@memberjunction/server 5.43.0 → 5.45.0

package/dist/realtimeWidget/WidgetRouter.js

@@ -0,0 +1,182 @@
+/**
+ * @fileoverview Express wiring for the public web widget guest-session endpoints.
+ *
+ * Mirrors the magic-link public-router pattern: a single PUBLIC router
+ * (unauthenticated) mounted BEFORE the unified auth middleware. The widget reuses
+ * the magic-link RS256 key + the registered `magic-link` auth provider for token
+ * validation, so this module ensures both are initialized (idempotently) even when
+ * `magicLink.enabled` is false — the widget can stand on its own.
+ *
+ * @module @memberjunction/server/widget
+ */
+import { Router, json } from 'express';
+import { rateLimit } from 'express-rate-limit';
+import { LogStatus } from '@memberjunction/core';
+import { configInfo } from '../config.js';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+import { registerMagicLinkAuthProvider } from '../auth/magicLink/MagicLinkRouter.js';
+import { WidgetSessionService } from './WidgetSessionService.js';
+import { looksLikeBot } from './widgetCore.js';
+/** The mount path for the widget public router (`/widget`). */
+export const WIDGET_MOUNT_PATH = '/widget';
+/**
+ * Ensures the magic-link signing key is initialized and the `magic-link` auth
+ * provider is registered, so widget tokens (signed with that key) validate. Safe to
+ * call when magic-link is already enabled — both operations are idempotent.
+ */
+function ensureWidgetSigning(publicUrl, widgetConfig) {
+    const mlConfig = configInfo.magicLink;
+    // The widget shares the magic-link audience so the same provider validates its
+    // tokens; surface a clear log if a deployment diverged them.
+    if (mlConfig?.audience && mlConfig.audience !== widgetConfig.audience) {
+        LogStatus(`[Widget] WARNING: widget.audience ('${widgetConfig.audience}') != magicLink.audience ('${mlConfig.audience}'). ` +
+            `Widget tokens will not validate unless an auth provider is registered for the widget audience.`);
+    }
+    MagicLinkKeyManager.Instance.Initialize(mlConfig?.rsaPrivateKey);
+    // Register the magic-link provider against the magic-link config (its audience),
+    // which is what validates widget tokens. No-op if already registered.
+    if (mlConfig) {
+        registerMagicLinkAuthProvider(publicUrl, mlConfig);
+    }
+}
+/**
+ * Builds the widget routers. Mount `publicRouter` at WIDGET_MOUNT_PATH BEFORE the unified auth
+ * middleware (the mint/forget endpoints are public — visitors have no MJ JWT yet) and
+ * `authenticatedRouter` at the same path AFTER it (the RV4 resolve-identity endpoint needs the
+ * verified principal from `req.userPayload`).
+ */
+export function createWidgetHandler(publicUrl, config) {
+    ensureWidgetSigning(publicUrl, config);
+    const service = new WidgetSessionService(publicUrl, config);
+    // Per-instance DYNAMIC mint limiter (W6 hardening): keyed by (widgetKey + IP) so each widget
+    // deployment gets its own bucket and one abusive IP can't exhaust a shared instance's budget for
+    // everyone. The per-request `limit` is the widget instance's stored `RateLimitPerMinute` (cached,
+    // resolved from the parsed body), falling back to the deployment-wide default for an unknown key.
+    // `json()` runs FIRST so the key generator + limit can read `req.body.widgetKey`.
+    const mintLimiter = rateLimit({
+        windowMs: config.rateLimitWindowMs,
+        standardHeaders: 'draft-7',
+        legacyHeaders: false,
+        keyGenerator: (req) => `${readWidgetKey(req)}:${req.ip ?? 'noip'}`,
+        limit: async (req) => service.ResolvePerInstanceRateLimit(readWidgetKey(req)),
+        message: { success: false, errorCode: 'rate_limited', error: 'Too many widget session requests. Try again later.' },
+    });
+    const publicRouter = Router();
+    publicRouter.post('/session', json(), mintLimiter, async (req, res) => {
+        await handleMint(service, req, res, false);
+    });
+    publicRouter.post('/session/refresh', json(), mintLimiter, async (req, res) => {
+        await handleMint(service, req, res, true);
+    });
+    // W5 magic-link upgrade ("Verify it's you"): emails a verification link scoped to the widget's app.
+    // Same dynamic limiter as mint — it issues an email invite, a comparable cost/abuse surface.
