@memberjunction/server 5.51.2 → 5.51.4

package/README.md

@@ -125,7 +125,10 @@ module.exports = {
   userHandling: {
     autoCreateNewUsers: true,
     newUserLimitedToAuthorizedDomains: false,
-    newUserRoles: ['UI', 'Developer'],
+    // 'UI' is the end-user role. Do NOT add 'Developer' or 'Integration' here: on the baseline
+    // seed both hold unfiltered update on MJ: Users, so an auto-provisioned user could set their
+    // own Type to 'Owner' (issue #4260).
+    newUserRoles: ['UI'],
     contextUserForNewUserCreation: 'admin@example.com',
     CreateUserApplicationRecords: true,
   },
@@ -864,6 +867,36 @@ connectionPool: {
 - Production: `max: 50, min: 5`
 - High load: `max: 100, min: 10`
 
+### The Read-Only Login
+
+Ad-hoc SQL (`ExecuteAdhocQuery`), `TestQuerySQL` and query specs run caller-supplied SQL as the read-only login (`dbReadOnlyUsername` / `dbReadOnlyPassword`). Without one, ad-hoc SQL is refused. Grant that login **`SELECT` on the entity base views and nothing else**:
+
+- no access to the base tables behind them;
+- no membership of PostgreSQL's `pg_read_server_files`, or any SQL Server permission to reach files or other servers.
+
+MJAPI checks what SQL reads in two ways. It refuses a table reference that isn't a readable entity view, and it refuses functions that run SQL given as a string or read files (`query_to_xml`, `ts_stat`, `pg_read_file`, `OPENROWSET`, …). The login's own grants are still the only limit that SQL can never get around. On PostgreSQL, MJAPI logs a warning at startup if the read-only login can read base tables in the core schema or server files.
+
+### Database Settings on PostgreSQL
+
+PostgreSQL reads the same `databaseSettings` as SQL Server, with the same defaults. There are no PostgreSQL-only settings.
+
+| Setting (default) | SQL Server | PostgreSQL |
+|---|---|---|
+| `requestTimeout` (30,000) | Driver request timeout: a client-side timer over the whole request | `statement_timeout` on every pooled connection |
+| `connectionPool.max` / `min` (50 / 5) | Pool size | Pool size. The read-only pool is capped at 10 and keeps no idle minimum |
+| `connectionPool.idleTimeoutMillis` (30,000) | Idle connection eviction | Idle connection eviction |
+| `connectionPool.acquireTimeoutMillis` (30,000) | Wait for a pooled connection | `connectionTimeoutMillis` (see below) |
+| `connectionTimeout` (45,000) | Time to open a connection | Not used |
+| `dbReadOnlyUsername` / `dbReadOnlyPassword` | Read-only pool | Read-only pool; falls back to `PG_READ_ONLY_USERNAME` / `PG_READ_ONLY_PASSWORD` |
+
+Where the two platforms cannot match:
+
+- **One connection timeout.** The `pg` pool has a single `connectionTimeoutMillis` covering both waiting for a free slot and opening a connection. It is fed from `acquireTimeoutMillis`; `connectionTimeout` is not used.
+- **The request timeout measures something different.** SQL Server's `requestTimeout` is a client-side timer over the whole request, including reading rows. PostgreSQL's `statement_timeout` is execution time on the server, per statement. A query that executes quickly but returns rows slowly is cut off on SQL Server and not on PostgreSQL.
+- **Idle transactions.** PostgreSQL also gets `idle_in_transaction_session_timeout`, set to twice `requestTimeout`, so a connection left inside an open transaction is closed. SQL Server has no counterpart, so there is no setting for it.
+- **Connection count.** MJAPI opens two PostgreSQL pools at up to `connectionPool.max` each (a raw compatibility pool and the provider pool), plus the read-only pool (up to 10) and, when `CODEGEN_DB_USERNAME` is set, a CodeGen pool of 10. With the default of 50, that can exceed PostgreSQL's default `max_connections` of 100. Size `max` with this in mind. SQL Server opens one pool.
+- **Encryption.** SQL Server uses `encrypt` with `DB_TRUST_SERVER_CERTIFICATE`. On PostgreSQL, connections the data provider opens itself use SSL when `NODE_ENV` is `production`; the pools MJAPI opens directly (the compatibility, read-only and CodeGen pools) do not set SSL.
+
 ### Metadata Caching
 
