@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/dist/auth/localDevAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localDevAuth.d.ts","sourceRoot":"","sources":["../../src/auth/localDevAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,MAAM,EAAQ,KAAK,OAAO,EAAiB,MAAM,SAAS,CAAC;AAEpE,OAAO,EAGL,iBAAiB,EAIjB,QAAQ,EACT,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,CAAC;AAE5D,kDAAkD;AAClD,UAAU,iBAAkB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,MAAM,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kDAAkD;AAClD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAYD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,iBAAiB,EAAE,OAAO,GAAG,OAAO,CA0BhG;AAoCD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,CA6GtB;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAqCrE;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,cAAc,CAAC,EAAE,MAAM,EACvB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4D1B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,SAAW,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAkCjE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CA2G7D"}

package/dist/auth/localDevAuth.js

@@ -0,0 +1,439 @@
+/**
+ * @fileoverview Local Development Mock/Test JWT Authentication (`local`).
+ *
+ * Provides a zero-external-IdP local development login flow backed by MJ's
+ * in-memory RS256 `MagicLinkKeyManager` and JWKS endpoint.
+ *
+ * HARD SECURITY INVARIANTS:
+ * 1. Fail loud in production: If `MJ_DEV_AUTH_ENABLED` (or `configInfo.devAuth?.enabled`)
+ *    is enabled while `NODE_ENV === 'production'`, server startup throws a fatal error
+ *    and refuses to boot.
+ * 2. Strict localhost-only guard: Every request to `/auth/dev-login` and `/auth/dev-users`
+ *    verifies that:
+ *    - `NODE_ENV !== 'production'` and local dev auth is enabled.
+ *    - `X-Forwarded-For` (if present) contains only loopback addresses.
+ *    - `Host` header is `localhost`, `127.0.0.1`, or `::1`.
+ *    - `Origin` / `Referer` headers (if present) resolve to `localhost`, `127.0.0.1`, or `::1`.
+ *    - Socket remote address is loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) or local
+ *      Docker bridge/host-gateway when no external `X-Forwarded-For` is present.
+ *    Any request failing these checks is denied with `403 Forbidden` and logged.
+ *
+ * @module @memberjunction/server/auth/localDevAuth
+ */
+import * as fs from 'node:fs';
+import { json } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogError, LogStatusEx, Metadata, } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { AuthProviderFactory, LocalDevProvider } from '@memberjunction/auth-providers';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import { configInfo } from '../config.js';
+import { ApiRoute } from '../apiRoot.js';
+import { MagicLinkKeyManager } from './magicLink/MagicLinkKeys.js';
+import { MAGIC_LINK_JWKS_PATH } from './magicLink/MagicLinkRouter.js';
+import { AssertLocalDevAuthAllowed, IsLocalDevAuthEnabled } from './initializeProviders.js';
+export { AssertLocalDevAuthAllowed, IsLocalDevAuthEnabled };
+const LOCALHOST_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+function TrimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47) {
+        end--;
+    }
+    return value.slice(0, end);
+}
+/**
+ * Checks whether an IP address is a loopback address, or (when `allowDockerBridge` is true)
+ * a local Docker bridge / Docker Desktop host-gateway address.
+ */
+export function IsLoopbackAddress(rawIp, allowDockerBridge) {
+    if (!rawIp) {
+        return false;
+    }
+    const normalized = rawIp.trim().toLowerCase().replace(/^::ffff:/, '');
+    if (normalized === '127.0.0.1' || normalized === '::1' || normalized === 'localhost') {
+        return true;
+    }
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(normalized)) {
+        return true;
+    }
+    if (allowDockerBridge) {
+        // Docker Desktop macOS/Windows host-gateway IPs (192.168.65.0/24) and local
