@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/dist/agentSessions/SessionRunIDVerifier.js

@@ -0,0 +1,129 @@
+/**
+ * @fileoverview Checks the run ids a realtime session keeps in its `Config` before server code
+ * acts on them.
+ *
+ * @module @memberjunction/server
+ */
+import { LogError, RunView } from '@memberjunction/core';
+import { EscapeSQLString, IsValidUUID, UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/generic-database-provider';
+const AGENT_RUN_ENTITY = 'MJ: AI Agent Runs';
+const AGENT_RUN_STEP_ENTITY = 'MJ: AI Agent Run Steps';
+/**
+ * Keeps the run ids from a session's `Config` that are records of that session.
+ *
+ * The session owner can edit `Config`, so its run ids are claims. A run id is kept when it is the
+ * UUID of an `MJ: AI Agent Runs` row whose `AgentSessionID` is the session. The step id and the
+ * prompt run id are kept when they belong to that co-agent run: the step's `AgentRunID` is the
+ * co-agent run, and the prompt run is the `TargetLogID` of one of its `Prompt` steps.
+ *
+ * The lookups run as the system user when one is cached, else as the acting user. They are pinned
+ * to the session's id and return nothing to the caller, and row-level security can hide a session's
+ * own runs from its owner (a web-widget guest's delegated runs carry no `ConversationID`, which the
+ * guest's run filter keys on).
+ *
+ * Each call reads the database again (`BypassCache`) and keeps no result, because the links can
+ * change after a lookup: a run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` are
+ * updatable.
+ */
+export class SessionRunIDVerifier {
+    /**
+     * Returns the subset of `claimed` that belongs to the session now. Never throws: when a lookup
+     * fails, nothing is kept.
+     *
+     * @param sessionID The `MJ: AI Agent Sessions` id the claims were read from. The caller must have
+     *   checked that the session is the caller's own.
+     * @param claimed The run ids read from the session's `Config`.
+     * @param contextUser The acting user; the lookups run as it only when no system user is cached.
+     * @param provider The request-scoped metadata provider.
+     * @returns The claims that are records of the session.
+     */
+    async Verify(sessionID, claimed, contextUser, provider) {
+        const candidates = this.keepUUIDs(claimed);
+        if (!candidates.CoAgentRunID && !candidates.PendingFeedbackRunID) {
+            return {};
+        }
+        return (await this.lookUpOwned(sessionID.trim(), candidates, contextUser, provider)) ?? {};
+    }
+    /** Drops every claim that is not a UUID. The prompt run and step need a co-agent run to hang off. */
+    keepUUIDs(claimed) {
+        const coAgentRunID = this.uuidOrUndefined(claimed.CoAgentRunID);
+        return {
+            CoAgentRunID: coAgentRunID,
+            PromptRunID: coAgentRunID ? this.uuidOrUndefined(claimed.PromptRunID) : undefined,
+            CoAgentRunStepID: coAgentRunID ? this.uuidOrUndefined(claimed.CoAgentRunStepID) : undefined,
+            PendingFeedbackRunID: this.uuidOrUndefined(claimed.PendingFeedbackRunID),
+        };
+    }
+    uuidOrUndefined(value) {
+        return value && IsValidUUID(value) ? value.trim() : undefined;
+    }
+    /** Runs the lookups; `null` when one of them fails. */
+    async lookUpOwned(sessionID, candidates, contextUser, provider) {
+        const stepsQuery = this.stepsQuery(candidates);
+        const queries = stepsQuery ? [this.runsQuery(sessionID, candidates), stepsQuery] : [this.runsQuery(sessionID, candidates)];
+        try {
+            const lookupUser = UserCache.Instance.GetSystemUser() ?? contextUser;
+            const [runs, steps] = await RunView.FromMetadataProvider(provider).RunViews(queries, lookupUser);
+            const failed = [runs, steps].find((result) => result && !result.Success);
+            if (!runs || failed) {
+                LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${failed?.ErrorMessage ?? 'no result'}`);
+                return null;
+            }
+            return this.pickOwned(candidates, runs.Results, steps?.Results ?? []);
+        }
+        catch (error) {
+            LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+    /** The claimed runs that carry this session's id. */
+    runsQuery(sessionID, candidates) {
+        const ids = [candidates.CoAgentRunID, candidates.PendingFeedbackRunID]
+            .filter((id) => !!id)
+            .map((id) => `'${EscapeSQLString(id)}'`);
+        return {
+            EntityName: AGENT_RUN_ENTITY,
+            ExtraFilter: `AgentSessionID='${EscapeSQLString(sessionID)}' AND ID IN (${ids.join(', ')})`,
+            Fields: ['ID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+    /** The claimed co-agent run's steps that match the claimed step or prompt run; `null` when neither is claimed. */
+    stepsQuery(candidates) {
+        const matches = [];
+        if (candidates.CoAgentRunStepID) {
+            matches.push(`ID='${EscapeSQLString(candidates.CoAgentRunStepID)}'`);
+        }
+        if (candidates.PromptRunID) {
+            matches.push(`TargetLogID='${EscapeSQLString(candidates.PromptRunID)}'`);
+        }
+        if (!candidates.CoAgentRunID || matches.length === 0) {
+            return null;
+        }
+        return {
+            EntityName: AGENT_RUN_STEP_ENTITY,
+            ExtraFilter: `AgentRunID='${EscapeSQLString(candidates.CoAgentRunID)}' AND (${matches.join(' OR ')})`,
+            Fields: ['ID', 'StepType', 'TargetLogID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+    pickOwned(candidates, runs, steps) {
+        const isOwnedRun = (id) => !!id && runs.some((row) => UUIDsEqual(row.ID, id));
+        const coAgentRunID = isOwnedRun(candidates.CoAgentRunID) ? candidates.CoAgentRunID : undefined;
+        const ownedSteps = coAgentRunID ? steps : [];
+        const stepID = candidates.CoAgentRunStepID;
+        const promptRunID = candidates.PromptRunID;
+        return {
+            CoAgentRunID: coAgentRunID,
+            CoAgentRunStepID: stepID && ownedSteps.some((row) => UUIDsEqual(row.ID, stepID)) ? stepID : undefined,
+            PromptRunID: promptRunID && ownedSteps.some((row) => row.StepType === 'Prompt' && UUIDsEqual(row.TargetLogID, promptRunID))
+                ? promptRunID
+                : undefined,
+            PendingFeedbackRunID: isOwnedRun(candidates.PendingFeedbackRunID) ? candidates.PendingFeedbackRunID : undefined,
+        };
+    }
+}
+//# sourceMappingURL=SessionRunIDVerifier.js.map