 Entity metadata is loaded once at startup and shared across all per-request provider instances. The cache refresh interval is configurable:

package/dist/agentSessions/SessionManager.d.ts

@@ -55,6 +55,8 @@ export declare class SessionAuthorizationError extends Error {
 export declare class SessionManager {
     /** session ID (lowercased) → epoch ms of its last persisted `LastActiveAt` write. */
     private heartbeatLastWrite;
+    /** Checks the run ids read from a session's owner-editable `Config_` before they are used. */
+    private readonly runIDVerifier;
     /**
      * Authorize and create a new session. Flow:
      * 1. `CanRun` check on the agent — denied → {@link SessionAuthorizationError}, no row written.
@@ -96,11 +98,12 @@ export declare class SessionManager {
     private notifyChannelPluginsSessionClosed;
     /**
      * Finalizes the co-agent observability runs a realtime voice session stored in its `Config_`
-     * (see `RealtimeClientSessionResolver`). No-op when the config carries no run ids. Tolerant: a
+     * (see `RealtimeClientSessionResolver`). Only run ids that are records of the session are
+     * finalized, because the owner can edit `Config_`. No-op when none remain. Tolerant: a
      * malformed config or a finalize failure is swallowed so it can never break session close.
      */
     private finalizeObservabilityRuns;
-    /** Parses the session's `Config_` for observability run ids; returns an empty config on any error. */
+    /** Parses the session's `Config_` for observability run ids; returns none on any error. */
     private parseSessionRunConfig;
     /**
      * Record activity on a session. Coalesces persisted writes so at most one `LastActiveAt` update

package/dist/agentSessions/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EACH,sBAAsB,EACtB,6BAA6B,EAEhC,MAAM,+BAA+B,CAAC;AAwBvC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/E;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI9B;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,cAAc;IACvB,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAA6B;IAEvD;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAWlC;;;;;;;;;;;;OAYG;IACU,YAAY,CACrB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,GAAE,kBAA+B,EAC5C,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,GACpD,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;YACW,kCAAkC;IAwBhD;;;;;OAKG;YACW,iCAAiC;IAW/C;;;;OAIG;YACW,yBAAyB;IA2BvC,sGAAsG;IACtG,OAAO,CAAC,qBAAqB;IAgB7B;;;;;OAKG;IACU,SAAS,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACU,QAAQ,CACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IAcnB,0FAA0F;YAC5E,YAAY;IAS1B,8EAA8E;YAChE,kBAAkB;IA4ChC,6EAA6E;YAC/D,iBAAiB;IAkC/B,6EAA6E;YAC/D,WAAW;IAUzB,qFAAqF;YACvE,iBAAiB;IAU/B,qGAAqG;YACvF,kBAAkB;IAoBhC;;;;OAIG;YACW,kBAAkB;IAsBhC;;;;;OAKG;IACU,2BAA2B,CACpC,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAexD,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB,mGAAmG;YACrF,gBAAgB;IAoB9B,8FAA8F;YAChF,SAAS;CAU1B"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EACH,sBAAsB,EACtB,6BAA6B,EAEhC,MAAM,+BAA+B,CAAC;AAavC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/E;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI9B;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,cAAc;IACvB,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAA6B;IAEvD,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA8B;IAE5D;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAWlC;;;;;;;;;;;;OAYG;IACU,YAAY,CACrB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,GAAE,kBAA+B,EAC5C,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,GACpD,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;YACW,kCAAkC;IAwBhD;;;;;OAKG;YACW,iCAAiC;IAW/C;;;;;OAKG;YACW,yBAAyB;IAgCvC,2FAA2F;IAC3F,OAAO,CAAC,qBAAqB;IAiB7B;;;;;OAKG;IACU,SAAS,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACU,QAAQ,CACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IAcnB,0FAA0F;YAC5E,YAAY;IAS1B,8EAA8E;YAChE,kBAAkB;IA4ChC,6EAA6E;YAC/D,iBAAiB;IAkC/B,6EAA6E;YAC/D,WAAW;IAUzB,qFAAqF;YACvE,iBAAiB;IAU/B,qGAAqG;YACvF,kBAAkB;IAoBhC;;;;OAIG;YACW,kBAAkB;IAsBhC;;;;;OAKG;IACU,2BAA2B,CACpC,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAexD,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB,mGAAmG;YACrF,gBAAgB;IAoB9B,8FAA8F;YAChF,SAAS;CAU1B"}

