@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/dist/realtimeSessions/verificationCore.d.ts

@@ -0,0 +1,243 @@
+/**
+ * @fileoverview Pure functional core of mid-session identity verification — no DB, no email, no clock
+ * of its own. Everything here is deterministic given its inputs (modulo crypto randomness) and is
+ * unit-testable with plain assertions.
+ *
+ * ## What is stored, and where
+ *
+ * The verification state of a session lives in `AIAgentSession.Config` under the key
+ * `identityVerification` (a server-authoritative key — see `sessionConfigGuard` in
+ * `@memberjunction/core-entities-server`). It is an {@link IdentityVerificationState}: the policy
+ * snapshot taken at mint, how many emails the session has triggered, at most one *pending*
+ * verification, and — once done — the verified identity.
+ *
+ * ## Secrets
+ *
+ * Nothing redeemable is ever stored: only hashes.
+ *
+ * - The **link token** is `mj_rv_<session id>_<256 random bits>`. The session id is deliberately part of
+ *   it so redemption is a primary-key lookup instead of a scan; it is not a secret. Only the SHA-256 of
+ *   the whole token is stored, and it is compared in constant time.
+ * - The **typed code** is 6 digits (the fallback for opening the email on another device). Six digits
+ *   cannot be made brute-force-proof by hashing — a million candidates is nothing — so its protection is
+ *   structural: it expires, it is single-use, it is voided after {@link IdentityVerificationPolicy.maxCodeAttempts}
+ *   wrong entries, only the session's own principal can submit it, and submissions are rate-limited.
+ *   It is salted and bound to the session id so equal codes do not produce equal stored hashes.
+ *
+ * Token generation and hashing reuse the magic-link module's primitives (`HashToken`).
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import type { IdentityVerificationPolicy, ResolvedIdentityVerificationPolicy } from './verificationPolicy.js';
+/** Prefix of a verification link token (mirrors `mj_ml_` / `mj_sk_`). */
+export declare const VERIFICATION_TOKEN_PREFIX = "mj_rv_";
+/** Number of digits in the typed code. */
+export declare const VERIFICATION_CODE_LENGTH = 6;
+/** Longest name accepted, in characters. */
+export declare const MAX_VERIFICATION_NAME_LENGTH = 100;
+/** A verification that has been requested and not yet redeemed. Holds hashes only. */
+export interface PendingVerification {
+    /** SHA-256 (base64url) of the link token. */
+    TokenHash: string;
+    /** Salted, server-keyed HMAC-SHA-256 (base64url) of the typed code. */
+    CodeHash: string;
+    /** Random per-verification salt for {@link PendingVerification.CodeHash}. */
+    CodeSalt: string;
+    /** The address the link and code were sent to (normalised). */
+    Email: string;
+    /** The name given with the request (sanitised, length-capped). */
+    Name: string;
+    /** ISO instant the verification was requested. */
+    RequestedAt: string;
+    /** ISO instant after which neither the link nor the code redeems. */
+    ExpiresAt: string;
+    /** Wrong code entries so far. */
+    CodeAttempts: number;
+}
+/** The proven identity of a verified session. */
+export interface VerifiedIdentity {
+    Email: string;
+    Name: string;
+    /** ISO instant the verification completed. */
+    VerifiedAt: string;
+    /** How it was proven. */
+    Method: 'link' | 'code';
+}
+/** The whole verification state of one session (the value of `Config.identityVerification`). */
+export interface IdentityVerificationState {
+    /** The session-scoped policy layer, snapshotted at mint. Absent when the cascade carried none. */
+    Policy?: IdentityVerificationPolicy;
+    /** How many verification emails this session has triggered (a send that failed to deliver does not count). */
+    SendCount: number;
+    /** The outstanding verification, if any. A new request replaces it. */
+    Pending?: PendingVerification;
+    /** Set once verified. */
+    Verified?: VerifiedIdentity;
+}
+/** A state with nothing in it. */
+export declare function EmptyIdentityVerificationState(): IdentityVerificationState;
+/**
+ * Reads the verification state out of a session's `Config` JSON. Tolerant by design: a missing,
+ * malformed or partial value yields an empty / partial state rather than an exception, because a
+ * garbled state must never be the reason a session cannot be addressed.
