@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.5

package/dist/globalCors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalCors.js","sourceRoot":"","sources":["../src/globalCors.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAWrH;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACtC,QAAwC,EACxC,sBAAyC,EAAE;IAE3C,MAAM,WAAW,GAAG,QAAQ,EAAE,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/C,sFAAsF;IACtF,6FAA6F;IAC7F,yFAAyF;IACzF,sFAAsF;IACtF,8FAA8F;IAC9F,mFAAmF;IACnF,MAAM,UAAU,GAAG,IAAI,CAAmB;QACtC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YACzB,8DAA8D;YAC9D,qDAAqD;YACrD,IAAI,YAAY,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,IAAI,KAAK,CAAC,UAAU,MAAM,sBAAsB,CAAC,CAAC,CAAC;YAChE,CAAC;QACL,CAAC;QACD,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,KAAK;KACpC,CAAmB,CAAC;IACrB,OAAO,2BAA2B,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qCAAqC,CAAC,mBAAsC;IACxF,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,8BAA8B,CAAC,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO;QACX,CAAC;QACD,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;AACN,CAAC"}

package/dist/index.d.ts

@@ -25,6 +25,7 @@ export { Int, Float, ID } from 'type-graphql';
 export { NewUserBase } from './auth/newUsers.js';
 export { CreateIsolatedProvider } from './isolatedProvider.js';
 export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
+export { ApiRoute, ApiRootPath, ConfiguredPublicUrl, JoinApiRoute, NormalizeApiRootPath, type ApiRouteOptions } from './apiRoot.js';
 export { ServerExtensionLoader, BaseServerExtension, DefaultServerExtensionServiceRegistry } from '@memberjunction/server-extensions-core';
 export type { ServerExtensionConfig, ServerExtensionPhase, ServerExtensionServiceRegistry, ServerExtensionInitContext, ExtensionInitResult, ExtensionHealthResult, LoadExtensionsOptions, } from '@memberjunction/server-extensions-core';
 export * from './directives/index.js';
@@ -107,6 +108,7 @@ export * from './resolvers/FileCategoryResolver.js';
 export * from './resolvers/FileResolver.js';
 export * from './rest/MediaAccessKeys.js';
 export * from './rest/MediaStreamHandler.js';
+export * from './rest/RealtimeRecordingHandler.js';
 export * from './resolvers/InfoResolver.js';
 export * from './resolvers/PotentialDuplicateRecordResolver.js';
 export * from './resolvers/DuplicateEntryCheckResolver.js';
@@ -141,10 +143,19 @@ export type MJServerOptions = {
      */
     serverExtensions?: ServerExtensionConfig[];
 };
+/**
+ * Creates the Express application MJServer serves on. `X-Powered-By` is disabled: it only
+ * advertises the framework to scanners. {@link Serve} disables it again on a host-supplied app.
+ */
 export declare const CreateApp: () => Application;
 /** @deprecated Use {@link CreateApp}. */
 export declare const createApp: () => Application;
 export declare const Serve: (resolverPaths: Array<string>, app?: Application, options?: MJServerOptions) => Promise<void>;
 /** @deprecated Use {@link Serve}. */
 export declare const serve: (resolverPaths: Array<string>, app?: Application, options?: MJServerOptions) => Promise<void>;
+export { BuildSessionClaims, MagicLinkKeyManager, MagicLinkService, HashToken, GenerateRawToken } from './auth/magicLink/index.js';
+export type { MagicLinkJWTClaims } from './auth/magicLink/index.js';
+export { VerifyHostAssertion } from './realtimeWidget/host-identity.js';
+export type { HostAssertedIdentity, HostAssertionResult } from './realtimeWidget/host-identity.js';
+export { IsScopeLimitedPrincipal } from './auth/scopeLimitedPrincipal.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAY,gBAAgB,EAAqJ,MAAM,sBAAsB,CAAC;AAUrN,OAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAS/C,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,EAA2I,cAAc,EAAE,MAAM,aAAa,CAAC;AAwEtL,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAA4I,MAAM,wCAAwC,CAAC;AAOhP,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAC;AAE/E;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAED,yCAAyC;AACzC,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,cAAc,cAAc,CAAC;AAI7B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAC;AAC3I,YAAY,EACR,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,wCAAwC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACH,aAAa,EACb,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,GACnB,MAAM,iBAAiB,CAAC;AACzB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAOhD,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAChH,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAIxE;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,qBAAqB,GAAG,IAAI,CAEvE;AAED,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AAGjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iDAAiD,CAAC;AAChE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErH,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AAStC,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,EAAE,CAAC;CAC5C,CAAC;AAUF,eAAO,MAAM,SAAS,QAAO,WAAwB,CAAC;AAEtD,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAHO,WAGK,CAAC;AAgHnC,eAAO,MAAM,KAAK,GAAU,eAAe,KAAK,CAAC,MAAM,CAAC,EAAE,MAAK,WAAyB,EAAE,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CA86CjI,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,KAAK,kBAj7CyB,KAAK,CAAC,MAAM,CAAC,QAAO,WAAW,YAA0B,eAAe,KAAG,OAAO,CAAC,IAAI,CAi7CxG,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAY,gBAAgB,EAA+J,MAAM,sBAAsB,CAAC;AAU/N,OAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAS/C,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,EAA2I,cAAc,EAAE,MAAM,aAAa,CAAC;AAiEtL,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAA+K,MAAM,wCAAwC,CAAC;AAUnR,OAAO,EAAE,mCAAmC,EAAE,MAAM,0BAA0B,CAAC;AAE/E;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAED,yCAAyC;AACzC,wBAAgB,SAAS,IAAI,gBAAgB,CAE5C;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,cAAc,cAAc,CAAC;AAI7B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACpI,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAC;AAC3I,YAAY,EACR,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,wCAAwC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC9E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,YAAY,CAAC;AAC3B,OAAO,EACH,aAAa,EACb,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,GACnB,MAAM,iBAAiB,CAAC;AACzB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAOhD,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAChH,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAIxE;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,qBAAqB,GAAG,IAAI,CAEvE;AAED,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,kCAAkC,CAAC;AAGjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kCAAkC,CAAC;AACjD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iDAAiD,CAAC;AAChE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,0BAA0B,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErH,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AAStC,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,EAAE,CAAC;CAC5C,CAAC;AAUF;;;GAGG;AACH,eAAO,MAAM,SAAS,QAAO,WAI5B,CAAC;AAEF,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAPO,WAOK,CAAC;AAgHnC,eAAO,MAAM,KAAK,GAAU,eAAe,KAAK,CAAC,MAAM,CAAC,EAAE,MAAK,WAAyB,EAAE,UAAU,eAAe,KAAG,OAAO,CAAC,IAAI,CAi0CjI,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,KAAK,kBAp0CyB,KAAK,CAAC,MAAM,CAAC,QAAO,WAAW,YAA0B,eAAe,KAAG,OAAO,CAAC,IAAI,CAo0CxG,CAAC;AA6b3B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACnI,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/index.js

@@ -41,21 +41,17 @@ import { StartupLogger } from './logging/StartupLogger.js';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import createMSSQLConfig from './orm.js';
 import { setupRESTEndpoints } from './rest/setupRESTEndpoints.js';
-import { createOAuthCallbackHandler } from './rest/OAuthCallbackHandler.js';
-import { createSignatureWebhookHandler } from './rest/SignatureWebhookHandler.js';
-import { createMediaStreamRouter } from './rest/MediaStreamHandler.js';
-import { createRealtimeSdpBrokerRouter } from './rest/RealtimeSdpBrokerHandler.js';
-import { REALTIME_SDP_EXCHANGE_PATH } from '@memberjunction/ai';
-import { createMagicLinkHandler, createMagicLinkJwksRouter, registerMagicLinkAuthProvider, MAGIC_LINK_MOUNT_PATH } from './auth/magicLink/index.js';
-import { createWidgetHandler, WIDGET_MOUNT_PATH } from './realtimeWidget/index.js';
-import { CreateRealtimeVerifyRouter, REALTIME_VERIFY_MOUNT_PATH, RealtimeSessionEventService, RealtimeSessionVerificationService, ParseReplicatedRealtimeSessionEvent, } from './realtimeSessions/index.js';
+import { CreateRealtimeRecordingRouter, REALTIME_RECORDING_MOUNT_PATH } from './rest/RealtimeRecordingHandler.js';
+import { LoadOwnedRealtimeSession } from './realtimeSessions/ownedRealtimeSession.js';
+import { LoadSessionConversationExternalID } from './realtimeSessions/sessionAccess.js';
+import { RecordingAssemblyScheduler } from './realtimeSessions/RecordingAssemblyScheduler.js';
+import { RealtimeSessionEventService, ParseReplicatedRealtimeSessionEvent, } from './realtimeSessions/index.js';
