@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.8

package/dist/agentSessions/sessionDeadline.js

@@ -0,0 +1,68 @@
+/**
+ * Parses the absolute deadline (ms) from a session's `Config_` JSON, or null when absent/malformed.
+ * A malformed deadline counts as absent by design: a sweep must never throw on one bad row, so null
+ * is the documented failure result here, not a swallowed error.
+ */
+export function ParseSessionDeadlineMs(configJson) {
+    if (!configJson) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(configJson);
+        if (typeof parsed.maxSessionDeadlineIso !== 'string') {
+            return null;
+        }
+        const ms = Date.parse(parsed.maxSessionDeadlineIso);
+        return Number.isNaN(ms) ? null : ms;
+    }
+    catch {
+        // Malformed JSON: treated as "no deadline" (see doc comment).
+        return null;
+    }
+}
+/**
+ * Decides why a session has expired, or null when it has not.
+ *
+ * Two moments can expire a session: its idle moment (`LastActiveAt + closeThresholdMs`) and its authored
+ * hard deadline (`Config_.maxSessionDeadlineIso`). Only a moment that has already passed (`<= nowMs`)
+ * counts, and the EARLIER of the passed moments wins. A tie at the same instant yields `TimeLimit`:
+ * the authored rule beats the safety net. A row without a usable `LastActiveAt` (null, or a value that
+ * does not parse to a date) is never `Idle`, and neither is any row when `closeThresholdMs` is non-finite.
+ * `LastActiveAt` is typed `Date` but may arrive as an ISO string from a provider, so both are accepted.
+ */
+export function ExpiryCloseReason(session, nowMs, closeThresholdMs) {
+    const lastActiveMs = session.LastActiveAt ? new Date(session.LastActiveAt).getTime() : Number.NaN;
+    const idleMs = lastActiveMs + closeThresholdMs;
+    const idleAt = Number.isFinite(idleMs) ? idleMs : null;
+    const deadlineAt = ParseSessionDeadlineMs(session.Config_);
+    const idlePassed = idleAt !== null && idleAt <= nowMs;
+    const deadlinePassed = deadlineAt !== null && deadlineAt <= nowMs;
+    if (deadlinePassed && idlePassed) {
+        return deadlineAt <= idleAt ? 'TimeLimit' : 'Idle';
+    }
+    if (deadlinePassed) {
+        return 'TimeLimit';
+    }
+    return idlePassed ? 'Idle' : null;
+}
+/**
+ * How far ahead of a stored deadline a browser's `TimeLimit` claim is still believed. The browser's
+ * alarm runs on its own clock: when it extends to a server ISO deadline it anchors that time against its
+ * own `Date.now()`, so a client clock running ahead of the server fires early by the difference (a throttled
+ * tab only fires late). A minute absorbs that skew without letting a client end a session meant to run for
+ * minutes more.
+ */
+export const DEADLINE_CLAIM_SKEW_MS = 60_000;
+/**
+ * Verifies a `TimeLimit` close claim against the session's stored deadline. The browser claims, the server
+ * verifies: the claim holds when the stored deadline has passed or falls within {@link DEADLINE_CLAIM_SKEW_MS},
+ * otherwise (no deadline, or one far in the future) the close is recorded as `Explicit`. The janitor's own
+ * `TimeLimit` trivially passes, so every caller shares one path, and this module remains the single place that
+ * answers "did the deadline pass?" for both the sweep and the client claim. Idleness never counts here.
+ */
+export function VerifyTimeLimitClaim(session, nowMs) {
+    return ExpiryCloseReason(session, nowMs + DEADLINE_CLAIM_SKEW_MS, Number.POSITIVE_INFINITY) === 'TimeLimit'
+        ? 'TimeLimit'
+        : 'Explicit';
+}
+//# sourceMappingURL=sessionDeadline.js.map

package/dist/agentSessions/sessionDeadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionDeadline.js","sourceRoot":"","sources":["../../src/agentSessions/sessionDeadline.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAqC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAwC,CAAC;QAC7E,IAAI,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACL,8DAA8D;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC7B,OAA+F,EAC/F,KAAa,EACb,gBAAwB;IAExB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAClG,MAAM,MAAM,GAAG,YAAY,GAAG,gBAAgB,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;IACtD,MAAM,cAAc,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,IAAI,KAAK,CAAC;IAClE,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;QAC/B,OAAO,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IACvD,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAChC,OAA+F,EAC/F,KAAa;IAEb,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,GAAG,sBAAsB,EAAE,MAAM,CAAC,iBAAiB,CAAC,KAAK,WAAW;QACvG,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,UAAU,CAAC;AACrB,CAAC"}