+ *
+ * @param configRaw - `AIAgentSession.Config` as stored
+ * @param readPolicy - reads a policy layer from untrusted JSON (injected to keep this module free of policy wiring)
+ */
+export declare function ReadIdentityVerificationState(configRaw: string | null | undefined, readPolicy: (raw: unknown) => IdentityVerificationPolicy): IdentityVerificationState;
+/** Parses a `Config` JSON string into a plain object; anything else is `{}`. */
+export declare function ParseConfigObject(raw: string | null | undefined): Record<string, unknown>;
+/**
+ * Returns `configRaw` with `identityVerification` (and, when given, `maxSessionDeadlineIso`) replaced,
+ * preserving every other key verbatim.
+ *
+ * @param configRaw - the stored Config
+ * @param state - the new verification state
+ * @param deadlineIso - a new absolute deadline to write, or undefined to leave the existing one alone
+ */
+export declare function WriteIdentityVerificationState(configRaw: string | null | undefined, state: IdentityVerificationState, deadlineIso?: string): string;
+/**
+ * Generates a verification link token bound (by construction) to one session.
+ *
+ * @param agentSessionId - the session the token redeems against
+ * @throws Error when `agentSessionId` is not a UUID — a programming error, never user input
+ */
+export declare function GenerateVerificationToken(agentSessionId: string): string;
+/** The structure of a token, once parsed. */
+export interface ParsedVerificationToken {
+    /** The session id embedded in the token (dashed, lower-case). Not a secret and not yet trusted. */
+    AgentSessionID: string;
+}
+/**
+ * Parses a presented token's structure. Success means "well-formed", NOT "valid": validity is decided
+ * only by comparing hashes ({@link EvaluateRedemption}).
+ *
+ * @returns the embedded session id, or null for anything malformed
+ */
+export declare function ParseVerificationToken(token: string): ParsedVerificationToken | null;
+/** Generates a uniformly random numeric code of {@link VERIFICATION_CODE_LENGTH} digits. */
+export declare function GenerateVerificationCode(): string;
+/**
+ * Normalises a typed code: strips spaces and dashes (people type "123 456"). Returns null unless the
+ * result is exactly {@link VERIFICATION_CODE_LENGTH} digits.
+ */
+export declare function NormalizeVerificationCode(input: string): string | null;
+/** Hash stored for a link token. */
+export declare function HashVerificationToken(token: string): string;
+/**
+ * Hash stored for a code: an HMAC-SHA-256 under a SERVER-ONLY key, salted and bound to the session so
+ * equal codes never hash equal.
+ *
+ * The key is what makes this safe. A code is only six digits, and the session's owner — the very person
+ * being verified — can read their own `Session.Config`, hash and salt included. A plain (even salted)
+ * hash would let them recover the code offline in about a million guesses without ever opening the
+ * inbox, bypassing the attempt cap entirely. Without the key the stored value is useless to a reader.
+ *
+ * @param code - the normalised six-digit code
+ * @param salt - the per-verification salt stored beside the hash
+ * @param agentSessionId - the session the code is bound to
+ * @param key - the server-only key (`realtime.identityVerification.hmacSecret`); must be non-empty
+ */
+export declare function HashVerificationCode(code: string, salt: string, agentSessionId: string, key: string): string;
+/**
+ * Constant-time equality of two hash strings. Both are re-hashed to a fixed length first, so neither
+ * the comparison time nor an early length check reveals how much of a guess was right.
+ */
+export declare function HashesEqual(a: string, b: string): boolean;
+/**
+ * Sanitises a display name: collapses whitespace, strips control characters and the characters that
+ * could shape markup or a header (`<`, `>`, `"`), and caps the length. The result is for display
+ * only — it is still HTML-escaped wherever it is rendered.
+ *
+ * @returns the cleaned name, or null when nothing usable is left
+ */
+export declare function SanitizeVerificationName(raw: string): string | null;
+/** What {@link IssueVerification} produces: the state to store and the secrets to send. */
+export interface IssuedVerification {
+    /** Store this. Contains hashes only. */
+    Pending: PendingVerification;
+    /** Send this in the link. Never store it. */
+    Token: string;
+    /** Send this as the typed code. Never store it. */
+    Code: string;
+}
+/**
+ * Creates a fresh pending verification for a session.
