@memberjunction/server 5.44.0 → 5.45.1

package/dist/realtimeWidget/WidgetSessionService.js

@@ -0,0 +1,477 @@
+/**
+ * @fileoverview Imperative shell for public web widget guest sessions: resolves a
+ * widget instance by its public key, enforces the origin allowlist + status, and
+ * mints a short-lived anonymous guest session JWT by reusing the magic-link RS256
+ * key + `anonymous-embed` synthesis. The pure logic lives in `widgetCore.ts`.
+ *
+ * Design (per public-web-widget.md W1 + open-Q #1): DIRECT-MINT for anonymous
+ * guests — no MagicLinkInvite row is created (those model single-use invites; a
+ * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
+ * carried in the token, plus best-effort structured audit logging. The minted
+ * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
+ * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ *
+ * @module @memberjunction/server/widget
+ */
+import { Metadata, RunView, LogError, LogStatus } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
+import { generateSessionId } from '../auth/magicLink/magicLinkCore.js';
+import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
+import { configInfo } from '../config.js';
+import { buildWidgetGuestClaims, evaluateWidgetMint, parseEnabledChannels } from './widgetCore.js';
+import { verifyHostAssertion } from './host-identity.js';
+import { writeReturningVisitorRecap } from '../agentSessions/ReturningVisitorRecap.js';
+import { resolveIdentityByEmail, mergeVisitorIdentity, forgetVisitor } from './visitorIdentity.js';
+const WIDGET_ENTITY = 'MJ: Conversation Widget Instances';
+const CONVERSATIONS_ENTITY = 'MJ: Conversations';
+/** Shape of the durable visitor anchor key (opaque base64url, same alphabet as generateSessionId). */
+const VISITOR_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+/** Minimal email sanity check (presence + single `@` with a dotted domain) — not full RFC validation. */
+function isLikelyEmail(email) {
+    return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email);
+}
+/**
+ * Mints constrained, short-lived guest sessions for the public web widget.
+ * Stateless; constructed once at server startup alongside the magic-link service.
+ */
+export class WidgetSessionService {
+    constructor(publicUrl, config) {
+        this.publicUrl = publicUrl;
+        this.config = config;
+        /** Short-TTL cache of resolved per-instance rate limits, so the limiter doesn't hit the DB per request. */
+        this.rateLimitCache = new Map();
+    }
+    /**
+     * Resolves the widget instance, enforces guardrails, and mints a guest JWT.
+     * Never throws for business failures — returns `{ success: false, errorCode }`.
+     */
+    async MintGuestSession(input) {
+        try {
+            const contextUser = this.resolveLookupUser();
+            if (!contextUser) {
+                LogError('[Widget] No lookup context user available; server not configured.');
+                return { success: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+            }
+            const widget = await this.loadWidgetByKey(input.widgetKey, contextUser);
+            if (!widget) {
+                return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, undefined);
+            }
+            const eligibility = evaluateWidgetMint({ Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality }, input.origin);
+            if (!eligibility.ok) {
+                return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
+            }
+            const guestRoleName = this.resolveGuestRoleName(widget.GuestRoleID);
+            if (!guestRoleName) {
+                LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
+                return this.audited({ success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' }, input, widget);
+            }
+            // D1 host-identity strategy: a HostIdentity widget MUST present a valid host assertion.
+            let hostIdentity;
+            if (widget.AuthStrategy === 'HostIdentity') {
+                const verified = this.verifyHost(widget, input.hostAssertion);
+                if (!verified) {
+                    return this.audited({ success: false, errorCode: 'host_assertion_invalid', error: 'Host identity assertion invalid.' }, input, widget);
+                }
+                hostIdentity = verified;
+            }
+            // Returning-visitor anchor (RV1): resolve/mint the durable VisitorKey and chain to the prior
+            // conversation — only when this widget opts in. Never blocks the mint (best-effort on lookup failure).
+            const returningVisitor = await this.resolveReturningVisitor(widget, input.visitorKey, contextUser);
+            // RV2 (text path): the text widget runs client-side and has no server "session closed" event, so
+            // we recap the visitor's PRIOR conversation lazily, at the moment they return — which is exactly
+            // when the recap is needed for RV3 to inject it into this new session. Idempotent (skips when a
+            // recap already exists) and best-effort (never blocks or fails the mint).