package/dist/auth/APIKeyScopeAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"APIKeyScopeAuth.d.ts","sourceRoot":"","sources":["../../src/auth/APIKeyScopeAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAGzD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,gBAAgB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,EACrB,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAmG1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,EACD,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8H/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAM,IAC9E,KAAK;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,EAAE,WAAW,MAAM,mBAQrG;AAGD,eAAO,MAAM,cAAc,QAXJ;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,aAAa,MAAM,kBAWhD,CAAC;AACvD,eAAO,MAAM,eAAe,QAZL;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,aAAa,MAAM,kBAY9C,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAbT;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,aAAa,MAAM,kBAatC,CAAC"}
+{"version":3,"file":"APIKeyScopeAuth.d.ts","sourceRoot":"","sources":["../../src/auth/APIKeyScopeAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,mBAAmB,EAAwB,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAC;AAIzD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,gBAAgB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,EACrB,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAmG1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,EACD,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,eAAe,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8H/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAM,IAC9E,KAAK;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,EAAE,WAAW,MAAM,mBAQrG;AAGD,eAAO,MAAM,cAAc,QAXJ;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,aAAa,MAAM,kBAWhD,CAAC;AACvD,eAAO,MAAM,eAAe,QAZL;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,aAAa,MAAM,kBAY9C,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAbT;IAAE,WAAW,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAA;KAAE,CAAA;CAAE,aAAa,MAAM,kBAatC,CAAC"}

package/dist/auth/APIKeyScopeAuth.js

@@ -6,6 +6,7 @@
 import { AuthorizationError } from 'type-graphql';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { RunView } from '@memberjunction/core';
+import { EscapeSQLString } from '@memberjunction/global';
 /**
  * Check if an API key has the required scope for an operation.
  *
@@ -50,7 +51,7 @@ export async function CheckAPIKeyScope(apiKeyId, scopePath, contextUser, options
     const rv = new RunView();
     const keyResult = await rv.RunView({
         EntityName: 'MJ: API Keys',
-        ExtraFilter: `ID='${apiKeyId}'`,
+        ExtraFilter: `ID='${EscapeSQLString(apiKeyId)}'`,
         ResultType: 'entity_object'
     }, contextUser);
     if (!keyResult.Success || keyResult.Results.length === 0) {
@@ -68,7 +69,7 @@ export async function CheckAPIKeyScope(apiKeyId, scopePath, contextUser, options
     // Get the application by name
     const appResult = await rv.RunView({
         EntityName: 'MJ: API Applications',
-        ExtraFilter: `Name='${applicationName}'`,
+        ExtraFilter: `Name='${EscapeSQLString(applicationName)}'`,
         ResultType: 'entity_object'
     }, contextUser);
     if (!appResult.Success || appResult.Results.length === 0) {
@@ -144,7 +145,7 @@ export async function CheckAPIKeyScopeAndLog(apiKeyId, scopePath, contextUser, u
     // Get the API key
     const keyResult = await rv.RunView({
         EntityName: 'MJ: API Keys',
-        ExtraFilter: `ID='${apiKeyId}'`,
+        ExtraFilter: `ID='${EscapeSQLString(apiKeyId)}'`,
         ResultType: 'entity_object'
     }, contextUser);
     if (!keyResult.Success || keyResult.Results.length === 0) {
@@ -162,7 +163,7 @@ export async function CheckAPIKeyScopeAndLog(apiKeyId, scopePath, contextUser, u
     // Get the application
     const appResult = await rv.RunView({
         EntityName: 'MJ: API Applications',
-        ExtraFilter: `Name='${applicationName}'`,
+        ExtraFilter: `Name='${EscapeSQLString(applicationName)}'`,
         ResultType: 'entity_object'
     }, contextUser);
     if (!appResult.Success || appResult.Results.length === 0) {