+        // Docker bridge gateway (.1) addresses when a host browser connects to a
+        // port-forwarded container bound to 127.0.0.1 on the host.
+        if (/^192\.168\.65\.\d{1,3}$/.test(normalized)) {
+            return true;
+        }
+        if (/^172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.1$/.test(normalized)) {
+            return true;
+        }
+        if (normalized === '10.0.2.2') {
+            return true;
+        }
+    }
+    return false;
+}
+function isRunningInsideContainer(env) {
+    if (env.MJ_DEV_AUTH_ALLOW_DOCKER_BRIDGE === 'true') {
+        return true;
+    }
+    if (env.MJ_DEV_AUTH_ALLOW_DOCKER_BRIDGE === 'false') {
+        return false;
+    }
+    return fs.existsSync('/.dockerenv') || fs.existsSync('/run/.containerenv');
+}
+/** Extracts the hostname (without port) from a raw HTTP `Host` header value. */
+function extractHostnameFromHostHeader(hostHeader) {
+    if (!hostHeader) {
+        return '';
+    }
+    const trimmed = hostHeader.trim().toLowerCase();
+    if (trimmed.startsWith('[')) {
+        const closeIdx = trimmed.indexOf(']');
+        return closeIdx >= 0 ? trimmed.slice(1, closeIdx) : trimmed;
+    }
+    const colonIdx = trimmed.indexOf(':');
+    return colonIdx >= 0 ? trimmed.slice(0, colonIdx) : trimmed;
+}
+/** Extracts the hostname from an `Origin` or `Referer` URL header. */
+function extractHostnameFromUrlHeader(urlHeader) {
+    try {
+        const parsed = new URL(urlHeader);
+        return parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verifies that an incoming HTTP request to a local-dev auth endpoint originated
+ * strictly from localhost (`localhost`, `127.0.0.1`, or `::1`).
+ */
+export function VerifyLocalhostRequest(req, env = process.env) {
+    if (env.NODE_ENV?.trim().toLowerCase() === 'production') {
+        return {
+            Allowed: false,
+            Reason: 'Local dev auth is strictly forbidden when NODE_ENV=production.',
+        };
+    }
+    // 1. Inspect X-Forwarded-For / Forwarded / X-Real-IP / CF-Connecting-IP if present — every hop must be pure loopback
+    const xffRaw = req.headers['x-forwarded-for'];
+    const xffValue = Array.isArray(xffRaw) ? xffRaw.join(',') : xffRaw;
+    if (xffValue && xffValue.trim().length > 0) {
+        const hops = xffValue.split(',').map((h) => h.trim()).filter(Boolean);
+        for (const hop of hops) {
+            if (!IsLoopbackAddress(hop, false)) {
+                return {
+                    Allowed: false,
+                    Reason: `Non-loopback X-Forwarded-For address '${hop}' rejected.`,
+                };
+            }
+        }
+    }
+    for (const proxyHeader of ['x-real-ip', 'cf-connecting-ip']) {
+        const rawHeader = req.headers[proxyHeader];
+        const headerVal = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+        if (headerVal && headerVal.trim().length > 0 && !IsLoopbackAddress(headerVal, false)) {
+            return {
+                Allowed: false,
+                Reason: `Non-loopback ${proxyHeader} address '${headerVal}' rejected.`,
+            };
+        }
+    }
+    const forwardedHeader = req.headers['forwarded'];
+    const forwardedVal = Array.isArray(forwardedHeader) ? forwardedHeader.join(',') : forwardedHeader;
+    if (forwardedVal && forwardedVal.trim().length > 0) {
+        const forMatches = forwardedVal.matchAll(/for=\s*"?\[?([^;,"\]]+)\]?"?/gi);
+        for (const match of forMatches) {
+            const candidateIp = match[1]?.split(':')[0]?.trim();
+            if (candidateIp && !IsLoopbackAddress(candidateIp, false)) {
+                return {
+                    Allowed: false,
+                    Reason: `Non-loopback Forwarded address '${candidateIp}' rejected.`,
+                };
+            }
+        }
+    }
+    // 1b. Reject browser cross-site requests via Sec-Fetch-Site
+    const secFetchSite = typeof req.headers['sec-fetch-site'] === 'string' ? req.headers['sec-fetch-site'].trim().toLowerCase() : undefined;