 import { resolve } from 'node:path';
 import { DataSourceInfo, raiseEvent } from './types.js';
 import { ScheduledJobsService } from './services/ScheduledJobsService.js';
 import { IntegrationSyncWorkerService } from './services/IntegrationSyncWorkerService.js';
 import { LocalCacheManager, TelemetryManager, LogStatus, LogError, SetVerboseLogging } from '@memberjunction/core';
 import { validateAuthProvidersRegistered } from './auth/index.js';
-import { createAuthProviderCatalogRouter, AUTH_CATALOG_MOUNT_PATH } from './auth/AuthProviderCatalogRouter.js';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { ActionEngineServer } from '@memberjunction/actions';
 import { CreateAdhocSQLAuthorizer } from './resolvers/AdhocQueryResolver.js';
@@ -67,7 +63,7 @@ import { RoomHandoffEngine } from '@memberjunction/livekit-room-server';
 import { IntegrationProgressEmitter } from '@memberjunction/integration-progress-artifacts';
 import { PublishIntegrationProgress } from './resolvers/IntegrationProgressResolver.js';
 import { RegisterRSUProgressBridge } from './integration/RSUProgressBridge.js';
-import { ClientToolRequestManager, AgentRunWatchdog } from '@memberjunction/ai-agents';
+import { ClientToolRequestManager, AgentRunWatchdog, SqlRealtimeRecordingLedger } from '@memberjunction/ai-agents';
 import { BindBridgeEngineHostInstance, SessionJanitor, SetHostInstancePort, StartBridgeOrphanReconciliation } from './agentSessions/index.js';
 import { StartTaskGraphDispatcher } from './services/StartTaskGraphDispatcher.js';
 import { MJServerWorkQueueProviderSource, StartWorkQueueHost } from './services/WorkQueueHostService.js';
@@ -76,8 +72,11 @@ import { MJStorageBlobStore } from './services/MJStorageBlobStore.js';
 import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData, ConfigureRecordDataBroadcast } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
-import { ServerExtensionLoader, mergeServerExtensionConfigs, prepareServerExtensionConfigs, describeServerExtensionMount, InstallMediaUpgradeDispatcher, IsGraphQLWsPath } from '@memberjunction/server-extensions-core';
-import { coreReservedServerExtensionRoots } from './serverExtensionReservedRoots.js';
+import { ServerExtensionLoader, mergeServerExtensionConfigs, prepareServerExtensionConfigs, describeServerExtensionMount, InstallMediaUpgradeDispatcher, IsGraphQLWsPath, GetCorsOwningServerExtensionRoots } from '@memberjunction/server-extensions-core';
+import { CreateExtensionOwnedPreflightFallback, CreateGlobalCorsMiddleware } from './globalCors.js';
+import { CoreReservedServerExtensionRoots } from './serverExtensionReservedRoots.js';
+import { ApiRoute, ApiRootPath, ConfiguredPublicUrl } from './apiRoot.js';
+import { MountHealthcheckRoute, MountPublicCoreRoutes, MountExtensionHealthRoute, MountAuthCatalogRoute, MountAuthenticatedCoreRoutes } from './coreRoutes.js';
 import { MetadataCacheRefreshIntervalSeconds } from './providerConfigUnits.js';
 import { CreateMetadataRefreshSignalHandler, METADATA_REFRESH_SIGNAL } from './metadataRefreshSignal.js';
 const cacheRefreshInterval = configInfo.databaseSettings.metadataCacheRefreshInterval;
@@ -110,6 +109,7 @@ export { Int, Float, ID } from 'type-graphql';
 export { NewUserBase } from './auth/newUsers.js';
 export { CreateIsolatedProvider } from './isolatedProvider.js';
 export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
+export { ApiRoute, ApiRootPath, ConfiguredPublicUrl, JoinApiRoute, NormalizeApiRootPath } from './apiRoot.js';
 export { ServerExtensionLoader, BaseServerExtension, DefaultServerExtensionServiceRegistry } from '@memberjunction/server-extensions-core';
 export * from './directives/index.js';
 export { NoLog, hasNoLogParameter, getNoLogFields } from './logging/NoLog.js';
@@ -199,6 +199,7 @@ export * from './resolvers/FileCategoryResolver.js';
 export * from './resolvers/FileResolver.js';
 export * from './rest/MediaAccessKeys.js';
 export * from './rest/MediaStreamHandler.js';
+export * from './rest/RealtimeRecordingHandler.js';
 export * from './resolvers/InfoResolver.js';
 export * from './resolvers/PotentialDuplicateRecordResolver.js';
 export * from './resolvers/DuplicateEntryCheckResolver.js';
@@ -232,7 +233,15 @@ const localPath = (p) => {
     const resolvedPath = resolve(dirname, p);
     return resolvedPath;
 };
-export const CreateApp = () => express();
+/**
+ * Creates the Express application MJServer serves on. `X-Powered-By` is disabled: it only
+ * advertises the framework to scanners. {@link Serve} disables it again on a host-supplied app.