+            await this.recapPriorConversationIfNeeded(widget, returningVisitor, contextUser);
+            // RV4 (host-identity path): when a host asserts a resolvable identity, promote the visitor's prior
+            // anonymous trail to that record and surface the pair so the client stamps the new conversation.
+            const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
+            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity), input, widget);
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * Refreshes a live guest session. The widget always holds its public key, so a
+     * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
+     * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+     */
+    async RefreshGuestSession(input) {
+        return this.MintGuestSession(input);
+    }
+    static { this.RATE_LIMIT_CACHE_TTL_MS = 60_000; }
+    /**
+     * Resolves the per-instance `RateLimitPerMinute` for a widget key (W6 hardening), falling back to the
+     * deployment-wide `defaultRateLimitPerMinute` for an unknown/invalid key (so an enumeration probe is
+     * still bounded by the coarse default). Cached for a short TTL so the dynamic limiter — which runs on
+     * EVERY mint request — does not issue a DB read per request. Never throws.
+     */
+    async ResolvePerInstanceRateLimit(widgetKey) {
+        const key = (widgetKey ?? '').trim();
+        const fallback = this.config.defaultRateLimitPerMinute;
+        if (!key) {
+            return fallback;
+        }
+        const cached = this.rateLimitCache.get(key);
+        const now = Date.now();
+        if (cached && cached.expiresAtMs > now) {
+            return cached.limit;
+        }
+        let limit = fallback;
+        try {
+            const contextUser = this.resolveLookupUser();
+            if (contextUser) {
+                const widget = await this.loadWidgetByKey(key, contextUser);
+                if (widget && widget.RateLimitPerMinute > 0) {
+                    limit = widget.RateLimitPerMinute;
+                }
+            }
+        }
+        catch (e) {
+            LogError(e);
+        }
+        this.rateLimitCache.set(key, { limit, expiresAtMs: now + WidgetSessionService.RATE_LIMIT_CACHE_TTL_MS });
+        return limit;
+    }
+    /**
+     * W5 magic-link upgrade — "Verify it's you". For a widget whose AuthStrategy is `MagicLinkUpgrade`,
+     * a guest supplies their email and we issue a single-use **email-mode** magic-link invite scoped to
+     * the widget's Application (under the server principal — `CreateInvite` is Owner-gated). The visitor
+     * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
+     * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
+     *
+     * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+     * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
+     * throws for business failures — returns a structured result.
+     */
+    async RequestUpgrade(input) {
+        try {
+            const email = (input.email ?? '').trim();
+            if (!isLikelyEmail(email)) {
+                return { success: false, errorCode: 'invalid_email', error: 'A valid email is required.' };
+            }
+            const contextUser = this.resolveLookupUser();
+            if (!contextUser) {
+                return { success: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+            }
+            const widget = await this.loadWidgetByKey(input.widgetKey, contextUser);
+            if (!widget) {
+                return { success: false, errorCode: 'not_found', error: 'Unknown widget key.' };
+            }
+            const eligibility = evaluateWidgetMint({ Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality }, input.origin);
+            if (!eligibility.ok) {
+                return { success: false, errorCode: eligibility.errorCode, error: 'Widget upgrade rejected.' };
+            }
+            if (widget.AuthStrategy !== 'MagicLinkUpgrade') {
+                return { success: false, errorCode: 'upgrade_not_enabled', error: 'This widget does not offer magic-link upgrade.' };
+            }
+            const magicLinkConfig = configInfo.magicLink;
+            if (!magicLinkConfig) {
+                LogError('[Widget] Upgrade requested but magicLink config is absent.');
+                return { success: false, errorCode: 'server_error', error: 'Identity verification is not configured.' };
+            }
+            const service = new MagicLinkService(this.publicUrl, magicLinkConfig);
+            const result = await service.CreateInvite({ email, applicationId: widget.ApplicationID }, contextUser);
+            if (!result.success) {
+                LogError(`[Widget] Upgrade invite failed for widget ${widget.ID}: ${result.error ?? result.errorCode ?? 'unknown'}`);
+                return { success: false, errorCode: 'server_error', error: 'Could not start identity verification.' };
+            }
+            // Deliberately do NOT echo the raw token/redemption URL to the public caller — the verified link
+            // is delivered out-of-band by email so a widget-key holder cannot mint verified sessions at will.
+            return { success: true, emailSent: result.emailSent ?? false };
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * Verifies a host-identity assertion for a HostIdentity widget against the host's
+     * registered public key (config interim store, keyed by widget PublicKey). Fails closed
+     * when the key is absent or the assertion is missing/invalid.
