@memberjunction/server 6.2.0-edge.2 → 6.2.0-edge.4

package/dist/realtimeSessions/verificationWorkflow.js

@@ -0,0 +1,435 @@
+/**
+ * @fileoverview The orchestration of mid-session identity verification, written against **ports** so the
+ * whole policy surface (every refusal, every limit, deadline extension, single use) is unit-testable
+ * without a database, a mail server or a PubSub.
+ *
+ * {@link RealtimeSessionVerificationWorkflow} owns the decisions and their order; the injected
+ * {@link VerificationPorts} own the side effects (read the session, write its `Config`, send the email,
+ * publish the event, write the audit row). `RealtimeSessionVerificationService` wires the real ports.
+ *
+ * ## Operations
+ *
+ * | Operation | Caller | What it does |
+ * |---|---|---|
+ * | {@link RealtimeSessionVerificationWorkflow.RequestVerification} | the session's own principal | validates, applies policy + limits, stores a pending verification, emails link + code |
+ * | {@link RealtimeSessionVerificationWorkflow.SubmitCode} | the session's own principal | redeems the typed code |
+ * | {@link RealtimeSessionVerificationWorkflow.RedeemLink} | anyone holding the emailed link (public route) | redeems the link token |
+ * | {@link RealtimeSessionVerificationWorkflow.GetStatus} | the session's own principal | reads the current state (the durable backstop for a missed event) |
+ *
+ * ## What a successful verification does — and does not do
+ *
+ * It records the verified identity on the session, **extends the session's deadline** when policy says
+ * to, publishes `identity.verified`, and writes an audit entry. It does **not** create an MJ user, swap
+ * the session's principal, or link a Person/User: the principal never changes, so ownership and
+ * row-level security are untouched. Linking the verified email to a record is an application decision,
+ * made by a server-side subscriber to the event.
+ *
+ * ## Concurrency
+ *
+ * Operations on one session are serialised in-process (a per-session mutex) so two simultaneous
+ * redemptions cannot both pass, and every write re-reads the session's current state first. Across
+ * *replicas* the database offers no compare-and-swap on `Config`, so strict single-use and attempt
+ * counting are exact per instance and best-effort across them: the worst a cross-replica race can do is
+ * let two simultaneous redemptions of the same valid secret both succeed (they converge on the same
+ * verified identity) or let a burst of parallel guesses count as one attempt. The per-session attempt
+ * rate limiter and the code's 6-digit space bound the latter.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { LogError, LogStatus } from '@memberjunction/core';
+import { IsValidUUID } from '@memberjunction/global';
+import { AuthorizeSessionAccess } from './sessionAccess.js';
+import { SlidingWindowRateLimiter } from './SlidingWindowRateLimiter.js';
+import { EvaluateEmailDomainPolicy, ParseEmailAddress, ReadIdentityVerificationPolicyLayer, ResolveIdentityVerificationPolicy, } from './verificationPolicy.js';
+import { ComputeVerifiedDeadline, EvaluateRedemption, IssueVerification, NormalizeVerificationCode, ParseConfigObject, ParseVerificationToken, ReadIdentityVerificationState, SanitizeVerificationName, WriteIdentityVerificationState, } from './verificationCore.js';
+import { BuildVerificationEmail } from './verificationPages.js';
+/** Builds a failure result. */
+function failure(code, message, extra = {}) {
+    return { Success: false, VerificationState: 'unverified', ErrorCode: code, Message: message, ...extra };
+}
+/** Result for a session that is already verified (idempotent success). */
+function alreadyVerified(state) {
+    return {
+        Success: true,
+        VerificationState: 'verified',
+        VerifiedEmail: state.Verified?.Email,
+        VerifiedAt: state.Verified?.VerifiedAt,
+        Message: 'Your email is already verified.',
+    };
+}
+const SESSION_NOT_FOUND = 'Session not found.';
+const UNAVAILABLE = 'Email verification is not available.';
+/**
+ * The decisions and their order. See the module header for the contract.
