@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/dist/resolvers/UserResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAc,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAwB,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EAAqB,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,OAAO;CAG3C,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;;8CACN;AAFV,eAAe;IAD3B,UAAU,EAAE;GACA,eAAe,CAG3B;;AAaM,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,kBAAkB;IAG5C,AAAN,KAAK,CAAC,WAAW,CAAQ,OAAmB;QAC1C,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,MAAM,QAAQ,GAAG;gBACf,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;gBACrD,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;aAC1C,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAY,CAAC;YAC3G,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;aACrG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAC1D,OAAO,CAAC,WAAW,CAAC,KAAK,CAC1B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAuB,EAAU,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QAC5F,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAA+B,UAAkB,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACpH,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAA6B,KAAa,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACxG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAa,EAAE,OAAmB;QAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAErF,IAAI,WAAW,CAAC,oBAAoB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAClC,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAa;YAC1C,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,EAAE,WAAW,CAAC,CAAC;QAEhB,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAC7C,gBAAgB,EAChB,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,WAAW,EACX,QAAQ,CACQ,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAAmB,EACnB,IAAmC,EACnC,WAAsB,EACtB,QAA4B;QAE5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;YACvC,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;SACxC,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAkB,CAAC;IAClH,CAAC;CACF,CAAA;AAvHO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC;IACV,WAAA,GAAG,EAAE,CAAA;;;;+CAuCvB;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACL,WAAA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAc,WAAA,GAAG,EAAE,CAAA;;;;4CAMtD;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACG,WAAA,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAsB,WAAA,GAAG,EAAE,CAAA;;;;oDAM9E;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAAiB,WAAA,GAAG,EAAE,CAAA;;;;+CAOlE;AAtEU,YAAY;IADxB,QAAQ,CAAC,OAAO,CAAC;GACL,YAAY,CA0HxB;;AACD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"UserResolver.js","sourceRoot":"","sources":["../../src/resolvers/UserResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAc,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAwB,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EAAqB,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,OAAO;CAG3C,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;;8CACN;AAFV,eAAe;IAD3B,UAAU,EAAE;GACA,eAAe,CAG3B;;AAaM,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,kBAAkB;IAG5C,AAAN,KAAK,CAAC,WAAW,CAAQ,OAAmB;QAC1C,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAY,CAAC;YAC3G,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC;aACrG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAC9B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAC1D,OAAO,CAAC,WAAW,CAAC,KAAK,CAC1B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7D,OAAO;YACL,GAAG,MAAM;YACT,KAAK,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC;SACpD,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAuB,EAAU,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QAC5F,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAElF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAA+B,UAAkB,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACpH,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC,CAAC;QAE1F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAA6B,KAAa,EAAS,EAAE,SAAS,EAAE,WAAW,EAAc;QACxG,MAAM,IAAI,CAAC,6BAA6B,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,KAAK,CAAC;QAC1B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAC,wBAAwB,EAAE,IAAI,EAAC,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAa,EAAE,OAAmB;QAC/D,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAErF,IAAI,WAAW,CAAC,oBAAoB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAClC,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAC3E,CAAC;QACF,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAa;YAC1C,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,QAAQ;SACrB,EAAE,WAAW,CAAC,CAAC;QAEhB,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAC7C,gBAAgB,EAChB,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,WAAW,EACX,QAAQ,CACQ,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAAmB,EACnB,IAAmC,EACnC,WAAsB,EACtB,QAA4B;QAE5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;YACvC,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,GAAG;SACxC,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAkB,CAAC;IAClH,CAAC;CACF,CAAA;AAxGO;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC;IACV,WAAA,GAAG,EAAE,CAAA;;;;+CAwBvB;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACL,WAAA,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAc,WAAA,GAAG,EAAE,CAAA;;;;4CAMtD;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACG,WAAA,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAAsB,WAAA,GAAG,EAAE,CAAA;;;;oDAM9E;AAGK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;IACF,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAAiB,WAAA,GAAG,EAAE,CAAA;;;;+CAOlE;AAvDU,YAAY;IADxB,QAAQ,CAAC,OAAO,CAAC;GACL,YAAY,CA2GxB;;AACD,eAAe,YAAY,CAAC"}