+    publicRouter.post('/upgrade', json(), mintLimiter, async (req, res) => {
+        await handleUpgrade(service, req, res);
+    });
+    // RV5 "forget me": archive the visitor's memory + clear the VisitorKey linkage. Public — the visitor
+    // proves possession of the durable key (not an identity). Same dynamic limiter as mint.
+    publicRouter.post('/forget', json(), mintLimiter, async (req, res) => {
+        await handleForget(service, req, res);
+    });
+    // RV4 resolve-identity: promote the visitor's anonymous trail to the verified record. AUTHENTICATED —
+    // it reads the verified principal's email from req.userPayload, so it mounts after the auth middleware.
+    const authenticatedRouter = Router();
+    authenticatedRouter.post('/resolve-identity', json(), mintLimiter, async (req, res) => {
+        await handleResolveIdentity(service, req, res);
+    });
+    return { publicRouter, authenticatedRouter };
+}
+/** Reads the `widgetKey` from a parsed JSON body, or '' when absent (used to key the dynamic limiter). */
+function readWidgetKey(req) {
+    const body = (req.body ?? {});
+    return typeof body.widgetKey === 'string' ? body.widgetKey.trim() : '';
+}
+/** Handles "forget me" (RV5) — parses the body, calls the service, maps the status. */
+async function handleForget(service, req, res) {
+    const body = (req.body ?? {});
+    const widgetKey = typeof body.widgetKey === 'string' ? body.widgetKey : '';
+    const visitorKey = typeof body.visitorKey === 'string' ? body.visitorKey : '';
+    if (!widgetKey) {
+        res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
+        return;
+    }
+    const result = await service.ForgetVisitor({ widgetKey, visitorKey, origin: req.get('origin') ?? undefined });
+    res.status(result.success ? 200 : result.errorCode === 'server_error' ? 500 : 403).json(result);
+}
+/**
+ * Handles RV4 resolve-identity — reads the verified email from the authenticated principal
+ * (`req.userPayload.userRecord`), parses the body, calls the service, maps the status.
+ */
+async function handleResolveIdentity(service, req, res) {
+    const verifiedUser = req.userPayload?.userRecord;
+    if (!verifiedUser?.Email) {
+        res.status(401).json({ success: false, errorCode: 'server_error', error: 'Authentication required.' });
+        return;
+    }
+    const body = (req.body ?? {});
+    const widgetKey = typeof body.widgetKey === 'string' ? body.widgetKey : '';
+    const visitorKey = typeof body.visitorKey === 'string' ? body.visitorKey : '';
+    if (!widgetKey) {
+        res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
+        return;
+    }
+    const result = await service.ResolveVisitorIdentity({
+        widgetKey,
+        visitorKey,
+        verifiedEmail: verifiedUser.Email,
+        origin: req.get('origin') ?? undefined,
+    });
+    res.status(result.success ? 200 : result.errorCode === 'server_error' ? 500 : 403).json(result);
+}
+/** Handles the magic-link upgrade request — parses the body, calls the service, maps the status. */
+async function handleUpgrade(service, req, res) {
+    const body = (req.body ?? {});
+    const widgetKey = typeof body.widgetKey === 'string' ? body.widgetKey : '';
+    const email = typeof body.email === 'string' ? body.email : '';
+    if (!widgetKey) {
+        res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
+        return;
+    }
+    const result = await service.RequestUpgrade({ widgetKey, email, origin: req.get('origin') ?? undefined });
+    // 400 for a bad email (client can fix it); 403 for any policy rejection (uniform, non-enumerable); 500 for faults.
+    const status = result.success ? 200 : result.errorCode === 'invalid_email' ? 400 : result.errorCode === 'server_error' ? 500 : 403;
+    res.status(status).json(result);
+}
+/** Shared mint/refresh handler — parses the request, calls the service, maps the status. */
+async function handleMint(service, req, res, refresh) {
+    const body = (req.body ?? {});
+    const widgetKey = typeof body.widgetKey === 'string' ? body.widgetKey : '';
+    if (!widgetKey) {
+        res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
+        return;
+    }
+    // W6 hardening: coarse bot/automation rejection before any DB lookup or token mint. Returns the same
+    // 403 as a policy rejection so a probe can't distinguish "bot-blocked" from "bad key/origin".