+     */
+    verifyHost(widget, assertion) {
+        // Prefer the per-instance HostPublicKey column (Phase 3 — no config-resident keys); fall back to the
+        // interim config map (keyed by PublicKey) for deployments that haven't migrated their key yet.
+        const hostKey = widget.HostPublicKey ?? this.config.hostPublicKeys?.[widget.PublicKey];
+        const result = verifyHostAssertion(assertion, hostKey, widget.PublicKey);
+        if (result.ok && result.identity) {
+            return result.identity;
+        }
+        LogError(`[Widget] Host assertion rejected for widget ${widget.ID}: ${result.errorCode ?? 'unknown'}`);
+        return null;
+    }
+    /** Builds + signs the guest JWT for an eligible widget instance. */
+    mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity) {
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const ttlMinutes = widget.SessionTTLMinutes || this.config.defaultSessionTtlMinutes;
+        // Generated once and returned to the client: the widget stamps Conversation.ExternalID with
+        // this id so the Widget Guest RLS filters ({{ScopeResourceID}}) isolate this guest's rows.
+        const sessionId = generateSessionId();
+        const claims = buildWidgetGuestClaims({
+            issuer: this.publicUrl,
+            audience: this.config.audience,
+            widgetId: widget.ID,
+            sessionId,
+            anonymousEmail: this.config.anonymousEmail,
+            applicationId: widget.ApplicationID,
+            guestRoleName,
+            nowSeconds,
+            ttlSeconds: ttlMinutes * 60,
+            hostIdentity,
+            // RV1/RV2/RV4: carry the returning-visitor anchor + resolved identity as claims so the voice path
+            // (server-created conversation) stamps the same fields the text path stamps client-side.
+            returningVisitor: returningVisitor
+                ? {
+                    visitorKey: returningVisitor.visitorKey,
+                    lastConversationId: returningVisitor.lastConversationId,
+                    linkedEntityId: resolvedIdentity?.entityId,
+                    linkedRecordId: resolvedIdentity?.recordId,
+                }
+                : undefined,
+        });
+        const token = MagicLinkKeyManager.Instance.Sign(claims);
+        return {
+            success: true,
+            token,
+            expiresAt: new Date(claims.exp * 1000).toISOString(),
+            widgetId: widget.ID,
+            applicationId: widget.ApplicationID,
+            pinnedAgentId: widget.PinnedAgentID,
+            modality: widget.Modality,
+            sessionId,
+            // Phase 2: which interactive channels this widget may attach during a voice session. Read from the
+            // per-instance EnabledChannels column (added by the Widget_Public_Hardening migration + CodeGen).
+            enabledChannels: parseEnabledChannels(widget.EnabledChannels),
+            voiceMaxSessionMinutes: widget.VoiceMaxSessionMinutes ?? undefined,
+            rememberReturningVisitors: !!returningVisitor,
+            visitorKey: returningVisitor?.visitorKey,
+            lastConversationId: returningVisitor?.lastConversationId,
+            linkedEntityId: resolvedIdentity?.entityId,
+            linkedRecordId: resolvedIdentity?.recordId,
+        };
+    }
+    /**
+     * RV4 (host-identity path): when a `HostIdentity` widget asserts a resolvable identity AND remembering
+     * is on, resolve the asserted email to a polymorphic record and merge the visitor's prior anonymous
+     * trail onto it. Returns the resolved pair (so the client stamps the new conversation), or undefined
+     * when not applicable or no record matched. Best-effort — never blocks the mint.
+     */
+    async resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser) {
+        if (!widget.RememberReturningVisitors || !hostIdentity?.email || !returningVisitor?.visitorKey) {
+            return undefined;
+        }
+        const identity = await resolveIdentityByEmail(hostIdentity.email, contextUser, Metadata.Provider, this.config.identityResolution); // global-provider-ok: server-side mint under the single default provider
+        if (!identity) {
+            return undefined;
+        }
+        await mergeVisitorIdentity({
+            visitorKey: returningVisitor.visitorKey,
+            applicationId: widget.ApplicationID,
+            identity,
+            contextUser,
+            provider: Metadata.Provider, // global-provider-ok: server-side mint under the single default provider
+        });
+        return identity;
+    }
+    /**
+     * RV4 (magic-link upgrade path): after a visitor verifies their identity, promote their anonymous
+     * trail to the verified record. Called from the AUTHENTICATED route with the verified session's email,
+     * so the resolved record is the deployment-configured target for that email (default: the MJ User).