package/dist/auth/APIKeyScopeAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"APIKeyScopeAuth.js","sourceRoot":"","sources":["../../src/auth/APIKeyScopeAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAA6C,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAY,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAkCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,QAA4B,EAC5B,SAAiB,EACjB,WAAqB,EACrB,UAA4B,EAAE;IAE9B,MAAM,EACF,eAAe,GAAG,OAAO,EACzB,QAAQ,GAAG,GAAG,EACd,aAAa,GAAG,IAAI,EACvB,GAAG,OAAO,CAAC;IAEZ,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B;SAC1C,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,sCAAsC;IACtC,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;QAC/C,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE,OAAO,QAAQ,GAAG;QAC/B,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAoB;YAC5B,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC9B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpC,8BAA8B;IAC9B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAyB;QACvD,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,SAAS,eAAe,GAAG;QACxC,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAoB;YAC5B,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,wBAAwB,eAAe,EAAE;SACpD,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChB,MAAM,MAAM,GAAoB;YAC5B,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,8BAA8B,eAAe,EAAE;SAC1D,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAyB;QAClC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,QAAQ;KACrB,CAAC;IAEF,sEAAsE;IACtE,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,IAAI,kBAAkB,CACxB,+CAA+C,YAAY,KAAK,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAC5F,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,UAAU,CAAC,cAAc;KAC5C,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,QAA4B,EAC5B,SAAiB,EACjB,WAAqB,EACrB,YAQC,EACD,UAA4B,EAAE;IAE9B,MAAM,EACF,eAAe,GAAG,OAAO,EACzB,QAAQ,GAAG,GAAG,EACd,aAAa,GAAG,IAAI,EACvB,GAAG,OAAO,CAAC;IAEZ,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B;SAC1C,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IAEzB,kBAAkB;IAClB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;QAC/C,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE,OAAO,QAAQ,GAAG;QAC/B,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAyC;YACjD,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC9B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpC,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAyB;QACvD,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,SAAS,eAAe,GAAG;QACxC,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAyC;YACjD,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,wBAAwB,eAAe,EAAE;SACpD,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEjC,kCAAkC;IAClC,MAAM,OAAO,GAAyB;QAClC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,QAAQ;KACrB,CAAC;IAEF,kBAAkB;IAClB,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7E,gBAAgB;IAChB,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE/E,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,UAAU,CACjC,QAAQ,EACR,GAAG,CAAC,EAAE,EACN,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,aAAa,IAAI,IAAI,EAClC,YAAY,CAAC,MAAM,EACnB,UAAU,EACV,YAAY,CAAC,cAAc,IAAI,IAAI,EACnC,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,WAAW,CACd,CAAC,IAAI,SAAS,CAAC;IACpB,CAAC;SAAM,CAAC;QACJ,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,SAAS,CAChC,QAAQ,EACR,GAAG,CAAC,EAAE,EACN,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,aAAa,IAAI,IAAI,EAClC,YAAY,CAAC,MAAM,EACnB,UAAU,EACV,YAAY,CAAC,cAAc,IAAI,IAAI,EACnC,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,MAAM,EACjB,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,WAAW,CACd,CAAC,IAAI,SAAS,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,IAAI,kBAAkB,CACxB,+CAA+C,YAAY,KAAK,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAC5F,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,KAAK,EAAE,KAAK;KACf,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA8C,EAAE;IAC5F,OAAO,KAAK,EAAE,GAAiE,EAAE,QAAiB,EAAE,EAAE;QAClG,MAAM,gBAAgB,CAClB,GAAG,CAAC,WAAW,CAAC,QAAQ,EACxB,SAAS,EACT,GAAG,CAAC,WAAW,CAAC,UAAU,EAC1B,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAC3B,CAAC;IACN,CAAC,CAAC;AACN,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC"}
+{"version":3,"file":"APIKeyScopeAuth.js","sourceRoot":"","sources":["../../src/auth/APIKeyScopeAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAA6C,MAAM,0BAA0B,CAAC;AACtG,OAAO,EAAY,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAkCzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,QAA4B,EAC5B,SAAiB,EACjB,WAAqB,EACrB,UAA4B,EAAE;IAE9B,MAAM,EACF,eAAe,GAAG,OAAO,EACzB,QAAQ,GAAG,GAAG,EACd,aAAa,GAAG,IAAI,EACvB,GAAG,OAAO,CAAC;IAEZ,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B;SAC1C,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,sCAAsC;IACtC,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;QAC/C,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,GAAG;QAChD,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAoB;YAC5B,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC9B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpC,8BAA8B;IAC9B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAyB;QACvD,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,SAAS,eAAe,CAAC,eAAe,CAAC,GAAG;QACzD,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAoB;YAC5B,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,wBAAwB,eAAe,EAAE;SACpD,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEjC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChB,MAAM,MAAM,GAAoB;YAC5B,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,8BAA8B,eAAe,EAAE;SAC1D,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAyB;QAClC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,QAAQ;KACrB,CAAC;IAEF,sEAAsE;IACtE,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,IAAI,kBAAkB,CACxB,+CAA+C,YAAY,KAAK,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAC5F,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,UAAU,CAAC,cAAc;KAC5C,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,QAA4B,EAC5B,SAAiB,EACjB,WAAqB,EACrB,YAQC,EACD,UAA4B,EAAE;IAE9B,MAAM,EACF,eAAe,GAAG,OAAO,EACzB,QAAQ,GAAG,GAAG,EACd,aAAa,GAAG,IAAI,EACvB,GAAG,OAAO,CAAC;IAEZ,qEAAqE;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO;YACH,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B;SAC1C,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;IAEzB,kBAAkB;IAClB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB;QAC/C,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,GAAG;QAChD,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAyC;YACjD,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,mBAAmB;SAC9B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpC,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAyB;QACvD,UAAU,EAAE,sBAAsB;QAClC,WAAW,EAAE,SAAS,eAAe,CAAC,eAAe,CAAC,GAAG;QACzD,UAAU,EAAE,eAAe;KAC9B,EAAE,WAAW,CAAC,CAAC;IAEhB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAyC;YACjD,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,wBAAwB,eAAe,EAAE;SACpD,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEjC,kCAAkC;IAClC,MAAM,OAAO,GAAyB;QAClC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,QAAQ;KACrB,CAAC;IAEF,kBAAkB;IAClB,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAE7E,gBAAgB;IAChB,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE/E,IAAI,KAAyB,CAAC;IAC9B,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,UAAU,CACjC,QAAQ,EACR,GAAG,CAAC,EAAE,EACN,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,aAAa,IAAI,IAAI,EAClC,YAAY,CAAC,MAAM,EACnB,UAAU,EACV,YAAY,CAAC,cAAc,IAAI,IAAI,EACnC,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,WAAW,CACd,CAAC,IAAI,SAAS,CAAC;IACpB,CAAC;SAAM,CAAC;QACJ,KAAK,GAAG,CAAC,MAAM,WAAW,CAAC,SAAS,CAChC,QAAQ,EACR,GAAG,CAAC,EAAE,EACN,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,aAAa,IAAI,IAAI,EAClC,YAAY,CAAC,MAAM,EACnB,UAAU,EACV,YAAY,CAAC,cAAc,IAAI,IAAI,EACnC,QAAQ,EACR,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,MAAM,EACjB,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,YAAY,CAAC,SAAS,IAAI,IAAI,EAC9B,WAAW,CACd,CAAC,IAAI,SAAS,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,MAAM,IAAI,kBAAkB,CACxB,+CAA+C,YAAY,KAAK,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAC5F,CAAC;IACN,CAAC;IAED,OAAO;QACH,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,KAAK,EAAE,KAAK;KACf,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAA8C,EAAE;IAC5F,OAAO,KAAK,EAAE,GAAiE,EAAE,QAAiB,EAAE,EAAE;QAClG,MAAM,gBAAgB,CAClB,GAAG,CAAC,WAAW,CAAC,QAAQ,EACxB,SAAS,EACT,GAAG,CAAC,WAAW,CAAC,UAAU,EAC1B,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAC3B,CAAC;IACN,CAAC,CAAC;AACN,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC"}