+ */
+export class RealtimeSessionVerificationWorkflow {
+    constructor(ports) {
+        this.ports = ports;
+        this.locks = new Map();
+        const limits = ports.GetSettings().RateLimits;
+        this.ipLimiter = new SlidingWindowRateLimiter({ Limit: limits.PerIpSends, WindowMs: limits.SendWindowMs });
+        this.domainLimiter = new SlidingWindowRateLimiter({ Limit: limits.PerEmailDomainSends, WindowMs: limits.SendWindowMs });
+        this.emailLimiter = new SlidingWindowRateLimiter({ Limit: limits.PerEmailSends, WindowMs: limits.SendWindowMs });
+        this.codeLimiter = new SlidingWindowRateLimiter({ Limit: limits.PerSessionCodeAttempts, WindowMs: limits.CodeAttemptWindowMs });
+    }
+    /** Whether the feature is switched on. */
+    get IsEnabled() {
+        return this.ports.GetSettings().Enabled;
+    }
+    /**
+     * Asks to verify `Email` for the caller's session: validates, applies policy and limits, stores a
+     * pending verification (hashes only) and emails a one-time link plus a typed code.
+     *
+     * Nothing is consumed unless the email is actually sent: a delivery failure rolls the stored state back.
+     */
+    async RequestVerification(input, caller) {
+        const settings = this.ports.GetSettings();
+        if (!settings.Enabled || !settings.PublicBaseUrl) {
+            return failure('verification_unavailable', UNAVAILABLE);
+        }
+        const name = SanitizeVerificationName(input.Name);
+        if (!name) {
+            return failure('invalid_input', 'Please enter your name.');
+        }
+        const email = ParseEmailAddress(input.Email);
+        if (!email.Ok) {
+            return failure('invalid_email', 'Please enter a valid email address.');
+        }
+        return this.withSessionLock(input.AgentSessionID, async () => {
+            const access = await this.authorize(input.AgentSessionID, caller, false);
+            if (access.Ok === false) {
+                return access.Result;
+            }
+            const state = ReadIdentityVerificationState(access.Session.ConfigRaw, ReadIdentityVerificationPolicyLayer);
+            if (state.Verified) {
+                return alreadyVerified(state);
+            }
+            const policy = ResolveIdentityVerificationPolicy([settings.PolicyDefaults, state.Policy]);
+            const refusal = this.checkRequestRefusals(email, state, policy, caller);
+            return refusal ?? this.issueAndSend(access.Session, { Email: email.Email, Name: name }, policy, caller, settings);
+        });
+    }
+    /**
+     * Redeems the typed code for the caller's session. Wrong entries are counted against the pending
+     * verification and void it at `maxCodeAttempts`; submissions are also rate limited per session.
+     */
+    async SubmitCode(input, caller) {
+        const settings = this.ports.GetSettings();
+        if (!settings.Enabled) {
+            return failure('verification_unavailable', UNAVAILABLE);
+        }
+        if (!IsValidUUID(input.AgentSessionID)) {
+            return failure('session_not_found', SESSION_NOT_FOUND);
+        }
+        const gate = this.codeLimiter.TryConsume(input.AgentSessionID.toLowerCase(), this.ports.Now());
+        if (!gate.Allowed) {
+            return failure('rate_limited', 'Too many attempts. Please wait a moment and try again.', {
+                RetryAfterSeconds: Math.ceil(gate.RetryAfterMs / 1000),
+            });
+        }
+        const code = NormalizeVerificationCode(input.Code);
+        if (!code) {
+            // Cannot match any stored code, so it must not burn the person's attempts either.
+            return failure('invalid_code', 'That code is not valid. Check it and try again.');
+        }
+        return this.withSessionLock(input.AgentSessionID, async () => {
+            const access = await this.authorize(input.AgentSessionID, caller, false);
+            if (access.Ok === false) {
+                return access.Result;
+            }
+            return this.redeem(input.AgentSessionID, caller, { Kind: 'code', Code: code, AgentSessionID: input.AgentSessionID });
+        });
+    }
+    /**
+     * Redeems an emailed link token. The capability IS the token, so there is no principal; every
+     * failure — malformed, unknown, expired, used, voided — is the same result so the response cannot
+     * be used to learn anything about a session.
+     */
+    async RedeemLink(token, caller) {
+        if (!this.ports.GetSettings().Enabled) {
+            return failure('verification_unavailable', UNAVAILABLE);
+        }
+        const parsed = ParseVerificationToken(token);
+        if (!parsed) {
+            return failure('invalid_link', 'This link is no longer valid.');
+        }
+        return this.withSessionLock(parsed.AgentSessionID, () => this.redeem(parsed.AgentSessionID, caller, { Kind: 'token', Token: token }));
+    }
+    /**
+     * Reads the session's verification state. This is the **durable** counterpart of the
+     * `identity.verified` event: a subscriber that was disconnected when the event fired recovers by
+     * asking here.