package/dist/agentSessions/SessionRunIDVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRunIDVerifier.js","sourceRoot":"","sources":["../../src/agentSessions/SessionRunIDVerifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAqB,QAAQ,EAAE,OAAO,EAA2B,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEtE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AA2BvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IAC7B;;;;;;;;;;OAUG;IACI,KAAK,CAAC,MAAM,CACf,SAAiB,EACjB,OAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC/D,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,CAAC;IAED,qGAAqG;IAC7F,SAAS,CAAC,OAAsB;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO;YACH,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACjF,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oBAAoB,CAAC;SAC3E,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,KAAyB;QAC7C,OAAO,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,uDAAuD;IAC/C,KAAK,CAAC,WAAW,CACrB,SAAiB,EACjB,UAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3H,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,WAAW,CAAC;YACrE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAY,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5G,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;gBAClB,QAAQ,CAAC,uDAAuD,SAAS,KAAK,MAAM,EAAE,YAAY,IAAI,WAAW,EAAE,CAAC,CAAC;gBACrH,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,QAAQ,CAAC,uDAAuD,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxI,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,qDAAqD;IAC7C,SAAS,CAAC,SAAiB,EAAE,UAAyB;QAC1D,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,oBAAoB,CAAC;aACjE,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO;YACH,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,mBAAmB,eAAe,CAAC,SAAS,CAAC,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3F,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAED,kHAAkH;IAC1G,UAAU,CAAC,UAAyB;QACxC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,gBAAgB,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO;YACH,UAAU,EAAE,qBAAqB;YACjC,WAAW,EAAE,eAAe,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;YACrG,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC;YACzC,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAEO,SAAS,CAAC,UAAyB,EAAE,IAAiB,EAAE,KAAkB;QAC9E,MAAM,UAAU,GAAG,CAAC,EAAsB,EAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC3C,OAAO;YACH,YAAY,EAAE,YAAY;YAC1B,gBAAgB,EAAE,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACrG,WAAW,EACP,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAC1G,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,SAAS;YACnB,oBAAoB,EAAE,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;SAClH,CAAC;IACN,CAAC;CACJ"}

package/dist/agentSessions/index.d.ts

@@ -1,5 +1,7 @@
 export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
+export * from './BridgeHostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/agentSessions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AA8BA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAmCA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/dist/agentSessions/index.js

