@memberjunction/server 6.1.5 → 6.1.6

package/dist/agentSessions/SessionManager.d.ts

@@ -81,6 +81,8 @@ export declare class SessionManager {
      * accumulated the chain, silently no-op'ing on the live instance (see the constructor param doc).
      */
     private readonly realtimeClientSessionService;
+    /** Checks the run ids read from a session's owner-editable `Config_` before they are used. */
+    private readonly runIDVerifier;
     /**
      * @param realtimeClientSessionService The shared {@link RealtimeClientSessionService} instance to
      *   finalize observability runs through. Pass the SAME instance your resolver/service used to create
@@ -131,11 +133,12 @@ export declare class SessionManager {
     private notifyChannelPluginsSessionClosed;
     /**
      * Finalizes the co-agent observability runs a realtime voice session stored in its `Config_`
-     * (see `RealtimeClientSessionResolver`). No-op when the config carries no run ids. Tolerant: a
+     * (see `RealtimeClientSessionResolver`). Only run ids that are records of the session are
+     * finalized, because the owner can edit `Config_`. No-op when none remain. Tolerant: a
      * malformed config or a finalize failure is swallowed so it can never break session close.
      */
     private finalizeObservabilityRuns;
-    /** Parses the session's `Config_` for observability run ids; returns an empty config on any error. */
+    /** Parses the session's `Config_` for observability run ids; returns none on any error. */
     private parseSessionRunConfig;
     /**
      * Record activity on a session. Coalesces persisted writes so at most one `LastActiveAt` update

package/dist/agentSessions/SessionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EACH,sBAAsB,EACtB,6BAA6B,EAEhC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,4BAA4B,EAA6B,MAAM,2BAA2B,CAAC;AAsBpG;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/E;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI9B;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,cAAc;IACvB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAGhC;IAEH;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA+B;IAE5E;;;;;;;OAOG;gBACS,4BAA4B,CAAC,EAAE,4BAA4B;IAIvE;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAWlC;;;;;;;;;;;;OAYG;IACU,YAAY,CACrB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,GAAE,kBAA+B,EAC5C,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,GACpD,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;YACW,kCAAkC;IAwBhD;;;;;OAKG;YACW,iCAAiC;IAW/C;;;;OAIG;YACW,yBAAyB;IA2BvC,sGAAsG;IACtG,OAAO,CAAC,qBAAqB;IAgB7B;;;;;OAKG;IACU,SAAS,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACU,QAAQ,CACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IAcnB,0FAA0F;YAC5E,YAAY;IAS1B,8EAA8E;YAChE,kBAAkB;IA4ChC,6EAA6E;YAC/D,iBAAiB;IAkC/B,6EAA6E;YAC/D,WAAW;IAUzB,qFAAqF;YACvE,iBAAiB;IAU/B,qGAAqG;YACvF,kBAAkB;IAoBhC;;;;OAIG;YACW,kBAAkB;IAsBhC;;;;;OAKG;IACU,2BAA2B,CACpC,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAexD,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB,mGAAmG;YACrF,gBAAgB;IAoB9B,8FAA8F;YAChF,SAAS;CAU1B"}
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EACH,sBAAsB,EACtB,6BAA6B,EAEhC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,4BAA4B,EAA6B,MAAM,2BAA2B,CAAC;AAWpG;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/E;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI9B;AASD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,cAAc;IACvB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAGhC;IAEH;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAA+B;IAE5E,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA8B;IAE5D;;;;;;;OAOG;gBACS,4BAA4B,CAAC,EAAE,4BAA4B;IAIvE;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAWlC;;;;;;;;;;;;OAYG;IACU,YAAY,CACrB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,GAAE,kBAA+B,EAC5C,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,GACpD,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;YACW,kCAAkC;IAwBhD;;;;;OAKG;YACW,iCAAiC;IAW/C;;;;;OAKG;YACW,yBAAyB;IAgCvC,2FAA2F;IAC3F,OAAO,CAAC,qBAAqB;IAgB7B;;;;;OAKG;IACU,SAAS,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACU,QAAQ,CACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IAcnB,0FAA0F;YAC5E,YAAY;IAS1B,8EAA8E;YAChE,kBAAkB;IA4ChC,6EAA6E;YAC/D,iBAAiB;IAkC/B,6EAA6E;YAC/D,WAAW;IAUzB,qFAAqF;YACvE,iBAAiB;IAU/B,qGAAqG;YACvF,kBAAkB;IAoBhC;;;;OAIG;YACW,kBAAkB;IAsBhC;;;;;OAKG;IACU,2BAA2B,CACpC,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAexD,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB,mGAAmG;YACrF,gBAAgB;IAoB9B,8FAA8F;YAChF,SAAS;CAU1B"}