+     * Validates the widget + origin + opt-in + key, then resolves and merges. Never throws.
+     */
+    async ResolveVisitorIdentity(input) {
+        try {
+            const gate = await this.gateVisitorPrivacyRequest(input.widgetKey, input.visitorKey, input.origin);
+            if (!gate.ok) {
+                return { success: false, errorCode: gate.errorCode, error: gate.error };
+            }
+            const identity = await resolveIdentityByEmail(input.verifiedEmail, gate.contextUser, Metadata.Provider, this.config.identityResolution); // global-provider-ok: server-side mint under the single default provider
+            if (!identity) {
+                // Verified, but no record matches the email under the configured target — nothing to merge.
+                return { success: true, mergedConversations: 0 };
+            }
+            const mergedConversations = await mergeVisitorIdentity({
+                visitorKey: input.visitorKey,
+                applicationId: gate.widget.ApplicationID,
+                identity,
+                contextUser: gate.contextUser,
+                provider: Metadata.Provider, // global-provider-ok: server-side mint under the single default provider
+            });
+            return { success: true, resolved: identity, mergedConversations };
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * RV5 "forget me": archives the visitor's auto-generated memory and clears the VisitorKey linkage for
+     * this anchor in the widget's application. Public (the visitor proves possession of the durable key,
+     * not an identity). Validates the widget + origin + opt-in + key, then delegates to {@link forgetVisitor}.
+     */
+    async ForgetVisitor(input) {
+        try {
+            const gate = await this.gateVisitorPrivacyRequest(input.widgetKey, input.visitorKey, input.origin);
+            if (!gate.ok) {
+                return { success: false, errorCode: gate.errorCode, error: gate.error };
+            }
+            const { notesArchived, conversationsCleared } = await forgetVisitor({
+                visitorKey: input.visitorKey,
+                applicationId: gate.widget.ApplicationID,
+                contextUser: gate.contextUser,
+                provider: Metadata.Provider, // global-provider-ok: server-side mint under the single default provider
+            });
+            return { success: true, notesArchived, conversationsCleared };
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * Shared guard for the RV4/RV5 visitor-privacy endpoints: resolves the lookup user, loads + validates
+     * the widget (status/origin), requires returning-visitor memory to be ON, and validates the presented
+     * VisitorKey shape. Returns the resolved widget + context user on success, or a structured failure.
+     */
+    async gateVisitorPrivacyRequest(widgetKey, visitorKey, origin) {
+        const contextUser = this.resolveLookupUser();
+        if (!contextUser) {
+            return { ok: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+        }
+        const widget = await this.loadWidgetByKey(widgetKey, contextUser);
+        if (!widget) {
+            return { ok: false, errorCode: 'not_found', error: 'Unknown widget key.' };
+        }
+        const eligibility = evaluateWidgetMint({ Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality }, origin);
+        if (!eligibility.ok) {
+            return { ok: false, errorCode: eligibility.errorCode ?? 'server_error', error: 'Widget request rejected.' };
+        }
+        if (!widget.RememberReturningVisitors) {
+            return { ok: false, errorCode: 'upgrade_not_enabled', error: 'Returning-visitor memory is not enabled for this widget.' };
+        }
+        if (!VISITOR_KEY_PATTERN.test((visitorKey ?? '').trim())) {
+            return { ok: false, errorCode: 'not_found', error: 'A valid visitorKey is required.' };
+        }
+        return { ok: true, widget, contextUser };
+    }
+    /**
+     * Resolves the returning-visitor anchor for a mint (RV1). Returns undefined when the widget does NOT
+     * opt in (RememberReturningVisitors off) — the default, fully-off path: no cookie, no chaining.
+     * When on: validates the presented key (else mints a fresh one) and, for a returning key, finds the
+     * visitor's most-recent prior conversation in this widget's application to chain from. Best-effort:
+     * a lookup failure degrades to "no prior conversation" rather than blocking the session.