+ *
+ * @param args.AgentSessionID - the session being verified
+ * @param args.Email - the normalised address the secrets will be sent to
+ * @param args.Name - the sanitised name
+ * @param args.TtlMinutes - how long the secrets stay redeemable
+ * @param args.NowMs - the current time, epoch ms
+ */
+export declare function IssueVerification(args: {
+    AgentSessionID: string;
+    Email: string;
+    Name: string;
+    TtlMinutes: number;
+    NowMs: number;
+    /** The server-only code-hash key (see {@link HashVerificationCode}). */
+    CodeHashKey: string;
+}): IssuedVerification;
+/** What a person presents to redeem a verification. */
+export type VerificationCredential = {
+    Kind: 'token';
+    Token: string;
+} | {
+    Kind: 'code';
+    Code: string;
+    AgentSessionID: string;
+};
+/** Why a redemption was refused. */
+export type RedemptionRefusal = 'already_verified' | 'no_pending' | 'expired' | 'invalid' | 'attempts_exhausted';
+/** Outcome of {@link EvaluateRedemption}. `Next` is the state to persist in every case. */
+export type RedemptionOutcome = {
+    Outcome: 'verified';
+    Next: IdentityVerificationState;
+    Verified: VerifiedIdentity;
+} | {
+    Outcome: 'rejected';
+    Reason: RedemptionRefusal;
+    Next: IdentityVerificationState;
+    AttemptsRemaining?: number;
+};
+/**
+ * Decides a redemption attempt and returns the state to persist. Pure: the caller supplies the time.
+ *
+ * Properties this function guarantees (and the tests pin):
+ *
+ * - **Single use.** A success removes the pending verification, so neither the link nor the code works again.
+ * - **Expiry.** Past `ExpiresAt` nothing redeems, and the stale pending verification is cleared.
+ * - **Bounded guessing.** A wrong code increments `CodeAttempts`; reaching `maxCodeAttempts` voids the
+ *   pending verification (a new request — itself capped by `maxSendsPerSession` — is needed). A wrong
+ *   *token* changes nothing: 256 random bits are not guessable, and counting them would let a stranger
+ *   burn a legitimate person's pending link just by hitting the URL.
+ * - **Constant-time compares.** Secrets are compared via {@link HashesEqual}.
+ *
+ * @param state - the session's current verification state
+ * @param credential - what was presented
+ * @param nowMs - the current time, epoch ms
+ * @param policy - the resolved policy (for `maxCodeAttempts`)
+ * @param codeHashKey - the server-only code-hash key (see {@link HashVerificationCode})
+ */
+export declare function EvaluateRedemption(state: IdentityVerificationState, credential: VerificationCredential, nowMs: number, policy: Pick<ResolvedIdentityVerificationPolicy, 'maxCodeAttempts'>, codeHashKey: string): RedemptionOutcome;
+/**
+ * The session deadline after a successful verification, or `undefined` when verification should not
+ * change it.
+ *
+ * Verification only ever **extends** a deadline that exists: a session with no deadline stays
+ * uncapped, and a `verifiedMaxSeconds` shorter than what is already granted never pulls a deadline in.
+ * The new deadline is measured from the session's start, so `verifiedMaxSeconds` means "a verified
+ * session may run this long in total", the same meaning `unverifiedMaxSeconds` has.