package/dist/agentSessions/SessionManager.js

@@ -4,6 +4,7 @@ import { AIAgentPermissionHelper } from '@memberjunction/ai-engine-base';
 import { RealtimeClientSessionService, RealtimeChannelServerHost } from '@memberjunction/ai-agents';
 import { GetHostInstanceID } from './HostInstance.js';
 import { writeReturningVisitorRecap } from './ReturningVisitorRecap.js';
+import { SessionRunIDVerifier } from './SessionRunIDVerifier.js';
 import { ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 /** Entity names — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
 const SESSION_ENTITY = 'MJ: AI Agent Sessions';
@@ -76,6 +77,8 @@ export class SessionManager {
             maxSize: 5_000,
             ttlMs: 4 * 60 * 60 * 1000, // 4h backstop — generous vs. the janitor's 15m staleness threshold
         });
+        /** Checks the run ids read from a session's owner-editable `Config_` before they are used. */
+        this.runIDVerifier = new SessionRunIDVerifier();
         this.realtimeClientSessionService = realtimeClientSessionService ?? new RealtimeClientSessionService();
     }
     /**
@@ -173,12 +176,13 @@ export class SessionManager {
     }
     /**
      * Finalizes the co-agent observability runs a realtime voice session stored in its `Config_`
-     * (see `RealtimeClientSessionResolver`). No-op when the config carries no run ids. Tolerant: a
+     * (see `RealtimeClientSessionResolver`). Only run ids that are records of the session are
+     * finalized, because the owner can edit `Config_`. No-op when none remain. Tolerant: a
      * malformed config or a finalize failure is swallowed so it can never break session close.
      */
     async finalizeObservabilityRuns(session, contextUser, provider) {
-        const config = this.parseSessionRunConfig(session.Config_);
-        if (!config.coAgentRunID && !config.promptRunID && !config.coAgentRunStepID) {
+        const claimed = this.parseSessionRunConfig(session.Config_);
+        if (!claimed.CoAgentRunID && !claimed.PromptRunID && !claimed.CoAgentRunStepID) {
             return;
         }
         try {
@@ -186,13 +190,18 @@ export class SessionManager {
             // for a scoped anonymous session, so an owner-initiated (or error) close must finalize
             // under it too — the caller's role holds no grants on the AI run entities. Janitor and
             // shutdown sweeps already close as the system user and pass through unchanged.
-            await this.realtimeClientSessionService.FinalizeCoAgentRun(config.coAgentRunID ?? null, config.promptRunID ?? null, ResolveScopedAnonymousRunUser(contextUser), provider, true, config.coAgentRunStepID ?? null);
+            const runUser = ResolveScopedAnonymousRunUser(contextUser);
+            const runIDs = await this.runIDVerifier.Verify(session.ID, claimed, runUser, provider);
+            if (!runIDs.CoAgentRunID && !runIDs.PromptRunID && !runIDs.CoAgentRunStepID) {
+                return;
+            }
+            await this.realtimeClientSessionService.FinalizeCoAgentRun(runIDs.CoAgentRunID ?? null, runIDs.PromptRunID ?? null, runUser, provider, true, runIDs.CoAgentRunStepID ?? null);
         }
         catch (e) {
             LogError(`SessionManager.finalizeObservabilityRuns failed: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
-    /** Parses the session's `Config_` for observability run ids; returns an empty config on any error. */
+    /** Parses the session's `Config_` for observability run ids; returns none on any error. */
     parseSessionRunConfig(raw) {
         if (!raw) {
             return {};
@@ -200,9 +209,9 @@ export class SessionManager {
         try {
             const parsed = JSON.parse(raw);
             return {
-                coAgentRunID: typeof parsed.coAgentRunID === 'string' ? parsed.coAgentRunID : undefined,
-                promptRunID: typeof parsed.promptRunID === 'string' ? parsed.promptRunID : undefined,
-                coAgentRunStepID: typeof parsed.coAgentRunStepID === 'string' ? parsed.coAgentRunStepID : undefined,
+                CoAgentRunID: typeof parsed.coAgentRunID === 'string' ? parsed.coAgentRunID : undefined,
+                PromptRunID: typeof parsed.promptRunID === 'string' ? parsed.promptRunID : undefined,
+                CoAgentRunStepID: typeof parsed.coAgentRunStepID === 'string' ? parsed.coAgentRunStepID : undefined,
             };
         }
         catch {