+    if (secFetchSite === 'cross-site') {
+        return {
+            Allowed: false,
+            Reason: `Cross-site request (Sec-Fetch-Site: ${secFetchSite}) rejected.`,
+        };
+    }
+    // 2. Inspect Host header — must be localhost, 127.0.0.1, or ::1
+    const hostHeader = typeof req.headers.host === 'string' ? req.headers.host : req.hostname;
+    const hostName = extractHostnameFromHostHeader(hostHeader);
+    if (!hostName || !LOCALHOST_HOSTNAMES.has(hostName)) {
+        return {
+            Allowed: false,
+            Reason: `Non-localhost Host header '${hostHeader ?? 'missing'}' rejected.`,
+        };
+    }
+    // 3. Inspect Origin header if present
+    const originHeader = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
+    if (originHeader) {
+        const originHost = extractHostnameFromUrlHeader(originHeader);
+        if (!originHost || !LOCALHOST_HOSTNAMES.has(originHost)) {
+            return {
+                Allowed: false,
+                Reason: `Non-localhost Origin header '${originHeader}' rejected.`,
+            };
+        }
+    }
+    // 4. Inspect Referer header if present
+    const refererHeader = typeof req.headers.referer === 'string' ? req.headers.referer : undefined;
+    if (refererHeader) {
+        const refererHost = extractHostnameFromUrlHeader(refererHeader);
+        if (!refererHost || !LOCALHOST_HOSTNAMES.has(refererHost)) {
+            return {
+                Allowed: false,
+                Reason: `Non-localhost Referer header '${refererHeader}' rejected.`,
+            };
+        }
+    }
+    // 5. Inspect socket remote address (allow Docker local bridge ONLY when running in a container and no proxy header is present)
+    const hasProxyHeader = Boolean((xffValue && xffValue.trim().length > 0) ||
+        (forwardedVal && forwardedVal.trim().length > 0) ||
+        req.headers['x-real-ip'] ||
+        req.headers['cf-connecting-ip']);
+    const allowDockerBridge = !hasProxyHeader && isRunningInsideContainer(env);
+    const remoteAddress = req.socket?.remoteAddress || req.ip;
+    if (!IsLoopbackAddress(remoteAddress, allowDockerBridge)) {
+        return {
+            Allowed: false,
+            Reason: `Non-loopback socket remote address '${remoteAddress ?? 'unknown'}' rejected.`,
+        };
+    }
+    return { Allowed: true };
+}
+/**
+ * Registers the `local` auth provider in `AuthProviderFactory` and `configInfo.authProviders`
+ * using the server's configured public URL and the shared `MagicLinkKeyManager` JWKS endpoint.
+ */
+export function RegisterLocalDevAuthProvider(publicUrl) {
+    AssertLocalDevAuthAllowed();
+    MagicLinkKeyManager.Instance.Initialize(configInfo.magicLink?.rsaPrivateKey);
+    const base = publicUrl ? TrimTrailingSlashes(publicUrl) : undefined;
+    const issuer = base ? `${base}/local-dev` : ApiRoute('/local-dev', { absolute: true });
+    const jwksUri = base ? `${base}${MAGIC_LINK_JWKS_PATH}` : ApiRoute(MAGIC_LINK_JWKS_PATH, { absolute: true });
+    const providerConfig = {
+        name: 'local',
+        type: 'local',
+        issuer,
+        audience: LocalDevProvider.DEFAULT_AUDIENCE,
+        jwksUri,
+    };
+    try {
+        const factory = AuthProviderFactory.Instance;
+        const existingProvider = factory.getByName('local');
+        if (existingProvider && existingProvider.issuer === issuer && existingProvider.jwksUri === jwksUri) {
+            return;
+        }
+        configInfo.authProviders = configInfo.authProviders ?? [];
+        const existingIdx = configInfo.authProviders.findIndex((p) => p.type === 'local' || p.name === 'local');
+        if (existingIdx >= 0) {
+            configInfo.authProviders[existingIdx] = providerConfig;
+        }
+        else {
+            configInfo.authProviders.push(providerConfig);
+        }
+        factory.register(AuthProviderFactory.createProvider(providerConfig));
+        LogStatusEx({
