ──────────────────────────────────────────
+    // Extensions declaring Phase: 'post-auth' mount after the unified auth middleware
+    // and are protected by JWT authentication by default.
+    if (extensionConfigs.length > 0) {
+        await extensionLoader.LoadExtensions(app, extensionConfigs, {
+            phase: 'post-auth',
+            httpServer,
+            publicUrl: oauthPublicUrl,
+        });
+    }
+    // ─── Cross-extension lifecycle hook: OnAllExtensionsMounted ───────────────
+    // Called after all extensions across both pre-auth and post-auth phases are mounted.
+    // Extensions can wire themselves to services registered by other extensions or core.
+    await extensionLoader.NotifyAllExtensionsMounted({
+        httpServer,
+        publicUrl: oauthPublicUrl,
+    });
+    // Install the single path-routing WebSocket-upgrade dispatcher AFTER all extensions across both
+    // pre-auth and post-auth phases have mounted and registered their media WSS routes. ws 8.x has each
+    // {server}-bound WebSocketServer 400 paths it doesn't own, so the GraphQL socket and the telephony
+    // media sockets cannot coexist as separate {server} servers — this strips the auto-listeners and
+    // routes upgrades by path. No-op when no media routes registered (telephony off).
+    InstallMediaUpgradeDispatcher(httpServer, webSocketServer, graphqlRootPath, (req, socket, head) => {
+        return RealtimeProxyServer.Instance.TryHandleUpgrade(req, socket, head);
+    });
     // ─── REST API endpoints (auth already handled by unified middleware) ─────
     const restApiConfig = {
         enabled: configInfo.restApiOptions?.enabled ?? false,
@@ -1310,22 +1363,6 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         StartTaskGraphDispatcher(taskGraphPool, resumeUser)
             .catch(err => console.warn(`[TaskGraphDispatcher] Startup failed: ${err}`));
     }
-    // Launch the calendar / scheduled-bridge loop (M2): poll agent calendars for meeting invites and
-    // start due meeting bridges. Mirrors the SessionJanitor lifecycle (run-once + interval, timer
-    // unref'd). Gated on Teams meetings being enabled (the provider whose scheduled-join is wired) and
-    // reuses the SAME meetings service as the ingress; identities without configured calendar creds are
-    // skipped, so this is a harmless no-op until a Graph-backed identity + token are configured.
-    if (resumeUser && configInfo.telephony?.teams?.enabled) { // global-provider-ok: server-owned background poller under the server's provider + system user
-        const teamsMeetingsService = GetTeamsMeetingsService();
-        if (teamsMeetingsService) {
-            StartCalendarScheduler({
-                Provider: Metadata.Provider, // global-provider-ok: server-owned background poller under the server's single default provider + system user
-                ContextUser: resumeUser,
-                TeamsService: teamsMeetingsService,
-                TeamsConfig: configInfo.telephony.teams,
-            });
-        }
-    }
     // Set up graceful shutdown handlers
     const gracefulShutdown = async (signal) => {
         console.log(`\n${signal} received, shutting down gracefully...`);
@@ -1333,6 +1370,7 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         if (extensionLoader.ExtensionCount > 0) {
             try {
                 await extensionLoader.ShutdownAll();
+                _currentExtensionLoader = null;
                 console.log('✅ Server extensions shut down');
             }
             catch (error) {