package/dist/agentSessions/SessionManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE1F,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAwChD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,cAAc;IA+BvB;;;;;;;OAOG;IACH,YAAY,4BAA2D;QAtCvE;;;;;;;;;;;;;WAaG;QACc,uBAAkB,GAAG,IAAI,UAAU,CAAiB;YACjE,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,mEAAmE;SACjG,CAAC,CAAC;QAsBC,IAAI,CAAC,4BAA4B,GAAG,4BAA4B,IAAI,IAAI,4BAA4B,EAAE,CAAC;IAC3G,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,aAAa,CACtB,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;eACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,cAAkC,UAAU,EAC5C,iBAAmD;QAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1E,8FAA8F;QAC9F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,0BAA0B,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kCAAkC,CAC5C,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CACrD;gBACI,cAAc,EAAE,OAAO,CAAC,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;gBAC9C,mFAAmF;gBACnF,gFAAgF;gBAChF,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aAC9C,EACD,WAAW,EACX,QAAQ,CACX,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iCAAiC,CAC3C,cAAsB,EACtB,WAAsC;QAEtC,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACnC,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1E,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,+EAA+E;YAC/E,MAAM,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CACtD,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,WAAW,IAAI,IAAI,EAC1B,6BAA6B,CAAC,WAAW,CAAC,EAC1C,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAClC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,sGAAsG;IAC9F,qBAAqB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;YAC5D,OAAO;gBACH,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACvF,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACpF,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACtG,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAClB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,QAAQ,CACjB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAE5F,0FAA0F;IAClF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,WAAqB;QAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,yBAAyB,CAC/B,QAAQ,WAAW,CAAC,KAAK,iDAAiD,OAAO,EAAE,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,kBAAkB,CAC5B,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC5G,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,YAAY,CAAC,IAAI,GAAG,eAAe,CAAC;QACpC,yFAAyF;QACzF,2FAA2F;QAC3F,sFAAsF;QACtF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,YAAY,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;gBACrD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YACzD,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACtH,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAC3B,KAAyB,EACzB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,OAAO,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAChG,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,WAAW,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAC3B,OAA+B,EAC/B,WAA+B;QAE/B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,kBAAkB,CAC5B,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,iBAAmD;QAEnD,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,QAAQ,GAAG,iBAAiB;eAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,sBAAsB,MAAM,gCAAgC;YACzE,UAAU,EAAE,eAAe;SAC9B,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,8DAA8D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8FAA8F;IACtF,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,+BAA+B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW,EAAE,SAA4B;QAC9D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,gBAAgB,CAC1B,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,SAAS,CACnB,MAA8D,EAC9D,EAAU;QAEV,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}
+{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAiB,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE1F,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AA4BhD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,cAAc;IAkCvB;;;;;;;OAOG;IACH,YAAY,4BAA2D;QAzCvE;;;;;;;;;;;;;WAaG;QACc,uBAAkB,GAAG,IAAI,UAAU,CAAiB;YACjE,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,mEAAmE;SACjG,CAAC,CAAC;QAaH,8FAA8F;QAC7E,kBAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAWxD,IAAI,CAAC,4BAA4B,GAAG,4BAA4B,IAAI,IAAI,4BAA4B,EAAE,CAAC;IAC3G,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,aAAa,CACtB,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;eACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,cAAkC,UAAU,EAC5C,iBAAmD;QAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1E,8FAA8F;QAC9F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,0BAA0B,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kCAAkC,CAC5C,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CACrD;gBACI,cAAc,EAAE,OAAO,CAAC,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;gBAC9C,mFAAmF;gBACnF,gFAAgF;gBAChF,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aAC9C,EACD,WAAW,EACX,QAAQ,CACX,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iCAAiC,CAC3C,cAAsB,EACtB,WAAsC;QAEtC,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,yBAAyB,CACnC,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7E,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,+EAA+E;YAC/E,MAAM,OAAO,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,OAAO;YACX,CAAC;YACD,MAAM,IAAI,CAAC,4BAA4B,CAAC,kBAAkB,CACtD,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,WAAW,IAAI,IAAI,EAC1B,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAClC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,2FAA2F;IACnF,qBAAqB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkF,CAAC;YAChH,OAAO;gBACH,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACvF,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACpF,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACtG,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAClB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,QAAQ,CACjB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAE5F,0FAA0F;IAClF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,WAAqB;QAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,yBAAyB,CAC/B,QAAQ,WAAW,CAAC,KAAK,iDAAiD,OAAO,EAAE,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,kBAAkB,CAC5B,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC5G,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,YAAY,CAAC,IAAI,GAAG,eAAe,CAAC;QACpC,yFAAyF;QACzF,2FAA2F;QAC3F,sFAAsF;QACtF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,YAAY,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;gBACrD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YACzD,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACtH,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAC3B,KAAyB,EACzB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,OAAO,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAChG,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,WAAW,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAC3B,OAA+B,EAC/B,WAA+B;QAE/B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,kBAAkB,CAC5B,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,iBAAmD;QAEnD,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,QAAQ,GAAG,iBAAiB;eAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,sBAAsB,MAAM,gCAAgC;YACzE,UAAU,EAAE,eAAe;SAC9B,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,8DAA8D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8FAA8F;IACtF,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,+BAA+B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW,EAAE,SAA4B;QAC9D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,gBAAgB,CAC1B,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,SAAS,CACnB,MAA8D,EAC9D,EAAU;QAEV,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}

package/dist/agentSessions/SessionRunIDVerifier.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview Checks the run ids a realtime session keeps in its `Config` before server code
+ * acts on them.
+ *
+ * @module @memberjunction/server
+ */
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/**
+ * The run ids a realtime voice session keeps in its `Config` JSON. Server code reads and writes the
+ * records they point at, often as an elevated user.
+ */
+export interface SessionRunIDs {
+    /** The co-agent observability run (`MJ: AI Agent Runs`). */
+    CoAgentRunID?: string;
+    /** The co-agent prompt run (`MJ: AI Prompt Runs`), linked through the co-agent run's prompt step. */
+    PromptRunID?: string;
+    /** The co-agent run's system-prompt step (`MJ: AI Agent Run Steps`). */
+    CoAgentRunStepID?: string;
+    /** A delegated run (`MJ: AI Agent Runs`) that paused for the user's answer. */
+    PendingFeedbackRunID?: string;
+}
+/**
+ * Keeps the run ids from a session's `Config` that are records of that session.
+ *
+ * The session owner can edit `Config`, so its run ids are claims. A run id is kept when it is the
+ * UUID of an `MJ: AI Agent Runs` row whose `AgentSessionID` is the session. The step id and the
+ * prompt run id are kept when they belong to that co-agent run: the step's `AgentRunID` is the
+ * co-agent run, and the prompt run is the `TargetLogID` of one of its `Prompt` steps.
+ *
+ * The lookups run as the system user when one is cached, else as the acting user. They are pinned
+ * to the session's id and return nothing to the caller, and row-level security can hide a session's
+ * own runs from its owner (a web-widget guest's delegated runs carry no `ConversationID`, which the
+ * guest's run filter keys on).
+ *
+ * Each call reads the database again (`BypassCache`) and keeps no result, because the links can
+ * change after a lookup: a run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` are
+ * updatable.
+ */
+export declare class SessionRunIDVerifier {
+    /**
+     * Returns the subset of `claimed` that belongs to the session now. Never throws: when a lookup
+     * fails, nothing is kept.
+     *
+     * @param sessionID The `MJ: AI Agent Sessions` id the claims were read from. The caller must have
+     *   checked that the session is the caller's own.
+     * @param claimed The run ids read from the session's `Config`.
+     * @param contextUser The acting user; the lookups run as it only when no system user is cached.
+     * @param provider The request-scoped metadata provider.
+     * @returns The claims that are records of the session.
+     */
+    Verify(sessionID: string, claimed: SessionRunIDs, contextUser: UserInfo, provider: IMetadataProvider): Promise<SessionRunIDs>;
+    /** Drops every claim that is not a UUID. The prompt run and step need a co-agent run to hang off. */
+    private keepUUIDs;
+    private uuidOrUndefined;
+    /** Runs the lookups; `null` when one of them fails. */
+    private lookUpOwned;
+    /** The claimed runs that carry this session's id. */
+    private runsQuery;
+    /** The claimed co-agent run's steps that match the claimed step or prompt run; `null` when neither is claimed. */
+    private stepsQuery;
+    private pickOwned;
+}
+//# sourceMappingURL=SessionRunIDVerifier.d.ts.map