+            message: `[LocalDevAuth] Registered local dev auth provider (issuer: ${providerConfig.issuer}, jwks: ${providerConfig.jwksUri})`,
+            verboseOnly: true,
+        });
+    }
+    catch (e) {
+        LogError(`[LocalDevAuth] Failed to register local dev auth provider: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/**
+ * Resolves the active local MJ user to sign in as for local development.
+ */
+export async function ResolveLocalDevUser(requestedEmail, provider) {
+    const effectiveProvider = provider ?? Metadata.Provider;
+    if ((!UserCache.Instance.Users || UserCache.Instance.Users.length === 0) && effectiveProvider) {
+        try {
+            await UserCache.Instance.Refresh(effectiveProvider);
+        }
+        catch (err) {
+            LogError(`[LocalDevAuth] Failed to refresh UserCache: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    const allUsers = UserCache.Instance.Users ?? [];
+    const activeUsers = allUsers.filter((u) => u.IsActive &&
+        !UUIDsEqual(u.ID, UserCache.Instance.SYSTEM_USER_ID) &&
+        u.Name?.trim().toLowerCase() !== 'system');
+    const targetEmail = requestedEmail?.trim() ||
+        process.env.MJ_DEV_AUTH_DEFAULT_EMAIL?.trim() ||
+        configInfo?.devAuth?.defaultEmail?.trim();
+    if (targetEmail) {
+        const matched = activeUsers.find((u) => u.Email?.trim().toLowerCase() === targetEmail.toLowerCase());
+        if (matched) {
+            return matched;
+        }
+        // If an explicit email was requested on the call and doesn't exist, return null
+        if (requestedEmail?.trim()) {
+            return null;
+        }
+    }
+    // 1. Default MJ installer admin email
+    const defaultAdmin = activeUsers.find((u) => u.Email?.trim().toLowerCase() === 'admin@memberjunction.org');
+    if (defaultAdmin) {
+        return defaultAdmin;
+    }
+    // 2. First active user holding the Developer role
+    const developerUser = activeUsers.find((u) => u.Email?.trim().toLowerCase() !== 'not.set@nowhere.com' &&
+        u.UserRoles?.some((r) => r.Role?.trim().toLowerCase() === 'developer'));
+    if (developerUser) {
+        return developerUser;
+    }
+    // 3. First active Owner user with a real email
+    const ownerUser = activeUsers.find((u) => u.Email?.trim().toLowerCase() !== 'not.set@nowhere.com' &&
+        u.Type?.trim().toLowerCase() === 'owner');
+    if (ownerUser) {
+        return ownerUser;
+    }
+    return activeUsers[0] ?? null;
+}
+/**
+ * Mints a signed RS256 local-dev JWT for the given `UserInfo`.
+ */
+export function MintLocalDevJwt(user, publicUrl, ttlSeconds = 8 * 3600) {
+    AssertLocalDevAuthAllowed();
+    MagicLinkKeyManager.Instance.Initialize(configInfo.magicLink?.rsaPrivateKey);
+    const base = publicUrl ? TrimTrailingSlashes(publicUrl) : undefined;
+    const issuer = base ? `${base}/local-dev` : ApiRoute('/local-dev', { absolute: true });
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const expSeconds = nowSeconds + ttlSeconds;
+    const firstName = user.FirstName?.trim() || 'Admin';
+    const lastName = user.LastName?.trim() || 'User';
+    const fullName = [user.FirstName?.trim(), user.LastName?.trim()].filter(Boolean).join(' ') ||
+        user.Name?.trim() ||
+        user.Email;
+    const claims = {
+        iss: issuer,
+        aud: LocalDevProvider.DEFAULT_AUDIENCE,
+        sub: `local-dev|${user.ID}`,
+        email: user.Email,
+        given_name: firstName,
+        family_name: lastName,
+        name: fullName,
+        preferred_username: user.Email,
+        iat: nowSeconds,
+        exp: expSeconds,
+    };
+    const token = MagicLinkKeyManager.Instance.Sign(claims);
+    return {
+        token,
+        expiresAt: new Date(expSeconds * 1000).toISOString(),
+        claims,
+    };
+}
+/**
+ * Attaches `/dev-login` and `/dev-users` routes onto the `/auth` router.
+ *
+ * When local dev auth is disabled, these routes respond with `404`.
+ * When enabled, every request is gated by {@link VerifyLocalhostRequest}.