+     */
+    async GetStatus(input, caller) {
+        const settings = this.ports.GetSettings();
+        if (!settings.Enabled) {
+            return failure('verification_unavailable', UNAVAILABLE);
+        }
+        const access = await this.authorize(input.AgentSessionID, caller, true);
+        if (access.Ok === false) {
+            return access.Result;
+        }
+        const state = ReadIdentityVerificationState(access.Session.ConfigRaw, ReadIdentityVerificationPolicyLayer);
+        if (state.Verified) {
+            return alreadyVerified(state);
+        }
+        const policy = ResolveIdentityVerificationPolicy([settings.PolicyDefaults, state.Policy]);
+        const pendingLive = state.Pending && Date.parse(state.Pending.ExpiresAt) > this.ports.Now() ? state.Pending : undefined;
+        return {
+            Success: true,
+            VerificationState: pendingLive ? 'pending' : 'unverified',
+            ExpiresAt: pendingLive?.ExpiresAt,
+            SendsRemaining: Math.max(0, policy.maxSendsPerSession - state.SendCount),
+            AttemptsRemaining: pendingLive ? Math.max(0, policy.maxCodeAttempts - pendingLive.CodeAttempts) : undefined,
+        };
+    }
+    // ───────────── request internals ─────────────
+    /** The policy and limit refusals of a request, in order; null when the request may proceed. */
+    checkRequestRefusals(email, state, policy, caller) {
+        const domain = EvaluateEmailDomainPolicy(email.Domain, policy);
+        if (domain.Allowed === false) {
+            return domain.Reason === 'domain_blocked'
+                ? failure('domain_blocked', 'Email addresses from that domain cannot be used here.')
+                : failure('consumer_domain', 'Please use your work email address.');
+        }
+        if (state.SendCount >= policy.maxSendsPerSession) {
+            return failure('send_limit_reached', 'The maximum number of verification emails for this conversation has been reached.', {
+                SendsRemaining: 0,
+            });
+        }
+        return this.checkSendRateLimits(email, caller.ClientIp);
+    }
+    /** Applies the per-IP, per-domain and per-address send limits; null when all admit the send. */
+    checkSendRateLimits(email, clientIp) {
+        const now = this.ports.Now();
+        const decisions = [
+            clientIp ? this.ipLimiter.TryConsume(clientIp, now) : { Allowed: true, RetryAfterMs: 0 },
+            this.domainLimiter.TryConsume(email.Domain, now),
+            this.emailLimiter.TryConsume(email.Email, now),
+        ];
+        const refused = decisions.find((decision) => !decision.Allowed);
+        if (!refused) {
+            return null;
+        }
+        return failure('rate_limited', 'Too many verification requests. Please try again later.', {
+            RetryAfterSeconds: Math.ceil(refused.RetryAfterMs / 1000),
+        });
+    }
+    /** Stores the pending verification, emails it, and rolls the store back if the email cannot be sent. */
+    async issueAndSend(session, recipient, policy, caller, settings) {
+        const issued = IssueVerification({
+            AgentSessionID: session.AgentSessionID,
+            Email: recipient.Email,
+            Name: recipient.Name,
+            TtlMinutes: policy.linkTtlMinutes,
+            NowMs: this.ports.Now(),
+            CodeHashKey: settings.CodeHashKey,
+        });
+        const stored = await this.ports.MutateSessionConfig(session.AgentSessionID, caller, (current) => {
+            const state = ReadIdentityVerificationState(current.ConfigRaw, ReadIdentityVerificationPolicyLayer);
+            if (state.Verified) {
+                return { NextConfigRaw: null, Outcome: { Kind: 'already_verified' } };
+            }
+            if (state.SendCount >= policy.maxSendsPerSession) {
+                return { NextConfigRaw: null, Outcome: { Kind: 'send_limit' } };
+            }
+            const next = { ...state, SendCount: state.SendCount + 1, Pending: issued.Pending };
+            return { NextConfigRaw: WriteIdentityVerificationState(current.ConfigRaw, next), Outcome: { Kind: 'stored', SendCount: next.SendCount } };
+        });
+        const early = this.requestStoreRefusal(stored);
+        if (early || stored.Outcome?.Kind !== 'stored') {
+            return early ?? failure('persist_failed', 'We could not start verification. Please try again.');
+        }
+        const email = BuildVerificationEmail({
+            Name: recipient.Name,
+            Code: issued.Code,
+            LinkUrl: `${settings.PublicBaseUrl}/realtime/verify/${issued.Token}`,