+    if (looksLikeBot(req.get('user-agent'))) {
+        res.status(403).json({ success: false, errorCode: 'origin_not_allowed', error: 'Widget mint rejected.' });
+        return;
+    }
+    const origin = req.get('origin') ?? undefined;
+    const input = {
+        widgetKey,
+        origin,
+        hostAssertion: typeof body.hostAssertion === 'string' ? body.hostAssertion : undefined,
+        visitorKey: typeof body.visitorKey === 'string' ? body.visitorKey : undefined,
+        audit: { ipAddress: req.ip, userAgent: req.get('user-agent') ?? undefined, origin },
+    };
+    const result = refresh ? await service.RefreshGuestSession(input) : await service.MintGuestSession(input);
+    res.status(statusForResult(result)).json(result);
+}
+/**
+ * Maps a mint result to an HTTP status. All client-side rejections (unknown key,
+ * disabled widget, disallowed origin, modality off) return 403 — deliberately
+ * uniform so a probe cannot distinguish "no such widget" from "wrong origin" and
+ * enumerate valid keys. Only true server faults return 500.
+ */
+function statusForResult(result) {
+    if (result.success) {
+        return 200;
+    }
+    return result.errorCode === 'server_error' ? 500 : 403;
+}
+//# sourceMappingURL=WidgetRouter.js.map

package/dist/realtimeWidget/WidgetRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WidgetRouter.js","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAA+B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAA+B,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,YAA0B;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtE,SAAS,CACP,uCAAuC,YAAY,CAAC,QAAQ,8BAA8B,QAAQ,CAAC,QAAQ,MAAM;YACjH,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjE,iFAAiF;IACjF,sEAAsE;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,6BAA6B,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAoB;IACzE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE5D,6FAA6F;IAC7F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,WAAW,GAAG,SAAS,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,EAAE;QAC3E,KAAK,EAAE,KAAK,EAAE,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;KACpH,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,oGAAoG;IACpG,6FAA6F;IAC7F,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,qGAAqG;IACrG,wFAAwF;IACxF,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtF,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,sGAAsG;IACtG,wGAAwG;IACxG,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IACrC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvG,MAAM,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED,0GAA0G;AAC1G,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;IACxD,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,YAAY,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IACpF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IAC9G,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IAC7F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;IACjD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC;QAClD,SAAS;QACT,UAAU;QACV,aAAa,EAAE,YAAY,CAAC,KAAK;QACjC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;KACvC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IACrF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2C,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IAC1G,mHAAmH;IACnH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa,EAAE,OAAgB;IACpG,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwE,CAAC;IACrG,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,qGAAqG;IACrG,8FAA8F;IAC9F,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,SAAS;QACT,MAAM;QACN,aAAa,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACtF,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,MAAM,EAAE;KACpF,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1G,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAA8B;IACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC"}

package/dist/realtimeWidget/WidgetSessionService.d.ts

@@ -0,0 +1,265 @@
+/**
+ * @fileoverview Imperative shell for public web widget guest sessions: resolves a
+ * widget instance by its public key, enforces the origin allowlist + status, and
+ * mints a short-lived anonymous guest session JWT by reusing the magic-link RS256
+ * key + `anonymous-embed` synthesis. The pure logic lives in `widgetCore.ts`.
+ *
+ * Design (per public-web-widget.md W1 + open-Q #1): DIRECT-MINT for anonymous
+ * guests — no MagicLinkInvite row is created (those model single-use invites; a
+ * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
+ * carried in the token, plus best-effort structured audit logging. The minted
+ * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
+ * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ *
+ * @module @memberjunction/server/widget
+ */
+import { type WidgetConfig } from '../config.js';
+import { type WidgetMintErrorCode } from './widgetCore.js';
+import { type ResolvedVisitorIdentity } from './visitorIdentity.js';
+/** Per-request forensic context captured for audit (sourced from the HTTP request). */
+export interface WidgetMintAuditContext {
+    ipAddress?: string;
+    userAgent?: string;
+    origin?: string;
+}
+/** Input to mint a guest session. */
+export interface MintGuestSessionInput {
+    /** The widget's public embed key (pk_live_…). */
+    widgetKey: string;
+    /** The request's Origin header — enforced against the instance allowlist. */
+    origin?: string;
+    /**
+     * A host-signed RS256 identity assertion (D1 `host-identity` strategy). Required when the
+     * resolved widget's AuthStrategy is `HostIdentity`; ignored otherwise. Verified against the
+     * host's registered public key; its identity is carried as informational claims only.