package/dist/resolvers/agent-run-data-guard.d.ts

@@ -0,0 +1,31 @@
+import type { UserPayload } from '../types.js';
+/**
+ * The API-key scope (`MJ: API Scopes.FullPath`) that makes an `mj_sk_*` key a trusted integration for reserved run
+ * data. Checked against the agent being run, so a key can be trusted for some agents only. `full_access` does not
+ * imply it: the key must hold this scope itself.
+ */
+export declare const TRUSTED_RUN_DATA_SCOPE = "agent:trusted";
+/** Who sent a run's `data`, as far as {@link IsTrustedAgentRunCaller} needs to know. */
+export interface ClientAgentRunCaller {
+    /**
+     * The request's authenticated payload, BEFORE any widget-guest elevation. `isSystemUser` is set only by
+     * the system API key (and by widget elevation, which {@link IsWidgetGuestRun} overrides); `apiKeyHash`
+     * only by an `mj_sk_*` user API key.
+     */
+    UserPayload: Pick<UserPayload, 'email' | 'isSystemUser' | 'apiKeyHash'>;
+    /** True when the run executes under the widget-guest elevated principal. Such a run is never trusted. */
+    IsWidgetGuestRun: boolean;
+    /** The agent the caller asked to run: the resource the {@link TRUSTED_RUN_DATA_SCOPE} check is made against. */
+    AgentID: string;
+}
+/**
+ * Whether a caller may set the reserved run-data keys — the value the agent-run resolvers pass as
+ * `ExecuteAgentParams.TrustReservedRunData`: the system user, or an API key that holds
+ * {@link TRUSTED_RUN_DATA_SCOPE} for this agent, and never a widget-guest run, whatever principal it was elevated to.
+ * A key without the scope is treated like the browser session of the user it belongs to.
+ *
+ * @param caller - Who sent the run's `data`.
+ * @returns `true` when the run may read the reserved keys from `data`.
+ */
+export declare function IsTrustedAgentRunCaller(caller: ClientAgentRunCaller): Promise<boolean>;
+//# sourceMappingURL=agent-run-data-guard.d.ts.map

package/dist/resolvers/agent-run-data-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-run-data-guard.d.ts","sourceRoot":"","sources":["../../src/resolvers/agent-run-data-guard.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACjC;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,cAAc,GAAG,YAAY,CAAC,CAAC;IACxE,yGAAyG;IACzG,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gHAAgH;IAChH,OAAO,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAS5F"}

package/dist/resolvers/agent-run-data-guard.js

@@ -0,0 +1,72 @@
+/**
+ * @fileoverview Decides which callers of the agent-run resolvers may set a run's scope or agent-type parameters
+ * through the free-form `data` argument.
+ *
+ * `BaseAgent` and `AgentRunner` read a few `ExecuteAgentParams.data` keys (`RESERVED_AGENT_RUN_DATA_KEYS` in
+ * `@memberjunction/ai-core-plus`) as fallbacks that change what a run is, not just what its prompt says:
+ *  - `PrimaryScopeEntityName`, `PrimaryScopeRecordID`, `SecondaryScopes` decide the run's scope: which
+ *    notes and examples memory is injected, the pre-execution RAG search context, the scoped prompt parts
+ *    and run settings, the scope columns written on the `MJ: AI Agent Runs` row, and what sub-agents
+ *    inherit. On a widget-guest run an explicit scope also beats the returning-visitor scope.
+ *  - `__agentTypePromptParams` is the highest-precedence agent-type parameter layer. It can turn on the
+ *    Loop type's `enableTaskGraphs` capability, and switch decisions on or off.
+ *
+ * The rule lives with the run, not here: `BaseAgent.Execute` drops those keys from every run's `data` unless the
+ * params set `ExecuteAgentParams.TrustReservedRunData`. The resolvers set that marker for the callers
+ * {@link IsTrustedAgentRunCaller} accepts — the system user, and an `mj_sk_*` API key that holds the
+ * {@link TRUSTED_RUN_DATA_SCOPE} scope — and never for a browser or a widget guest. Any user who may create API
+ * keys can mint one for themselves, so a key alone is not enough: an administrator grants the scope. Explorer never
+ * sends these keys. Everything else in `data` (template data, `conversationId`, `appContext`, `clientTools`, ...)
+ * reaches the run unchanged either way.
+ *
+ * @module @memberjunction/server/resolvers
+ */
+import { LogError } from '@memberjunction/core';
+import { GetAPIKeyEngine } from '@memberjunction/api-keys';
+import { UserCache } from '@memberjunction/generic-database-provider';
+/**
+ * The API-key scope (`MJ: API Scopes.FullPath`) that makes an `mj_sk_*` key a trusted integration for reserved run
+ * data. Checked against the agent being run, so a key can be trusted for some agents only. `full_access` does not
+ * imply it: the key must hold this scope itself.
+ */
+export const TRUSTED_RUN_DATA_SCOPE = 'agent:trusted';
+/**
+ * Whether a caller may set the reserved run-data keys — the value the agent-run resolvers pass as
+ * `ExecuteAgentParams.TrustReservedRunData`: the system user, or an API key that holds
+ * {@link TRUSTED_RUN_DATA_SCOPE} for this agent, and never a widget-guest run, whatever principal it was elevated to.
+ * A key without the scope is treated like the browser session of the user it belongs to.
+ *
+ * @param caller - Who sent the run's `data`.
+ * @returns `true` when the run may read the reserved keys from `data`.
+ */
+export async function IsTrustedAgentRunCaller(caller) {
+    if (caller.IsWidgetGuestRun) {
+        return false;
+    }
+    if (caller.UserPayload.isSystemUser === true) {
+        return true;
+    }
+    const apiKeyHash = caller.UserPayload.apiKeyHash;
+    return apiKeyHash ? keyHoldsTrustedRunDataScope(apiKeyHash, caller.AgentID) : false;
+}
+/**
+ * Whether the key explicitly holds {@link TRUSTED_RUN_DATA_SCOPE} for the agent. A key-level rule must match: an
+ * allow that comes from scope enforcement being switched off, or from `defaultBehaviorNoScopes: 'allow'`, matches
+ * no rule and does not count. Any failure counts as not held.
+ */
+async function keyHoldsTrustedRunDataScope(apiKeyHash, agentID) {
+    try {
+        const systemUser = UserCache.Instance.GetSystemUser();
+        if (!systemUser) {
+            return false;
+        }
+        // A probe, not an access decision (the run goes ahead either way), so it is not written to the usage log.
+        const result = await GetAPIKeyEngine().Authorize(apiKeyHash, 'MJAPI', TRUSTED_RUN_DATA_SCOPE, agentID, systemUser, { endpoint: '/graphql', method: 'POST' }, { skipLogging: true });
+        return result.Allowed && result.MatchedKeyRule != null;
+    }
+    catch (e) {
+        LogError(`IsTrustedAgentRunCaller: the ${TRUSTED_RUN_DATA_SCOPE} check failed; the run is not trusted: ${e}`);
+        return false;
+    }
+}
+//# sourceMappingURL=agent-run-data-guard.js.map