+            TtlMinutes: policy.linkTtlMinutes,
+        });
+        const sent = await this.ports.SendEmail({ To: recipient.Email, Subject: email.Subject, Text: email.Text, Html: email.Html });
+        if (!sent.Success) {
+            LogError(`RealtimeSessionVerification: email to the verifier of session ${session.AgentSessionID} failed: ${sent.ErrorMessage ?? 'unknown error'}`);
+            await this.rollbackPending(session.AgentSessionID, caller, issued.Pending.TokenHash);
+            return failure('email_send_failed', 'We could not send the email. Please check the address and try again.');
+        }
+        return {
+            Success: true,
+            VerificationState: 'pending',
+            ExpiresAt: issued.Pending.ExpiresAt,
+            SendsRemaining: Math.max(0, policy.maxSendsPerSession - stored.Outcome.SendCount),
+            Message: 'We emailed you a link and a code.',
+        };
+    }
+    /** Maps a failed/short-circuited store into a result; null when the pending verification was stored. */
+    requestStoreRefusal(stored) {
+        if (stored.Outcome?.Kind === 'already_verified') {
+            return { Success: true, VerificationState: 'verified', Message: 'Your email is already verified.' };
+        }
+        if (stored.Outcome?.Kind === 'send_limit') {
+            return failure('send_limit_reached', 'The maximum number of verification emails for this conversation has been reached.', {
+                SendsRemaining: 0,
+            });
+        }
+        if (!stored.Persisted) {
+            return failure('persist_failed', 'We could not start verification. Please try again.');
+        }
+        return null;
+    }
+    /** Removes the pending verification (and the send it counted) if it is still the one we stored. */
+    async rollbackPending(agentSessionId, caller, tokenHash) {
+        const result = await this.ports.MutateSessionConfig(agentSessionId, caller, (current) => {
+            const state = ReadIdentityVerificationState(current.ConfigRaw, ReadIdentityVerificationPolicyLayer);
+            if (state.Pending?.TokenHash !== tokenHash) {
+                return { NextConfigRaw: null, Outcome: undefined };
+            }
+            const { Pending: _dropped, ...rest } = state;
+            return { NextConfigRaw: WriteIdentityVerificationState(current.ConfigRaw, { ...rest, SendCount: Math.max(0, state.SendCount - 1) }), Outcome: undefined };
+        });
+        if (!result.Persisted && result.ErrorMessage) {
+            LogError(`RealtimeSessionVerification: could not roll back the pending verification of session ${agentSessionId}: ${result.ErrorMessage}`);
+        }
+    }
+    // ───────────── redemption internals ─────────────
+    /**
+     * Shared by the code and link paths: re-read the session, decide the redemption on its CURRENT
+     * state, persist the resulting state (and the extended deadline on success), and on success
+     * publish the event and write the audit entry.
+     */
+    async redeem(agentSessionId, caller, credential) {
+        const settings = this.ports.GetSettings();
+        const nowMs = this.ports.Now();
+        const result = await this.ports.MutateSessionConfig(agentSessionId, caller, (current) => {
+            const state = ReadIdentityVerificationState(current.ConfigRaw, ReadIdentityVerificationPolicyLayer);
+            const policy = ResolveIdentityVerificationPolicy([settings.PolicyDefaults, state.Policy]);
+            const decision = EvaluateRedemption(state, credential, nowMs, policy, settings.CodeHashKey);
+            const deadlineIso = decision.Outcome === 'verified' && current.Status !== 'Closed'
+                ? ComputeVerifiedDeadline({
+                    CurrentDeadlineIso: readDeadline(current.ConfigRaw),
+                    SessionStartedAtMs: current.StartedAtMs,
+                    VerifiedMaxSeconds: policy.verifiedMaxSeconds,
+                })
+                : undefined;
+            const changed = decision.Next !== state;
+            return {
+                NextConfigRaw: changed ? WriteIdentityVerificationState(current.ConfigRaw, decision.Next, deadlineIso) : null,
+                Outcome: { Decision: decision, DeadlineIso: deadlineIso },
+            };
+        });
+        if (!result.Session || !result.Outcome) {
+            // The session could not be read (or does not exist). For the link that is "invalid"; for the code
+            // path the caller was already authorized, so it is a server fault.
+            return caller.Kind === 'link'
+                ? failure('invalid_link', 'This link is no longer valid.')