+ */
+export function AttachLocalDevAuthRoutes(router) {
+    const devAuthLimiter = rateLimit({
+        windowMs: 60_000,
+        limit: 60,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+    });
+    router.post('/dev-login', devAuthLimiter, json(), async (req, res) => {
+        if (!IsLocalDevAuthEnabled()) {
+            res.status(404).json({
+                success: false,
+                error: 'Local dev auth is not enabled. Set MJ_DEV_AUTH_ENABLED=true in local development.',
+            });
+            return;
+        }
+        const guard = VerifyLocalhostRequest(req);
+        if (!guard.Allowed) {
+            LogError(`[SECURITY] Blocked /auth/dev-login request: ${guard.Reason}`);
+            res.status(403).json({
+                success: false,
+                error: 'Forbidden: /auth/dev-login is restricted to localhost only.',
+            });
+            return;
+        }
+        try {
+            RegisterLocalDevAuthProvider();
+            const body = (req.body ?? {});
+            const requestedEmail = typeof body.email === 'string' ? body.email.trim() : undefined;
+            const user = await ResolveLocalDevUser(requestedEmail);
+            if (!user) {
+                const availableEmails = (UserCache.Instance.Users ?? [])
+                    .filter((u) => u.IsActive && !UUIDsEqual(u.ID, UserCache.Instance.SYSTEM_USER_ID))
+                    .map((u) => u.Email);
+                res.status(404).json({
+                    success: false,
+                    error: requestedEmail
+                        ? `No active MJ user found matching email '${requestedEmail}'.`
+                        : 'No active non-System MJ user found in UserCache.',
+                    availableUsers: availableEmails,
+                });
+                return;
+            }
+            const { token, expiresAt, claims } = MintLocalDevJwt(user);
+            res.set('Cache-Control', 'no-store');
+            res.status(200).json({
+                success: true,
+                token,
+                expiresAt,
+                user: {
+                    id: user.ID,
+                    email: user.Email,
+                    name: claims.name,
+                    firstName: claims.given_name,
+                    lastName: claims.family_name,
+                    roles: (user.UserRoles ?? []).map((r) => r.Role),
+                },
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            LogError(`[LocalDevAuth] /auth/dev-login error: ${message}`);
+            res.status(500).json({
+                success: false,
+                error: message,
+            });
+        }
+    });
+    router.get('/dev-users', devAuthLimiter, async (req, res) => {
+        if (!IsLocalDevAuthEnabled()) {
+            res.status(404).json({
+                success: false,
+                error: 'Local dev auth is not enabled.',
+            });
+            return;
+        }
+        const guard = VerifyLocalhostRequest(req);
+        if (!guard.Allowed) {
+            LogError(`[SECURITY] Blocked /auth/dev-users request: ${guard.Reason}`);
+            res.status(403).json({
+                success: false,
+                error: 'Forbidden: /auth/dev-users is restricted to localhost only.',
+            });
+            return;
+        }
+        const users = (UserCache.Instance.Users ?? [])
+            .filter((u) => u.IsActive && !UUIDsEqual(u.ID, UserCache.Instance.SYSTEM_USER_ID) && u.Name?.trim().toLowerCase() !== 'system')
+            .map((u) => ({
+            id: u.ID,
+            email: u.Email,
+            name: u.Name,
+            firstName: u.FirstName,
+            lastName: u.LastName,
+            type: u.Type,
+            roles: (u.UserRoles ?? []).map((r) => r.Role),
+        }));
+        res.set('Cache-Control', 'no-store');
+        res.status(200).json({ success: true, users });
+    });
+}
+//# sourceMappingURL=localDevAuth.js.map