package/dist/resolvers/agent-run-data-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-run-data-guard.js","sourceRoot":"","sources":["../../src/resolvers/agent-run-data-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAgBtD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAA4B;IACtE,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;IACjD,OAAO,UAAU,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CAAC,UAAkB,EAAE,OAAe;IAC1E,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,0GAA0G;QAC1G,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,UAAU,EAC7G,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,QAAQ,CAAC,gCAAgC,sBAAsB,0CAA0C,CAAC,EAAE,CAAC,CAAC;QAC9G,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/dist/resolvers/agentVisionConsentAudit.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview The audit trail for agent-vision consent: one `MJ: Audit Logs` row each time a person allows, or stops
+ * letting, agents see their camera and shared screen in a meeting room, including when LiveKit refuses the change.
+ *
+ * The row is saved by the system user, as MJ's other server-written audit rows are, because the person may not be
+ * allowed to create audit rows themselves; `UserID` and `RecordID` are the person. When the audit log type has not
+ * been seeded, the entry goes to the server log instead, so a choice is never left unrecorded.
+ *
+ * Invoked from `RealtimeBridgeResolver.SetLiveKitAgentVision`.
+ *
+ * @module @memberjunction/server
+ */
+import { type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+/** The seeded audit log type (see `metadata/audit-log-types/.realtime-session-audit-types.json`). */
+export declare const REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE = "Realtime Agent Vision Consent";
+/** One consent change to record. */
+export interface AgentVisionConsentEntry {
+    /** The person who chose. */
+    User: UserInfo;
+    /** The room they chose for. */
+    RoomName: string;
+    /** `true` to let agents see their camera and shared screen, `false` to stop. */
+    Allow: boolean;
+    /** Whether LiveKit applied the change. */
+    Applied: boolean;
+    /** Why it was not applied. */
+    ErrorMessage?: string;
+}
+/**
+ * Writes the audit row for one consent change. Never throws: a failure to audit is logged, and the person's choice
+ * stands as LiveKit applied it.
+ *
+ * @param entry The change to record.
+ * @param provider The request's provider.
+ */
+export declare function WriteAgentVisionConsentAudit(entry: AgentVisionConsentEntry, provider: IMetadataProvider | null): Promise<void>;
+//# sourceMappingURL=agentVisionConsentAudit.d.ts.map

package/dist/resolvers/agentVisionConsentAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentVisionConsentAudit.d.ts","sourceRoot":"","sources":["../../src/resolvers/agentVisionConsentAudit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAY,KAAK,iBAAiB,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIvF,qGAAqG;AACrG,eAAO,MAAM,wCAAwC,kCAAkC,CAAC;AAKxF,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,OAAO,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpI"}