+                : failure('persist_failed', 'We could not check that code. Please try again.');
+        }
+        const { Decision, DeadlineIso } = result.Outcome;
+        if (Decision.Outcome === 'verified') {
+            return this.completeVerification(result.Session, result.Persisted, result.ErrorMessage, Decision.Verified, DeadlineIso, caller);
+        }
+        return this.refusalResult(Decision, caller);
+    }
+    /** Success path: surface persistence failure, otherwise publish + audit and build the result. */
+    async completeVerification(session, persisted, persistError, verified, deadlineIso, caller) {
+        if (!persisted) {
+            LogError(`RealtimeSessionVerification: verified session ${session.AgentSessionID} but could not persist it: ${persistError ?? 'unknown error'}`);
+            return failure('persist_failed', 'We could not record your verification. Please try again.');
+        }
+        if (session.Status !== 'Closed') {
+            this.ports.PublishVerified({ AgentSessionID: session.AgentSessionID, OwnerUserID: session.OwnerUserID, ScopeKey: session.ConversationExternalID }, {
+                VerifiedEmail: verified.Email,
+                VerifiedName: verified.Name,
+                VerifiedAt: verified.VerifiedAt,
+                Method: verified.Method,
+                MaxSessionDeadlineIso: deadlineIso,
+            });
+        }
+        await this.ports.WriteAudit({
+            AgentSessionID: session.AgentSessionID,
+            OwnerUserID: session.OwnerUserID,
+            Email: verified.Email,
+            Method: verified.Method,
+            ClientIp: caller.ClientIp,
+            MaxSessionDeadlineIso: deadlineIso,
+        });
+        LogStatus(`RealtimeSessionVerification: session ${session.AgentSessionID} verified by ${verified.Method}${deadlineIso ? `; deadline extended to ${deadlineIso}` : ''}.`);
+        return {
+            Success: true,
+            VerificationState: 'verified',
+            VerifiedEmail: verified.Email,
+            VerifiedAt: verified.VerifiedAt,
+            MaxSessionDeadlineIso: deadlineIso,
+            Message: "You're verified.",
+        };
+    }
+    /** Maps a rejected redemption to a result (uniform for the link path). */
+    refusalResult(decision, caller) {
+        if (caller.Kind === 'link') {
+            return failure('invalid_link', 'This link is no longer valid.');
+        }
+        switch (decision.Reason) {
+            case 'already_verified':
+                return alreadyVerified(decision.Next);
+            case 'no_pending':
+                return failure('no_pending_verification', 'There is no verification waiting. Request a new email.');
+            case 'expired':
+                return failure('code_expired', 'That code has expired. Request a new email.');
+            case 'attempts_exhausted':
+                return failure('attempts_exhausted', 'Too many incorrect codes. Request a new email.', { AttemptsRemaining: 0 });
+            case 'invalid':
+            default:
+                return failure('invalid_code', 'That code is not correct.', { VerificationState: 'pending', AttemptsRemaining: decision.AttemptsRemaining });
+        }
+    }
+    // ───────────── shared internals ─────────────
+    /**
+     * Loads the session as the caller and applies {@link AuthorizeSessionAccess}. Not-found and
+     * not-yours are the same result so a caller cannot enumerate other people's session ids; the real
+     * reason is logged server-side.
+     */
+    async authorize(agentSessionId, caller, allowClosed) {
+        const notFound = { Ok: false, Result: failure('session_not_found', SESSION_NOT_FOUND) };
+        if (!IsValidUUID(agentSessionId)) {
+            return notFound;
+        }
+        const session = await this.ports.LoadSession(agentSessionId, caller);
+        if (!session) {
+            return notFound;
+        }
+        const decision = AuthorizeSessionAccess({ SessionUserID: session.OwnerUserID, ConversationExternalID: session.ConversationExternalID }, caller.ContextUser);
+        if (decision.Allowed === false) {
+            LogError(`RealtimeSessionVerification: refused user ${caller.ContextUser.ID} on session ${agentSessionId} (${decision.Reason}).`);
+            return notFound;
+        }
+        if (!allowClosed && session.Status === 'Closed') {
+            return { Ok: false, Result: failure('session_closed', 'This conversation has ended.') };
+        }
+        return { Ok: true, Session: session };
+    }
+    /** Serialises operations on one session within this process (see the module header). */
+    async withSessionLock(agentSessionId, work) {
+        const key = agentSessionId.toLowerCase();
+        const previous = this.locks.get(key) ?? Promise.resolve();
+        let release = () => undefined;
+        const gate = new Promise((resolve) => {
+            release = resolve;
+        });
+        const tail = previous.then(() => gate);
+        this.locks.set(key, tail);
+        try {
+            await previous;
+            return await work();
+        }
+        finally {
+            release();
+            if (this.locks.get(key) === tail) {
+                this.locks.delete(key);
+            }
+        }
+    }
+}
+/** The stored `maxSessionDeadlineIso`, when it is a string. */
+function readDeadline(configRaw) {
+    const value = ParseConfigObject(configRaw)['maxSessionDeadlineIso'];