package/dist/auth/localDevAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localDevAuth.js","sourceRoot":"","sources":["../../src/auth/localDevAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAU,IAAI,EAA+B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAIL,QAAQ,EACR,WAAW,EACX,QAAQ,GAET,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,CAAC;AAsB5D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhF,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnD,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB,EAAE,iBAA0B;IACrF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QACrF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,4EAA4E;QAC5E,yEAAyE;QACzE,2DAA2D;QAC3D,IAAI,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAsB;IACtD,IAAI,GAAG,CAAC,+BAA+B,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,+BAA+B,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,SAAS,6BAA6B,CAAC,UAA8B;IACnE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED,sEAAsE;AACtE,SAAS,4BAA4B,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gEAAgE;SACzE,CAAC;IACJ,CAAC;IAED,qHAAqH;IACrH,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yCAAyC,GAAG,aAAa;iBAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAU,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,gBAAgB,WAAW,aAAa,SAAS,aAAa;aACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAClG,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QAC3E,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,mCAAmC,WAAW,aAAa;iBACpE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxI,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,uCAAuC,YAAY,aAAa;SACzE,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC1F,MAAM,QAAQ,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,8BAA8B,UAAU,IAAI,SAAS,aAAa;SAC3E,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,gCAAgC,YAAY,aAAa;aAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,MAAM,aAAa,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,4BAA4B,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iCAAiC,aAAa,aAAa;aACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+HAA+H;IAC/H,MAAM,cAAc,GAAG,OAAO,CAC5B,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;QACxB,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAChC,CAAC;IACF,MAAM,iBAAiB,GAAG,CAAC,cAAc,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,uCAAuC,aAAa,IAAI,SAAS,aAAa;SACvF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAkB;IAC7D,yBAAyB,EAAE,CAAC;IAC5B,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7G,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,MAAM;QACN,QAAQ,EAAE,gBAAgB,CAAC,gBAAgB;QAC3C,OAAO;KACR,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,KAAK,MAAM,IAAI,gBAAgB,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACnG,OAAO;QACT,CAAC;QAED,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACxG,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,cAAc,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC;YACV,OAAO,EAAE,8DAA8D,cAAc,CAAC,MAAM,WAAW,cAAc,CAAC,OAAO,GAAG;YAChI,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,8DAA8D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAAuB,EACvB,QAA4B;IAE5B,MAAM,iBAAiB,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACxD,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,iBAAiB,EAAE,CAAC;QAC9F,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAyC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ;QACV,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpD,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAC5C,CAAC;IAEF,MAAM,WAAW,GACf,cAAc,EAAE,IAAI,EAAE;QACtB,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE;QAC7C,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;QACrG,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,gFAAgF;QAChF,IAAI,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,0BAA0B,CAAC,CAAC;IAC3G,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kDAAkD;IAClD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB;QACvD,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,CACzE,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB;QACvD,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAC3C,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,SAAkB,EAClB,UAAU,GAAG,CAAC,GAAG,IAAI;IAErB,yBAAyB,EAAE,CAAC;IAC5B,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;IACjD,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;QACjB,IAAI,CAAC,KAAK,CAAC;IAEb,MAAM,MAAM,GAAsB;QAChC,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,gBAAgB,CAAC,gBAAgB;QACtC,GAAG,EAAE,aAAa,IAAI,CAAC,EAAE,EAAE;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,QAAQ;QACrB,IAAI,EAAE,QAAQ;QACd,kBAAkB,EAAE,IAAI,CAAC,KAAK;QAC9B,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,UAAU;KAChB,CAAC;IAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO;QACL,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACpD,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,cAAc,GAAG,SAAS,CAAC;QAC/B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtF,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mFAAmF;aAC3F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,QAAQ,CAAC,+CAA+C,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,6DAA6D;aACrE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,4BAA4B,EAAE,CAAC;YAE/B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;YACpD,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;YAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,eAAe,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;qBACrD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;qBACjF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,cAAc;wBACnB,CAAC,CAAC,2CAA2C,cAAc,IAAI;wBAC/D,CAAC,CAAC,kDAAkD;oBACtD,cAAc,EAAE,eAAe;iBAChC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,IAAI;gBACb,KAAK;gBACL,SAAS;gBACT,IAAI,EAAE;oBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,QAAQ,EAAE,MAAM,CAAC,WAAW;oBAC5B,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACjD;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,QAAQ,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7E,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,gCAAgC;aACxC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,QAAQ,CAAC,+CAA+C,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,6DAA6D;aACrE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;aAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;aAC9H,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAC9C,CAAC,CAAC,CAAC;QAEN,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/magicLink/MagicLinkKeys.d.ts