package/dist/agentSessions/SessionManager.js

@@ -3,6 +3,7 @@ import { AIAgentPermissionHelper } from '@memberjunction/ai-engine-base';
 import { RealtimeClientSessionService, RealtimeChannelServerHost } from '@memberjunction/ai-agents';
 import { GetHostInstanceID } from './HostInstance.js';
 import { writeReturningVisitorRecap } from './ReturningVisitorRecap.js';
+import { SessionRunIDVerifier } from './SessionRunIDVerifier.js';
 import { ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 /** Entity names — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
 const SESSION_ENTITY = 'MJ: AI Agent Sessions';
@@ -49,6 +50,8 @@ export class SessionManager {
     constructor() {
         /** session ID (lowercased) → epoch ms of its last persisted `LastActiveAt` write. */
         this.heartbeatLastWrite = new Map();
+        /** Checks the run ids read from a session's owner-editable `Config_` before they are used. */
+        this.runIDVerifier = new SessionRunIDVerifier();
     }
     /**
      * Authorize and create a new session. Flow:
@@ -145,12 +148,13 @@ export class SessionManager {
     }
     /**
      * Finalizes the co-agent observability runs a realtime voice session stored in its `Config_`
-     * (see `RealtimeClientSessionResolver`). No-op when the config carries no run ids. Tolerant: a
+     * (see `RealtimeClientSessionResolver`). Only run ids that are records of the session are
+     * finalized, because the owner can edit `Config_`. No-op when none remain. Tolerant: a
      * malformed config or a finalize failure is swallowed so it can never break session close.
      */
     async finalizeObservabilityRuns(session, contextUser, provider) {
-        const config = this.parseSessionRunConfig(session.Config_);
-        if (!config.coAgentRunID && !config.promptRunID && !config.coAgentRunStepID) {
+        const claimed = this.parseSessionRunConfig(session.Config_);
+        if (!claimed.CoAgentRunID && !claimed.PromptRunID && !claimed.CoAgentRunStepID) {
             return;
         }
         try {
@@ -158,13 +162,18 @@ export class SessionManager {
             // for a scoped anonymous session, so an owner-initiated (or error) close must finalize
             // under it too — the caller's role holds no grants on the AI run entities. Janitor and
             // shutdown sweeps already close as the system user and pass through unchanged.
-            await new RealtimeClientSessionService().FinalizeCoAgentRun(config.coAgentRunID ?? null, config.promptRunID ?? null, ResolveScopedAnonymousRunUser(contextUser), provider, true, config.coAgentRunStepID ?? null);
+            const runUser = ResolveScopedAnonymousRunUser(contextUser);
+            const runIDs = await this.runIDVerifier.Verify(session.ID, claimed, runUser, provider);
+            if (!runIDs.CoAgentRunID && !runIDs.PromptRunID && !runIDs.CoAgentRunStepID) {
+                return;
+            }
+            await new RealtimeClientSessionService().FinalizeCoAgentRun(runIDs.CoAgentRunID ?? null, runIDs.PromptRunID ?? null, runUser, provider, true, runIDs.CoAgentRunStepID ?? null);
         }
         catch (e) {
             LogError(`SessionManager.finalizeObservabilityRuns failed: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
-    /** Parses the session's `Config_` for observability run ids; returns an empty config on any error. */
+    /** Parses the session's `Config_` for observability run ids; returns none on any error. */
     parseSessionRunConfig(raw) {
         if (!raw) {
             return {};
@@ -172,9 +181,9 @@ export class SessionManager {
         try {
             const parsed = JSON.parse(raw);
             return {
-                coAgentRunID: typeof parsed.coAgentRunID === 'string' ? parsed.coAgentRunID : undefined,
-                promptRunID: typeof parsed.promptRunID === 'string' ? parsed.promptRunID : undefined,
-                coAgentRunStepID: typeof parsed.coAgentRunStepID === 'string' ? parsed.coAgentRunStepID : undefined,
+                CoAgentRunID: typeof parsed.coAgentRunID === 'string' ? parsed.coAgentRunID : undefined,
+                PromptRunID: typeof parsed.promptRunID === 'string' ? parsed.promptRunID : undefined,
+                CoAgentRunStepID: typeof parsed.coAgentRunStepID === 'string' ? parsed.coAgentRunStepID : undefined,
             };
         }
         catch {