package/dist/agentSessions/SessionRunIDVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRunIDVerifier.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionRunIDVerifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAoC,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAOrG;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACjC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,oBAAoB;IAC7B;;;;;;;;;;OAUG;IACU,MAAM,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,aAAa,CAAC;IAQzB,qGAAqG;IACrG,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,eAAe;IAIvB,uDAAuD;YACzC,WAAW;IAuBzB,qDAAqD;IACrD,OAAO,CAAC,SAAS;IAajB,kHAAkH;IAClH,OAAO,CAAC,UAAU;IAoBlB,OAAO,CAAC,SAAS;CAgBpB"}

package/dist/agentSessions/SessionRunIDVerifier.js

@@ -0,0 +1,129 @@
+/**
+ * @fileoverview Checks the run ids a realtime session keeps in its `Config` before server code
+ * acts on them.
+ *
+ * @module @memberjunction/server
+ */
+import { LogError, RunView } from '@memberjunction/core';
+import { EscapeSQLString, IsValidUUID, UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/generic-database-provider';
+const AGENT_RUN_ENTITY = 'MJ: AI Agent Runs';
+const AGENT_RUN_STEP_ENTITY = 'MJ: AI Agent Run Steps';
+/**
+ * Keeps the run ids from a session's `Config` that are records of that session.
+ *
+ * The session owner can edit `Config`, so its run ids are claims. A run id is kept when it is the
+ * UUID of an `MJ: AI Agent Runs` row whose `AgentSessionID` is the session. The step id and the
+ * prompt run id are kept when they belong to that co-agent run: the step's `AgentRunID` is the
+ * co-agent run, and the prompt run is the `TargetLogID` of one of its `Prompt` steps.
+ *
+ * The lookups run as the system user when one is cached, else as the acting user. They are pinned
+ * to the session's id and return nothing to the caller, and row-level security can hide a session's
+ * own runs from its owner (a web-widget guest's delegated runs carry no `ConversationID`, which the
+ * guest's run filter keys on).
+ *
+ * Each call reads the database again (`BypassCache`) and keeps no result, because the links can
+ * change after a lookup: a run's `AgentSessionID` and a step's `AgentRunID` and `TargetLogID` are
+ * updatable.
+ */
+export class SessionRunIDVerifier {
+    /**
+     * Returns the subset of `claimed` that belongs to the session now. Never throws: when a lookup
+     * fails, nothing is kept.
+     *
+     * @param sessionID The `MJ: AI Agent Sessions` id the claims were read from. The caller must have
+     *   checked that the session is the caller's own.
+     * @param claimed The run ids read from the session's `Config`.
+     * @param contextUser The acting user; the lookups run as it only when no system user is cached.
+     * @param provider The request-scoped metadata provider.
+     * @returns The claims that are records of the session.
+     */
+    async Verify(sessionID, claimed, contextUser, provider) {
+        const candidates = this.keepUUIDs(claimed);
+        if (!candidates.CoAgentRunID && !candidates.PendingFeedbackRunID) {
+            return {};
+        }
+        return (await this.lookUpOwned(sessionID.trim(), candidates, contextUser, provider)) ?? {};
+    }
+    /** Drops every claim that is not a UUID. The prompt run and step need a co-agent run to hang off. */
+    keepUUIDs(claimed) {
+        const coAgentRunID = this.uuidOrUndefined(claimed.CoAgentRunID);
+        return {
+            CoAgentRunID: coAgentRunID,
+            PromptRunID: coAgentRunID ? this.uuidOrUndefined(claimed.PromptRunID) : undefined,
+            CoAgentRunStepID: coAgentRunID ? this.uuidOrUndefined(claimed.CoAgentRunStepID) : undefined,
+            PendingFeedbackRunID: this.uuidOrUndefined(claimed.PendingFeedbackRunID),
+        };
+    }
+    uuidOrUndefined(value) {
+        return value && IsValidUUID(value) ? value.trim() : undefined;
+    }
+    /** Runs the lookups; `null` when one of them fails. */
+    async lookUpOwned(sessionID, candidates, contextUser, provider) {
+        const stepsQuery = this.stepsQuery(candidates);
+        const queries = stepsQuery ? [this.runsQuery(sessionID, candidates), stepsQuery] : [this.runsQuery(sessionID, candidates)];
+        try {
+            const lookupUser = UserCache.Instance.GetSystemUser() ?? contextUser;
+            const [runs, steps] = await RunView.FromMetadataProvider(provider).RunViews(queries, lookupUser);
+            const failed = [runs, steps].find((result) => result && !result.Success);
+            if (!runs || failed) {
+                LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${failed?.ErrorMessage ?? 'no result'}`);
+                return null;
+            }
+            return this.pickOwned(candidates, runs.Results, steps?.Results ?? []);
+        }
+        catch (error) {
+            LogError(`SessionRunIDVerifier: run lookup failed for session ${sessionID}: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+    /** The claimed runs that carry this session's id. */
+    runsQuery(sessionID, candidates) {
+        const ids = [candidates.CoAgentRunID, candidates.PendingFeedbackRunID]
+            .filter((id) => !!id)
+            .map((id) => `'${EscapeSQLString(id)}'`);