@@ -38,10 +38,10 @@ export declare class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManag
      */
     Initialize(privateKeyPem?: string): void;
     /**
-     * Signs a set of magic-link claims and returns the compact JWT.
+     * Signs a set of magic-link (or local-dev) claims and returns the compact JWT.
      * `iat`/`exp` are expected to already be set on the claims.
      */
-    Sign(claims: MagicLinkJWTClaims): string;
+    Sign(claims: MagicLinkJWTClaims | Record<string, unknown>): string;
     /**
      * Returns the JWKS document (public key set) for the JWKS endpoint.
      */

package/dist/auth/magicLink/MagicLinkKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IA+B/C;;;OAGG;IACI,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAK/C;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}
+{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IA+B/C;;;OAGG;IACI,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAKzE;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}

package/dist/auth/magicLink/MagicLinkKeys.js

@@ -70,7 +70,7 @@ export class MagicLinkKeyManager extends BaseSingleton {
         this._initialized = true;
     }
     /**
-     * Signs a set of magic-link claims and returns the compact JWT.
+     * Signs a set of magic-link (or local-dev) claims and returns the compact JWT.
      * `iat`/`exp` are expected to already be set on the claims.
      */
     Sign(claims) {

package/dist/auth/magicLink/MagicLinkKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAMzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QARF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,aAAsB;QACtC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,sFAAsF;YACtF,0FAA0F;YAC1F,sFAAsF;YACtF,2DAA2D;YAC3D,WAAW,CAAC;gBACV,OAAO,EACL,kFAAkF;oBAClF,8FAA8F;oBAC9F,4DAA4D;gBAC9D,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAC,MAA0B;QACpC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAMzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QARF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,aAAsB;QACtC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,sFAAsF;YACtF,0FAA0F;YAC1F,sFAAsF;YACtF,2DAA2D;YAC3D,WAAW,CAAC;gBACV,OAAO,EACL,kFAAkF;oBAClF,8FAA8F;oBAC9F,4DAA4D;gBAC9D,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAC,MAAoD;QAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/auth/magicLink/types.d.ts

@@ -56,6 +56,18 @@ export interface MagicLinkJWTClaims {
     mj_anon?: boolean;
     /** Opaque per-session id — correlates one anonymous session's activity across audit rows without a real user. */
     mj_sid?: string;
+    /**
+     * When `mj_sid` was first minted (epoch seconds). Set on widget guest tokens and copied unchanged by every
+     * refresh, so the server can refuse to renew a session past its hard end (`MAX_GUEST_SESSION_SECONDS`).
+     */
+    mj_sid_iat?: number;
+    /**
+     * Confirmation (RFC 7800 / RFC 9449): the RFC 7638 thumbprint of the key the widget registered at mint.
+     * Refreshing a widget guest token requires a proof signed by that key, so a copied token cannot be renewed.
+     */
+    cnf?: {
+        jkt: string;
+    };
     /**
      * Public web widget instance id (additive — set only for widget guest sessions
      * minted by WidgetSessionService). Binds the synthesized guest principal to one