+ */
+export const CreateApp = () => {
+    const app = express();
+    app.disable('x-powered-by');
+    return app;
+};
 /** @deprecated Use {@link CreateApp}. */
 export const createApp = CreateApp;
 /**
@@ -707,6 +716,8 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
     if (sharedCache) {
         await LocalCacheManager.Instance.SetStorageProvider(sharedCache);
     }
+    // The derived per-entry ceiling, so the boot log says what the largest cacheable entry actually is.
+    startupLog.LogIf('verbose', `LocalCacheManager: largest cacheable entry ${Math.floor(LocalCacheManager.Instance.MaxEntrySizeBytes / 1024 / 1024)} MB (maxEntryPercentOfCache: ${configInfo.cacheSettings?.maxEntryPercentOfCache ?? 'auto'})`);
     const engineSweepMs = StartEngineSweeper(configInfo.cacheSettings);
     startupLog.LogIf('verbose', engineSweepMs > 0 ? `Engine/database sweep every ${engineSweepMs / 1000}s` : 'Engine/database sweep disabled');
     const userCacheCheckMs = StartUserCacheChecks(configInfo.cacheSettings);
@@ -1074,6 +1085,8 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
     const apolloServer = buildApolloServer({ schema }, { httpServer, serverCleanup }, mwApolloPlugins.length > 0 ? mwApolloPlugins : undefined);
     await apolloServer.start();
     // Fix #8: Add compression for better throughput performance
+    // Never advertise the framework (`X-Powered-By: Express`) — the host may have passed its own app.
+    app.disable('x-powered-by');
     app.use(compression({
         // Don't compress responses smaller than 1KB
         threshold: 1024,
@@ -1093,102 +1106,21 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
         // High compression level (good balance between CPU and compression ratio)
         level: 6
     }));
-    // Health check endpoint - registered before auth middleware so cloud
-    // platform probes (Azure App Service, AWS ALB, k8s, etc.) don't
-    // generate noisy auth errors in the logs. CORS is enabled so browser-based
-    // clients (e.g. MJExplorer's connectivity poller) can read the response.
-    app.get('/healthcheck', cors(), (_req, res) => {
-        res.status(200).json({ status: 'ok' });
-    });
+    // Health check — before every middleware contribution and the auth middleware, so cloud platform
+    // probes never generate auth noise. Every core route mounts under MJAPI_BASE_PATH (see apiRoot.ts).
+    MountHealthcheckRoute(app);
     // Apply middleware-contributed pre-auth handlers (after compression, before routes)
     for (const mw of mwPreAuth) {
         app.use(mw);
     }
-    // ─── OAuth callback routes (unauthenticated, registered BEFORE auth) ─────
-    const oauthPublicUrl = configInfo.publicUrl || `${configInfo.baseUrl}:${configInfo.graphqlPort}${configInfo.graphqlRootPath || ''}`;
+    // ─── Public core routes (unauthenticated, registered BEFORE auth) ─────
+    // OAuth callback, eSignature, media, realtime SDP broker, magic-link, widget, realtime verify — see
+    // coreRoutes.ts. New custom routes belong in Server Extensions, never in serve().
+    // oauthPublicUrl is the configured public URL, derived as it always was; it is also the magic-link JWT
+    // issuer, so it stays untrimmed. Outward links use ApiRoute(…, { absolute: true }) instead.
+    const oauthPublicUrl = ConfiguredPublicUrl();
     startupLog.LogIf('verbose', `[OAuth] publicUrl: ${oauthPublicUrl}`);
-    let oauthAuthenticatedRouter;
-    if (oauthPublicUrl) {
-        const { callbackRouter, authenticatedRouter } = createOAuthCallbackHandler({
-            publicUrl: oauthPublicUrl,
-            successRedirectUrl: `${oauthPublicUrl}/oauth/success`,
-            errorRedirectUrl: `${oauthPublicUrl}/oauth/error`,
-            // Constrains where a caller-supplied frontendReturnUrl may point (open-redirect guard).
-            allowedFrontendOrigins: configInfo.cors?.allowedOrigins ?? ['*']
-        });
-        oauthAuthenticatedRouter = authenticatedRouter;
-        const oauthCors = cors();
-        // OAuth callback is unauthenticated (called by external auth server)
-        app.use('/oauth', oauthCors, callbackRouter);
-        startupLog.LogIf('verbose', '[OAuth] Callback route registered at /oauth/callback');
-    }
-    // ─── Core HTTP Routes (Static Core Infrastructure) ─────────────────────────
-    // IMPORTANT ARCHITECTURAL NOTE:
-    // The route mounts below are strictly reserved for core framework infrastructure (OAuth, eSignature,
-    // media streaming, realtime WebRTC broker, magic-link, widgets).