+        return {
+            EntityName: AGENT_RUN_ENTITY,
+            ExtraFilter: `AgentSessionID='${EscapeSQLString(sessionID)}' AND ID IN (${ids.join(', ')})`,
+            Fields: ['ID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+    /** The claimed co-agent run's steps that match the claimed step or prompt run; `null` when neither is claimed. */
+    stepsQuery(candidates) {
+        const matches = [];
+        if (candidates.CoAgentRunStepID) {
+            matches.push(`ID='${EscapeSQLString(candidates.CoAgentRunStepID)}'`);
+        }
+        if (candidates.PromptRunID) {
+            matches.push(`TargetLogID='${EscapeSQLString(candidates.PromptRunID)}'`);
+        }
+        if (!candidates.CoAgentRunID || matches.length === 0) {
+            return null;
+        }
+        return {
+            EntityName: AGENT_RUN_STEP_ENTITY,
+            ExtraFilter: `AgentRunID='${EscapeSQLString(candidates.CoAgentRunID)}' AND (${matches.join(' OR ')})`,
+            Fields: ['ID', 'StepType', 'TargetLogID'],
+            ResultType: 'simple',
+            BypassCache: true,
+        };
+    }
+    pickOwned(candidates, runs, steps) {
+        const isOwnedRun = (id) => !!id && runs.some((row) => UUIDsEqual(row.ID, id));
+        const coAgentRunID = isOwnedRun(candidates.CoAgentRunID) ? candidates.CoAgentRunID : undefined;
+        const ownedSteps = coAgentRunID ? steps : [];
+        const stepID = candidates.CoAgentRunStepID;
+        const promptRunID = candidates.PromptRunID;
+        return {
+            CoAgentRunID: coAgentRunID,
+            CoAgentRunStepID: stepID && ownedSteps.some((row) => UUIDsEqual(row.ID, stepID)) ? stepID : undefined,
+            PromptRunID: promptRunID && ownedSteps.some((row) => row.StepType === 'Prompt' && UUIDsEqual(row.TargetLogID, promptRunID))
+                ? promptRunID
+                : undefined,
+            PendingFeedbackRunID: isOwnedRun(candidates.PendingFeedbackRunID) ? candidates.PendingFeedbackRunID : undefined,
+        };
+    }
+}
+//# sourceMappingURL=SessionRunIDVerifier.js.map

package/dist/agentSessions/SessionRunIDVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRunIDVerifier.js","sourceRoot":"","sources":["../../src/agentSessions/SessionRunIDVerifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAqB,QAAQ,EAAE,OAAO,EAA2B,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEtE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AA2BvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,oBAAoB;IAC7B;;;;;;;;;;OAUG;IACI,KAAK,CAAC,MAAM,CACf,SAAiB,EACjB,OAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;YAC/D,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,CAAC;IAED,qGAAqG;IAC7F,SAAS,CAAC,OAAsB;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO;YACH,YAAY,EAAE,YAAY;YAC1B,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YACjF,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3F,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,oBAAoB,CAAC;SAC3E,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,KAAyB;QAC7C,OAAO,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,uDAAuD;IAC/C,KAAK,CAAC,WAAW,CACrB,SAAiB,EACjB,UAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3H,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,WAAW,CAAC;YACrE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAY,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5G,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;gBAClB,QAAQ,CAAC,uDAAuD,SAAS,KAAK,MAAM,EAAE,YAAY,IAAI,WAAW,EAAE,CAAC,CAAC;gBACrH,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,QAAQ,CAAC,uDAAuD,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxI,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,qDAAqD;IAC7C,SAAS,CAAC,SAAiB,EAAE,UAAyB;QAC1D,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,oBAAoB,CAAC;aACjE,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO;YACH,UAAU,EAAE,gBAAgB;YAC5B,WAAW,EAAE,mBAAmB,eAAe,CAAC,SAAS,CAAC,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3F,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAED,kHAAkH;IAC1G,UAAU,CAAC,UAAyB;QACxC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,gBAAgB,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO;YACH,UAAU,EAAE,qBAAqB;YACjC,WAAW,EAAE,eAAe,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;YACrG,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC;YACzC,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAEO,SAAS,CAAC,UAAyB,EAAE,IAAiB,EAAE,KAAkB;QAC9E,MAAM,UAAU,GAAG,CAAC,EAAsB,EAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC3C,OAAO;YACH,YAAY,EAAE,YAAY;YAC1B,gBAAgB,EAAE,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACrG,WAAW,EACP,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;gBAC1G,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,SAAS;YACnB,oBAAoB,EAAE,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;SAClH,CAAC;IACN,CAAC;CACJ"}

package/dist/agentSessions/index.d.ts

@@ -2,4 +2,5 @@ export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/agentSessions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AA8BA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AA8BA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/dist/agentSessions/index.js