package/dist/auth/loginEmailResolution.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Which email a verified login is matched to a User record by, and whether that differs from the
+ * identity the token carries.
+ *
+ * The server links a login to a User row by email alone. `USER_EMAIL_MAP` can rewrite that email
+ * before the lookup, which makes a login run as a different person's record. That is a legitimate
+ * development aid, but it is silent, so a misconfigured map on a shared machine looks exactly like
+ * an authentication bug. These helpers keep the token's identity next to the one actually used, so
+ * the session audit and the server log can say when the two differ.
+ */
+/** The identity fields of a verified token that the lookup can use. */
+export interface LoginIdentityClaims {
+    email?: string;
+    preferredUsername?: string;
+}
+/** The email the token carries and the email the User lookup will use. */
+export interface LoginEmailResolution {
+    /** The identity from the verified token: its email claim, or its preferred username when it has none. */
+    TokenEmail: string | undefined;
+    /** The email the User record is looked up by, after any `USER_EMAIL_MAP` rewrite. */
+    LookupEmail: string | undefined;
+    /** True when `USER_EMAIL_MAP` replaced the token's email with a different one. */
+    Remapped: boolean;
+}
+/**
+ * Resolves the lookup email for a verified token. The map applies only to the email claim, with an
+ * exact (case-sensitive) key match, as it always has; a preferred username is never remapped.
+ *
+ * Named without "login"/"auth"/"verify": CodeQL treats calls with those words as authentication
+ * actions and reports the `if (!token)` guard above this call in GetUserPayload as a user-controlled
+ * bypass. This is a plain lookup, not an authentication step.
+ */
+export declare function ResolveUserLookupEmail(claims: LoginIdentityClaims, emailMap: Record<string, string> | undefined): LoginEmailResolution;
+/** Case-insensitive, whitespace-trimmed comparison, matching how the User lookup compares emails. */
+export declare function EmailsMatch(a: string | undefined, b: string | undefined): boolean;
+/**
+ * The startup warning for a configured `USER_EMAIL_MAP`, or null when the map is absent or rewrites
+ * nothing. Lists every entry so whoever starts the server can see whose record each login will use.
+ */
+export declare function DescribeUserEmailMap(emailMap: Record<string, string> | undefined): string | null;
+//# sourceMappingURL=loginEmailResolution.d.ts.map

package/dist/auth/loginEmailResolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginEmailResolution.d.ts","sourceRoot":"","sources":["../../src/auth/loginEmailResolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,yGAAyG;IACzG,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,oBAAoB,CAOtI;AAED,qGAAqG;AACrG,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAUhG"}

package/dist/auth/loginEmailResolution.js

@@ -0,0 +1,47 @@
+/**
+ * Which email a verified login is matched to a User record by, and whether that differs from the
+ * identity the token carries.
+ *
+ * The server links a login to a User row by email alone. `USER_EMAIL_MAP` can rewrite that email
+ * before the lookup, which makes a login run as a different person's record. That is a legitimate
+ * development aid, but it is silent, so a misconfigured map on a shared machine looks exactly like
+ * an authentication bug. These helpers keep the token's identity next to the one actually used, so
+ * the session audit and the server log can say when the two differ.
+ */
+/**
+ * Resolves the lookup email for a verified token. The map applies only to the email claim, with an
+ * exact (case-sensitive) key match, as it always has; a preferred username is never remapped.
+ *
+ * Named without "login"/"auth"/"verify": CodeQL treats calls with those words as authentication
+ * actions and reports the `if (!token)` guard above this call in GetUserPayload as a user-controlled
+ * bypass. This is a plain lookup, not an authentication step.
+ */
+export function ResolveUserLookupEmail(claims, emailMap) {
+    if (!claims.email) {
+        return { TokenEmail: claims.preferredUsername, LookupEmail: claims.preferredUsername, Remapped: false };
+    }
+    const mapped = emailMap?.[claims.email];
+    const lookupEmail = mapped ?? claims.email;
+    return { TokenEmail: claims.email, LookupEmail: lookupEmail, Remapped: mapped !== undefined && !EmailsMatch(mapped, claims.email) };
+}
+/** Case-insensitive, whitespace-trimmed comparison, matching how the User lookup compares emails. */
+export function EmailsMatch(a, b) {
+    if (!a || !b) {
+        return false;
+    }
+    return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+/**
+ * The startup warning for a configured `USER_EMAIL_MAP`, or null when the map is absent or rewrites
+ * nothing. Lists every entry so whoever starts the server can see whose record each login will use.
+ */
+export function DescribeUserEmailMap(emailMap) {
+    const entries = Object.entries(emailMap ?? {}).filter(([from, to]) => !EmailsMatch(from, to));
+    if (entries.length === 0) {
+        return null;
+    }
+    const lines = entries.map(([from, to]) => `  ${from} -> ${to}`).join('\n');
+    return (`[Auth] USER_EMAIL_MAP is set: ${entries.length} login email(s) will be matched to a different user's record. ` +
+        `A login with the first address runs as the user with the second. Remove the setting unless this is intended.\n${lines}`);
+}
+//# sourceMappingURL=loginEmailResolution.js.map