+     */
+    async resolveReturningVisitor(widget, presentedKey, contextUser) {
+        if (!widget.RememberReturningVisitors) {
+            return undefined;
+        }
+        const presented = (presentedKey ?? '').trim();
+        const isReturning = VISITOR_KEY_PATTERN.test(presented);
+        const visitorKey = isReturning ? presented : generateSessionId();
+        const lastConversationId = isReturning
+            ? await this.findPreviousConversationByVisitorKey(visitorKey, widget.ApplicationID, contextUser)
+            : undefined;
+        return { visitorKey, lastConversationId };
+    }
+    /**
+     * Recaps the visitor's prior conversation when they return (RV2, text path). No-op unless this is a
+     * returning visit (a resolved `lastConversationId`). Delegates to the shared, idempotent,
+     * best-effort {@link writeReturningVisitorRecap}, attributing the recap to the widget's pinned agent
+     * and stamping the widget's `VisitorMemoryRetentionDays` as the note's expiry. Awaited so the recap
+     * note exists before the new session's memory injection (RV3) runs; the recap's own idempotency
+     * bounds the LLM cost to the first return after each prior conversation.
+     */
+    async recapPriorConversationIfNeeded(widget, returningVisitor, contextUser) {
+        const priorConversationId = returningVisitor?.lastConversationId;
+        if (!priorConversationId) {
+            return;
+        }
+        // global-provider-ok: server-side mint under the single default provider (same rationale as resolveGuestRoleName).
+        await writeReturningVisitorRecap(priorConversationId, widget.PinnedAgentID, contextUser, Metadata.Provider, // global-provider-ok: server-side mint under the single default provider
+        widget.VisitorMemoryRetentionDays);
+    }
+    /**
+     * Finds the visitor's most-recent prior conversation for a VisitorKey, scoped to the widget's
+     * application so a key can never resolve a conversation from a different deployment. Returns the
+     * id or undefined (first visit, or read failure — never throws).
+     */
+    async findPreviousConversationByVisitorKey(visitorKey, applicationId, contextUser) {
+        const rv = new RunView();
+        const result = await rv.RunView({
+            EntityName: CONVERSATIONS_ENTITY,
+            // visitorKey is validated base64url ([A-Za-z0-9_-]) so the literal is injection-safe; applicationId
+            // is a server-trusted UUID. Scope to the application to prevent cross-widget anchor reuse.
+            ExtraFilter: `VisitorKey = '${visitorKey}' AND ApplicationID = '${applicationId.replace(/'/g, "''")}'`,
+            OrderBy: '__mj_CreatedAt DESC',
+            MaxRows: 1,
+            Fields: ['ID'],
+            ResultType: 'simple',
+        }, contextUser);
+        if (!result.Success) {
+            LogError(`[Widget] Returning-visitor lookup failed: ${result.ErrorMessage}`);
+            return undefined;
+        }
+        return result.Results?.[0]?.ID ?? undefined;
+    }
+    /** Loads a single widget instance by its public key (read-only, simple result). */
+    async loadWidgetByKey(widgetKey, contextUser) {
+        const key = (widgetKey ?? '').trim();
+        if (!key) {
+            return null;
+        }
+        const rv = new RunView();
+        const result = await rv.RunView({
+            EntityName: WIDGET_ENTITY,
+            ExtraFilter: `PublicKey = '${key.replace(/'/g, "''")}'`,
+            MaxRows: 1,
+            ResultType: 'entity_object',
+        }, contextUser);
+        if (!result.Success) {
+            LogError(`[Widget] Failed to load widget by key: ${result.ErrorMessage}`);
+            return null;
+        }
+        return result.Results?.[0] ?? null;
+    }
+    /** Resolves the guest role's NAME from its id (claims carry the name, not the id). */
+    resolveGuestRoleName(guestRoleId) {
+        const md = Metadata.Provider; // global-provider-ok: pre-auth server-side mint under the single default provider
+        const role = md?.Roles.find((r) => UUIDsEqual(r.ID, guestRoleId));
+        return role?.Name ?? null;
+    }
+    /** Resolves the server-side context user used to READ widget config (not the guest principal). */
+    resolveLookupUser() {
+        const candidate = this.config.contextUserForLookup;
+        if (candidate) {
+            const byName = UserCache.Instance.UserByName(candidate);
+            if (byName) {
+                return byName;
+            }
+            LogError(`[Widget] Configured lookup user '${candidate}' not found; falling back to system/Owner.`);
+        }
+        return (UserCache.Instance.GetSystemUser() ??
+            UserCache.Users.find((u) => u.IsActive && u.Type?.trim().toLowerCase() === 'owner') ??
+            null);
+    }
+    /**
+     * Best-effort structured audit of a mint attempt. Never alters the result — losing
+     * an audit line must not change whether a visitor got (or was denied) a session.