+ *
+ * @param args.CurrentDeadlineIso - the stamped deadline, if any
+ * @param args.SessionStartedAtMs - when the session started, epoch ms
+ * @param args.VerifiedMaxSeconds - the verified cap from policy, if any
+ * @returns the new ISO deadline, or undefined for "leave it alone"
+ */
+export declare function ComputeVerifiedDeadline(args: {
+    CurrentDeadlineIso: string | undefined;
+    SessionStartedAtMs: number;
+    VerifiedMaxSeconds: number | undefined;
+}): string | undefined;
+//# sourceMappingURL=verificationCore.d.ts.map

package/dist/realtimeSessions/verificationCore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationCore.d.ts","sourceRoot":"","sources":["../../src/realtimeSessions/verificationCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAE9G,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,4CAA4C;AAC5C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAChC,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAAyB;IACtC,kGAAkG;IAClG,MAAM,CAAC,EAAE,0BAA0B,CAAC;IACpC,8GAA8G;IAC9G,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,kCAAkC;AAClC,wBAAgB,8BAA8B,IAAI,yBAAyB,CAE1E;AAwCD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CACzC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,0BAA0B,GACzD,yBAAyB,CAuB3B;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzF;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,KAAK,EAAE,yBAAyB,EAChC,WAAW,CAAC,EAAE,MAAM,GACrB,MAAM,CAOR;AAeD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAMxE;AAED,6CAA6C;AAC7C,MAAM,WAAW,uBAAuB;IACpC,mGAAmG;IACnG,cAAc,EAAE,MAAM,CAAC;CAC1B;AAKD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAGpF;AAED,4FAA4F;AAC5F,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGtE;AAED,oCAAoC;AACpC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAK5G;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASnE;AAID,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IAC/B,wCAAwC;IACxC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;CACvB,GAAG,kBAAkB,CAkBrB;AAID,uDAAuD;AACvD,MAAM,MAAM,sBAAsB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,oCAAoC;AACpC,MAAM,MAAM,iBAAiB,GACvB,kBAAkB,GAClB,YAAY,GACZ,SAAS,GACT,SAAS,GACT,oBAAoB,CAAC;AAE3B,2FAA2F;AAC3F,MAAM,MAAM,iBAAiB,GACvB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACpF;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAQtH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAC9B,KAAK,EAAE,yBAAyB,EAChC,UAAU,EAAE,sBAAsB,EAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,IAAI,CAAC,kCAAkC,EAAE,iBAAiB,CAAC,EACnE,WAAW,EAAE,MAAM,GACpB,iBAAiB,CAqBnB;AAsCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C,GAAG,MAAM,GAAG,SAAS,CAUrB"}

package/dist/realtimeSessions/verificationCore.js

@@ -0,0 +1,356 @@
+/**
+ * @fileoverview Pure functional core of mid-session identity verification — no DB, no email, no clock
+ * of its own. Everything here is deterministic given its inputs (modulo crypto randomness) and is
+ * unit-testable with plain assertions.
+ *
+ * ## What is stored, and where
+ *
+ * The verification state of a session lives in `AIAgentSession.Config` under the key
+ * `identityVerification` (a server-authoritative key — see `sessionConfigGuard` in
+ * `@memberjunction/core-entities-server`). It is an {@link IdentityVerificationState}: the policy
+ * snapshot taken at mint, how many emails the session has triggered, at most one *pending*
+ * verification, and — once done — the verified identity.
+ *
+ * ## Secrets
+ *
+ * Nothing redeemable is ever stored: only hashes.
+ *
+ * - The **link token** is `mj_rv_<session id>_<256 random bits>`. The session id is deliberately part of
+ *   it so redemption is a primary-key lookup instead of a scan; it is not a secret. Only the SHA-256 of
+ *   the whole token is stored, and it is compared in constant time.
+ * - The **typed code** is 6 digits (the fallback for opening the email on another device). Six digits
+ *   cannot be made brute-force-proof by hashing — a million candidates is nothing — so its protection is
+ *   structural: it expires, it is single-use, it is voided after {@link IdentityVerificationPolicy.maxCodeAttempts}
+ *   wrong entries, only the session's own principal can submit it, and submissions are rate-limited.
+ *   It is salted and bound to the session id so equal codes do not produce equal stored hashes.
+ *
+ * Token generation and hashing reuse the magic-link module's primitives (`HashToken`).
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { createHash, createHmac, randomBytes, randomInt, timingSafeEqual } from 'node:crypto';
+import { HashToken } from '../auth/magicLink/magicLinkCore.js';
+/** Prefix of a verification link token (mirrors `mj_ml_` / `mj_sk_`). */
+export const VERIFICATION_TOKEN_PREFIX = 'mj_rv_';
+/** Number of digits in the typed code. */
+export const VERIFICATION_CODE_LENGTH = 6;
+/** Longest name accepted, in characters. */
+export const MAX_VERIFICATION_NAME_LENGTH = 100;
+/** A state with nothing in it. */
+export function EmptyIdentityVerificationState() {
+    return { SendCount: 0 };
+}
+/** True for a plain object. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** True for a non-empty string. */
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/** Reads a pending verification from untrusted JSON; undefined unless every field is well-formed. */
+function readPending(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const { TokenHash, CodeHash, CodeSalt, Email, Name, RequestedAt, ExpiresAt, CodeAttempts } = value;
+    if (!isNonEmptyString(TokenHash) || !isNonEmptyString(CodeHash) || !isNonEmptyString(CodeSalt) ||
+        !isNonEmptyString(Email) || typeof Name !== 'string' || !isNonEmptyString(RequestedAt) ||
+        !isNonEmptyString(ExpiresAt) || typeof CodeAttempts !== 'number' || !Number.isFinite(CodeAttempts)) {
+        return undefined;
+    }
+    return { TokenHash, CodeHash, CodeSalt, Email, Name, RequestedAt, ExpiresAt, CodeAttempts };
+}
+/** Reads a verified identity from untrusted JSON; undefined unless every field is well-formed. */
+function readVerified(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const { Email, Name, VerifiedAt, Method } = value;
+    if (!isNonEmptyString(Email) || typeof Name !== 'string' || !isNonEmptyString(VerifiedAt) || (Method !== 'link' && Method !== 'code')) {
+        return undefined;
+    }
+    return { Email, Name, VerifiedAt, Method };
+}
+/**
+ * Reads the verification state out of a session's `Config` JSON. Tolerant by design: a missing,
+ * malformed or partial value yields an empty / partial state rather than an exception, because a
+ * garbled state must never be the reason a session cannot be addressed.