package/dist/agentSessions/SessionManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE1F,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAwChD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,cAAc;IAA3B;QACI,qFAAqF;QAC7E,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IA4b3D,CAAC;IA1bG;;;;;;;;;OASG;IACI,KAAK,CAAC,aAAa,CACtB,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;eACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,cAAkC,UAAU,EAC5C,iBAAmD;QAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1E,8FAA8F;QAC9F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,0BAA0B,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kCAAkC,CAC5C,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CACrD;gBACI,cAAc,EAAE,OAAO,CAAC,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;gBAC9C,mFAAmF;gBACnF,gFAAgF;gBAChF,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aAC9C,EACD,WAAW,EACX,QAAQ,CACX,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iCAAiC,CAC3C,cAAsB,EACtB,WAAsC;QAEtC,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACnC,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1E,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,+EAA+E;YAC/E,MAAM,IAAI,4BAA4B,EAAE,CAAC,kBAAkB,CACvD,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,WAAW,IAAI,IAAI,EAC1B,6BAA6B,CAAC,WAAW,CAAC,EAC1C,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAClC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,sGAAsG;IAC9F,qBAAqB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;YAC5D,OAAO;gBACH,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACvF,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACpF,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACtG,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAClB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,QAAQ,CACjB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAE5F,0FAA0F;IAClF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,WAAqB;QAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,yBAAyB,CAC/B,QAAQ,WAAW,CAAC,KAAK,iDAAiD,OAAO,EAAE,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,kBAAkB,CAC5B,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC5G,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,YAAY,CAAC,IAAI,GAAG,eAAe,CAAC;QACpC,yFAAyF;QACzF,2FAA2F;QAC3F,sFAAsF;QACtF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,YAAY,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;gBACrD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YACzD,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACtH,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAC3B,KAAyB,EACzB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,OAAO,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAChG,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,WAAW,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAC3B,OAA+B,EAC/B,WAA+B;QAE/B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,kBAAkB,CAC5B,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,iBAAmD;QAEnD,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,QAAQ,GAAG,iBAAiB;eAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,sBAAsB,MAAM,gCAAgC;YACzE,UAAU,EAAE,eAAe;SAC9B,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,8DAA8D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8FAA8F;IACtF,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,+BAA+B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW,EAAE,SAA4B;QAC9D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,gBAAgB,CAC1B,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,SAAS,CACnB,MAA8D,EAC9D,EAAU;QAEV,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}
+{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAiB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE1F,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AA4BhD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,cAAc;IAA3B;QACI,qFAAqF;QAC7E,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEvD,8FAA8F;QAC7E,kBAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAmchE,CAAC;IAjcG;;;;;;;;;OASG;IACI,KAAK,CAAC,aAAa,CACtB,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;eACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,cAAkC,UAAU,EAC5C,iBAAmD;QAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1E,8FAA8F;QAC9F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,0BAA0B,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kCAAkC,CAC5C,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CACrD;gBACI,cAAc,EAAE,OAAO,CAAC,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;gBAC9C,mFAAmF;gBACnF,gFAAgF;gBAChF,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aAC9C,EACD,WAAW,EACX,QAAQ,CACX,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iCAAiC,CAC3C,cAAsB,EACtB,WAAsC;QAEtC,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,yBAAyB,CACnC,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7E,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,+EAA+E;YAC/E,MAAM,OAAO,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,OAAO;YACX,CAAC;YACD,MAAM,IAAI,4BAA4B,EAAE,CAAC,kBAAkB,CACvD,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,WAAW,IAAI,IAAI,EAC1B,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAClC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,2FAA2F;IACnF,qBAAqB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkF,CAAC;YAChH,OAAO;gBACH,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACvF,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACpF,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACtG,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAGD;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAClB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,QAAQ,CACjB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAE5F,0FAA0F;IAClF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,WAAqB;QAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,yBAAyB,CAC/B,QAAQ,WAAW,CAAC,KAAK,iDAAiD,OAAO,EAAE,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,kBAAkB,CAC5B,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC5G,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,YAAY,CAAC,IAAI,GAAG,eAAe,CAAC;QACpC,yFAAyF;QACzF,2FAA2F;QAC3F,sFAAsF;QACtF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,YAAY,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;gBACrD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YACzD,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACtH,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAC3B,KAAyB,EACzB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,OAAO,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAChG,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,WAAW,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAC3B,OAA+B,EAC/B,WAA+B;QAE/B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,kBAAkB,CAC5B,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,iBAAmD;QAEnD,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,QAAQ,GAAG,iBAAiB;eAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,sBAAsB,MAAM,gCAAgC;YACzE,UAAU,EAAE,eAAe;SAC9B,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,8DAA8D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8FAA8F;IACtF,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,+BAA+B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW,EAAE,SAA4B;QAC9D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,gBAAgB,CAC1B,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,SAAS,CACnB,MAA8D,EAC9D,EAAU;QAEV,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}

package/dist/agentSessions/SessionRunIDVerifier.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview Checks the run ids a realtime session keeps in its `Config` before server code
+ * acts on them.
+ *
+ * @module @memberjunction/server
+ */
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/**
+ * The run ids a realtime voice session keeps in its `Config` JSON. Server code reads and writes the
+ * records they point at, often as an elevated user.
+ */
+export interface SessionRunIDs {
+    /** The co-agent observability run (`MJ: AI Agent Runs`). */
+    CoAgentRunID?: string;
+    /** The co-agent prompt run (`MJ: AI Prompt Runs`), linked through the co-agent run's prompt step. */
+    PromptRunID?: string;
+    /** The co-agent run's system-prompt step (`MJ: AI Agent Run Steps`). */
+    CoAgentRunStepID?: string;
+    /** A delegated run (`MJ: AI Agent Runs`) that paused for the user's answer. */
+    PendingFeedbackRunID?: string;
+}
+/**
+ * Keeps the run ids from a session's `Config` that are records of that session.
+ *
+ * The session owner can edit `Config`, so its run ids are claims. A run id is kept when it is the
+ * UUID of an `MJ: AI Agent Runs` row whose `AgentSessionID` is the session. The step id and the
+ * prompt run id are kept when they belong to that co-agent run: the step's `AgentRunID` is the
+ * co-agent run, and the prompt run is the `TargetLogID` of one of its `Prompt` steps.
+ *
+ * The lookups run as the system user when one is cached, else as the acting user. They are pinned
+ * to the session's id and return nothing to the caller, and row-level security can hide a session's
+ * own runs from its owner (a web-widget guest's delegated runs carry no `ConversationID`, which the
+ * guest's run filter keys on).
+ *
+ * Each call reads the database again (`BypassCache`) and keeps no result, because the links can
+ * change after a lookup: a run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` are
+ * updatable.
+ */
+export declare class SessionRunIDVerifier {
+    /**
+     * Returns the subset of `claimed` that belongs to the session now. Never throws: when a lookup
+     * fails, nothing is kept.
+     *
+     * @param sessionID The `MJ: AI Agent Sessions` id the claims were read from. The caller must have
+     *   checked that the session is the caller's own.
+     * @param claimed The run ids read from the session's `Config`.
+     * @param contextUser The acting user; the lookups run as it only when no system user is cached.
+     * @param provider The request-scoped metadata provider.
+     * @returns The claims that are records of the session.
+     */
+    Verify(sessionID: string, claimed: SessionRunIDs, contextUser: UserInfo, provider: IMetadataProvider): Promise<SessionRunIDs>;
+    /** Drops every claim that is not a UUID. The prompt run and step need a co-agent run to hang off. */
+    private keepUUIDs;
+    private uuidOrUndefined;
+    /** Runs the lookups; `null` when one of them fails. */
+    private lookUpOwned;
+    /** The claimed runs that carry this session's id. */
+    private runsQuery;
+    /** The claimed co-agent run's steps that match the claimed step or prompt run; `null` when neither is claimed. */
+    private stepsQuery;
+    private pickOwned;
+}
+//# sourceMappingURL=SessionRunIDVerifier.d.ts.map