@@ -2,12 +2,14 @@
  * @fileoverview AI Agent Session lifecycle substrate (server-side, record + janitor layer).
  *
  * Exposes the session-record lifecycle manager, the orphan-reconciliation janitor, and the
- * per-process host identity helpers. The audio/media (WebRTC) transport and the long-lived
- * realtime agent run are deliberately **not** part of this layer — they arrive in P5.
+ * host-instance identity (`hostname:port:pid:bootId`) the janitor matches sessions by, which the
+ * realtime bridge engine is given for its bridge rows too (`BindBridgeEngineHostInstance`). The
+ * audio/media (WebRTC) transport and the long-lived realtime agent run are deliberately **not**
+ * part of this layer — they arrive in P5.
  *
  * @module @memberjunction/server
  */
-import { LoadWhiteboardChannelServer, LoadMeetingControlsChannelServer, LoadMediaChannelServer, LoadClientContextChannelServer } from '@memberjunction/ai-agents';
+import { LoadWhiteboardChannelServer, LoadMeetingControlsChannelServer, LoadMediaChannelServer, LoadClientContextChannelServer, LoadClientOnlyChannelServer, LoadIdentityVerificationChannelServer, LoadInteractiveComponentChannelServer } from '@memberjunction/ai-agents';
 import { LoadRemoteBrowserChannel } from '@memberjunction/remote-browser-server';
 import { LoadSelfHostRemoteBrowser } from '@memberjunction/remote-browser-selfhost';
 import { BindRemoteBrowserGoalEngine } from './remoteBrowserGoalEngine.js';
@@ -18,6 +20,9 @@ LoadWhiteboardChannelServer();
 LoadMeetingControlsChannelServer();
 LoadMediaChannelServer();
 LoadClientContextChannelServer();
+LoadClientOnlyChannelServer();
+LoadIdentityVerificationChannelServer();
+LoadInteractiveComponentChannelServer();
 // Remote Browser native channel (client-direct): the lifecycle-only server channel plugin + the
 // Self-Hosted Chrome backend driver (whose default runner launches a local headless Chromium via
 // Playwright — pulled in transitively through the SelfHost package, documented and acceptable).
@@ -28,6 +33,8 @@ LoadSelfHostRemoteBrowser();
 BindRemoteBrowserGoalEngine();
 export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
+export * from './BridgeHostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';
 //# sourceMappingURL=index.js.map

package/dist/agentSessions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,8EAA8E;AAC9E,gGAAgG;AAChG,6FAA6F;AAC7F,2BAA2B,EAAE,CAAC;AAC9B,gCAAgC,EAAE,CAAC;AACnC,sBAAsB,EAAE,CAAC;AACzB,8BAA8B,EAAE,CAAC;AACjC,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,wBAAwB,EAAE,CAAC;AAC3B,yBAAyB,EAAE,CAAC;AAC5B,wGAAwG;AACxG,wGAAwG;AACxG,2BAA2B,EAAE,CAAC;AAE9B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,qCAAqC,EAAE,qCAAqC,EAAE,MAAM,2BAA2B,CAAC;AAC7Q,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,8EAA8E;AAC9E,gGAAgG;AAChG,6FAA6F;AAC7F,2BAA2B,EAAE,CAAC;AAC9B,gCAAgC,EAAE,CAAC;AACnC,sBAAsB,EAAE,CAAC;AACzB,8BAA8B,EAAE,CAAC;AACjC,2BAA2B,EAAE,CAAC;AAC9B,qCAAqC,EAAE,CAAC;AACxC,qCAAqC,EAAE,CAAC;AACxC,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,wBAAwB,EAAE,CAAC;AAC3B,yBAAyB,EAAE,CAAC;AAC5B,wGAAwG;AACxG,wGAAwG;AACxG,2BAA2B,EAAE,CAAC;AAE9B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/dist/apiRoot.d.ts