+ *
+ * @param configRaw - `AIAgentSession.Config` as stored
+ * @param readPolicy - reads a policy layer from untrusted JSON (injected to keep this module free of policy wiring)
+ */
+export function ReadIdentityVerificationState(configRaw, readPolicy) {
+    const config = ParseConfigObject(configRaw);
+    const stored = config['identityVerification'];
+    if (!isRecord(stored)) {
+        return EmptyIdentityVerificationState();
+    }
+    const sends = stored['SendCount'];
+    const state = {
+        SendCount: typeof sends === 'number' && Number.isFinite(sends) && sends >= 0 ? Math.floor(sends) : 0,
+    };
+    const policy = readPolicy(stored['Policy']);
+    if (Object.keys(policy).length > 0) {
+        state.Policy = policy;
+    }
+    const pending = readPending(stored['Pending']);
+    if (pending) {
+        state.Pending = pending;
+    }
+    const verified = readVerified(stored['Verified']);
+    if (verified) {
+        state.Verified = verified;
+    }
+    return state;
+}
+/** Parses a `Config` JSON string into a plain object; anything else is `{}`. */
+export function ParseConfigObject(raw) {
+    if (typeof raw !== 'string' || raw.trim().length === 0) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return isRecord(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Returns `configRaw` with `identityVerification` (and, when given, `maxSessionDeadlineIso`) replaced,
+ * preserving every other key verbatim.
+ *
+ * @param configRaw - the stored Config
+ * @param state - the new verification state
+ * @param deadlineIso - a new absolute deadline to write, or undefined to leave the existing one alone
+ */
+export function WriteIdentityVerificationState(configRaw, state, deadlineIso) {
+    const config = ParseConfigObject(configRaw);
+    config['identityVerification'] = state;
+    if (deadlineIso !== undefined) {
+        config['maxSessionDeadlineIso'] = deadlineIso;
+    }
+    return JSON.stringify(config);
+}
+// ───────────────────────── tokens, codes, hashing ─────────────────────────
+/** Lower-case 32-hex form of a UUID (the dashes dropped), or null when it is not a UUID. */
+function compactUUID(uuid) {
+    const compact = uuid.replace(/-/g, '').toLowerCase();
+    return /^[0-9a-f]{32}$/.test(compact) ? compact : null;
+}
+/** Re-inserts the dashes of a compact UUID. */
+function expandUUID(compact) {
+    return `${compact.slice(0, 8)}-${compact.slice(8, 12)}-${compact.slice(12, 16)}-${compact.slice(16, 20)}-${compact.slice(20)}`;
+}
+/**
+ * Generates a verification link token bound (by construction) to one session.
+ *
+ * @param agentSessionId - the session the token redeems against
+ * @throws Error when `agentSessionId` is not a UUID — a programming error, never user input
+ */
+export function GenerateVerificationToken(agentSessionId) {
+    const compact = compactUUID(agentSessionId);
+    if (!compact) {
+        throw new Error(`GenerateVerificationToken: '${agentSessionId}' is not a session id`);
+    }
+    return `${VERIFICATION_TOKEN_PREFIX}${compact}_${randomBytes(32).toString('hex')}`;
+}
+/** Token shape: prefix, 32 hex of session id, `_`, 64 hex of randomness. */
+const TOKEN_PATTERN = new RegExp(`^${VERIFICATION_TOKEN_PREFIX}([0-9a-f]{32})_[0-9a-f]{64}$`);
+/**
+ * Parses a presented token's structure. Success means "well-formed", NOT "valid": validity is decided
+ * only by comparing hashes ({@link EvaluateRedemption}).