+     */
+    hostAssertion?: string;
+    /**
+     * The durable returning-visitor anchor (RV1) the client presents from its first-party cookie.
+     * Honored only when the widget's `RememberReturningVisitors` toggle is on: a valid presented key
+     * chains this visit to the visitor's prior conversation; absent/invalid on a first visit, the
+     * server mints a fresh one. Ignored entirely when remembering is off.
+     */
+    visitorKey?: string;
+    audit?: WidgetMintAuditContext;
+}
+/** Result of a guest-session mint. */
+export interface MintGuestSessionResult {
+    success: boolean;
+    /** The minted session JWT (RS256), held by the widget in memory and refreshed before expiry. */
+    token?: string;
+    /** ISO expiry of the session token. */
+    expiresAt?: string;
+    /** The widget instance id (also carried as the `mj_widget_id` claim). */
+    widgetId?: string;
+    /** The Application the session is scoped to. */
+    applicationId?: string;
+    /** The pinned support agent the widget passes as explicitAgentId for every turn (D5). */
+    pinnedAgentId?: string;
+    /** Which modalities this widget exposes (drives the widget UI). */
+    modality?: string;
+    /**
+     * The opaque per-session id (also the signed scope resourceId). The widget stamps
+     * Conversation.ExternalID with this so the Widget Guest RLS filters isolate this guest's rows.
+     */
+    sessionId?: string;
+    /**
+     * Optional hard ceiling (minutes) on a voice session for this widget. Surfaced so the client
+     * voice-abuse guard uses the deployment-configured limit; also enforced server-side at mint.
+     */
+    voiceMaxSessionMinutes?: number;
+    /** Whether returning-visitor memory is enabled for this widget (gates the cookie + chaining). */
+    rememberReturningVisitors?: boolean;
+    /**
+     * The durable visitor anchor to persist as a cookie (RV1). Set only when remembering is on:
+     * the validated key the client presented, or a freshly minted one on a first visit.
+     */
+    visitorKey?: string;
+    /** The visitor's prior conversation for this anchor (RV2 chain); set only on a returning visit. */
+    lastConversationId?: string;
+    /**
+     * The resolved polymorphic identity entity id (RV4), set only when a host-identity widget asserted a
+     * resolvable identity at mint. The client stamps it (with {@link MintGuestSessionResult.linkedRecordId})
+     * onto the new conversation so memory injection (RV3) keys off the resolved record, not the cookie.
+     */
+    linkedEntityId?: string;
+    /** The resolved polymorphic identity record id (RV4); paired with {@link MintGuestSessionResult.linkedEntityId}. */
+    linkedRecordId?: string;
+    /**
+     * Interactive channels (by name, e.g. `["Whiteboard"]`) this widget may attach when voice is active
+     * (Phase 2). Mirrors the widget instance's `EnabledChannels`; empty (the default) = no channels.
+     */
+    enabledChannels?: string[];
+    error?: string;
+    errorCode?: WidgetMintErrorCode;
+}
+/** Input to resolve a returning visitor's identity after they verify (RV4, magic-link upgrade path). */
+export interface ResolveVisitorIdentityInput {
+    /** The widget's public embed key. */
+    widgetKey: string;
+    /** The durable returning-visitor anchor whose trail should be promoted to the verified identity. */
+    visitorKey: string;
+    /** The verified visitor's email (from the authenticated session) — resolved to a record via config. */
+    verifiedEmail: string;
+    /** The request's Origin header — enforced against the instance allowlist. */
+    origin?: string;
+}
+/** Result of an RV4 identity resolve+merge. */
+export interface ResolveVisitorIdentityResult {
+    success: boolean;
+    /** The resolved polymorphic pair, when a record matched the verified email. */
+    resolved?: ResolvedVisitorIdentity;
+    /** How many conversations were stamped with the resolved identity. */
+    mergedConversations?: number;
+    error?: string;
+    errorCode?: WidgetMintErrorCode;
+}
+/** Input to a "forget me" request (RV5). */
+export interface ForgetVisitorInput {
+    /** The widget's public embed key. */
+    widgetKey: string;
+    /** The durable returning-visitor anchor to forget. */
+    visitorKey: string;
+    /** The request's Origin header — enforced against the instance allowlist. */
+    origin?: string;
+}
+/** Result of a "forget me" request (RV5). */
+export interface ForgetVisitorResult {
+    success: boolean;
+    /** Count of memory notes archived. */
+    notesArchived?: number;
+    /** Count of conversations whose VisitorKey linkage was cleared. */
+    conversationsCleared?: number;
+    error?: string;
+    errorCode?: WidgetMintErrorCode;
+}
+/** Input to request a magic-link identity upgrade for a live guest session (W5). */
+export interface UpgradeGuestSessionInput {
+    /** The widget's public embed key. */
+    widgetKey: string;
+    /** The email to send the verification link to (becomes the provisioned user's email). */
+    email: string;
+    /** The request's Origin header — enforced against the instance allowlist. */
+    origin?: string;
+}
+/** Result of a magic-link upgrade request. Never carries the token (delivered by email, out-of-band). */
+export interface UpgradeGuestSessionResult {
+    success: boolean;
+    /** Whether the verification email was dispatched (false when no comms provider is configured). */
+    emailSent?: boolean;
+    error?: string;
+    errorCode?: WidgetMintErrorCode;
+}
+/**
+ * Mints constrained, short-lived guest sessions for the public web widget.