+    return typeof value === 'string' ? value : undefined;
+}
+//# sourceMappingURL=verificationWorkflow.js.map

package/dist/realtimeSessions/verificationWorkflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationWorkflow.js","sourceRoot":"","sources":["../../src/realtimeSessions/verificationWorkflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAyC,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EACH,yBAAyB,EACzB,iBAAiB,EACjB,mCAAmC,EACnC,iCAAiC,GAGpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACH,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,GAGjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAoKhE,+BAA+B;AAC/B,SAAS,OAAO,CACZ,IAA2B,EAC3B,OAAe,EACf,QAA8C,EAAE;IAEhD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AAC5G,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,KAAgC;IACrD,OAAO;QACH,OAAO,EAAE,IAAI;QACb,iBAAiB,EAAE,UAAU;QAC7B,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK;QACpC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU;QACtC,OAAO,EAAE,iCAAiC;KAC7C,CAAC;AACN,CAAC;AAED,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAa3D;;GAEG;AACH,MAAM,OAAO,mCAAmC;IAO5C,YAA6B,KAAwB;QAAxB,UAAK,GAAL,KAAK,CAAmB;QAFpC,UAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;QAGtD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,aAAa,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,YAAY,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,WAAW,GAAG,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,sBAAsB,EAAE,QAAQ,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpI,CAAC;IAED,0CAA0C;IAC1C,IAAW,SAAS;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,mBAAmB,CAC5B,KAA8D,EAC9D,MAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC,0BAA0B,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;YACD,MAAM,KAAK,GAAG,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;YAC3G,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,MAAM,GAAG,iCAAiC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACxE,OAAO,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtH,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,UAAU,CACnB,KAA+C,EAC/C,MAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,0BAA0B,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,cAAc,EAAE,wDAAwD,EAAE;gBACrF,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;aACzD,CAAC,CAAC;QACP,CAAC;QACD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,kFAAkF;YAClF,OAAO,OAAO,CAAC,cAAc,EAAE,iDAAiD,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACtB,OAAO,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,MAAqD;QACxF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,0BAA0B,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,OAAO,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAC9E,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,SAAS,CAAC,KAAiC,EAAE,MAAuB;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,0BAA0B,EAAE,WAAW,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAC3G,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,iCAAiC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxH,OAAO;YACH,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;YACzD,SAAS,EAAE,WAAW,EAAE,SAAS;YACjC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC,SAAS,CAAC;YACxE,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9G,CAAC;IACN,CAAC;IAED,gDAAgD;IAEhD,+FAA+F;IACvF,oBAAoB,CACxB,KAAwC,EACxC,KAAgC,EAChC,MAA0C,EAC1C,MAAuB;QAEvB,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,MAAM,KAAK,gBAAgB;gBACrC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,uDAAuD,CAAC;gBACpF,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC,oBAAoB,EAAE,mFAAmF,EAAE;gBACtH,cAAc,EAAE,CAAC;aACpB,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,gGAAgG;IACxF,mBAAmB,CAAC,KAAwC,EAAE,QAA4B;QAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG;YACd,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;YACxF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;SACjD,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,OAAO,CAAC,cAAc,EAAE,yDAAyD,EAAE;YACtF,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;SAC5D,CAAC,CAAC;IACP,CAAC;IAED,wGAAwG;IAChG,KAAK,CAAC,YAAY,CACtB,OAAwB,EACxB,SAA0C,EAC1C,MAA0C,EAC1C,MAAuB,EACvB,QAA8B;QAE9B,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC7B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,UAAU,EAAE,MAAM,CAAC,cAAc;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAe,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1G,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC;YAC1E,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC/C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,GAA8B,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9G,OAAO,EAAE,aAAa,EAAE,8BAA8B,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAC9I,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,KAAK,GAAG,sBAAsB,CAAC;YACjC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,GAAG,QAAQ,CAAC,aAAa,oBAAoB,MAAM,CAAC,KAAK,EAAE;YACpE,UAAU,EAAE,MAAM,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7H,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,QAAQ,CAAC,iEAAiE,OAAO,CAAC,cAAc,YAAY,IAAI,CAAC,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC;YACpJ,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrF,OAAO,OAAO,CAAC,mBAAmB,EAAE,sEAAsE,CAAC,CAAC;QAChH,CAAC;QACD,OAAO;YACH,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YACjF,OAAO,EAAE,mCAAmC;SAC/C,CAAC;IACN,CAAC;IAED,wGAAwG;IAChG,mBAAmB,CAAC,MAA0C;QAClE,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACxG,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,oBAAoB,EAAE,mFAAmF,EAAE;gBACtH,cAAc,EAAE,CAAC;aACpB,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,eAAe,CAAC,cAAsB,EAAE,MAAuB,EAAE,SAAiB;QAC5F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAO,cAAc,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAC1F,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;YACpG,IAAI,KAAK,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACzC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACvD,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAC7C,OAAO,EAAE,aAAa,EAAE,8BAA8B,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC9J,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3C,QAAQ,CAAC,wFAAwF,cAAc,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/I,CAAC;IACL,CAAC;IAED,mDAAmD;IAEnD;;;;OAIG;IACK,KAAK,CAAC,MAAM,CAChB,cAAsB,EACtB,MAA0B,EAC1B,UAAoD;QAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAA4B,cAAc,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAC/G,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;YACpG,MAAM,MAAM,GAAG,iCAAiC,CAAC,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1F,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5F,MAAM,WAAW,GACb,QAAQ,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAC1D,CAAC,CAAC,uBAAuB,CAAC;oBACpB,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;oBACnD,kBAAkB,EAAE,OAAO,CAAC,WAAW;oBACvC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;iBAChD,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YACpB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC;YACxC,OAAO;gBACH,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC7G,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE;aAC5D,CAAC;QACN,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrC,kGAAkG;YAClG,mEAAmE;YACnE,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,+BAA+B,CAAC;gBAC1D,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;QACjD,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACpI,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,oBAAoB,CAC9B,OAAwB,EACxB,SAAkB,EAClB,YAAgC,EAChC,QAA0B,EAC1B,WAA+B,EAC/B,MAA0B;QAE1B,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,QAAQ,CAAC,iDAAiD,OAAO,CAAC,cAAc,8BAA8B,YAAY,IAAI,eAAe,EAAE,CAAC,CAAC;YACjJ,OAAO,OAAO,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,eAAe,CACtB,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,sBAAsB,EAAE,EACtH;gBACI,aAAa,EAAE,QAAQ,CAAC,KAAK;gBAC7B,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,qBAAqB,EAAE,WAAW;aACrC,CACJ,CAAC;QACN,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACxB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,qBAAqB,EAAE,WAAW;SACrC,CAAC,CAAC;QACH,SAAS,CAAC,wCAAwC,OAAO,CAAC,cAAc,gBAAgB,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzK,OAAO;YACH,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,UAAU;YAC7B,aAAa,EAAE,QAAQ,CAAC,KAAK;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,qBAAqB,EAAE,WAAW;YAClC,OAAO,EAAE,kBAAkB;SAC9B,CAAC;IACN,CAAC;IAED,0EAA0E;IAClE,aAAa,CACjB,QAAiF,EACjF,MAA0B;QAE1B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,cAAc,EAAE,+BAA+B,CAAC,CAAC;QACpE,CAAC;QACD,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,kBAAkB;gBACnB,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,KAAK,YAAY;gBACb,OAAO,OAAO,CAAC,yBAAyB,EAAE,wDAAwD,CAAC,CAAC;YACxG,KAAK,SAAS;gBACV,OAAO,OAAO,CAAC,cAAc,EAAE,6CAA6C,CAAC,CAAC;YAClF,KAAK,oBAAoB;gBACrB,OAAO,OAAO,CAAC,oBAAoB,EAAE,gDAAgD,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;YACrH,KAAK,SAAS,CAAC;YACf;gBACI,OAAO,OAAO,CAAC,cAAc,EAAE,2BAA2B,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACrJ,CAAC;IACL,CAAC;IAED,+CAA+C;IAE/C;;;;OAIG;IACK,KAAK,CAAC,SAAS,CACnB,cAAsB,EACtB,MAAuB,EACvB,WAAoB;QAEpB,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACjG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CACnC,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAC9F,MAAM,CAAC,WAAW,CACrB,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,QAAQ,CAAC,6CAA6C,MAAM,CAAC,WAAW,CAAC,EAAE,eAAe,cAAc,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YAClI,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IAED,wFAAwF;IAChF,KAAK,CAAC,eAAe,CAAI,cAAsB,EAAE,IAAsB;QAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,IAAI,OAAO,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACvC,OAAO,GAAG,OAAO,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC;YACf,OAAO,MAAM,IAAI,EAAE,CAAC;QACxB,CAAC;gBAAS,CAAC;YACP,OAAO,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAED,+DAA+D;AAC/D,SAAS,YAAY,CAAC,SAAwB;IAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACpE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC"}

package/dist/realtimeWidget/widgetGuestElevation.d.ts

@@ -52,8 +52,10 @@ export declare function resolveWidgetGuestRunContext(userPayload: UserPayload, p
  * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
  * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
  * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
- * required: on the realtime path the agent authority is already server-side (the session config's
- * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ * required: the realtime target is the session config's `targetAgentID`, which the owner can edit, so
+ * the relay re-checks `CanRun` on it for the CALLER before this elevation. Direct actions are refused
+ * for these callers before elevation, so only the delegated agent run and the run-entity writes
+ * execute as the system user.