+     * (A dedicated `MJ: Widget Session` audit entity is a follow-on; for now this is a
+     * structured log line carrying the same forensics as the magic-link redemption row.)
+     */
+    audited(result, input, widget) {
+        try {
+            LogStatus(`[Widget][audit] mint outcome=${result.success ? 'success' : result.errorCode} ` +
+                `widget=${widget?.ID ?? 'unknown'} origin=${input.audit?.origin ?? input.origin ?? '-'} ` +
+                `ip=${input.audit?.ipAddress ?? '-'}`);
+        }
+        catch {
+            /* audit is best-effort */
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=WidgetSessionService.js.map

package/dist/realtimeWidget/WidgetSessionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WidgetSessionService.js","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,oBAAoB,EAA4B,MAAM,iBAAiB,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,aAAa,EAAgC,MAAM,sBAAsB,CAAC;AAEjI,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAsKtD,yGAAyG;AACzG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAC/B,YACmB,SAAiB,EACjB,MAAoB;QADpB,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAc;QA0EvC,2GAA2G;QAC1F,mBAAc,GAAG,IAAI,GAAG,EAAkD,CAAC;IA1EzF,CAAC;IAEJ;;;OAGG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,KAAK,CAAC,MAAM,CACb,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3H,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,QAAQ,CAAC,uBAAuB,MAAM,CAAC,WAAW,eAAe,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBACrG,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACzH,CAAC;YAED,wFAAwF;YACxF,IAAI,YAA8C,CAAC;YACnD,IAAI,MAAM,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzI,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,6FAA6F;YAC7F,uGAAuG;YACvG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAEnG,iGAAiG;YACjG,iGAAiG;YACjG,gGAAgG;YAChG,0EAA0E;YAC1E,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEjF,mGAAmG;YACnG,iGAAiG;YACjG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEzH,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9H,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,mBAAmB,CAAC,KAA4B;QAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;aAIuB,4BAAuB,GAAG,MAAM,AAAT,CAAU;IAEzD;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CAAC,SAAiB;QACxD,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,IAAI,KAAK,GAAG,QAAQ,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;oBAC5C,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,GAAG,oBAAoB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACzG,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7F,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAClF,CAAC;YACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAClJ,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YACjG,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,KAAK,kBAAkB,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;YACvH,CAAC;YACD,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,QAAQ,CAAC,4DAA4D,CAAC,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;YAC1G,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,6CAA6C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;YACxG,CAAC;YACD,iGAAiG;YACjG,kGAAkG;YAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,MAA0C,EAAE,SAA6B;QAC1F,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,QAAQ,CAAC,+CAA+C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IAC5D,SAAS,CACf,MAA0C,EAC1C,aAAqB,EACrB,YAAmC,EACnC,gBAA6C,EAC7C,gBAA0C;QAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;QACpF,4FAA4F;QAC5F,2FAA2F;QAC3F,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa;YACb,UAAU;YACV,UAAU,EAAE,UAAU,GAAG,EAAE;YAC3B,YAAY;YACZ,kGAAkG;YAClG,yFAAyF;YACzF,gBAAgB,EAAE,gBAAgB;gBAChC,CAAC,CAAC;oBACE,UAAU,EAAE,gBAAgB,CAAC,UAAU;oBACvC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;oBACvD,cAAc,EAAE,gBAAgB,EAAE,QAAQ;oBAC1C,cAAc,EAAE,gBAAgB,EAAE,QAAQ;iBAC3C;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACpD,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,mGAAmG;YACnG,kGAAkG;YAClG,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7D,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,SAAS;YAClE,yBAAyB,EAAE,CAAC,CAAC,gBAAgB;YAC7C,UAAU,EAAE,gBAAgB,EAAE,UAAU;YACxC,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;YACxD,cAAc,EAAE,gBAAgB,EAAE,QAAQ;YAC1C,cAAc,EAAE,gBAAgB,EAAE,QAAQ;SAC3C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,+BAA+B,CAC3C,MAA0C,EAC1C,YAA8C,EAC9C,gBAAwD,EACxD,WAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC;YAC/F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,yEAAyE;QAC5M,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,oBAAoB,CAAC;YACzB,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;SACvG,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CAAC,KAAkC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,yEAAyE;YAClN,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,4FAA4F;gBAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC;gBACrD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;aACvG,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,KAAyB;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,MAAM,aAAa,CAAC;gBAClE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;aACvG,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACrC,SAAiB,EACjB,UAAkB,EAClB,MAA0B;QAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;QAC5H,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAA0C,EAC1C,YAAgC,EAChC,WAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACjE,MAAM,kBAAkB,GAAG,WAAW;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;YAChG,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,8BAA8B,CAC1C,MAA0C,EAC1C,gBAAwD,EACxD,WAAqB;QAErB,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;QACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,mHAAmH;QACnH,MAAM,0BAA0B,CAC9B,mBAAmB,EACnB,MAAM,CAAC,aAAa,EACpB,WAAW,EACX,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;QAC5F,MAAM,CAAC,0BAA0B,CAClC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,oCAAoC,CAChD,UAAkB,EAClB,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,UAAU,EAAE,oBAAoB;YAChC,oGAAoG;YACpG,2FAA2F;YAC3F,WAAW,EAAE,iBAAiB,UAAU,0BAA0B,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YACtG,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;SACrB,EACD,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,6CAA6C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;IAC9C,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,WAAqB;QACpE,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,gBAAgB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YACvD,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,eAAe;SAC5B,EACD,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,0CAA0C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,sFAAsF;IAC9E,oBAAoB,CAAC,WAAmB;QAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,kFAAkF;QAChH,MAAM,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAC1F,iBAAiB;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,QAAQ,CAAC,oCAAoC,SAAS,4CAA4C,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE;YAClC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;YACnF,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,MAA8B,EAAE,KAA4B,EAAE,MAAiD;QAC7H,IAAI,CAAC;YACH,SAAS,CACP,gCAAgC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG;gBAChF,UAAU,MAAM,EAAE,EAAE,IAAI,SAAS,WAAW,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,GAAG;gBACzF,MAAM,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,EAAE,CACtC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC"}

package/dist/realtimeWidget/host-identity.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview Host-passed identity (D1 strategy `host-identity`). When a widget is
+ * embedded in an already-authenticated host portal, the host signs a short-lived
+ * assertion (its own RS256 key) describing the visitor; the widget posts it to
+ * `POST /widget/session`, which verifies it against the host's registered public key
+ * and folds the host-provided identity into the minted guest claims. The minted token
+ * is still validated by the same `magic-link` AuthProviderFactory path + synthesized by
+ * `buildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
+ * session-validation provider (it converges on the one pathway, per D1).
+ *
+ * Pure + unit-testable: verification takes the PEM as an argument.
+ *
+ * @module @memberjunction/server/widget
+ */
+import type jwt from 'jsonwebtoken';
+import { type HostAssertionError } from '@memberjunction/auth-providers';
+export type { HostAssertionError };
+/** The visitor identity a host asserts. Standard OIDC-ish claims so synthesis is uniform. */
+export interface HostAssertedIdentity {
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    /** The host's opaque user id for this visitor (audit correlation; not an MJ user id). */
+    hostUserId?: string;
+}
+/** Result of verifying a host assertion. `identity` is present iff `ok` is true. */
+export interface HostAssertionResult {
+    ok: boolean;
+    identity?: HostAssertedIdentity;
+    errorCode?: HostAssertionError;
+}
+/**
+ * Verifies a host-signed RS256 assertion against the host's registered public key (PEM) and extracts the
+ * asserted visitor identity. Thin adapter over {@link HostIdentityProvider.VerifyHostAssertion} (the single
+ * implementation, registered in the AuthProviderFactory) preserving this module's result shape. Never throws.
+ */
+export declare function verifyHostAssertion(assertion: string | undefined, hostPublicKeyPem: string | undefined, expectedAudience: string): HostAssertionResult;
+/** Pulls the visitor identity from a verified host-assertion payload (delegates to the provider). */
+export declare function extractHostIdentity(payload: jwt.JwtPayload): HostAssertedIdentity;
+//# sourceMappingURL=host-identity.d.ts.map

package/dist/realtimeWidget/host-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-identity.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/host-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAE/F,YAAY,EAAE,kBAAkB,EAAE,CAAC;AAEnC,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAeD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,gBAAgB,EAAE,MAAM,GACzB,mBAAmB,CAcrB;AAED,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,GAAG,oBAAoB,CAQjF"}

package/dist/realtimeWidget/host-identity.js

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview Host-passed identity (D1 strategy `host-identity`). When a widget is
+ * embedded in an already-authenticated host portal, the host signs a short-lived
+ * assertion (its own RS256 key) describing the visitor; the widget posts it to
+ * `POST /widget/session`, which verifies it against the host's registered public key
+ * and folds the host-provided identity into the minted guest claims. The minted token
+ * is still validated by the same `magic-link` AuthProviderFactory path + synthesized by
+ * `buildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
+ * session-validation provider (it converges on the one pathway, per D1).