@@ -0,0 +1,32 @@
+/** Options for {@link ApiRoute}. */
+export interface ApiRouteOptions {
+    /** Return the public absolute URL (`MJAPI_PUBLIC_URL` + subpath) instead of the server mount path. */
+    absolute?: boolean;
+}
+/**
+ * Normalizes a base-path value to a prefix with no trailing slash: `''` for `/`, `'/api'` for `/api/` or
+ * `/api`. Throws on a value that does not start with `/`, since Express would mount it nowhere.
+ */
+export declare function NormalizeApiRootPath(rootPath: string | undefined): string;
+/** Joins a base path and a subpath relative to it. Pure, so tests can drive any base path. */
+export declare function JoinApiRoute(apiRootPath: string, subpath: string): string;
+/** The running server's base path (`MJAPI_BASE_PATH`, no trailing slash; `''` at `/`). */
+export declare function ApiRootPath(): string;
+/**
+ * The server's configured public URL, derived exactly as it always has been: `MJAPI_PUBLIC_URL`, else
+ * `baseUrl:graphqlPort` + `graphqlRootPath`. Unchanged and untrimmed on purpose: it is the magic-link JWT
+ * issuer and the `publicUrl` handed to OAuth and server extensions, and changing it would invalidate issued
+ * tokens. Build URLs with `ApiRoute(subpath, { absolute: true })`, not from this.
+ */
+export declare function ConfiguredPublicUrl(): string;
+/**
+ * The path (or, with `{ absolute: true }`, the public URL) of a route under MJAPI's base path.
+ *
+ * `subpath` is relative to the base path and must start with `/`.
+ * - `ApiRoute('/media')` → `/media` at base `/`, `/api/media` at `MJAPI_BASE_PATH=/api`.
+ * - `ApiRoute('/media/abc', { absolute: true })` → `${MJAPI_PUBLIC_URL}/media/abc`. `MJAPI_PUBLIC_URL` is
+ *   wherever the world reaches MJAPI (prefix included), so the base path is never added to it. Without it,
+ *   the local fallback is `baseUrl:graphqlPort` + the base path.
+ */
+export declare function ApiRoute(subpath: string, options?: ApiRouteOptions): string;
+//# sourceMappingURL=apiRoot.d.ts.map

package/dist/apiRoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiRoot.d.ts","sourceRoot":"","sources":["../src/apiRoot.ts"],"names":[],"mappings":"AAgBA,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC5B,sGAAsG;IACtG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMzE;AAQD,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED,0FAA0F;AAC1F,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,CAO3E"}

package/dist/apiRoot.js

@@ -0,0 +1,67 @@
+/**
+ * MJAPI's base path: the single prefix every route MJAPI serves is mounted under (MJ #5674).
+ *
+ * MJAPI does not know where a proxy exposes it. Behind a proxy that forwards a prefix WITHOUT stripping it
+ * (CloudFront `/api/*` → MJAPI), MJAPI must listen under that prefix, so the host sets
+ * `MJAPI_BASE_PATH=/api`. Behind a stripping proxy, or with no proxy, it stays `/`. Every mount and every
+ * URL handed to a browser, an email or a webhook provider goes through {@link ApiRoute}, so one setting moves
+ * them all. CI enforces this (`check:api-root` and `__tests__/apiRootBoot.test.ts`).
+ *
+ * `GRAPHQL_ROOT_PATH` is a separate thing: only where Apollo listens. Do not derive routes from it.
+ *
+ * At the default base path `/` every value here is byte-identical to the root-mounted paths MJAPI always used.
+ */
+import { TrimTrailingSlashes } from '@memberjunction/global';
+import { configInfo } from './config.js';
+/**
+ * Normalizes a base-path value to a prefix with no trailing slash: `''` for `/`, `'/api'` for `/api/` or
+ * `/api`. Throws on a value that does not start with `/`, since Express would mount it nowhere.
+ */
+export function NormalizeApiRootPath(rootPath) {
+    const trimmed = (rootPath ?? '').trim();
+    if (trimmed && !trimmed.startsWith('/')) {
+        throw new Error(`MJAPI_BASE_PATH must start with '/', got '${trimmed}'`);
+    }
+    return TrimTrailingSlashes(trimmed);
+}
+function assertSubpath(subpath) {
+    if (typeof subpath !== 'string' || !subpath.startsWith('/')) {
+        throw new Error(`ApiRoute subpath must start with '/', got '${String(subpath)}'`);
+    }
+}
+/** Joins a base path and a subpath relative to it. Pure, so tests can drive any base path. */
+export function JoinApiRoute(apiRootPath, subpath) {
+    assertSubpath(subpath);
+    return `${NormalizeApiRootPath(apiRootPath)}${subpath}`;
+}
+/** The running server's base path (`MJAPI_BASE_PATH`, no trailing slash; `''` at `/`). */
+export function ApiRootPath() {
+    return NormalizeApiRootPath(configInfo.apiBasePath);
+}
+/**
+ * The server's configured public URL, derived exactly as it always has been: `MJAPI_PUBLIC_URL`, else
+ * `baseUrl:graphqlPort` + `graphqlRootPath`. Unchanged and untrimmed on purpose: it is the magic-link JWT
+ * issuer and the `publicUrl` handed to OAuth and server extensions, and changing it would invalidate issued
+ * tokens. Build URLs with `ApiRoute(subpath, { absolute: true })`, not from this.
+ */
+export function ConfiguredPublicUrl() {
+    return configInfo.publicUrl || `${configInfo.baseUrl}:${configInfo.graphqlPort}${configInfo.graphqlRootPath || ''}`;
+}
+/**
+ * The path (or, with `{ absolute: true }`, the public URL) of a route under MJAPI's base path.
+ *
+ * `subpath` is relative to the base path and must start with `/`.
+ * - `ApiRoute('/media')` → `/media` at base `/`, `/api/media` at `MJAPI_BASE_PATH=/api`.
+ * - `ApiRoute('/media/abc', { absolute: true })` → `${MJAPI_PUBLIC_URL}/media/abc`. `MJAPI_PUBLIC_URL` is
+ *   wherever the world reaches MJAPI (prefix included), so the base path is never added to it. Without it,
+ *   the local fallback is `baseUrl:graphqlPort` + the base path.
+ */
+export function ApiRoute(subpath, options) {
+    if (!options?.absolute) {
+        return JoinApiRoute(ApiRootPath(), subpath);
+    }
+    assertSubpath(subpath);
+    const base = configInfo.publicUrl || `${configInfo.baseUrl}:${configInfo.graphqlPort}${ApiRootPath()}`;
+    return `${TrimTrailingSlashes(base)}${subpath}`;
+}
+//# sourceMappingURL=apiRoot.js.map