package/dist/resolvers/agentVisionConsentAudit.js

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview The audit trail for agent-vision consent: one `MJ: Audit Logs` row each time a person allows, or stops
+ * letting, agents see their camera and shared screen in a meeting room, including when LiveKit refuses the change.
+ *
+ * The row is saved by the system user, as MJ's other server-written audit rows are, because the person may not be
+ * allowed to create audit rows themselves; `UserID` and `RecordID` are the person. When the audit log type has not
+ * been seeded, the entry goes to the server log instead, so a choice is never left unrecorded.
+ *
+ * Invoked from `RealtimeBridgeResolver.SetLiveKitAgentVision`.
+ *
+ * @module @memberjunction/server
+ */
+import { LogError } from '@memberjunction/core';
+import { UserCache } from '@memberjunction/generic-database-provider';
+/** The seeded audit log type (see `metadata/audit-log-types/.realtime-session-audit-types.json`). */
+export const REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE = 'Realtime Agent Vision Consent';
+const AUDIT_LOG_ENTITY = 'MJ: Audit Logs';
+const USERS_ENTITY = 'MJ: Users';
+/**
+ * Writes the audit row for one consent change. Never throws: a failure to audit is logged, and the person's choice
+ * stands as LiveKit applied it.
+ *
+ * @param entry The change to record.
+ * @param provider The request's provider.
+ */
+export async function WriteAgentVisionConsentAudit(entry, provider) {
+    try {
+        const writer = UserCache.Instance.GetSystemUser();
+        const type = provider?.AuditLogTypes?.find((t) => t.Name?.trim().toLowerCase() === REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE.toLowerCase());
+        if (!provider || !writer || !type) {
+            LogError(`Agent vision consent not audited (${missingReason(provider, writer)}): user ${entry.User.ID}: ${describeChange(entry)}`);
+            return;
+        }
+        const row = await provider.GetEntityObject(AUDIT_LOG_ENTITY, writer);
+        row.NewRecord();
+        row.UserID = entry.User.ID;
+        row.AuditLogTypeID = type.ID;
+        row.Status = entry.Applied ? 'Success' : 'Failed';
+        row.EntityID = provider.EntityByName(USERS_ENTITY)?.ID ?? null;
+        row.RecordID = entry.User.ID;
+        row.Description = describeChange(entry);
+        row.Details = JSON.stringify({ roomName: entry.RoomName, allow: entry.Allow, error: entry.ErrorMessage ?? null });
+        if (!(await row.Save())) {
+            LogError(`Agent vision consent audit row not saved for user ${entry.User.ID}: ${row.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+        }
+    }
+    catch (error) {
+        LogError(`Agent vision consent audit write threw for user ${entry.User.ID}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/** Why the audit row can't be written: no provider, no system user, or the audit log type isn't seeded. */
+function missingReason(provider, writer) {
+    if (!provider) {
+        return 'no provider';
+    }
+    return writer ? `audit log type '${REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE}' is not seeded` : 'no system user';
+}
+/** One line saying what the person chose, and whether it was applied. */
+function describeChange(entry) {
+    const choice = entry.Allow ? 'Let agents see their camera and shared screen' : 'Stopped letting agents see their camera and shared screen';
+    return `${choice} in room ${entry.RoomName}${entry.Applied ? '' : ' (not applied)'}.`;
+}
+//# sourceMappingURL=agentVisionConsentAudit.js.map

package/dist/resolvers/agentVisionConsentAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentVisionConsentAudit.js","sourceRoot":"","sources":["../../src/resolvers/agentVisionConsentAudit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAyC,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEtE,qGAAqG;AACrG,MAAM,CAAC,MAAM,wCAAwC,GAAG,+BAA+B,CAAC;AAExF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,YAAY,GAAG,WAAW,CAAC;AAgBjC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAA8B,EAAE,QAAkC;IACnH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,wCAAwC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3I,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,QAAQ,CAAC,qCAAqC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnI,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAmB,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACvF,GAAG,CAAC,SAAS,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC/D,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,qDAAqD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,mDAAmD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,2GAA2G;AAC3G,SAAS,aAAa,CAAC,QAAkC,EAAE,MAAmC;IAC5F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,wCAAwC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAClH,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,KAA8B;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,2DAA2D,CAAC;IAC3I,OAAO,GAAG,MAAM,YAAY,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC;AACxF,CAAC"}