+ *
+ * @returns the embedded session id, or null for anything malformed
+ */
+export function ParseVerificationToken(token) {
+    const match = typeof token === 'string' ? TOKEN_PATTERN.exec(token) : null;
+    return match ? { AgentSessionID: expandUUID(match[1]) } : null;
+}
+/** Generates a uniformly random numeric code of {@link VERIFICATION_CODE_LENGTH} digits. */
+export function GenerateVerificationCode() {
+    return randomInt(0, 10 ** VERIFICATION_CODE_LENGTH).toString().padStart(VERIFICATION_CODE_LENGTH, '0');
+}
+/**
+ * Normalises a typed code: strips spaces and dashes (people type "123 456"). Returns null unless the
+ * result is exactly {@link VERIFICATION_CODE_LENGTH} digits.
+ */
+export function NormalizeVerificationCode(input) {
+    const stripped = (input ?? '').replace(/[\s-]/g, '');
+    return new RegExp(`^\\d{${VERIFICATION_CODE_LENGTH}}$`).test(stripped) ? stripped : null;
+}
+/** Hash stored for a link token. */
+export function HashVerificationToken(token) {
+    return HashToken(token);
+}
+/**
+ * Hash stored for a code: an HMAC-SHA-256 under a SERVER-ONLY key, salted and bound to the session so
+ * equal codes never hash equal.
+ *
+ * The key is what makes this safe. A code is only six digits, and the session's owner — the very person
+ * being verified — can read their own `Session.Config`, hash and salt included. A plain (even salted)
+ * hash would let them recover the code offline in about a million guesses without ever opening the
+ * inbox, bypassing the attempt cap entirely. Without the key the stored value is useless to a reader.
+ *
+ * @param code - the normalised six-digit code
+ * @param salt - the per-verification salt stored beside the hash
+ * @param agentSessionId - the session the code is bound to
+ * @param key - the server-only key (`realtime.identityVerification.hmacSecret`); must be non-empty
+ */
+export function HashVerificationCode(code, salt, agentSessionId, key) {
+    if (!key) {
+        throw new Error('HashVerificationCode requires a non-empty server key.');
+    }
+    return createHmac('sha256', key).update(`rv-code:${agentSessionId.toLowerCase()}:${salt}:${code}`).digest('base64url');
+}
+/**
+ * Constant-time equality of two hash strings. Both are re-hashed to a fixed length first, so neither
+ * the comparison time nor an early length check reveals how much of a guess was right.
+ */
+export function HashesEqual(a, b) {
+    const digestA = createHash('sha256').update(a).digest();
+    const digestB = createHash('sha256').update(b).digest();
+    return timingSafeEqual(digestA, digestB);
+}
+/**
+ * Sanitises a display name: collapses whitespace, strips control characters and the characters that
+ * could shape markup or a header (`<`, `>`, `"`), and caps the length. The result is for display
+ * only — it is still HTML-escaped wherever it is rendered.
+ *
+ * @returns the cleaned name, or null when nothing usable is left
+ */
+export function SanitizeVerificationName(raw) {
+    const cleaned = (raw ?? '')
+        // eslint-disable-next-line no-control-regex -- stripping control characters is the point
+        .replace(/[\u0000-\u001F\u007F-\u009F<>"]/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_VERIFICATION_NAME_LENGTH)
+        .trim();
+    return cleaned.length > 0 ? cleaned : null;
+}
+/**
+ * Creates a fresh pending verification for a session.
+ *
+ * @param args.AgentSessionID - the session being verified
+ * @param args.Email - the normalised address the secrets will be sent to
+ * @param args.Name - the sanitised name
+ * @param args.TtlMinutes - how long the secrets stay redeemable
+ * @param args.NowMs - the current time, epoch ms
+ */
+export function IssueVerification(args) {
+    const token = GenerateVerificationToken(args.AgentSessionID);
+    const code = GenerateVerificationCode();
+    const salt = randomBytes(16).toString('base64url');
+    return {
+        Token: token,
+        Code: code,
+        Pending: {
+            TokenHash: HashVerificationToken(token),
+            CodeHash: HashVerificationCode(code, salt, args.AgentSessionID, args.CodeHashKey),
+            CodeSalt: salt,
+            Email: args.Email,
+            Name: args.Name,
+            RequestedAt: new Date(args.NowMs).toISOString(),
+            ExpiresAt: new Date(args.NowMs + args.TtlMinutes * 60_000).toISOString(),
+            CodeAttempts: 0,
+        },
+    };
+}
+/** `state` with the pending verification removed. */
+function withoutPending(state) {
+    const { Pending: _removed, ...rest } = state;
+    return rest;
+}
+/**
+ * Decides a redemption attempt and returns the state to persist. Pure: the caller supplies the time.