package/dist/agentSessions/SessionRunIDVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRunIDVerifier.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionRunIDVerifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAoC,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAerG;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACjC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC7B;;;;;;;;;;OAUG;IACU,MAAM,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,aAAa,CAAC;IAQzB,qGAAqG;IACrG,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,eAAe;IAIvB,uDAAuD;YACzC,WAAW;IAuBzB,qDAAqD;IACrD,OAAO,CAAC,SAAS;IAajB,kHAAkH;IAClH,OAAO,CAAC,UAAU;IAoBlB,OAAO,CAAC,SAAS;CAgBpB"}

package/dist/agentSessions/SessionRunIDVerifier.js

@@ -0,0 +1,136 @@
+/**
+ * @fileoverview Checks the run ids a realtime session keeps in its `Config` before server code
+ * acts on them.
+ *
+ * @module @memberjunction/server
+ */
+import { LogError, RunView } from '@memberjunction/core';
+import { IsValidUUID, UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+const AGENT_RUN_ENTITY = 'MJ: AI Agent Runs';
+const AGENT_RUN_STEP_ENTITY = 'MJ: AI Agent Run Steps';
+/**
+ * Escapes a value for a single-quoted SQL literal: drops null bytes and doubles quotes. A copy of
+ * `EscapeSQLString` from `@memberjunction/global` on next, which lts/5 does not have.
+ */
+function EscapeSQLString(value) {
+    return value.replace(/\0/g, '').replace(/'/g, "''");
+}
+/**
+ * Keeps the run ids from a session's `Config` that are records of that session.
+ *
+ * The session owner can edit `Config`, so its run ids are claims. A run id is kept when it is the
+ * UUID of an `MJ: AI Agent Runs` row whose `AgentSessionID` is the session. The step id and the
+ * prompt run id are kept when they belong to that co-agent run: the step's `AgentRunID` is the
+ * co-agent run, and the prompt run is the `TargetLogID` of one of its `Prompt` steps.
+ *
+ * The lookups run as the system user when one is cached, else as the acting user. They are pinned
+ * to the session's id and return nothing to the caller, and row-level security can hide a session's
+ * own runs from its owner (a web-widget guest's delegated runs carry no `ConversationID`, which the
+ * guest's run filter keys on).
+ *
+ * Each call reads the database again (`BypassCache`) and keeps no result, because the links can
+ * change after a lookup: a run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` are
+ * updatable.
+ */
+export class SessionRunIDVerifier {
+    /**
+     * Returns the subset of `claimed` that belongs to the session now. Never throws: when a lookup
+     * fails, nothing is kept.
+     *
+     * @param sessionID The `MJ: AI Agent Sessions` id the claims were read from. The caller must have
+     *   checked that the session is the caller's own.
+     * @param claimed The run ids read from the session's `Config`.
+     * @param contextUser The acting user; the lookups run as it only when no system user is cached.
+     * @param provider The request-scoped metadata provider.
+     * @returns The claims that are records of the session.
+     */
+    async Verify(sessionID, claimed, contextUser, provider) {
+        const candidates = this.keepUUIDs(claimed);
+        if (!candidates.CoAgentRunID && !candidates.PendingFeedbackRunID) {
+            return {};
+        }
+        return (await this.lookUpOwned(sessionID.trim(), candidates, contextUser, provider)) ?? {};
+    }
+    /** Drops every claim that is not a UUID. The prompt run and step need a co-agent run to hang off. */
+    keepUUIDs(claimed) {
+        const coAgentRunID = this.uuidOrUndefined(claimed.CoAgentRunID);
+        return {
+            CoAgentRunID: coAgentRunID,
+            PromptRunID: coAgentRunID ? this.uuidOrUndefined(claimed.PromptRunID) : undefined,
+            CoAgentRunStepID: coAgentRunID ? this.uuidOrUndefined(claimed.CoAgentRunStepID) : undefined,
+            PendingFeedbackRunID: this.uuidOrUndefined(claimed.PendingFeedbackRunID),
+        };
+    }
+    uuidOrUndefined(value) {
+        return value && IsValidUUID(value) ? value.trim() : undefined;
+    }
+    /** Runs the lookups; `null` when one of them fails. */
+    async lookUpOwned(sessionID, candidates, contextUser, provider) {
+        const stepsQuery = this.stepsQuery(candidates);
+        const queries = stepsQuery ? [this.runsQuery(sessionID, candidates), stepsQuery] : [this.runsQuery(sessionID, candidates)];
+        try {
+            const lookupUser = UserCache.Instance.GetSystemUser() ?? contextUser;
+            const [runs, steps] = await RunView.FromMetadataProvider(provider).RunViews(queries, lookupUser);
+            const failed = [runs, steps].find((result) => result && !result.Success);
+            if (!runs || failed) {
+                LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${failed?.ErrorMessage ?? 'no result'}`);
+                return null;
+            }
+            return this.pickOwned(candidates, runs.Results, steps?.Results ?? []);
+        }
+        catch (error) {