package/dist/auth/loginEmailResolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginEmailResolution.js","sourceRoot":"","sources":["../../src/auth/loginEmailResolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA2B,EAAE,QAA4C;IAC9G,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtI,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,WAAW,CAAC,CAAqB,EAAE,CAAqB;IACtE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4C;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,OAAO,CACL,iCAAiC,OAAO,CAAC,MAAM,gEAAgE;QAC/G,iHAAiH,KAAK,EAAE,CACzH,CAAC;AACJ,CAAC"}

package/dist/auth/magicLink/MagicLinkKeys.d.ts

@@ -10,6 +10,13 @@
  */
 import { BaseSingleton } from '@memberjunction/global';
 import type { MagicLinkJWTClaims } from './types.js';
+/**
+ * True when the process is NOT running with `NODE_ENV=production`. This is the same
+ * production/local-dev line MJServer already uses to forbid local dev auth in production.
+ */
+export declare function IsMagicLinkLocalDevEnvironment(env?: NodeJS.ProcessEnv): boolean;
+/** Warning logged when a non-local-dev server falls back to an ephemeral keypair. */
+export declare const EPHEMERAL_MAGIC_LINK_KEY_WARNING: string;
 /** A single JSON Web Key plus the metadata jwks-rsa needs to match it. */
 interface PublishedJWK extends JsonWebKey {
     kid: string;
@@ -28,26 +35,67 @@ export declare class MagicLinkKeyManager extends BaseSingleton<MagicLinkKeyManag
     private publicKey?;
     private _kid;
     private _initialized;
+    private _isEphemeral;
     constructor();
     static get Instance(): MagicLinkKeyManager;
     get IsInitialized(): boolean;
+    /**
+     * True when no private key was configured and the keypair was generated for this process
+     * only. Tokens signed with an ephemeral key do not survive a restart and do not validate on
+     * other instances. Downstream code should ask this rather than reading the raw config value.
+     */
+    get IsEphemeral(): boolean;
     get Kid(): string;
     /**
      * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
      * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     *
+     * @param env - process environment used to decide whether the ephemeral fallback is a local-dev
+     *   default (verbose-only notice) or a production misconfiguration (warning). Defaults to `process.env`.
      */
-    Initialize(privateKeyPem?: string): void;
+    Initialize(privateKeyPem?: string, env?: NodeJS.ProcessEnv): void;
     /**
      * Signs a set of magic-link (or local-dev) claims and returns the compact JWT.
      * `iat`/`exp` are expected to already be set on the claims.
      */
-    Sign(claims: MagicLinkJWTClaims | Record<string, unknown>): string;
+    Sign<T extends object>(claims: T): string;
+    /**
+     * Verifies a magic-link session JWT signed by this key manager (`RS256`, `mj_magic_link === true`).
+     * Returns `null` if invalid, expired, or forged.
+     */
+    VerifySessionToken(token: string, options?: {
+        issuer?: string;
+        audience?: string;
+    }): MagicLinkJWTClaims | null;
+    /**
+     * Signs a redirect binding JWT (`mj_purpose = 'magic-link-redirect'`) that cryptographically
+     * binds a validated `redirectUrl` to a specific invite's `tokenHash`.
+     *
+     * Note: Expiration is intentionally omitted from the redirect binding JWT because the database
+     * invite row's `ExpiresAt` (enforced atomically during `RedeemInvite`) is the authoritative,
+     * mutable expiration — allowing `UpdateInviteExpiry()` to extend an invite without invalidating
+     * an already-delivered `&rt=` parameter.
+     */
+    SignRedirectBinding(tokenHash: string, redirectUrl: string, _expiresAtEpochSeconds?: number): string;
+    /**
+     * Verifies a redirect binding JWT produced by {@link SignRedirectBinding} and ensures it matches
+     * `expectedTokenHash` (preventing cross-invite substitution) and carries a valid `http(s)` URL.
+     * Ignores JWT `exp` so bindings minted before an `UpdateInviteExpiry()` extension remain valid
+     * while the underlying invite row is valid. Returns the bound URL or `null`.
+     */
+    VerifyRedirectBinding(bindingToken: string, expectedTokenHash: string): string | null;
     /**
      * Returns the JWKS document (public key set) for the JWKS endpoint.
      */
     GetJWKS(): {
         keys: PublishedJWK[];
     };
+    /**
+     * Local dev (NODE_ENV not 'production'): the ephemeral fallback is the designed behavior and
+     * fires on every boot, so the notice stays verbose-only. Otherwise it is a data-loss-on-restart
+     * misconfiguration, so it is a warning in the default output.
+     */
+    private reportEphemeralKey;
     private ensureInitialized;
     /** Accepts raw PEM or base64-encoded PEM and returns raw PEM. */
     private normalizePem;