-    // ALL new custom routes, external webhooks, vendor adapters, and application integrations MUST be
-    // implemented as Server Extensions (subclasses of BaseServerExtension in @memberjunction/server-extensions-core)
-    // mounted via ServerExtensionLoader — NEVER hardcoded as ad-hoc app.use() in serve().
-    // See guides/SERVER_EXTENSIONS_GUIDE.md for complete patterns and best practices.
-    // ─── eSignature webhook (unauthenticated, registered BEFORE auth) ─────
-    // Called by external signature providers (DocuSign Connect, etc.) without an MJ bearer token.
-    // The provider DRIVER verifies the payload signature/HMAC; MJ auth does not apply here.
-    app.use('/esignature', cors(), createSignatureWebhookHandler());
-    startupLog.LogIf('verbose', '[eSignature] Webhook route registered at /esignature/webhook/:driverKey');
-    // ─── Authenticated media streaming (token-gated, registered BEFORE auth) ─────
-    // The `?token=` query param (minted by CreateMediaAccessToken after a per-user permission
-    // check) is the capability — the route verifies it itself, so it does NOT use the MJ bearer
-    // auth middleware (an <audio>/<video> element can't send Authorization headers).
-    app.use('/media', cors(), createMediaStreamRouter());
-    startupLog.LogIf('verbose', '[Media] Streaming route registered at /media/:fileId');
-    // ─── Realtime WebRTC SDP broker (ticket-gated, registered BEFORE auth) ───────
-    if (configInfo.realtime?.enabled) {
-        app.use(REALTIME_SDP_EXCHANGE_PATH, cors(), createRealtimeSdpBrokerRouter());
-        startupLog.LogIf('verbose', `[Realtime] WebRTC SDP broker registered at ${REALTIME_SDP_EXCHANGE_PATH}`);
-    }
-    // ─── Magic-link routes (MJ-issued, app-scoped external access) ───────────
-    // Public router (JWKS + redeem) mounts BEFORE the auth middleware; the
-    // authenticated invite-creation router mounts AFTER it (see below).
-    let widgetAuthenticatedRouter;
-    let magicLinkAuthenticatedRouter;
-    if (configInfo.magicLink?.enabled) {
-        const { publicRouter, authenticatedRouter } = createMagicLinkHandler(oauthPublicUrl, configInfo.magicLink);
-        magicLinkAuthenticatedRouter = authenticatedRouter;
-        registerMagicLinkAuthProvider(oauthPublicUrl, configInfo.magicLink);
-        app.use(MAGIC_LINK_MOUNT_PATH, cors(), publicRouter);
-        startupLog.LogIf('verbose', `[MagicLink] Public routes registered at ${MAGIC_LINK_MOUNT_PATH}/redeem and ${MAGIC_LINK_MOUNT_PATH}/jwks.json`);
-    }
-    // ─── Public web widget: guest-session mint (PUBLIC, before auth mw) ───────
-    // Visitors hold no MJ JWT yet, so POST /widget/session is public. It reuses the
-    // magic-link RS256 key + `magic-link` auth provider (ensured idempotently inside
-    // createWidgetHandler), so it stands on its own even if magicLink.enabled is false.
-    if (configInfo.widget?.enabled) {
-        const { publicRouter: widgetRouter, authenticatedRouter: widgetAuthRouter } = createWidgetHandler(oauthPublicUrl, configInfo.widget);
-        widgetAuthenticatedRouter = widgetAuthRouter;
-        app.use(WIDGET_MOUNT_PATH, cors(), widgetRouter);
-        // The widget reuses the magic-link RS256 key + auth provider to validate guest
-        // tokens, which validates by fetching the JWKS at MAGIC_LINK_MOUNT_PATH/jwks.json.
-        // When magic-link itself is disabled its public router (which serves JWKS) never
-        // mounts, so publish the key here — otherwise every guest token fails validation
-        // (the auth middleware can't fetch the public key) and the widget 401s.