package/dist/apiRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiRoot.js","sourceRoot":"","sources":["../src/apiRoot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC7D,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,OAAe;IAC7D,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW;IACvB,OAAO,oBAAoB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IAC/B,OAAO,UAAU,CAAC,SAAS,IAAI,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;AACxH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,OAAyB;IAC/D,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACrB,OAAO,YAAY,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IACD,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,IAAI,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,WAAW,GAAG,WAAW,EAAE,EAAE,CAAC;IACvG,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;AACpD,CAAC"}

package/dist/auth/AuthProviderCatalogRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderCatalogRouter.d.ts","sourceRoot":"","sources":["../../src/auth/AuthProviderCatalogRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAK9D,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAiB/C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,CAyBxD;AAED,+DAA+D;AAC/D,wBAAgB,+BAA+B,IAAI,MAAM,CAExD"}
+{"version":3,"file":"AuthProviderCatalogRouter.d.ts","sourceRoot":"","sources":["../../src/auth/AuthProviderCatalogRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAM9D,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAiB/C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,CAkDxD;AAED,+DAA+D;AAC/D,wBAAgB,+BAA+B,IAAI,MAAM,CAExD"}

package/dist/auth/AuthProviderCatalogRouter.js

@@ -11,6 +11,7 @@ import { Router } from 'express';
 import { rateLimit } from 'express-rate-limit';
 import { LogError } from '@memberjunction/core';
 import { AuthProviderEngine } from './AuthProviderEngine.js';
+import { EMPTY_PUBLIC_LOGIN_SCREEN, LoginScreenEngine } from './LoginScreenEngine.js';
 /** Mount path for the public catalog router. */
 export const AUTH_CATALOG_MOUNT_PATH = '/auth';
 /** Requests per window per IP. Generous — a browser makes one call per page load. */
@@ -64,6 +65,30 @@ export function CreateAuthProviderCatalogRouter() {
             res.status(200).json(empty);
         }
     });
+    /**
+     * `GET /auth/login-screen`: the default theme's PUBLISHED sign-in page, logos and seeds, for the login
+     * screen to draw before anyone signs in. Its own rate-limit budget (a 429 must answer in this route's
+     * shape), the catalog's cache window, and the same failure rule: empty, never an error.
+     */
+    const loginScreenLimiter = rateLimit({
+        windowMs: DEFAULT_RATE_LIMIT_WINDOW_MS,
+        limit: DEFAULT_RATE_LIMIT_MAX,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        message: EMPTY_PUBLIC_LOGIN_SCREEN
+    });
+    router.get('/login-screen', loginScreenLimiter, (_req, res) => {
+        try {
+            const body = LoginScreenEngine.Instance.GetPublicLoginScreen();
+            res.set('Cache-Control', `public, max-age=${CACHE_MAX_AGE_SECONDS}`);
+            res.status(200).json(body);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            LogError(`[Auth] Failed to serve the public login screen: ${message}`);
+            res.status(200).json(EMPTY_PUBLIC_LOGIN_SCREEN);
+        }
+    });
     return router;
 }
 /** @deprecated Use {@link CreateAuthProviderCatalogRouter}. */