+ *
+ * Properties this function guarantees (and the tests pin):
+ *
+ * - **Single use.** A success removes the pending verification, so neither the link nor the code works again.
+ * - **Expiry.** Past `ExpiresAt` nothing redeems, and the stale pending verification is cleared.
+ * - **Bounded guessing.** A wrong code increments `CodeAttempts`; reaching `maxCodeAttempts` voids the
+ *   pending verification (a new request — itself capped by `maxSendsPerSession` — is needed). A wrong
+ *   *token* changes nothing: 256 random bits are not guessable, and counting them would let a stranger
+ *   burn a legitimate person's pending link just by hitting the URL.
+ * - **Constant-time compares.** Secrets are compared via {@link HashesEqual}.
+ *
+ * @param state - the session's current verification state
+ * @param credential - what was presented
+ * @param nowMs - the current time, epoch ms
+ * @param policy - the resolved policy (for `maxCodeAttempts`)
+ * @param codeHashKey - the server-only code-hash key (see {@link HashVerificationCode})
+ */
+export function EvaluateRedemption(state, credential, nowMs, policy, codeHashKey) {
+    if (state.Verified) {
+        return { Outcome: 'rejected', Reason: 'already_verified', Next: state };
+    }
+    const pending = state.Pending;
+    if (!pending) {
+        return { Outcome: 'rejected', Reason: 'no_pending', Next: state };
+    }
+    if (nowMs >= Date.parse(pending.ExpiresAt) || Number.isNaN(Date.parse(pending.ExpiresAt))) {
+        return { Outcome: 'rejected', Reason: 'expired', Next: withoutPending(state) };
+    }
+    if (credential.Kind === 'token') {
+        return HashesEqual(HashVerificationToken(credential.Token), pending.TokenHash)
+            ? verifiedOutcome(state, pending, 'link', nowMs)
+            : { Outcome: 'rejected', Reason: 'invalid', Next: state };
+    }
+    const presented = HashVerificationCode(credential.Code, pending.CodeSalt, credential.AgentSessionID, codeHashKey);
+    if (HashesEqual(presented, pending.CodeHash)) {
+        return verifiedOutcome(state, pending, 'code', nowMs);
+    }
+    return wrongCodeOutcome(state, pending, policy.maxCodeAttempts);
+}
+/** The success outcome: pending cleared, identity recorded. */
+function verifiedOutcome(state, pending, method, nowMs) {
+    const verified = {
+        Email: pending.Email,
+        Name: pending.Name,
+        VerifiedAt: new Date(nowMs).toISOString(),
+        Method: method,
+    };
+    return { Outcome: 'verified', Next: { ...withoutPending(state), Verified: verified }, Verified: verified };
+}
+/** The wrong-code outcome: one more attempt spent, voiding the pending verification at the cap. */
+function wrongCodeOutcome(state, pending, maxCodeAttempts) {
+    const attempts = pending.CodeAttempts + 1;
+    if (attempts >= maxCodeAttempts) {
+        return { Outcome: 'rejected', Reason: 'attempts_exhausted', Next: withoutPending(state), AttemptsRemaining: 0 };
+    }
+    return {
+        Outcome: 'rejected',
+        Reason: 'invalid',
+        Next: { ...state, Pending: { ...pending, CodeAttempts: attempts } },
+        AttemptsRemaining: maxCodeAttempts - attempts,
+    };
+}
+// ───────────────────────── deadline ─────────────────────────
+/**
+ * The session deadline after a successful verification, or `undefined` when verification should not
+ * change it.
+ *
+ * Verification only ever **extends** a deadline that exists: a session with no deadline stays
+ * uncapped, and a `verifiedMaxSeconds` shorter than what is already granted never pulls a deadline in.