package/dist/auth/magicLink/MagicLinkKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;OAGG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IA+B/C;;;OAGG;IACI,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAKzE;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}
+{"version":3,"file":"MagicLinkKeys.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE5F;AAED,qFAAqF;AACrF,eAAO,MAAM,gCAAgC,QAMJ,CAAC;AAE1C,0EAA0E;AAC1E,UAAU,YAAa,SAAQ,UAAU;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,mBAAmB,CAAC;IACzE,OAAO,CAAC,aAAa,CAAM;IAC3B,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAAS;;IAQ7B,WAAkB,QAAQ,IAAI,mBAAmB,CAEhD;IAED,IAAW,aAAa,IAAI,OAAO,CAElC;IAED;;;;OAIG;IACH,IAAW,WAAW,IAAI,OAAO,CAEhC;IAED,IAAW,GAAG,IAAI,MAAM,CAEvB;IAED;;;;;;OAMG;IACI,UAAU,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI;IAsBrF;;;OAGG;IACI,IAAI,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM;IAKhD;;;OAGG;IACI,kBAAkB,CACvB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,kBAAkB,GAAG,IAAI;IAyB5B;;;;;;;;OAQG;IACI,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,MAAM;IAe3G;;;;;OAKG;IACI,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IA8B5F;;OAEG;IACI,OAAO,IAAI;QAAE,IAAI,EAAE,YAAY,EAAE,CAAA;KAAE;IAM1C;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,iBAAiB;IAMzB,iEAAiE;IACjE,OAAO,CAAC,YAAY;IAOpB,wFAAwF;IACxF,OAAO,CAAC,UAAU;CAInB"}