package/dist/auth/magicLink/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,oIAAoI;IACpI,OAAO,EAAE,MAAM,CAAC;IAChB,kIAAkI;IAClI,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,oGAAoG;IACpG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wHAAwH;IACxH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2JAA2J;IAC3J,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2JAA2J;IAC3J,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,2BAA2B;IAC1C,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC;CAC1C;AAED,+BAA+B;AAC/B,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAEpI;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,oIAAoI;IACpI,OAAO,EAAE,MAAM,CAAC;IAChB,kIAAkI;IAClI,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,oGAAoG;IACpG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wHAAwH;IACxH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2JAA2J;IAC3J,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2JAA2J;IAC3J,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,aAAa,EAAE,IAAI,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,2BAA2B;IAC1C,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,oCAAoC;AACpC,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC;CAC1C;AAED,+BAA+B;AAC/B,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,qBAAqB,GAAG,cAAc,CAAC;AAEpI;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B"}

package/dist/auth/sessionUserClone.d.ts

@@ -7,7 +7,7 @@
  * concurrent session of the same user THE INSTANT it is written; this is
  * same-moment cross-request aliasing, not a cache-staleness problem. The
  * magic-link path has always cloned for exactly this reason (see
- * buildMagicLinkSessionUser in context.ts); this helper makes that rule a
+ * BuildMagicLinkSessionUser in context.ts); this helper makes that rule a
  * single shared primitive so every per-session stamp goes through the same
  * clone.
  *

package/dist/auth/sessionUserClone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionUserClone.d.ts","sourceRoot":"","sources":["../../src/auth/sessionUserClone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAkBnE"}
+{"version":3,"file":"sessionUserClone.d.ts","sourceRoot":"","sources":["../../src/auth/sessionUserClone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAmBnE"}

package/dist/auth/sessionUserClone.js

@@ -7,7 +7,7 @@
  * concurrent session of the same user THE INSTANT it is written; this is
  * same-moment cross-request aliasing, not a cache-staleness problem. The
  * magic-link path has always cloned for exactly this reason (see
- * buildMagicLinkSessionUser in context.ts); this helper makes that rule a
+ * BuildMagicLinkSessionUser in context.ts); this helper makes that rule a
  * single shared primitive so every per-session stamp goes through the same
  * clone.
  *
@@ -29,7 +29,7 @@ import { Metadata, UserInfo } from '@memberjunction/core';
  * state on the clone; never stamp the input itself.
  */
 export function CloneUserForSessionContext(user) {
-    const md = Metadata.Provider; // global-provider-ok: server-side session construction under the server's single default provider, same as buildMagicLinkSessionUser
+    const md = Metadata.Provider; // global-provider-ok: server-side session construction under the server's single default provider, same as BuildMagicLinkSessionUser
     const clone = new UserInfo(md, {
         ...user,
         _UserRoles: undefined,
@@ -43,6 +43,7 @@ export function CloneUserForSessionContext(user) {
     clone.ReturningVisitorContext = user.ReturningVisitorContext;
     clone.WidgetGuestContext = user.WidgetGuestContext;
     clone.IsMagicLinkAnonymous = user.IsMagicLinkAnonymous;
+    clone.AnonymousVisitorID = user.AnonymousVisitorID;
     clone.APIKeyActingContext = user.APIKeyActingContext;
     clone.APIKeyRowFilters = user.APIKeyRowFilters;
     return clone;

package/dist/auth/sessionUserClone.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionUserClone.js","sourceRoot":"","sources":["../../src/auth/sessionUserClone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,qIAAqI;IACnK,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE;QAC7B,GAAG,IAAI;QACP,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,wEAAwE;IACxE,0EAA0E;IAC1E,6DAA6D;IAC7D,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACzC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3C,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAC7D,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnD,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;IACvD,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACrD,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"sessionUserClone.js","sourceRoot":"","sources":["../../src/auth/sessionUserClone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAc;IACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,qIAAqI;IACnK,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE;QAC7B,GAAG,IAAI;QACP,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,wEAAwE;IACxE,0EAA0E;IAC1E,6DAA6D;IAC7D,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACzC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3C,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAC7D,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnD,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;IACvD,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACnD,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACrD,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}