+ * The new deadline is measured from the session's start, so `verifiedMaxSeconds` means "a verified
+ * session may run this long in total", the same meaning `unverifiedMaxSeconds` has.
+ *
+ * @param args.CurrentDeadlineIso - the stamped deadline, if any
+ * @param args.SessionStartedAtMs - when the session started, epoch ms
+ * @param args.VerifiedMaxSeconds - the verified cap from policy, if any
+ * @returns the new ISO deadline, or undefined for "leave it alone"
+ */
+export function ComputeVerifiedDeadline(args) {
+    if (!args.VerifiedMaxSeconds || args.VerifiedMaxSeconds <= 0 || !args.CurrentDeadlineIso) {
+        return undefined;
+    }
+    const currentMs = Date.parse(args.CurrentDeadlineIso);
+    const candidateMs = args.SessionStartedAtMs + args.VerifiedMaxSeconds * 1000;
+    if (Number.isNaN(currentMs) || Number.isNaN(candidateMs) || candidateMs <= currentMs) {
+        return undefined;
+    }
+    return new Date(candidateMs).toISOString();
+}
+//# sourceMappingURL=verificationCore.js.map

package/dist/realtimeSessions/verificationCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationCore.js","sourceRoot":"","sources":["../../src/realtimeSessions/verificationCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAG/D,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AA4ChD,kCAAkC;AAClC,MAAM,UAAU,8BAA8B;IAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,+BAA+B;AAC/B,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,mCAAmC;AACnC,SAAS,gBAAgB,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACnG,IACI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAC1F,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACtF,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EACpG,CAAC;QACC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAChG,CAAC;AAED,kGAAkG;AAClG,SAAS,YAAY,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QACpI,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CACzC,SAAoC,EACpC,UAAwD;IAExD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpB,OAAO,8BAA8B,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,KAAK,GAA8B;QACrC,SAAS,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACvG,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IAC1B,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACV,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACX,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,GAA8B;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC1C,SAAoC,EACpC,KAAgC,EAChC,WAAoB;IAEpB,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,uBAAuB,CAAC,GAAG,WAAW,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,6EAA6E;AAE7E,4FAA4F;AAC5F,SAAS,WAAW,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,+CAA+C;AAC/C,SAAS,UAAU,CAAC,OAAe;IAC/B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,cAAc,uBAAuB,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,yBAAyB,GAAG,OAAO,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACvF,CAAC;AAQD,4EAA4E;AAC5E,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,IAAI,yBAAyB,8BAA8B,CAAC,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,wBAAwB;IACpC,OAAO,SAAS,CAAC,CAAC,EAAE,EAAE,IAAI,wBAAwB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACnD,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,IAAI,MAAM,CAAC,QAAQ,wBAAwB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAC/C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAY,EAAE,cAAsB,EAAE,GAAW;IAChG,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,cAAc,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC3H,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxD,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAChD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACvB,yFAAyF;SACxF,OAAO,CAAC,kCAAkC,EAAE,GAAG,CAAC;SAChD,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC;SACtC,IAAI,EAAE,CAAC;IACZ,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAQjC;IACG,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO;QACH,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACL,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC;YACvC,QAAQ,EAAE,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;YACjF,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YAC/C,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;YACxE,YAAY,EAAE,CAAC;SAClB;KACJ,CAAC;AACN,CAAC;AAsBD,qDAAqD;AACrD,SAAS,cAAc,CAAC,KAAgC;IACpD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAC9B,KAAgC,EAChC,UAAkC,EAClC,KAAa,EACb,MAAmE,EACnE,WAAmB;IAEnB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,qBAAqB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;YAC1E,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;YAChD,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClH,IAAI,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;AACpE,CAAC;AAED,+DAA+D;AAC/D,SAAS,eAAe,CACpB,KAAgC,EAChC,OAA4B,EAC5B,MAAkC,EAClC,KAAa;IAEb,MAAM,QAAQ,GAAqB;QAC/B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QACzC,MAAM,EAAE,MAAM;KACjB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CACrB,KAAgC,EAChC,OAA4B,EAC5B,eAAuB;IAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACpH,CAAC;IACD,OAAO;QACH,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE;QACnE,iBAAiB,EAAE,eAAe,GAAG,QAAQ;KAChD,CAAC;AACN,CAAC;AAED,+DAA+D;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACG,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;QACnF,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/C,CAAC"}