+            LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+    /** The claimed runs that carry this session's id. */
+    runsQuery(sessionID, candidates) {
+        const ids = [candidates.CoAgentRunID, candidates.PendingFeedbackRunID]
+            .filter((id) => !!id)
+            .map((id) => `'${EscapeSQLString(id)}'`);
+        return {
+            EntityName: AGENT_RUN_ENTITY,
+            ExtraFilter: `AgentSessionID='${EscapeSQLString(sessionID)}' AND ID IN (${ids.join(', ')})`,
+            Fields: ['ID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+    /** The claimed co-agent run's steps that match the claimed step or prompt run; `null` when neither is claimed. */
+    stepsQuery(candidates) {
+        const matches = [];
+        if (candidates.CoAgentRunStepID) {
+            matches.push(`ID='${EscapeSQLString(candidates.CoAgentRunStepID)}'`);
+        }
+        if (candidates.PromptRunID) {
+            matches.push(`TargetLogID='${EscapeSQLString(candidates.PromptRunID)}'`);
+        }
+        if (!candidates.CoAgentRunID || matches.length === 0) {
+            return null;
+        }
+        return {
+            EntityName: AGENT_RUN_STEP_ENTITY,
+            ExtraFilter: `AgentRunID='${EscapeSQLString(candidates.CoAgentRunID)}' AND (${matches.join(' OR ')})`,
+            Fields: ['ID', 'StepType', 'TargetLogID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+    pickOwned(candidates, runs, steps) {
+        const isOwnedRun = (id) => !!id && runs.some((row) => UUIDsEqual(row.ID, id));
+        const coAgentRunID = isOwnedRun(candidates.CoAgentRunID) ? candidates.CoAgentRunID : undefined;
+        const ownedSteps = coAgentRunID ? steps : [];
+        const stepID = candidates.CoAgentRunStepID;
+        const promptRunID = candidates.PromptRunID;
+        return {
+            CoAgentRunID: coAgentRunID,
+            CoAgentRunStepID: stepID && ownedSteps.some((row) => UUIDsEqual(row.ID, stepID)) ? stepID : undefined,
+            PromptRunID: promptRunID && ownedSteps.some((row) => row.StepType === 'Prompt' && UUIDsEqual(row.TargetLogID, promptRunID))
+                ? promptRunID
+                : undefined,
+            PendingFeedbackRunID: isOwnedRun(candidates.PendingFeedbackRunID) ? candidates.PendingFeedbackRunID : undefined,
+        };
+    }
+}
+//# sourceMappingURL=SessionRunIDVerifier.js.map

package/dist/agentSessions/SessionRunIDVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRunIDVerifier.js","sourceRoot":"","sources":["../../src/agentSessions/SessionRunIDVerifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAqB,QAAQ,EAAE,OAAO,EAA2B,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAEvD;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AA2BD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IAC7B;;;;;;;;;;OAUG;IACI,KAAK,CAAC,MAAM,CACf,SAAiB,EACjB,OAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC/D,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,CAAC;IAED,qGAAqG;IAC7F,SAAS,CAAC,OAAsB;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO;YACH,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACjF,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oBAAoB,CAAC;SAC3E,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,KAAyB;QAC7C,OAAO,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,uDAAuD;IAC/C,KAAK,CAAC,WAAW,CACrB,SAAiB,EACjB,UAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3H,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,WAAW,CAAC;YACrE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAY,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5G,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;gBAClB,QAAQ,CAAC,uDAAuD,SAAS,KAAK,MAAM,EAAE,YAAY,IAAI,WAAW,EAAE,CAAC,CAAC;gBACrH,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,QAAQ,CAAC,uDAAuD,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxI,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,qDAAqD;IAC7C,SAAS,CAAC,SAAiB,EAAE,UAAyB;QAC1D,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,oBAAoB,CAAC;aACjE,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO;YACH,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,mBAAmB,eAAe,CAAC,SAAS,CAAC,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3F,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAED,kHAAkH;IAC1G,UAAU,CAAC,UAAyB;QACxC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,gBAAgB,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO;YACH,UAAU,EAAE,qBAAqB;YACjC,WAAW,EAAE,eAAe,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;YACrG,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC;YACzC,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAEO,SAAS,CAAC,UAAyB,EAAE,IAAiB,EAAE,KAAkB;QAC9E,MAAM,UAAU,GAAG,CAAC,EAAsB,EAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC3C,OAAO;YACH,YAAY,EAAE,YAAY;YAC1B,gBAAgB,EAAE,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACrG,WAAW,EACP,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAC1G,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,SAAS;YACnB,oBAAoB,EAAE,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;SAClH,CAAC;IACN,CAAC;CACJ"}