package/dist/auth/magicLink/MagicLinkKeys.js

@@ -9,9 +9,23 @@
  * @module @memberjunction/server/auth/magicLink
  */
 import { BaseSingleton } from '@memberjunction/global';
-import { LogStatusEx } from '@memberjunction/core';
+import { LogStatusEx, LogWarning } from '@memberjunction/core';
 import { createPrivateKey, createPublicKey, generateKeyPairSync, createHash } from 'node:crypto';
 import jwt from 'jsonwebtoken';
+/**
+ * True when the process is NOT running with `NODE_ENV=production`. This is the same
+ * production/local-dev line MJServer already uses to forbid local dev auth in production.
+ */
+export function IsMagicLinkLocalDevEnvironment(env = process.env) {
+    return env.NODE_ENV?.trim().toLowerCase() !== 'production';
+}
+/** Warning logged when a non-local-dev server falls back to an ephemeral keypair. */
+export const EPHEMERAL_MAGIC_LINK_KEY_WARNING = '[MagicLink] No rsaPrivateKey configured and NODE_ENV=production — generated an EPHEMERAL RS256 keypair. ' +
+    'Magic-link session tokens signed with it will stop validating when this process restarts, and they will not ' +
+    'validate on any other MJAPI instance behind the same load balancer, because each process generates its own key. ' +
+    'To fix, generate one RSA private key (e.g. `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048`) and set it ' +
+    'as magicLink.rsaPrivateKey in mj.config.cjs or as MJ_MAGIC_LINK_PRIVATE_KEY (raw or base64-encoded PEM), ' +
+    'using the same key on every instance.';
 /**
  * Manages the RS256 keypair used to sign and publish magic-link session tokens.
  * Singleton so the keypair (and therefore the `kid`) is stable for the process
@@ -27,6 +41,7 @@ export class MagicLinkKeyManager extends BaseSingleton {
         this.privateKeyPem = '';
         this._kid = '';
         this._initialized = false;
+        this._isEphemeral = false;
     }
     static get Instance() {
         return MagicLinkKeyManager.getInstance();
@@ -34,14 +49,25 @@ export class MagicLinkKeyManager extends BaseSingleton {
     get IsInitialized() {
         return this._initialized;
     }
+    /**
+     * True when no private key was configured and the keypair was generated for this process
+     * only. Tokens signed with an ephemeral key do not survive a restart and do not validate on
+     * other instances. Downstream code should ask this rather than reading the raw config value.
+     */
+    get IsEphemeral() {
+        return this._isEphemeral;
+    }
     get Kid() {
         return this._kid;
     }
     /**
      * Initializes the keypair from a provided PEM (raw or base64-encoded) or, if
      * none is supplied, generates an ephemeral 2048-bit RSA keypair. Idempotent.
+     *
+     * @param env - process environment used to decide whether the ephemeral fallback is a local-dev
+     *   default (verbose-only notice) or a production misconfiguration (warning). Defaults to `process.env`.
      */
-    Initialize(privateKeyPem) {
+    Initialize(privateKeyPem, env = process.env) {
         if (this._initialized) {
             return;
         }
@@ -53,16 +79,8 @@ export class MagicLinkKeyManager extends BaseSingleton {
         else {
             const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
             priv = privateKey;
-            // Verbose-only: on dev boxes with no configured key this fires on EVERY boot, and the
-            // ephemeral fallback is the designed behavior there — not a condition worth a log line in
-            // the default startup output. Deployments that care set the key; operators diagnosing
-            // magic-link session loss can re-run with verbose logging.
-            LogStatusEx({
-                message: '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
-                    'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
-                    '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
-                verboseOnly: true
-            });
+            this._isEphemeral = true;
+            this.reportEphemeralKey(env);
         }
         this.privateKeyPem = priv.export({ type: 'pkcs8', format: 'pem' });
         this.publicKey = createPublicKey(priv);
@@ -77,6 +95,88 @@ export class MagicLinkKeyManager extends BaseSingleton {
         this.ensureInitialized();
         return jwt.sign(claims, this.privateKeyPem, { algorithm: 'RS256', keyid: this._kid });
     }
+    /**
+     * Verifies a magic-link session JWT signed by this key manager (`RS256`, `mj_magic_link === true`).
+     * Returns `null` if invalid, expired, or forged.
+     */
+    VerifySessionToken(token, options) {
+        this.ensureInitialized();
+        try {
+            const publicPem = this.publicKey.export({ type: 'spki', format: 'pem' });
+            const verifyOptions = { algorithms: ['RS256'] };
+            if (options?.issuer) {
+                verifyOptions.issuer = options.issuer;
+            }
+            if (options?.audience) {
+                verifyOptions.audience = options.audience;
+            }
+            const decoded = jwt.verify(token, publicPem, verifyOptions);
+            if (!decoded || typeof decoded !== 'object') {
+                return null;
+            }
+            const claims = decoded;
+            if (claims.mj_magic_link !== true || typeof claims.sub !== 'string') {
+                return null;
+            }
+            return claims;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Signs a redirect binding JWT (`mj_purpose = 'magic-link-redirect'`) that cryptographically
+     * binds a validated `redirectUrl` to a specific invite's `tokenHash`.
+     *
+     * Note: Expiration is intentionally omitted from the redirect binding JWT because the database
+     * invite row's `ExpiresAt` (enforced atomically during `RedeemInvite`) is the authoritative,
+     * mutable expiration — allowing `UpdateInviteExpiry()` to extend an invite without invalidating
+     * an already-delivered `&rt=` parameter.
+     */
+    SignRedirectBinding(tokenHash, redirectUrl, _expiresAtEpochSeconds) {
+        this.ensureInitialized();
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        return jwt.sign({
+            mj_purpose: 'magic-link-redirect',
+            mj_th: tokenHash,
+            mj_redirect: redirectUrl,
+            iat: nowSeconds,
+        }, this.privateKeyPem, { algorithm: 'RS256', keyid: this._kid });
+    }
+    /**
+     * Verifies a redirect binding JWT produced by {@link SignRedirectBinding} and ensures it matches
+     * `expectedTokenHash` (preventing cross-invite substitution) and carries a valid `http(s)` URL.
+     * Ignores JWT `exp` so bindings minted before an `UpdateInviteExpiry()` extension remain valid
+     * while the underlying invite row is valid. Returns the bound URL or `null`.
+     */
+    VerifyRedirectBinding(bindingToken, expectedTokenHash) {
+        this.ensureInitialized();
+        try {
+            const publicPem = this.publicKey.export({ type: 'spki', format: 'pem' });
+            const decoded = jwt.verify(bindingToken, publicPem, {
+                algorithms: ['RS256'],
+                ignoreExpiration: true,
+            });
+            if (!decoded || typeof decoded !== 'object') {
+                return null;
+            }
+            const record = decoded;
+            if (record.mj_purpose !== 'magic-link-redirect' ||
+                record.mj_th !== expectedTokenHash ||
+                typeof record.mj_redirect !== 'string' ||
+                !record.mj_redirect) {
+                return null;
+            }
+            const parsed = new URL(record.mj_redirect);
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                return null;
+            }
+            return record.mj_redirect;
+        }
+        catch {
+            return null;
+        }
+    }
     /**
      * Returns the JWKS document (public key set) for the JWKS endpoint.
      */
@@ -85,6 +185,23 @@ export class MagicLinkKeyManager extends BaseSingleton {
         const jwk = this.publicKey.export({ format: 'jwk' });
         return { keys: [{ ...jwk, kid: this._kid, use: 'sig', alg: 'RS256' }] };
     }
+    /**
+     * Local dev (NODE_ENV not 'production'): the ephemeral fallback is the designed behavior and
+     * fires on every boot, so the notice stays verbose-only. Otherwise it is a data-loss-on-restart
+     * misconfiguration, so it is a warning in the default output.
+     */
+    reportEphemeralKey(env) {
+        if (!IsMagicLinkLocalDevEnvironment(env)) {
+            LogWarning(EPHEMERAL_MAGIC_LINK_KEY_WARNING);
+            return;
+        }
+        LogStatusEx({
+            message: '[MagicLink] No rsaPrivateKey configured — generated an EPHEMERAL RS256 keypair. ' +
+                'Outstanding magic-link sessions will be invalidated on restart. Set magicLink.rsaPrivateKey ' +
+                '(or MJ_MAGIC_LINK_PRIVATE_KEY) for stable production keys.',
+            verboseOnly: true
+        });
+    }
     ensureInitialized() {
         if (!this._initialized) {
             throw new Error('MagicLinkKeyManager not initialized — call Initialize() during server startup.');