+ *
+ * Pure + unit-testable: verification takes the PEM as an argument.
+ *
+ * @module @memberjunction/server/widget
+ */
+import { HostIdentityProvider } from '@memberjunction/auth-providers';
+/**
+ * The single shared {@link HostIdentityProvider} instance the mint path verifies through. The base
+ * `BaseAuthProvider` constructor builds a (never-contacted) JWKS client; host-identity verifies against
+ * static per-widget PEM keys, so we pass a placeholder `jwksUri`. Built once — verification is stateless.
+ */
+const hostIdentityProvider = new HostIdentityProvider({
+    name: 'host-identity',
+    type: 'host-identity',
+    issuer: 'host-identity',
+    audience: 'host-identity',
+    jwksUri: 'https://host-identity.local/unused',
+});
+/**
+ * Verifies a host-signed RS256 assertion against the host's registered public key (PEM) and extracts the
+ * asserted visitor identity. Thin adapter over {@link HostIdentityProvider.VerifyHostAssertion} (the single
+ * implementation, registered in the AuthProviderFactory) preserving this module's result shape. Never throws.
+ */
+export function verifyHostAssertion(assertion, hostPublicKeyPem, expectedAudience) {
+    const result = hostIdentityProvider.VerifyHostAssertion(assertion, hostPublicKeyPem, expectedAudience);
+    if (!result.ok || !result.userInfo?.email) {
+        return { ok: false, errorCode: result.errorCode };
+    }
+    return {
+        ok: true,
+        identity: {
+            email: result.userInfo.email,
+            firstName: result.userInfo.firstName,
+            lastName: result.userInfo.lastName,
+            hostUserId: result.hostUserId,
+        },
+    };
+}
+/** Pulls the visitor identity from a verified host-assertion payload (delegates to the provider). */
+export function extractHostIdentity(payload) {
+    const info = hostIdentityProvider.extractUserInfo(payload);
+    return {
+        email: info.email ?? '',
+        firstName: info.firstName,
+        lastName: info.lastName,
+        hostUserId: typeof payload.sub === 'string' ? payload.sub : undefined,
+    };
+}
+//# sourceMappingURL=host-identity.js.map

package/dist/realtimeWidget/host-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-identity.js","sourceRoot":"","sources":["../../src/realtimeWidget/host-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,oBAAoB,EAA2B,MAAM,gCAAgC,CAAC;AAoB/F;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC;IAClD,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,oCAAoC;CAChD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAC/B,SAA6B,EAC7B,gBAAoC,EACpC,gBAAwB;IAExB,MAAM,MAAM,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IACvG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;IACD,OAAO;QACH,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;YACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;YAClC,UAAU,EAAE,MAAM,CAAC,UAAU;SAChC;KACJ,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IACvD,MAAM,IAAI,GAAG,oBAAoB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO;QACH,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACN,CAAC"}

package/dist/realtimeWidget/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Public web widget guest-session module barrel.
+ * @module @memberjunction/server/widget
+ */
+export * from './widgetCore.js';
+export { verifyHostAssertion, extractHostIdentity, type HostAssertedIdentity, type HostAssertionResult, type HostAssertionError, } from './host-identity.js';
+export { WidgetSessionService } from './WidgetSessionService.js';
+export type { MintGuestSessionInput, MintGuestSessionResult, WidgetMintAuditContext } from './WidgetSessionService.js';
+export { createWidgetHandler, WIDGET_MOUNT_PATH } from './WidgetRouter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/realtimeWidget/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/realtimeWidget/index.js

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Public web widget guest-session module barrel.
+ * @module @memberjunction/server/widget
+ */
+export * from './widgetCore.js';
+export { verifyHostAssertion, extractHostIdentity, } from './host-identity.js';
+export { WidgetSessionService } from './WidgetSessionService.js';
+export { createWidgetHandler, WIDGET_MOUNT_PATH } from './WidgetRouter.js';
+//# sourceMappingURL=index.js.map

package/dist/realtimeWidget/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/realtimeWidget/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}