package/dist/auth/AuthProviderCatalogRouter.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProviderCatalogRouter.js","sourceRoot":"","sources":["../../src/auth/AuthProviderCatalogRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAkC,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,qFAAqF;AACrF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,yBAAyB;AACzB,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAA8B,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACtG,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,qBAAqB,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,uDAAuD,OAAO,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,GAA8B,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,+BAA+B;IAC7C,OAAO,+BAA+B,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"AuthProviderCatalogRouter.js","sourceRoot":"","sources":["../../src/auth/AuthProviderCatalogRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAkC,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,gDAAgD;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,qFAAqF;AACrF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,yBAAyB;AACzB,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,GAA8B,EAAE,SAAS,EAAE,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACtG,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,qBAAqB,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,uDAAuD,OAAO,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,GAA8B,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,MAAM,kBAAkB,GAAG,SAAS,CAAC;QACnC,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,sBAAsB;QAC7B,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,yBAAyB;KACnC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC/D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,qBAAqB,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,mDAAmD,OAAO,EAAE,CAAC,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,+BAA+B;IAC7C,OAAO,+BAA+B,EAAE,CAAC;AAC3C,CAAC"}

package/dist/auth/LoginScreenEngine.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @fileoverview Caches the default theme for the public login-screen route.
+ *
+ * @module @memberjunction/server/auth
+ */
+import { BaseEngine, UserInfo, type IMetadataProvider } from '@memberjunction/core';
+import { type PublicLoginScreen } from '@memberjunction/theme-engine';
+/** What the route serves when there is no default theme, or it cannot be read. */
+export declare const EMPTY_PUBLIC_LOGIN_SCREEN: Readonly<PublicLoginScreen>;
+/**
+ * Holds the default Active theme, so `GET /auth/login-screen` answers every anonymous page load from
+ * memory. Saving a theme refreshes it, so a publish in Login Studio reaches the login screen without a
+ * restart. Severity `warn`: a failed load must not stop the server; the route then serves the stock page.
+ */
+export declare class LoginScreenEngine extends BaseEngine<LoginScreenEngine> {
+    private _defaultThemes;
+    static get Instance(): LoginScreenEngine;
+    Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void>;
+    /** The default theme's public projection: its PUBLISHED design (never the draft), seeds and logos made safe. */
+    GetPublicLoginScreen(): PublicLoginScreen;
+}
+//# sourceMappingURL=LoginScreenEngine.d.ts.map

package/dist/auth/LoginScreenEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginScreenEngine.d.ts","sourceRoot":"","sources":["../../src/auth/LoginScreenEngine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAgD,QAAQ,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAElI,OAAO,EAA8B,KAAK,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAElG,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,iBAAiB,CAA6D,CAAC;AAEhI;;;;GAIG;AACH,qBAMa,iBAAkB,SAAQ,UAAU,CAAC,iBAAiB,CAAC;IAClE,OAAO,CAAC,cAAc,CAAuB;IAE7C,WAAkB,QAAQ,IAAI,iBAAiB,CAE9C;IAEY,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAchH,gHAAgH;IACzG,oBAAoB,IAAI,iBAAiB;CAIjD"}

package/dist/auth/LoginScreenEngine.js

@@ -0,0 +1,57 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+/**
+ * @fileoverview Caches the default theme for the public login-screen route.
+ *
+ * @module @memberjunction/server/auth
+ */
+import { BaseEngine, RegisterForStartup } from '@memberjunction/core';
+import { PublicLoginScreenFromTheme } from '@memberjunction/theme-engine';
+/** What the route serves when there is no default theme, or it cannot be read. */
+export const EMPTY_PUBLIC_LOGIN_SCREEN = { ThemeName: null, Design: null, Seeds: null, Logos: {} };
+/**
+ * Holds the default Active theme, so `GET /auth/login-screen` answers every anonymous page load from
+ * memory. Saving a theme refreshes it, so a publish in Login Studio reaches the login screen without a
+ * restart. Severity `warn`: a failed load must not stop the server; the route then serves the stock page.
+ */
+let LoginScreenEngine = class LoginScreenEngine extends BaseEngine {
+    constructor() {
+        super(...arguments);
+        this._defaultThemes = [];
+    }
+    static get Instance() {
+        return super.getInstance();
+    }
+    async Config(forceRefresh, contextUser, provider) {
+        const configs = [
+            {
+                PropertyName: '_defaultThemes',
+                EntityName: 'MJ: Themes',
+                // One default is enforced by the app, not the schema; the most recently changed one wins (as in Login Studio).
+                Filter: `IsDefault = 1 AND Status = 'Active'`,
+                OrderBy: '__mj_UpdatedAt DESC',
+                CacheLocal: true
+            }
+        ];
+        await this.Load(configs, provider, forceRefresh, contextUser);
+    }
+    /** The default theme's public projection: its PUBLISHED design (never the draft), seeds and logos made safe. */
+    GetPublicLoginScreen() {
+        const theme = this.GetConfigData('_defaultThemes')[0];
+        return theme ? PublicLoginScreenFromTheme(theme) : EMPTY_PUBLIC_LOGIN_SCREEN;
+    }
+};
+LoginScreenEngine = __decorate([
+    RegisterForStartup({
+        priority: 20,
+        severity: 'warn',
+        deferred: false,
+        description: 'Caches the default theme that GET /auth/login-screen serves to the login screen'
+    })
+], LoginScreenEngine);
+export { LoginScreenEngine };
+//# sourceMappingURL=LoginScreenEngine.js.map