package/dist/agentSessions/index.d.ts

@@ -2,4 +2,5 @@ export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/agentSessions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AA8BA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AA8BA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/dist/agentSessions/index.js

@@ -30,4 +30,5 @@ export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';
 //# sourceMappingURL=index.js.map

package/dist/agentSessions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,8EAA8E;AAC9E,gGAAgG;AAChG,6FAA6F;AAC7F,2BAA2B,EAAE,CAAC;AAC9B,gCAAgC,EAAE,CAAC;AACnC,sBAAsB,EAAE,CAAC;AACzB,8BAA8B,EAAE,CAAC;AACjC,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,wBAAwB,EAAE,CAAC;AAC3B,yBAAyB,EAAE,CAAC;AAC5B,wGAAwG;AACxG,wGAAwG;AACxG,2BAA2B,EAAE,CAAC;AAE9B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,8EAA8E;AAC9E,gGAAgG;AAChG,6FAA6F;AAC7F,2BAA2B,EAAE,CAAC;AAC9B,gCAAgC,EAAE,CAAC;AACnC,sBAAsB,EAAE,CAAC;AACzB,8BAA8B,EAAE,CAAC;AACjC,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,wBAAwB,EAAE,CAAC;AAC3B,yBAAyB,EAAE,CAAC;AAC5B,wGAAwG;AACxG,wGAAwG;AACxG,2BAA2B,EAAE,CAAC;AAE9B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/dist/auth/actionAuthorization.d.ts

@@ -0,0 +1,40 @@
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/** The outcome of {@link EvaluateActionRunAuthorization}. */
+export interface ActionRunAuthorization {
+    /** True when the user may run the action. */
+    Allowed: boolean;
+    /** Why the run is allowed or refused. */
+    Reason: string;
+}
+/** One provider's authorization tree and the role grants on it. */
+export type AuthorizationMetadata = Pick<IMetadataProvider, 'Authorizations' | 'AuthorizationRoles'>;
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export declare function IsOwner(user: UserInfo): boolean;
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export declare function EvaluateActionRunAuthorization(user: UserInfo, actionAuthorizationIDs: readonly string[], metadata: AuthorizationMetadata, actionAuthorizesCaller: boolean): ActionRunAuthorization;
+//# sourceMappingURL=actionAuthorization.d.ts.map

package/dist/auth/actionAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionAuthorization.d.ts","sourceRoot":"","sources":["../../src/auth/actionAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAMpI,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACnC,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAC;AAErG;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAE/C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAC1C,IAAI,EAAE,QAAQ,EACd,sBAAsB,EAAE,SAAS,MAAM,EAAE,EACzC,QAAQ,EAAE,qBAAqB,EAC/B,sBAAsB,EAAE,OAAO,GAChC,sBAAsB,CAkBxB"}