@@ -30,4 +30,5 @@ export * from './remoteBrowserGoalEngine.js';
 export * from './HostInstance.js';
 export * from './SessionManager.js';
 export * from './SessionJanitor.js';
+export * from './SessionRunIDVerifier.js';
 //# sourceMappingURL=index.js.map

package/dist/agentSessions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,8EAA8E;AAC9E,gGAAgG;AAChG,6FAA6F;AAC7F,2BAA2B,EAAE,CAAC;AAC9B,gCAAgC,EAAE,CAAC;AACnC,sBAAsB,EAAE,CAAC;AACzB,8BAA8B,EAAE,CAAC;AACjC,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,wBAAwB,EAAE,CAAC;AAC3B,yBAAyB,EAAE,CAAC;AAC5B,wGAAwG;AACxG,wGAAwG;AACxG,2BAA2B,EAAE,CAAC;AAE9B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agentSessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,2BAA2B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAClK,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,8EAA8E;AAC9E,gGAAgG;AAChG,6FAA6F;AAC7F,2BAA2B,EAAE,CAAC;AAC9B,gCAAgC,EAAE,CAAC;AACnC,sBAAsB,EAAE,CAAC;AACzB,8BAA8B,EAAE,CAAC;AACjC,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,wBAAwB,EAAE,CAAC;AAC3B,yBAAyB,EAAE,CAAC;AAC5B,wGAAwG;AACxG,wGAAwG;AACxG,2BAA2B,EAAE,CAAC;AAE9B,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/dist/auth/actionAuthorization.d.ts

@@ -0,0 +1,40 @@
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/** The outcome of {@link EvaluateActionRunAuthorization}. */
+export interface ActionRunAuthorization {
+    /** True when the user may run the action. */
+    Allowed: boolean;
+    /** Why the run is allowed or refused. */
+    Reason: string;
+}
+/** One provider's authorization tree and the role grants on it. */
+export type AuthorizationMetadata = Pick<IMetadataProvider, 'Authorizations' | 'AuthorizationRoles'>;
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export declare function IsOwner(user: UserInfo): boolean;
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export declare function EvaluateActionRunAuthorization(user: UserInfo, actionAuthorizationIDs: readonly string[], metadata: AuthorizationMetadata, actionAuthorizesCaller: boolean): ActionRunAuthorization;
+//# sourceMappingURL=actionAuthorization.d.ts.map

package/dist/auth/actionAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionAuthorization.d.ts","sourceRoot":"","sources":["../../src/auth/actionAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAMpI,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACnC,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAC;AAErG;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAE/C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,8BAA8B,CAC1C,IAAI,EAAE,QAAQ,EACd,sBAAsB,EAAE,SAAS,MAAM,EAAE,EACzC,QAAQ,EAAE,qBAAqB,EAC/B,sBAAsB,EAAE,OAAO,GAChC,sBAAsB,CAkBxB"}