package/dist/resolvers/avatarInputValidation.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview Trust-boundary validation for the self-service avatar mutation
+ * (`UpdateMyAvatar` in `UserAvatarResolver`).
+ *
+ * The browser checks these values too, but its URL check is `new URL(...)`, which happily accepts
+ * `javascript:` and every `data:` type. The server is the boundary, so everything that reaches
+ * `MJ: Users.UserImageURL` / `UserImageIconClass` through the mutation passes through here first.
+ *
+ * Pure: no I/O, no provider, no entity — so it is unit-testable on its own.
+ *
+ * @module @memberjunction/server/resolvers/avatarInputValidation
+ */
+/** Largest DECODED image accepted in a `data:` URI. Matches the Explorer upload cap. */
+export declare const AVATAR_MAX_IMAGE_BYTES: number;
+/** Longest `http:` / `https:` image URL accepted. */
+export declare const AVATAR_MAX_URL_LENGTH = 2048;
+/** Longest icon class string accepted. */
+export declare const AVATAR_MAX_ICON_CLASS_LENGTH = 100;
+/** The outcome of {@link ValidateAvatarInput}. Empty strings are normalised to `null` (clear). */
+export interface AvatarInputValidationResult {
+    Valid: boolean;
+    /** Why the input was refused. Set only when `Valid` is false. */
+    ErrorMessage?: string;
+    /** The value to store in `UserImageURL`; `null` clears it. */
+    ImageURL: string | null;
+    /** The value to store in `UserImageIconClass`; `null` clears it. */
+    IconClass: string | null;
+}
+/**
+ * Validates a requested avatar. Null or empty values clear the corresponding column, so both
+ * null is a valid "revert to default".
+ *
+ * - `imageURL`: a `data:image/(png|jpeg|jpg|gif|webp);base64,...` URI whose decoded size is at most
+ *   {@link AVATAR_MAX_IMAGE_BYTES}, or an absolute `http:`/`https:` URL of at most
+ *   {@link AVATAR_MAX_URL_LENGTH} characters with no whitespace. Everything else is refused.
+ * - `iconClass`: at most {@link AVATAR_MAX_ICON_CLASS_LENGTH} characters of `[a-z0-9 -]`,
+ *   containing at least one `fa-` token.
+ */
+export declare function ValidateAvatarInput(imageURL: string | null | undefined, iconClass: string | null | undefined): AvatarInputValidationResult;
+//# sourceMappingURL=avatarInputValidation.d.ts.map

package/dist/resolvers/avatarInputValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarInputValidation.d.ts","sourceRoot":"","sources":["../../src/resolvers/avatarInputValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,wFAAwF;AACxF,eAAO,MAAM,sBAAsB,QAAa,CAAC;AAEjD,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,0CAA0C;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAehD,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IACxC,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oEAAoE;IACpE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC,2BAA2B,CAK7B"}

package/dist/resolvers/avatarInputValidation.js

@@ -0,0 +1,97 @@
+/**
+ * @fileoverview Trust-boundary validation for the self-service avatar mutation
+ * (`UpdateMyAvatar` in `UserAvatarResolver`).
+ *
+ * The browser checks these values too, but its URL check is `new URL(...)`, which happily accepts
+ * `javascript:` and every `data:` type. The server is the boundary, so everything that reaches
+ * `MJ: Users.UserImageURL` / `UserImageIconClass` through the mutation passes through here first.
+ *
+ * Pure: no I/O, no provider, no entity — so it is unit-testable on its own.
+ *
+ * @module @memberjunction/server/resolvers/avatarInputValidation
+ */
+/** Largest DECODED image accepted in a `data:` URI. Matches the Explorer upload cap. */
+export const AVATAR_MAX_IMAGE_BYTES = 200 * 1024;
+/** Longest `http:` / `https:` image URL accepted. */
+export const AVATAR_MAX_URL_LENGTH = 2048;
+/** Longest icon class string accepted. */
+export const AVATAR_MAX_ICON_CLASS_LENGTH = 100;
+/**
+ * Longest `data:` value that can still decode to {@link AVATAR_MAX_IMAGE_BYTES}: the longest accepted
+ * prefix plus the padded base64 payload. Anything longer is refused before the pattern scans it.
+ */
+const AVATAR_MAX_DATA_URI_LENGTH = 'data:image/jpeg;base64,'.length + Math.ceil(AVATAR_MAX_IMAGE_BYTES / 3) * 4;
+/** `data:image/<raster type>;base64,<payload>` — SVG is deliberately absent (it can carry script). */
+const DATA_URI_PATTERN = /^data:image\/(png|jpeg|jpg|gif|webp);base64,([A-Za-z0-9+/]+={0,2})$/;
+/** Lower-case Font Awesome class lists only, e.g. `fa-solid fa-user`. */
+const ICON_CLASS_PATTERN = /^[a-z0-9 -]+$/;
+const FA_TOKEN_PATTERN = /^fa-[a-z0-9-]+$/;
+/**
+ * Validates a requested avatar. Null or empty values clear the corresponding column, so both
+ * null is a valid "revert to default".
+ *
+ * - `imageURL`: a `data:image/(png|jpeg|jpg|gif|webp);base64,...` URI whose decoded size is at most
+ *   {@link AVATAR_MAX_IMAGE_BYTES}, or an absolute `http:`/`https:` URL of at most
+ *   {@link AVATAR_MAX_URL_LENGTH} characters with no whitespace. Everything else is refused.
+ * - `iconClass`: at most {@link AVATAR_MAX_ICON_CLASS_LENGTH} characters of `[a-z0-9 -]`,
+ *   containing at least one `fa-` token.
+ */
+export function ValidateAvatarInput(imageURL, iconClass) {
+    const image = imageURL ? imageURL : null;
+    const icon = iconClass ? iconClass : null;
+    const error = (image === null ? undefined : imageUrlError(image)) ?? (icon === null ? undefined : iconClassError(icon));
+    return error ? { Valid: false, ErrorMessage: error, ImageURL: null, IconClass: null } : { Valid: true, ImageURL: image, IconClass: icon };
+}
+/** Returns why an image value is refused, or `undefined` when it is acceptable. */
+function imageUrlError(value) {
+    if (value.startsWith('data:')) {
+        return dataUriError(value);
+    }
+    return httpUrlError(value);
+}
+function dataUriError(value) {
+    if (value.length > AVATAR_MAX_DATA_URI_LENGTH) {
+        return tooLargeError(Math.floor((value.length * 3) / 4));
+    }
+    const match = DATA_URI_PATTERN.exec(value);
+    if (!match || match[2].length % 4 !== 0) {
+        return 'Avatar image must be a base64 PNG, JPEG, GIF or WEBP data URI.';
+    }
+    const decodedBytes = decodedBase64Length(match[2]);
+    return decodedBytes > AVATAR_MAX_IMAGE_BYTES ? tooLargeError(decodedBytes) : undefined;
+}
+function tooLargeError(bytes) {
+    return `Avatar image must be ${AVATAR_MAX_IMAGE_BYTES / 1024}KB or smaller (this one is about ${Math.ceil(bytes / 1024)}KB).`;
+}
+/** Decoded byte length of a padded base64 string, without decoding it. */
+function decodedBase64Length(base64) {
+    const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
+    return (base64.length / 4) * 3 - padding;
+}
+function httpUrlError(value) {
+    const refusal = 'Avatar image URL must be an absolute http or https URL.';
+    if (value.length > AVATAR_MAX_URL_LENGTH) {
+        return `Avatar image URL must be ${AVATAR_MAX_URL_LENGTH} characters or fewer.`;
+    }
+    if (/\s/.test(value) || !/^https?:\/\//i.test(value)) {
+        return refusal;
+    }
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:' ? undefined : refusal;
+    }
+    catch {
+        return refusal;
+    }
+}
+/** Returns why an icon class is refused, or `undefined` when it is acceptable. */
+function iconClassError(value) {
+    const valid = value.length <= AVATAR_MAX_ICON_CLASS_LENGTH &&
+        ICON_CLASS_PATTERN.test(value) &&
+        value.split(' ').some((token) => FA_TOKEN_PATTERN.test(token));
+    return valid
+        ? undefined
+        : `Avatar icon must be a Font Awesome class list (lower-case letters, digits, spaces and hyphens, ` +
+            `${AVATAR_MAX_ICON_CLASS_LENGTH} characters or fewer, including an fa- class).`;
+}
+//# sourceMappingURL=avatarInputValidation.js.map

package/dist/resolvers/avatarInputValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"avatarInputValidation.js","sourceRoot":"","sources":["../../src/resolvers/avatarInputValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEjD,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,0CAA0C;AAC1C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,yBAAyB,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhH,sGAAsG;AACtG,MAAM,gBAAgB,GAAG,qEAAqE,CAAC;AAE/F,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAa3C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAC/B,QAAmC,EACnC,SAAoC;IAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9I,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,gEAAgE,CAAC;IAC5E,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,YAAY,GAAG,sBAAsB,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAChC,OAAO,wBAAwB,sBAAsB,GAAG,IAAI,oCAAoC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;AAClI,CAAC;AAED,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,MAAc;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,OAAO,GAAG,yDAAyD,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,OAAO,4BAA4B,qBAAqB,uBAAuB,CAAC;IACpF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,KAAa;IACjC,MAAM,KAAK,GACP,KAAK,CAAC,MAAM,IAAI,4BAA4B;QAC5C,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK;QACR,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iGAAiG;YAC7F,GAAG,4BAA4B,gDAAgD,CAAC;AAC9F,CAAC"}