package/dist/auth/actionAuthorization.js

@@ -0,0 +1,94 @@
+import { AuthorizationRoleType } from '@memberjunction/core';
+import { NormalizeUUID, UUIDsEqual } from '@memberjunction/global';
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export function IsOwner(user) {
+    return user.Type?.trim().toLowerCase() === 'owner';
+}
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export function EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller) {
+    if (IsOwner(user)) {
+        return { Allowed: true, Reason: 'The user is an Owner.' };
+    }
+    if (actionAuthorizationIDs.length === 0) {
+        return actionAuthorizesCaller
+            ? { Allowed: true, Reason: 'The action authorizes its caller itself.' }
+            : { Allowed: false, Reason: 'No Action Authorization grants this action to any role, and the action does not authorize its caller itself; only an Owner may run it.' };
+    }
+    const authorizationsByID = new Map(metadata.Authorizations.map((auth) => [NormalizeUUID(auth.ID), auth]));
+    const userGrants = grantsToUserRoles(user, metadata.AuthorizationRoles);
+    const granted = actionAuthorizationIDs
+        .map((id) => authorizationsByID.get(NormalizeUUID(id)))
+        .filter((auth) => auth !== undefined)
+        .find((auth) => holdsLinkedAuthorization(auth, authorizationsByID, userGrants));
+    return granted
+        ? { Allowed: true, Reason: `The user holds the "${granted.Name}" authorization.` }
+        : { Allowed: false, Reason: 'None of your roles holds an authorization this action requires.' };
+}
+/** The role grants that name one of the user's roles. */
+function grantsToUserRoles(user, grants) {
+    const userRoleIDs = new Set((user.UserRoles ?? []).map((userRole) => NormalizeUUID(userRole.RoleID)));
+    return grants.filter((grant) => userRoleIDs.has(NormalizeUUID(grant.RoleID)));
+}
+/**
+ * True when the user holds a linked authorization: it is active, none of the user's roles is denied
+ * it, and the user holds it directly or through an ancestor. The first two are checked on the linked
+ * authorization itself, because the ancestor walk would otherwise grant it through the parent.
+ */
+function holdsLinkedAuthorization(auth, authorizationsByID, userGrants) {
+    if (!auth.IsActive || grantTypes(auth, userGrants).includes(AuthorizationRoleType.Deny)) {
+        return false;
+    }
+    return holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants);
+}
+/**
+ * True when the user holds the authorization or one of its ancestors, following `ParentID` within
+ * `authorizationsByID`. This is the walk `AuthorizationEvaluator.UserCanExecuteWithAncestors` does,
+ * with the role grants taken from the same provider as the authorizations.
+ */
+function holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants) {
+    const visited = new Set();
+    let node = auth;
+    while (node && !visited.has(NormalizeUUID(node.ID))) {
+        if (holdsDirectly(node, userGrants)) {
+            return true;
+        }
+        visited.add(NormalizeUUID(node.ID));
+        node = node.ParentID ? authorizationsByID.get(NormalizeUUID(node.ParentID)) : undefined;
+    }
+    return false;
+}
+/** True when the authorization is active and the user's roles have an Allow and no Deny on it. */
+function holdsDirectly(auth, userGrants) {
+    const types = grantTypes(auth, userGrants);
+    return auth.IsActive && types.includes(AuthorizationRoleType.Allow) && !types.includes(AuthorizationRoleType.Deny);
+}
+/** Allow or Deny, for each of the user's role grants on the authorization. */
+function grantTypes(auth, userGrants) {
+    return userGrants.filter((grant) => UUIDsEqual(grant.AuthorizationID, auth.ID)).map((grant) => grant.AuthorizationType());
+}
+//# sourceMappingURL=actionAuthorization.js.map

package/dist/auth/actionAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionAuthorization.js","sourceRoot":"","sources":["../../src/auth/actionAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,qBAAqB,EAA+B,MAAM,sBAAsB,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAgBnE;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAc;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAC1C,IAAc,EACd,sBAAyC,EACzC,QAA+B,EAC/B,sBAA+B;IAE/B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,sBAAsB;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE;YACvE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wIAAwI,EAAE,CAAC;IAC/K,CAAC;IACD,MAAM,kBAAkB,GAAuB,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9H,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,sBAAsB;SACjC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,IAAI,EAA6B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO;QACV,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,OAAO,CAAC,IAAI,kBAAkB,EAAE;QAClF,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;AACxG,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,IAAc,EAAE,MAAwC;IAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAuB,EAAE,kBAAsC,EAAE,UAA4C;IAC3I,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,8BAA8B,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,IAAuB,EAAE,kBAAsC,EAAE,UAA4C;IACjJ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,IAAI,GAAkC,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,IAAuB,EAAE,UAA4C;IACxF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACvH,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAuB,EAAE,UAA4C;IACrF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/dist/auth/index.d.ts

@@ -2,6 +2,7 @@ import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import sql from 'mssql';
 import { UserInfo } from '@memberjunction/core';
 export * from './APIKeyScopeAuth.js';
+export * from './scopeLimitedPrincipal.js';
 /**
  * Gets validation options for a specific issuer.
  * When multiple providers share the same issuer (e.g. two Auth0 apps on

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,EAAsB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAOpE,cAAc,sBAAsB,CAAC;AAkCrC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAexG,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW7F,CAAC;AAEH,qBAAa,WAAW;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,MAAM,QAAQ,SAAS,EAAE,IAAI,kBAAkB,SAmB3F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAiC5B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,aAAa,GAAG,CAAC,cAAc,EAAE,6BAA4B,OAAc,KAAG,OAAO,CAAC,QAAQ,CAYjI,CAAC;AA8BF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,WAAW,MAAM,EACjB,gBAAgB,MAAM,EACtB,aAAa,GAAG,CAAC,cAAc,EAC/B,6BAA4B,OAAc,KACzC,OAAO,CAAC,QAAQ,GAAG,SAAS,CA8E9B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,EAAsB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAOpE,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAkC3C;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAexG,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW7F,CAAC;AAEH,qBAAa,WAAW;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,MAAM,QAAQ,SAAS,EAAE,IAAI,kBAAkB,SAmB3F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAiC5B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,aAAa,GAAG,CAAC,cAAc,EAAE,6BAA4B,OAAc,KAAG,OAAO,CAAC,QAAQ,CAYjI,CAAC;AA8BF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,WAAW,MAAM,EACjB,gBAAgB,MAAM,EACtB,aAAa,GAAG,CAAC,cAAc,EAC/B,6BAA4B,OAAc,KACzC,OAAO,CAAC,QAAQ,GAAG,SAAS,CA8E9B,CAAC"}