package/dist/auth/actionAuthorization.js

@@ -0,0 +1,94 @@
+import { AuthorizationRoleType } from '@memberjunction/core';
+import { NormalizeUUID, UUIDsEqual } from '@memberjunction/global';
+/**
+ * True when the user is an Owner, MJ's superuser type. The column is nchar, so the stored value is
+ * padded.
+ */
+export function IsOwner(user) {
+    return user.Type?.trim().toLowerCase() === 'owner';
+}
+/**
+ * Decides whether a user may run an action through a public entry point such as the `RunAction`
+ * mutation. It fails closed:
+ *
+ * - An Owner may run any action.
+ * - An action with `MJ: Action Authorizations` rows runs for a user who holds at least one of the
+ *   linked authorizations. A linked authorization counts only when it is active and none of the
+ *   user's roles is denied it; the user may then hold it directly or through an ancestor.
+ * - An action with no such rows runs for any user when its class authorizes its caller itself
+ *   (`BaseAction.AuthorizesCaller`), so the action's own check decides. Otherwise it runs for
+ *   Owners only.
+ *
+ * The authorizations, their parents and their role grants are read only from `metadata`, never
+ * from the global provider. Pass the provider the `MJ: Action Authorizations` rows were read from.
+ *
+ * Refuse scope-limited sessions before calling this; see `IsScopeLimitedPrincipal`.
+ *
+ * @param user the caller
+ * @param actionAuthorizationIDs the AuthorizationID of each `MJ: Action Authorizations` row for the action
+ * @param metadata the provider whose authorizations and role grants decide
+ * @param actionAuthorizesCaller true when the action's class authorizes its caller itself
+ * @returns whether the run is allowed, and why
+ */
+export function EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller) {
+    if (IsOwner(user)) {
+        return { Allowed: true, Reason: 'The user is an Owner.' };
+    }
+    if (actionAuthorizationIDs.length === 0) {
+        return actionAuthorizesCaller
+            ? { Allowed: true, Reason: 'The action authorizes its caller itself.' }
+            : { Allowed: false, Reason: 'No Action Authorization grants this action to any role, and the action does not authorize its caller itself; only an Owner may run it.' };
+    }
+    const authorizationsByID = new Map(metadata.Authorizations.map((auth) => [NormalizeUUID(auth.ID), auth]));
+    const userGrants = grantsToUserRoles(user, metadata.AuthorizationRoles);
+    const granted = actionAuthorizationIDs
+        .map((id) => authorizationsByID.get(NormalizeUUID(id)))
+        .filter((auth) => auth !== undefined)
+        .find((auth) => holdsLinkedAuthorization(auth, authorizationsByID, userGrants));
+    return granted
+        ? { Allowed: true, Reason: `The user holds the "${granted.Name}" authorization.` }
+        : { Allowed: false, Reason: 'None of your roles holds an authorization this action requires.' };
+}
+/** The role grants that name one of the user's roles. */
+function grantsToUserRoles(user, grants) {
+    const userRoleIDs = new Set((user.UserRoles ?? []).map((userRole) => NormalizeUUID(userRole.RoleID)));
+    return grants.filter((grant) => userRoleIDs.has(NormalizeUUID(grant.RoleID)));
+}
+/**
+ * True when the user holds a linked authorization: it is active, none of the user's roles is denied
+ * it, and the user holds it directly or through an ancestor. The first two are checked on the linked
+ * authorization itself, because the ancestor walk would otherwise grant it through the parent.
+ */
+function holdsLinkedAuthorization(auth, authorizationsByID, userGrants) {
+    if (!auth.IsActive || grantTypes(auth, userGrants).includes(AuthorizationRoleType.Deny)) {
+        return false;
+    }
+    return holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants);
+}
+/**
+ * True when the user holds the authorization or one of its ancestors, following `ParentID` within
+ * `authorizationsByID`. This is the walk `AuthorizationEvaluator.UserCanExecuteWithAncestors` does,
+ * with the role grants taken from the same provider as the authorizations.
+ */
+function holdsDirectlyOrThroughAncestor(auth, authorizationsByID, userGrants) {
+    const visited = new Set();
+    let node = auth;
+    while (node && !visited.has(NormalizeUUID(node.ID))) {
+        if (holdsDirectly(node, userGrants)) {
+            return true;
+        }
+        visited.add(NormalizeUUID(node.ID));
+        node = node.ParentID ? authorizationsByID.get(NormalizeUUID(node.ParentID)) : undefined;
+    }
+    return false;
+}
+/** True when the authorization is active and the user's roles have an Allow and no Deny on it. */
+function holdsDirectly(auth, userGrants) {
+    const types = grantTypes(auth, userGrants);
+    return auth.IsActive && types.includes(AuthorizationRoleType.Allow) && !types.includes(AuthorizationRoleType.Deny);
+}
+/** Allow or Deny, for each of the user's role grants on the authorization. */
+function grantTypes(auth, userGrants) {
+    return userGrants.filter((grant) => UUIDsEqual(grant.AuthorizationID, auth.ID)).map((grant) => grant.AuthorizationType());
+}
+//# sourceMappingURL=actionAuthorization.js.map

package/dist/auth/actionAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionAuthorization.js","sourceRoot":"","sources":["../../src/auth/actionAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,qBAAqB,EAA+B,MAAM,sBAAsB,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAgBnE;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAc;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,8BAA8B,CAC1C,IAAc,EACd,sBAAyC,EACzC,QAA+B,EAC/B,sBAA+B;IAE/B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,sBAAsB;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,EAAE;YACvE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wIAAwI,EAAE,CAAC;IAC/K,CAAC;IACD,MAAM,kBAAkB,GAAuB,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9H,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,sBAAsB;SACjC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,IAAI,EAA6B,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO;QACV,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,OAAO,CAAC,IAAI,kBAAkB,EAAE;QAClF,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;AACxG,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,IAAc,EAAE,MAAwC;IAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,IAAuB,EAAE,kBAAsC,EAAE,UAA4C;IAC3I,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,8BAA8B,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,IAAuB,EAAE,kBAAsC,EAAE,UAA4C;IACjJ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,IAAI,GAAkC,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,IAAuB,EAAE,UAA4C;IACxF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACvH,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAuB,EAAE,UAA4C;IACrF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/dist/auth/exampleNewUserSubClass.js

@@ -1,3 +1,4 @@
+import { EscapeSQLString } from '@memberjunction/global';
 import { Metadata, RunView, LogError } from '@memberjunction/core';
 import { NewUserBase } from './newUsers.js';
 import { ResolveConfiguredPrincipal } from './principals.js';
@@ -34,7 +35,7 @@ export class ExampleNewUserSubClass extends NewUserBase {
             const rv = new RunView();
             const viewResults = await rv.RunView({
                 EntityName: 'Persons',
-                ExtraFilter: `Email = '${email}'`,
+                ExtraFilter: `Email = '${EscapeSQLString(email)}'`,
             }, contextUser);
             if (viewResults && viewResults.Success && Array.isArray(viewResults.Results) && viewResults.Results.length > 0) {
                 // we have a match so use it