-        if (!configInfo.magicLink?.enabled) {
-            app.use(MAGIC_LINK_MOUNT_PATH, cors(), createMagicLinkJwksRouter());
-            startupLog.LogIf('verbose', `[Widget] Published reused signing key at ${MAGIC_LINK_MOUNT_PATH}/jwks.json (magic-link flow disabled)`);
-        }
-        startupLog.LogIf('verbose', `[Widget] Public routes registered at ${WIDGET_MOUNT_PATH}/session and ${WIDGET_MOUNT_PATH}/session/refresh`);
-    }
-    // ─── Realtime identity verification: PUBLIC verify-link routes (before auth mw) ───
-    // The person opening the emailed link holds no MJ token — the single-use token is the capability.
-    // GET only renders a confirm button; the POST redeems (mail scanners GET every link). Mounted only
-    // when verification is enabled AND able to send mail AND able to protect its codes (see
-    // realtime.identityVerification config: communicationProvider + hmacSecret).
-    if (configInfo.realtime?.identityVerification?.enabled && !RealtimeSessionVerificationService.Instance.IsEnabled) {
-        console.warn('[RealtimeVerify] realtime.identityVerification.enabled is true but verification is unavailable: it needs a communicationProvider and an hmacSecret of at least 16 characters.');
-    }
-    if (RealtimeSessionVerificationService.Instance.IsEnabled) {
-        app.use(REALTIME_VERIFY_MOUNT_PATH, cors(), CreateRealtimeVerifyRouter());
-        startupLog.LogIf('verbose', `[RealtimeVerify] Public routes registered at ${REALTIME_VERIFY_MOUNT_PATH}/:token (GET) and ${REALTIME_VERIFY_MOUNT_PATH} (POST)`);
-    }
+    const coreAuthenticatedRouters = MountPublicCoreRoutes(app, oauthPublicUrl, startupLog);
     // ─── Server extensions loader & shared service registry ───────────────────
     const extensionLoader = new ServerExtensionLoader();
     _currentExtensionLoader = extensionLoader;
@@ -1255,13 +1187,14 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
     const mergedHostExtensions = mergeServerExtensionConfigs(telephonyExtensionConfigs, rawHostExtensions);
     // Open App packages publish their extensions; host mj.config.cjs overlays by DriverClass
     // (and remains the only source for host-only extensions such as Slack/Teams).
-    // extraReservedRoots is derived from the mounts registered above plus graphqlRootPath
-    // so a new pre-auth app.use(...) in serve() must also be added to
-    // coreReservedServerExtensionRoots() — otherwise an Open App can claim it.
+    // Every RootPath is relative to MJAPI_BASE_PATH: apiRootPath composes the real mount path, and
+    // extraReservedRoots (also relative) must list every core mount in coreRoutes.ts, otherwise an
+    // Open App can claim it.
     const extensionConfigs = prepareServerExtensionConfigs(mergeServerExtensionConfigs(options?.serverExtensions ?? [], mergedHostExtensions), {
         onInvalid: (message) => LogError(message),
         onOverlap: (message) => LogStatus(message),
-        extraReservedRoots: coreReservedServerExtensionRoots(graphqlRootPath),
+        extraReservedRoots: CoreReservedServerExtensionRoots(),
+        apiRootPath: ApiRootPath(),
     });
     for (const cfg of extensionConfigs) {
         LogStatus(`Server extension ${describeServerExtensionMount(cfg)}`);
@@ -1270,28 +1203,14 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
     // Without this, the browser blocks 401 responses from the auth middleware
     // because they lack Access-Control-Allow-Origin headers, preventing the
     // client from reading the error code and triggering token refresh.
-    const corsAllowed = configInfo.cors?.allowedOrigins ?? ['*'];
-    const corsWildcard = corsAllowed.includes('*');
-    // SECURITY: never combine credentials with a wildcard/reflect-any-origin policy. When
-    // allowedOrigins is ['*'] the origin callback reflects the caller's Origin, and pairing that
-    // with Access-Control-Allow-Credentials: true lets any site a signed-in user visits make
-    // credentialed cross-origin reads. MJ's primary auth is a Bearer token (not auto-sent
-    // cross-origin), so dropping credentials under the wildcard default is safe; deployments that
-    // genuinely need credentialed CORS must configure an explicit allowedOrigins list.
-    app.use(cors({
-        origin: (origin, callback) => {
-            // Allow all origins when ['*'] (default/backward-compatible),
-            // or when no Origin header (server-to-server calls).
-            if (corsWildcard || !origin || corsAllowed.includes(origin)) {
-                callback(null, true);
-            }
-            else {
-                callback(new Error(`Origin ${origin} not allowed by CORS`));
-            }
-        },
-        credentials: corsWildcard ? false : (configInfo.cors?.allowCredentials ?? true),
-        maxAge: configInfo.cors?.maxAge ?? 86400,
-    }));
+    // Extensions that declare `OwnsCORS: true` (ServerExtensionConfig) are exempt: the global
+    // middleware skips their RootPaths so it neither reflects an origin onto their responses nor
+    // answers their preflights — the extension's own OPTIONS handling and origin policy run instead.