+ * Stateless; constructed once at server startup alongside the magic-link service.
+ */
+export declare class WidgetSessionService {
+    private readonly publicUrl;
+    private readonly config;
+    constructor(publicUrl: string, config: WidgetConfig);
+    /**
+     * Resolves the widget instance, enforces guardrails, and mints a guest JWT.
+     * Never throws for business failures — returns `{ success: false, errorCode }`.
+     */
+    MintGuestSession(input: MintGuestSessionInput): Promise<MintGuestSessionResult>;
+    /**
+     * Refreshes a live guest session. The widget always holds its public key, so a
+     * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
+     * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+     */
+    RefreshGuestSession(input: MintGuestSessionInput): Promise<MintGuestSessionResult>;
+    /** Short-TTL cache of resolved per-instance rate limits, so the limiter doesn't hit the DB per request. */
+    private readonly rateLimitCache;
+    private static readonly RATE_LIMIT_CACHE_TTL_MS;
+    /**
+     * Resolves the per-instance `RateLimitPerMinute` for a widget key (W6 hardening), falling back to the
+     * deployment-wide `defaultRateLimitPerMinute` for an unknown/invalid key (so an enumeration probe is
+     * still bounded by the coarse default). Cached for a short TTL so the dynamic limiter — which runs on
+     * EVERY mint request — does not issue a DB read per request. Never throws.
+     */
+    ResolvePerInstanceRateLimit(widgetKey: string): Promise<number>;
+    /**
+     * W5 magic-link upgrade — "Verify it's you". For a widget whose AuthStrategy is `MagicLinkUpgrade`,
+     * a guest supplies their email and we issue a single-use **email-mode** magic-link invite scoped to
+     * the widget's Application (under the server principal — `CreateInvite` is Owner-gated). The visitor
+     * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
+     * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
+     *
+     * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+     * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
+     * throws for business failures — returns a structured result.
+     */
+    RequestUpgrade(input: UpgradeGuestSessionInput): Promise<UpgradeGuestSessionResult>;
+    /**
+     * Verifies a host-identity assertion for a HostIdentity widget against the host's
+     * registered public key (config interim store, keyed by widget PublicKey). Fails closed
+     * when the key is absent or the assertion is missing/invalid.
+     */
+    private verifyHost;
+    /** Builds + signs the guest JWT for an eligible widget instance. */
+    private mintToken;
+    /**
+     * RV4 (host-identity path): when a `HostIdentity` widget asserts a resolvable identity AND remembering
+     * is on, resolve the asserted email to a polymorphic record and merge the visitor's prior anonymous
+     * trail onto it. Returns the resolved pair (so the client stamps the new conversation), or undefined
+     * when not applicable or no record matched. Best-effort — never blocks the mint.
+     */
+    private resolveHostIdentityIfApplicable;
+    /**
+     * RV4 (magic-link upgrade path): after a visitor verifies their identity, promote their anonymous
+     * trail to the verified record. Called from the AUTHENTICATED route with the verified session's email,
+     * so the resolved record is the deployment-configured target for that email (default: the MJ User).
+     * Validates the widget + origin + opt-in + key, then resolves and merges. Never throws.