package/dist/auth/LoginScreenEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginScreenEngine.js","sourceRoot":"","sources":["../../src/auth/LoginScreenEngine.ts"],"names":[],"mappings":";;;;;;AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAA4B,kBAAkB,EAAoC,MAAM,sBAAsB,CAAC;AAElI,OAAO,EAAE,0BAA0B,EAA0B,MAAM,8BAA8B,CAAC;AAElG,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAgC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAEhI;;;;GAIG;AAOI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,UAA6B;IAA7D;;QACG,mBAAc,GAAoB,EAAE,CAAC;IAyB/C,CAAC;IAvBQ,MAAM,KAAK,QAAQ;QACxB,OAAO,KAAK,CAAC,WAAW,EAAqB,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC9F,MAAM,OAAO,GAAwC;YACnD;gBACE,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,YAAY;gBACxB,+GAA+G;gBAC/G,MAAM,EAAE,qCAAqC;gBAC7C,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EAAE,IAAI;aACjB;SACF,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,gHAAgH;IACzG,oBAAoB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAgB,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC/E,CAAC;CACF,CAAA;AA1BY,iBAAiB;IAN7B,kBAAkB,CAAC;QAClB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,iFAAiF;KAC/F,CAAC;GACW,iBAAiB,CA0B7B"}

package/dist/auth/actionAuthorization.d.ts

@@ -0,0 +1,40 @@
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/** The outcome of {@link EvaluateActionRunAuthorization}. */
+export interface ActionRunAuthorization {
+    /** True when the user may run the action. */
+    Allowed: boolean;
+    /** Why the run is allowed or refused. */
+    Reason: string;
+}
+/** One provider's authorization tree and the role grants on it. */
+export type AuthorizationMetadata = Pick<IMetadataProvider, 'Authorizations' | 'AuthorizationRoles'>;
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export declare function IsOwner(user: UserInfo): boolean;
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export declare function EvaluateActionRunAuthorization(user: UserInfo, actionAuthorizationIDs: readonly string[], metadata: AuthorizationMetadata, actionAuthorizesCaller: boolean): ActionRunAuthorization;
+//# sourceMappingURL=actionAuthorization.d.ts.map

package/dist/auth/actionAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionAuthorization.d.ts","sourceRoot":"","sources":["../../src/auth/actionAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGpI,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACnC,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAC;AAErG;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAE/C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAC1C,IAAI,EAAE,QAAQ,EACd,sBAAsB,EAAE,SAAS,MAAM,EAAE,EACzC,QAAQ,EAAE,qBAAqB,EAC/B,sBAAsB,EAAE,OAAO,GAChC,sBAAsB,CAkBxB"}