+    const corsOwnedExtensionRoots = GetCorsOwningServerExtensionRoots(extensionConfigs);
+    if (corsOwnedExtensionRoots.length > 0) {
+        LogStatus(`Global CORS skips extension-owned roots: ${corsOwnedExtensionRoots.join(', ')}`);
+    }
+    app.use(CreateGlobalCorsMiddleware(configInfo.cors, corsOwnedExtensionRoots));
     // ─── Pre-auth server extensions (before auth — extensions handle their own auth) ─────
     // Slack uses HMAC signature verification, Teams uses Bot Framework JWT validation.
     // These must be registered before the unified auth middleware so webhook
@@ -1301,21 +1220,11 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
             phase: 'pre-auth',
             httpServer,
             publicUrl: oauthPublicUrl,
+            apiRootPath: ApiRootPath(),
         });
     }
-    // Extension health endpoint (always available, returns empty array if no extensions)
-    app.get('/health/extensions', async (_req, res) => {
-        const results = await extensionLoader.HealthCheckAll();
-        const allHealthy = results.length === 0 || results.every(r => r.Healthy);
-        res.status(allHealthy ? 200 : 503).json({ extensions: results });
-    });
-    // ─── Public authentication-provider catalog (PUBLIC, before auth mw) ──────
-    // The browser needs the provider list BEFORE it holds a token, so this is necessarily
-    // unauthenticated and must mount ahead of the auth middleware. It publishes only the
-    // non-secret allow-list (see AuthProviderEngine.GetPublicCatalog) — the same values a
-    // single-provider SPA already compiled into its bundle.
-    app.use(AUTH_CATALOG_MOUNT_PATH, cors(), createAuthProviderCatalogRouter());
-    startupLog.LogIf('verbose', `[Auth] Public provider catalog registered at ${AUTH_CATALOG_MOUNT_PATH}/providers`);
+    MountExtensionHealthRoute(app, extensionLoader);
+    MountAuthCatalogRoute(app, startupLog);
     // ─── Unified auth middleware (replaces both REST authMiddleware and contextFunction auth) ─────
     app.use(CreateUnifiedAuthMiddleware(dataSources));
     // ─── Post-auth middleware from BaseServerMiddleware plugins ─────
@@ -1325,23 +1234,15 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
     for (const mw of mwPostAuth) {
         app.use(mw);
     }
-    // ─── OAuth authenticated routes (auth already handled by unified middleware) ─────
-    if (oauthAuthenticatedRouter) {
-        const oauthCors = cors();
-        app.use('/oauth', oauthCors, BodyParser.json(), oauthAuthenticatedRouter);
-        startupLog.LogIf('verbose', '[OAuth] Authenticated routes registered at /oauth/status, /oauth/initiate, and /oauth/exchange');
-    }
-    // ─── Magic-link authenticated route (invite creation) ─────────────────────
-    if (magicLinkAuthenticatedRouter) {
-        app.use(MAGIC_LINK_MOUNT_PATH, cors(), magicLinkAuthenticatedRouter);
-        startupLog.LogIf('verbose', `[MagicLink] Authenticated route registered at ${MAGIC_LINK_MOUNT_PATH}/create`);
-    }
-    // ─── Widget authenticated route (RV4 resolve-identity) ────────────────────
-    // Mounts after the unified auth middleware so a verified visitor (post magic-link upgrade) can
-    // promote their anonymous returning-visitor trail to the verified record.
-    if (widgetAuthenticatedRouter) {
-        app.use(WIDGET_MOUNT_PATH, cors(), widgetAuthenticatedRouter);
-        startupLog.LogIf('verbose', `[Widget] Authenticated route registered at ${WIDGET_MOUNT_PATH}/resolve-identity`);
+    // ─── Authenticated core routes: OAuth status/initiate/exchange, magic-link create, widget resolve-identity ─────
+    MountAuthenticatedCoreRoutes(app, coreAuthenticatedRouters, startupLog);
+    // ─── Realtime recording shards + terminal signal (authenticated, owner-gated) ─────
+    // The browser uploads a client-direct call's recording as Opus shards and a keepalive terminal request;
+    // assembly runs off the request path on the scheduler. Needs a SQL provider: the ledger calls procs.