+     */
+    ResolveVisitorIdentity(input: ResolveVisitorIdentityInput): Promise<ResolveVisitorIdentityResult>;
+    /**
+     * RV5 "forget me": archives the visitor's auto-generated memory and clears the VisitorKey linkage for
+     * this anchor in the widget's application. Public (the visitor proves possession of the durable key,
+     * not an identity). Validates the widget + origin + opt-in + key, then delegates to {@link forgetVisitor}.
+     */
+    ForgetVisitor(input: ForgetVisitorInput): Promise<ForgetVisitorResult>;
+    /**
+     * Shared guard for the RV4/RV5 visitor-privacy endpoints: resolves the lookup user, loads + validates
+     * the widget (status/origin), requires returning-visitor memory to be ON, and validates the presented
+     * VisitorKey shape. Returns the resolved widget + context user on success, or a structured failure.
+     */
+    private gateVisitorPrivacyRequest;
+    /**
+     * Resolves the returning-visitor anchor for a mint (RV1). Returns undefined when the widget does NOT
+     * opt in (RememberReturningVisitors off) — the default, fully-off path: no cookie, no chaining.
+     * When on: validates the presented key (else mints a fresh one) and, for a returning key, finds the
+     * visitor's most-recent prior conversation in this widget's application to chain from. Best-effort:
+     * a lookup failure degrades to "no prior conversation" rather than blocking the session.
+     */
+    private resolveReturningVisitor;
+    /**
+     * Recaps the visitor's prior conversation when they return (RV2, text path). No-op unless this is a
+     * returning visit (a resolved `lastConversationId`). Delegates to the shared, idempotent,
+     * best-effort {@link writeReturningVisitorRecap}, attributing the recap to the widget's pinned agent
+     * and stamping the widget's `VisitorMemoryRetentionDays` as the note's expiry. Awaited so the recap
+     * note exists before the new session's memory injection (RV3) runs; the recap's own idempotency
+     * bounds the LLM cost to the first return after each prior conversation.
+     */
+    private recapPriorConversationIfNeeded;
+    /**
+     * Finds the visitor's most-recent prior conversation for a VisitorKey, scoped to the widget's
+     * application so a key can never resolve a conversation from a different deployment. Returns the
+     * id or undefined (first visit, or read failure — never throws).
+     */
+    private findPreviousConversationByVisitorKey;
+    /** Loads a single widget instance by its public key (read-only, simple result). */
+    private loadWidgetByKey;
+    /** Resolves the guest role's NAME from its id (claims carry the name, not the id). */
+    private resolveGuestRoleName;
+    /** Resolves the server-side context user used to READ widget config (not the guest principal). */
+    private resolveLookupUser;
+    /**
+     * Best-effort structured audit of a mint attempt. Never alters the result — losing
+     * an audit line must not change whether a visitor got (or was denied) a session.
+     * (A dedicated `MJ: Widget Session` audit entity is a follow-on; for now this is a
+     * structured log line carrying the same forensics as the magic-link redemption row.)
+     */
+    private audited;
+}
+//# sourceMappingURL=WidgetSessionService.d.ts.map

package/dist/realtimeWidget/WidgetSessionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WidgetSessionService.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAoE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG7H,OAAO,EAA+D,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAgBjI,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oHAAoH;IACpH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,wGAAwG;AACxG,MAAM,WAAW,2BAA2B;IAC1C,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yGAAyG;AACzG,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kGAAkG;IAClG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAOD;;;GAGG;AACH,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY;IAGvC;;;OAGG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA0D5F;;;;OAIG;IACU,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI/F,2GAA2G;IAC3G,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6D;IAC5F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAEzD;;;;;OAKG;IACU,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA2B5E;;;;;;;;;;OAUG;IACU,cAAc,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAyChG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAYlB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IAwDjB;;;;;OAKG;YACW,+BAA+B;IAuB7C;;;;;OAKG;IACU,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyB9G;;;;OAIG;IACU,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmBnF;;;;OAIG;YACW,yBAAyB;IA6BvC;;;;;;OAMG;YACW,uBAAuB;IAiBrC;;;;;;;OAOG;YACW,8BAA8B;IAmB5C;;;;OAIG;YACW,oCAAoC;IA0BlD,mFAAmF;YACrE,eAAe;IAsB7B,sFAAsF;IACtF,OAAO,CAAC,oBAAoB;IAM5B,kGAAkG;IAClG,OAAO,CAAC,iBAAiB;IAgBzB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;CAYhB"}