package/dist/auth/exampleNewUserSubClass.js.map

@@ -1 +1 @@
-{"version":3,"file":"exampleNewUserSubClass.js","sourceRoot":"","sources":["../../src/auth/exampleNewUserSubClass.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C;;;;GAIG;AACH,sKAAsK;AACtK,6CAA6C;AAC7C,0LAA0L;AAC1L,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IACrC,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAgB,EAAE,KAAa,EAAE,mBAA2B,MAAM,EAAE,cAAuB,EAAE,oBAA6B;QAC/K,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,wGAAwG;YAEnI,yFAAyF;YACzF,2FAA2F;YAC3F,uFAAuF;YACvF,wFAAwF;YACxF,6BAA6B;YAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,EAAE,YAAY,EAAE,6BAA6B,EAAE,SAAS,CAAC,CAAC;YACnH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CACN,6QAA6Q,CAC9Q,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,iDAAiD;YAChH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,+BAA+B,CAAC,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,QAAQ,CAAC;YACb,uEAAuE;YACvE,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAClC;gBACE,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,YAAY,KAAK,GAAG;aAClC,EACD,WAAW,CACZ,CAAC;YAEF,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/G,4BAA4B;gBAC5B,MAAM,GAAG,GAAI,WAAW,CAAC,OAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;gBACpG,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,sDAAsD;gBACtD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3D,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,oFAAoF;gBACnG,sJAAsJ;gBACtJ,0BAA0B;gBAC1B,wBAAwB;gBACxB,kBAAkB;gBAClB,sBAAsB;gBACtB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACnB,QAAQ,GAAG,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,+MAA+M;gBACrP,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,+BAA+B,SAAS,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,sFAAsF;YACtF,OAAO,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,2BAA2B,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"exampleNewUserSubClass.js","sourceRoot":"","sources":["../../src/auth/exampleNewUserSubClass.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAiB,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C;;;;GAIG;AACH,sKAAsK;AACtK,6CAA6C;AAC7C,0LAA0L;AAC1L,MAAM,OAAO,sBAAuB,SAAQ,WAAW;IACrC,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,QAAgB,EAAE,KAAa,EAAE,mBAA2B,MAAM,EAAE,cAAuB,EAAE,oBAA6B;QAC/K,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,wGAAwG;YAEnI,yFAAyF;YACzF,2FAA2F;YAC3F,uFAAuF;YACvF,wFAAwF;YACxF,6BAA6B;YAC7B,MAAM,WAAW,GAAG,0BAA0B,CAAC,UAAU,EAAE,YAAY,EAAE,6BAA6B,EAAE,SAAS,CAAC,CAAC;YACnH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CACN,6QAA6Q,CAC9Q,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,iDAAiD;YAChH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,+BAA+B,CAAC,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,QAAQ,CAAC;YACb,uEAAuE;YACvE,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAClC;gBACE,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,YAAY,eAAe,CAAC,KAAK,CAAC,GAAG;aACnD,EACD,WAAW,CACZ,CAAC;YAEF,IAAI,WAAW,IAAI,WAAW,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/G,4BAA4B;gBAC5B,MAAM,GAAG,GAAI,WAAW,CAAC,OAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;gBACpG,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,sDAAsD;gBACtD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC3D,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,oFAAoF;gBACnG,sJAAsJ;gBACtJ,0BAA0B;gBAC1B,wBAAwB;gBACxB,kBAAkB;gBAClB,sBAAsB;gBACtB,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACnB,QAAQ,GAAG,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,+MAA+M;gBACrP,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,+BAA+B,SAAS,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YAED,sFAAsF;YACtF,OAAO,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,2BAA2B,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/auth/magicLink/MagicLinkService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAiCpB;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAsFvC;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,2CAA2C;IAC3C,OAAO,CAAC,kBAAkB;IAK1B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IA+D9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;;;;;;;;;;OAiBG;YACW,aAAa;IAmB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAKtC,qFAAqF;YACvE,eAAe;CA0B9B"}
+{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAInE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAiCpB;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAsFvC;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,2CAA2C;IAC3C,OAAO,CAAC,kBAAkB;IAK1B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IAiE9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;;;;;;;;;;OAiBG;YACW,aAAa;IAmB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAKtC,qFAAqF;YACvE,eAAe;CA0B9B"}

package/dist/auth/magicLink/MagicLinkService.js

@@ -13,6 +13,7 @@ import { ResolveConfiguredPrincipal } from '../principals.js';
 import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo } from '../../config.js';
+import { CreateIsolatedProvider } from '../../isolatedProvider.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
 import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInvitePostgresSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
 const INVITE_ENTITY = 'MJ: Magic Link Invites';
@@ -416,9 +417,11 @@ export class MagicLinkService {
     /** Creates a new user with exactly the restricted role + single app, transactionally. */
     async createScopedUser(invite, role, contextUser) {
         // Single provider for BOTH the transaction and the entity writes, so the
-        // BeginTransaction/Save/Commit are provably on the same connection.
-        // global-provider-ok: redemption runs in the pre-auth flow, no per-request provider yet.
-        const provider = Metadata.Provider; // global-provider-ok: server-side magic-link service; runs under the server's single default provider
+        // BeginTransaction/Save/Commit are provably on the same connection. Redemption runs
+        // pre-auth, with no per-request provider yet, and the global Metadata.Provider is shared
+        // by every concurrent request: a transaction opened there nests into anyone else's and
+        // swallows their writes. So it gets its own (see CreateIsolatedProvider).
+        const provider = await CreateIsolatedProvider();
         const email = invite.Email;
         // The invite does not persist a name; provision a sensible default. (The
         // create-invite params accept first/last name but there is no column to