+    if (configInfo.realtime?.enabled) {
+        if (mountRealtimeRecordingRoutes(app)) {
+            startupLog.LogIf('verbose', `[Realtime] Recording routes registered at ${ApiRoute(REALTIME_RECORDING_MOUNT_PATH)}/:agentSessionId/shard/:index and /end`);
+        }
     }
     // ─── Post-auth server extensions ──────────────────────────────────────────
     // Extensions declaring Phase: 'post-auth' mount after the unified auth middleware
@@ -1351,14 +1252,22 @@ export const Serve = async (resolverPaths, app = CreateApp(), options) => {
             phase: 'post-auth',
             httpServer,
             publicUrl: oauthPublicUrl,
+            apiRootPath: ApiRootPath(),
         });
     }
+    // Every extension has now had its chance at the request: a preflight under an extension-owned
+    // root that none of them answered is refused here, instead of falling through to the GraphQL
+    // mount's cors(), which would approve it for every origin.
+    if (corsOwnedExtensionRoots.length > 0) {
+        app.use(CreateExtensionOwnedPreflightFallback(corsOwnedExtensionRoots));
+    }
     // ─── Cross-extension lifecycle hook: OnAllExtensionsMounted ───────────────
     // Called after all extensions across both pre-auth and post-auth phases are mounted.
     // Extensions can wire themselves to services registered by other extensions or core.
     await extensionLoader.NotifyAllExtensionsMounted({
         httpServer,
         publicUrl: oauthPublicUrl,
+        apiRootPath: ApiRootPath(),
     });
     // Install the single path-routing WebSocket-upgrade dispatcher AFTER all extensions across both
     // pre-auth and post-auth phases have mounted and registered their media WSS routes. ws 8.x has each
@@ -1986,4 +1895,47 @@ function createMSSQLCompatPool(pgPool) {
     };
     return wrapper;
 }
+// Defined below serve() on purpose: serverExtensionReservedRoots.test.ts treats every app.use() that appears
+// textually before the unified auth middleware as a pre-auth mount, and these routes are mounted post-auth.
+/**
+ * Mounts the realtime recording shard/terminal routes (post-auth) and starts the assembly scheduler they
+ * hand work to. Skipped, with a warning, when the server's provider is not a SQL provider (the ledger calls
+ * stored procedures). Without a system user the routes still store shards, and the janitor assembles them.
+ * Returns whether the routes were mounted.
+ */
+function mountRealtimeRecordingRoutes(app) {
+    const provider = Metadata.Provider; // global-provider-ok: REST endpoint — no per-request provider injection in REST middleware yet; the ledger's procs run as the server's SQL login either way
+    if (!(provider instanceof DatabaseProviderBase)) {
+        console.warn('[Realtime] Recording routes not mounted: the server provider is not a DatabaseProviderBase');
+        return false;
+    }
+    const graceMs = () => configInfo.realtime.recordingAssemblyGraceSeconds * 1000;
+    const systemUser = UserCache.Instance.GetSystemUser();
+    if (systemUser) {
+        RecordingAssemblyScheduler.Instance.Start({ Provider: provider, SystemUser: systemUser, GraceMs: graceMs });
+    }
+    else {
+        LogError('[Realtime] Recording assembly scheduler not started: no system user; the session janitor assembles recordings instead');
+    }
+    app.use(ApiRoute(REALTIME_RECORDING_MOUNT_PATH), cors(), CreateRealtimeRecordingRouter({
+        ResolveCaller: req => {
+            const user = req.userPayload?.userRecord;
+            return user ? { ContextUser: user, Provider: provider } : null;
+        },
+        LoadOwnedSession: LoadOwnedRealtimeSession,
+        LoadConversationExternalID: LoadSessionConversationExternalID,
+        CreateLedger: (ledgerProvider, contextUser) => new SqlRealtimeRecordingLedger(ledgerProvider, contextUser),
+        Scheduler: RecordingAssemblyScheduler.Instance,
+        GraceMs: graceMs,
+        SystemUser: () => UserCache.Instance.GetSystemUser() ?? null,
+    }));
+    return true;
+}
+// Public-edge building blocks for Open Apps that run their own pre-auth edge and mint
+// scope-limited guest sessions (e.g. a ballot edge: verify a credential, then mint a short-lived
+// session scoped to one resource). They are the same pieces WidgetSessionService uses; a generic
+// public-widget session mint remains the long-term replacement.
+export { BuildSessionClaims, MagicLinkKeyManager, MagicLinkService, HashToken, GenerateRawToken } from './auth/magicLink/index.js';
+export { VerifyHostAssertion } from './realtimeWidget/host-identity.js';
+export { IsScopeLimitedPrincipal } from './auth/scopeLimitedPrincipal.js';
 //# sourceMappingURL=index.js.map