package/dist/auth/actionAuthorization.js

@@ -0,0 +1,94 @@
+import { AuthorizationRoleType } from '@memberjunction/core';
+import { FilterByUUIDs, IndexByUUID, NormalizeUUID, UUIDsEqual } from '@memberjunction/global';
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export function IsOwner(user) {
+    return user.Type?.trim().toLowerCase() === 'owner';
+}
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export function EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller) {
+    if (IsOwner(user)) {
+        return { Allowed: true, Reason: 'The user is an Owner.' };
+    }
+    if (actionAuthorizationIDs.length === 0) {
+        return actionAuthorizesCaller
+            ? { Allowed: true, Reason: 'The action authorizes its caller itself.' }
+            : { Allowed: false, Reason: 'No Action Authorization grants this action to any role, and the action does not authorize its caller itself; only an Owner may run it.' };
+    }
+    const authorizationsByID = IndexByUUID(metadata.Authorizations);
+    const userGrants = grantsToUserRoles(user, metadata.AuthorizationRoles);
+    const granted = actionAuthorizationIDs
+        .map((id) => authorizationsByID.Get(id))
+        .filter((auth) => auth !== undefined)
+        .find((auth) => holdsLinkedAuthorization(auth, authorizationsByID, userGrants));
+    return granted
+        ? { Allowed: true, Reason: `The user holds the "${granted.Name}" authorization.` }
+        : { Allowed: false, Reason: 'None of your roles holds an authorization this action requires.' };
+}
+/** The role grants that name one of the user's roles. */
+function grantsToUserRoles(user, grants) {
+    const userRoleIDs = (user.UserRoles ?? []).map((userRole) => userRole.RoleID);
+    return FilterByUUIDs(grants, userRoleIDs, (grant) => grant.RoleID);
+}
+/**
+ * True when the user holds a linked authorization: it is active, none of the user's roles is denied
+ * it, and the user holds it directly or through an ancestor. The first two are checked on the linked
+ * authorization itself, because the ancestor walk would otherwise grant it through the parent.
+ */
+function holdsLinkedAuthorization(auth, authorizationsByID, userGrants) {
+    if (!auth.IsActive || grantTypes(auth, userGrants).includes(AuthorizationRoleType.Deny)) {
+        return false;
+    }
+    return holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants);
+}
+/**
+ * True when the user holds the authorization or one of its ancestors, following `ParentID` within
+ * `authorizationsByID`. This is the walk `AuthorizationEvaluator.UserCanExecuteWithAncestors` does,
+ * with the role grants taken from the same provider as the authorizations.
+ */
+function holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants) {
+    const visited = new Set();
+    let node = auth;
+    while (node && !visited.has(NormalizeUUID(node.ID))) {
+        if (holdsDirectly(node, userGrants)) {
+            return true;
+        }
+        visited.add(NormalizeUUID(node.ID));
+        node = node.ParentID ? authorizationsByID.Get(node.ParentID) : undefined;
+    }
+    return false;
+}
+/** True when the authorization is active and the user's roles have an Allow and no Deny on it. */
+function holdsDirectly(auth, userGrants) {
+    const types = grantTypes(auth, userGrants);
+    return auth.IsActive && types.includes(AuthorizationRoleType.Allow) && !types.includes(AuthorizationRoleType.Deny);
+}
+/** Allow or Deny, for each of the user's role grants on the authorization. */
+function grantTypes(auth, userGrants) {
+    return userGrants.filter((grant) => UUIDsEqual(grant.AuthorizationID, auth.ID)).map((grant) => grant.AuthorizationType());
+}
+//# sourceMappingURL=actionAuthorization.js.map

package/dist/auth/actionAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionAuthorization.js","sourceRoot":"","sources":["../../src/auth/actionAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,qBAAqB,EAA+B,MAAM,sBAAsB,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAW,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAaxG;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAc;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAC1C,IAAc,EACd,sBAAyC,EACzC,QAA+B,EAC/B,sBAA+B;IAE/B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,sBAAsB;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE;YACvE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wIAAwI,EAAE,CAAC;IAC/K,CAAC;IACD,MAAM,kBAAkB,GAAG,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,sBAAsB;SACjC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,CAAC,IAAI,EAA6B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO;QACV,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,OAAO,CAAC,IAAI,kBAAkB,EAAE;QAClF,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;AACxG,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,IAAc,EAAE,MAAwC;IAC/E,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9E,OAAO,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAuB,EAAE,kBAA8C,EAAE,UAA4C;IACnJ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,8BAA8B,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,IAAuB,EAAE,kBAA8C,EAAE,UAA4C;IACzJ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,IAAI,GAAkC,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,IAAuB,EAAE,UAA4C;IACxF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACvH,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAuB,EAAE,UAA4C;IACrF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/dist/auth/index.d.ts

@@ -5,6 +5,7 @@ export * from './APIKeyScopeAuth.js';
 export * from './scopeLimitedPrincipal.js';
 export * from './actingContextResolver.js';
 export * from './AuthProviderEngine.js';
+export * from './LoginScreenEngine.js';
 export * from './AuthProviderCatalogRouter.js';
 export { InitializeAuthProviders, initializeAuthProviders, InitializeAuthProvidersFromMetadata, initializeAuthProvidersFromMetadata, RefreshAuthProviders, refreshAuthProviders, ValidateAuthProvidersRegistered, validateAuthProvidersRegistered } from './initializeProviders.js';
 /**