package/dist/resolvers/currentUserRoles.d.ts

@@ -1,8 +1,37 @@
+import { UserInfo } from '@memberjunction/core';
 /**
  * Guards and filter builders for CurrentUser role loading.
  * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
  * without importing generated GraphQL types or the Apollo config bootstrap.
  */
+/**
+ * The session user's own fields, as CurrentUser returns them. The client asks for every field of
+ * `UserInfo` (GraphQLDataProvider builds its query from it), so each one belongs here; anything
+ * left out reaches the client as null (as IsTemplate once did, hiding the template-user banner).
+ */
+export declare function SessionUserFields(userRecord: UserInfo): {
+    ID: string;
+    Name: string;
+    FirstName: string;
+    LastName: string;
+    Title: string;
+    Email: string;
+    Type: string;
+    IsActive: boolean;
+    IsTemplate: boolean;
+    LinkedRecordType: "None" | "Other" | "Employee";
+    EmployeeID: number;
+    LinkedEntityID: number;
+    LinkedEntityRecordID: number;
+    __mj_CreatedAt: Date;
+    __mj_UpdatedAt: Date;
+    FirstLast: string;
+    EmployeeFirstLast: string;
+    EmployeeEmail: string;
+    EmployeeTitle: string;
+    EmployeeSupervisor: string;
+    EmployeeSupervisorEmail: string;
+};
 export declare function RequireLoadedUser<T extends {
     ID?: string;
 }>(user: T | null | undefined, email: string | undefined): T & {

package/dist/resolvers/currentUserRoles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"currentUserRoles.d.ts","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACzD,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAKpB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKxE;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1D,MAAM,EAAE,MAAM,GACb,IAAI,CAMN"}
+{"version":3,"file":"currentUserRoles.d.ts","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AAEH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;;EAwBrD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,SAAS;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACzD,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAKpB;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKnE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,CAAC,CAKxE;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1D,MAAM,EAAE,MAAM,GACb,IAAI,CAMN"}

package/dist/resolvers/currentUserRoles.js

@@ -4,6 +4,36 @@ import { LogError } from '@memberjunction/core';
  * Kept out of UserResolver so the login-adjacent failure modes are unit-testable
  * without importing generated GraphQL types or the Apollo config bootstrap.
  */
+/**
+ * The session user's own fields, as CurrentUser returns them. The client asks for every field of
+ * `UserInfo` (GraphQLDataProvider builds its query from it), so each one belongs here; anything
+ * left out reaches the client as null (as IsTemplate once did, hiding the template-user banner).
+ */
+export function SessionUserFields(userRecord) {
+    return {
+        ID: userRecord.ID,
+        Name: userRecord.Name,
+        FirstName: userRecord.FirstName,
+        LastName: userRecord.LastName,
+        Title: userRecord.Title,
+        Email: userRecord.Email,
+        Type: userRecord.Type,
+        IsActive: userRecord.IsActive,
+        IsTemplate: userRecord.IsTemplate,
+        LinkedRecordType: userRecord.LinkedRecordType,
+        EmployeeID: userRecord.EmployeeID,
+        LinkedEntityID: userRecord.LinkedEntityID,
+        LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
+        __mj_CreatedAt: userRecord.__mj_CreatedAt,
+        __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
+        FirstLast: userRecord.FirstLast,
+        EmployeeFirstLast: userRecord.EmployeeFirstLast,
+        EmployeeEmail: userRecord.EmployeeEmail,
+        EmployeeTitle: userRecord.EmployeeTitle,
+        EmployeeSupervisor: userRecord.EmployeeSupervisor,
+        EmployeeSupervisorEmail: userRecord.EmployeeSupervisorEmail,
+    };
+}
 export function RequireLoadedUser(user, email) {
     if (!user?.ID) {
         throw new Error(`CurrentUser: no user found for email '${email ?? ''}'`);

package/dist/resolvers/currentUserRoles.js.map

@@ -1 +1 @@
-{"version":3,"file":"currentUserRoles.js","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;GAIG;AAEH,MAAM,UAAU,iBAAiB,CAC/B,IAA0B,EAC1B,KAAyB;IAEzB,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,IAA0B;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,QAA8B;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0D,EAC1D,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;QACvD,QAAQ,CAAC,8CAA8C,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"currentUserRoles.js","sourceRoot":"","sources":["../../src/resolvers/currentUserRoles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAoB;IACpD,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;QACjD,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAA0B,EAC1B,KAAyB;IAEzB,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,IAA0B;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAI,QAA8B;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,WAAW,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0D,EAC1D,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;QACvD,QAAQ,CAAC,8CAA8C,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/resolvers/meetings/meetingMutations.d.ts