package/dist/auth/magicLink/MagicLinkKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAU/B;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAMzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QARF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,UAAU,CAAC,aAAsB;QACtC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,sFAAsF;YACtF,0FAA0F;YAC1F,sFAAsF;YACtF,2DAA2D;YAC3D,WAAW,CAAC;gBACV,OAAO,EACL,kFAAkF;oBAClF,8FAA8F;oBAC9F,4DAA4D;gBAC9D,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAC,MAAoD;QAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"MagicLinkKeys.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,GAAG,MAAM,cAAc,CAAC;AAG/B;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjF,OAAO,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC;AAC7D,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,0GAA0G;IAC1G,8GAA8G;IAC9G,kHAAkH;IAClH,wHAAwH;IACxH,2GAA2G;IAC3G,uCAAuC,CAAC;AAS1C;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAOzE,+EAA+E;IAC/E,uDAAuD;IACvD;QACE,KAAK,EAAE,CAAC;QATF,kBAAa,GAAG,EAAE,CAAC;QAEnB,SAAI,GAAG,EAAE,CAAC;QACV,iBAAY,GAAG,KAAK,CAAC;QACrB,iBAAY,GAAG,KAAK,CAAC;IAM7B,CAAC;IAEM,MAAM,KAAK,QAAQ;QACxB,OAAO,mBAAmB,CAAC,WAAW,EAAuB,CAAC;IAChE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAW,GAAG;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,UAAU,CAAC,aAAsB,EAAE,MAAyB,OAAO,CAAC,GAAG;QAC5E,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,IAAe,CAAC;QACpB,MAAM,QAAQ,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,UAAU,CAAC;YAClB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QAC7E,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,IAAI,CAAmB,MAAS;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,KAAa,EACb,OAAgD;QAEhD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;YACpF,MAAM,aAAa,GAAsB,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,aAAa,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACxC,CAAC;YACD,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,aAAa,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAA6B,CAAC;YAC7C,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACI,mBAAmB,CAAC,SAAiB,EAAE,WAAmB,EAAE,sBAA+B;QAChG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC,IAAI,CACb;YACE,UAAU,EAAE,qBAAqB;YACjC,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,WAAW;YACxB,GAAG,EAAE,UAAU;SAChB,EACD,IAAI,CAAC,aAAa,EAClB,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CACzC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,qBAAqB,CAAC,YAAoB,EAAE,iBAAyB;QAC1E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;YACpF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE;gBAClD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,OAAwE,CAAC;YACxF,IACE,MAAM,CAAC,UAAU,KAAK,qBAAqB;gBAC3C,MAAM,CAAC,KAAK,KAAK,iBAAiB;gBAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,CAAC,MAAM,CAAC,WAAW,EACnB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACI,OAAO;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAsB;QAC/C,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,UAAU,CAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,WAAW,CAAC;YACV,OAAO,EACL,kFAAkF;gBAClF,8FAA8F;gBAC9F,4DAA4D;YAC9D,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,YAAY,CAAC,KAAa;QAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,UAAU,CAAC,SAAoB;QACrC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACxE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/auth/magicLink/MagicLinkRouter.d.ts

@@ -9,6 +9,7 @@
  */
 import { Router } from 'express';
 import { type MagicLinkConfig } from '../../config.js';
+import { MagicLinkService } from './MagicLinkService.js';
 /** The mount path for both routers (`/magic-link`). */
 export declare const MAGIC_LINK_MOUNT_PATH = "/magic-link";
 /** Path of the JWKS endpoint relative to the public URL. */
@@ -20,11 +21,13 @@ export declare const MAGIC_LINK_JWKS_PATH = "/magic-link/jwks.json";
 export declare function CreateMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
     publicRouter: Router;
     authenticatedRouter: Router;
+    service: MagicLinkService;
 };
 /** @deprecated Use {@link CreateMagicLinkHandler}. */
 export declare function createMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
     publicRouter: Router;
     authenticatedRouter: Router;
+    service: MagicLinkService;
 };
 /**
  * A minimal PUBLIC router that serves ONLY the JWKS endpoint (the magic-link

package/dist/auth/magicLink/MagicLinkRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOnE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgJA;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAEA;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAMlD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F;AAED,6DAA6D;AAC7D,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAE9F"}
+{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKzD,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAyKA;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,gBAAgB,CAAC;CAC3B,CAEA;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAMlD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F;AAED,6DAA6D;AAC7D,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAE9F"}