@@ -5,6 +5,12 @@ import * as defaultHelpers from './meetingHelpers.js';
 export type MeetingHelpers = typeof defaultHelpers;
 export declare function ExecuteCreateMeeting(provider: IMetadataProvider, user: UserInfo, input: CreateMeetingInput, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;
 export declare function ExecuteUpdateMeeting(provider: IMetadataProvider, user: UserInfo, input: UpdateMeetingInput, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;
+/**
+ * Starts a meeting for the `StartMeeting` mutation (`MeetingResolver`): marks it `Live`, ensures its Interaction, starts
+ * each agent participant in the room under an agent session created for it, starts an automatic recording, and mints the
+ * caller's client token. An agent that fails to start doesn't fail the meeting; the session created for it is closed
+ * (`Error`).
+ */
 export declare function ExecuteStartMeeting(provider: IMetadataProvider, user: UserInfo, meetingID: string, sessionManager: SessionManager, helpers?: Partial<MeetingHelpers>): Promise<StartMeetingResult>;
 export declare function ExecuteEndMeeting(provider: IMetadataProvider, user: UserInfo, meetingID: string, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;
 export declare function ExecuteCancelMeeting(provider: IMetadataProvider, user: UserInfo, meetingID: string, helpers?: Partial<MeetingHelpers>): Promise<MeetingResult>;

package/dist/resolvers/meetings/meetingMutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meetingMutations.d.ts","sourceRoot":"","sources":["../../../src/resolvers/meetings/meetingMutations.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAGjB,QAAQ,EACT,MAAM,sBAAsB,CAAC;AAY9B,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AAMnD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAoHxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA6IxB;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAmF7B;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAwCxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAiDxB"}
+{"version":3,"file":"meetingMutations.d.ts","sourceRoot":"","sources":["../../../src/resolvers/meetings/meetingMutations.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EAGjB,QAAQ,EACT,MAAM,sBAAsB,CAAC;AAY9B,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC;AAMnD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAoHxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA6IxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAkG7B;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAwCxB;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,aAAa,CAAC,CAiDxB"}

package/dist/resolvers/meetings/meetingMutations.js

@@ -235,6 +235,12 @@ export async function ExecuteUpdateMeeting(provider, user, input, helpers) {
         return { Success: false, ErrorMessage: msg };
     }
 }
+/**
+ * Starts a meeting for the `StartMeeting` mutation (`MeetingResolver`): marks it `Live`, ensures its Interaction, starts
+ * each agent participant in the room under an agent session created for it, starts an automatic recording, and mints the
+ * caller's client token. An agent that fails to start doesn't fail the meeting; the session created for it is closed
+ * (`Error`).
+ */
 export async function ExecuteStartMeeting(provider, user, meetingID, sessionManager, helpers) {
     const h = resolveHelpers(helpers);
     try {
@@ -261,8 +267,11 @@ export async function ExecuteStartMeeting(provider, user, meetingID, sessionMana
         const participants = await h.LoadParticipants(meeting.ID, user, provider);
         const agentParticipants = participants.filter((p) => p.Role === 'Agent' && p.AgentID);
         for (const ap of agentParticipants) {
+            // Set once this agent's session exists, so a start that fails after it was created can close it.
+            let createdSessionID;
             try {
                 const createdSession = await sessionManager.CreateSession({ agentID: ap.AgentID, userID: user.ID }, user, provider);
+                createdSessionID = createdSession.ID;
                 await LiveKitAgentRoomCoordinator.Instance.StartAgentRoomSession({
                     AgentSessionID: createdSession.ID,
                     RoomName: meeting.RoomName,
@@ -271,10 +280,22 @@ export async function ExecuteStartMeeting(provider, user, meetingID, sessionMana
                     MetadataProvider: provider,
                     TurnMode: 'Active',
                     TurnAddressing: 'Auto',
+                    // The session exists for this agent's time in the room alone: it closes when the agent leaves (the meeting is
+                    // ended, everyone leaves, the agent is stopped), not when the janitor finds it idle.
+                    Host: {
+                        OnSessionEnded: async (reason) => {
+                            await sessionManager.CloseSessionForEndedBridge(createdSession.ID, reason, user, provider);
+                        },
+                    },
                 });
             }
             catch (agentErr) {
                 LogError(`[MeetingResolver] Failed to start agent participant ${ap.AgentID} in room ${meeting.RoomName}: ${agentErr instanceof Error ? agentErr.message : String(agentErr)}`);
+                // The agent never joined, so the hook above never runs: close its session now (Error), not when the janitor finds
+                // it idle. The coordinator has already closed any model session the start opened (#5308).
+                if (createdSessionID) {
+                    await sessionManager.CloseSessionForFailedStart(createdSessionID, user, provider);
+                }
             }
         }
         // 3. Initiate recording if RecordingPolicy is 'Automatic'