  *
  * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
  * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter
@@ -66,6 +68,22 @@ export declare function resolveWidgetGuestRunContext(userPayload: UserPayload, p
  * work RUNS AS after ownership is proven.
  */
 export declare function ResolveScopedAnonymousRunUser(contextUser: UserInfo): UserInfo;
+/**
+ * The principal a client-direct call's consolidated RECORDING STORE runs as, once the caller has
+ * already passed the session-ownership and consent gates (#5195).
+ *
+ * The store writes `MJ: Files`, the file↔session link and the session's recording stamp — server
+ * plumbing attributed through the session link, never through the caller. A signed-in user whose only
+ * role is the stock UI role cannot create `MJ: Files`, so running the store as the caller lost every
+ * such user's recording (the object landed in storage, the row never did). It therefore runs as the
+ * system user for signed-in owners, and anonymous sessions keep exactly the
+ * {@link ResolveScopedAnonymousRunUser} behaviour (PUBLIC WEB-WIDGET guests stay on the caller for the
+ * same RLS reason documented there).
+ *
+ * Fails CLOSED: with no system user available the caller is returned, i.e. today's behaviour.
+ * Ownership/consent gates must NEVER use this.
+ */
+export declare function ResolveRecordingStoreUser(contextUser: UserInfo): UserInfo;
 /**
  * Builds an elevated {@link UserPayload} that runs subsequent agent work as `elevatedUser` while
  * preserving the guest's `sessionId` — so progress/streaming PubSub still routes to the guest's

package/dist/realtimeWidget/widgetGuestElevation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED,4DAA4D;AAC5D,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAEvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAEhG"}
+{"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED,4DAA4D;AAC5D,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAEvC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAazE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAEhG"}

package/dist/realtimeWidget/widgetGuestElevation.js

@@ -60,8 +60,10 @@ export async function resolveWidgetGuestRunContext(userPayload, provider) {
  * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
  * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
  * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
- * required: on the realtime path the agent authority is already server-side (the session config's
- * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ * required: the realtime target is the session config's `targetAgentID`, which the owner can edit, so
+ * the relay re-checks `CanRun` on it for the CALLER before this elevation. Direct actions are refused
+ * for these callers before elevation, so only the delegated agent run and the run-entity writes
+ * execute as the system user.
  *
  * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
  * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter
@@ -88,6 +90,33 @@ export function ResolveScopedAnonymousRunUser(contextUser) {
     // per-call log line would flood a live session's log. The dispatch path logs the elevation once.
     return systemUser;
 }
+/**
+ * The principal a client-direct call's consolidated RECORDING STORE runs as, once the caller has
+ * already passed the session-ownership and consent gates (#5195).
+ *
+ * The store writes `MJ: Files`, the file↔session link and the session's recording stamp — server
+ * plumbing attributed through the session link, never through the caller. A signed-in user whose only
+ * role is the stock UI role cannot create `MJ: Files`, so running the store as the caller lost every
+ * such user's recording (the object landed in storage, the row never did). It therefore runs as the
+ * system user for signed-in owners, and anonymous sessions keep exactly the
+ * {@link ResolveScopedAnonymousRunUser} behaviour (PUBLIC WEB-WIDGET guests stay on the caller for the
+ * same RLS reason documented there).
+ *
+ * Fails CLOSED: with no system user available the caller is returned, i.e. today's behaviour.
+ * Ownership/consent gates must NEVER use this.
+ */
+export function ResolveRecordingStoreUser(contextUser) {
+    if (contextUser?.IsMagicLinkAnonymous || contextUser?.WidgetGuestContext?.WidgetID) {
+        return ResolveScopedAnonymousRunUser(contextUser);
+    }
+    const systemUser = UserCache.Instance.GetSystemUser();
+    if (!systemUser) {
+        LogError(`[Realtime] Cannot elevate the recording store for user ${contextUser?.ID}: no system user available; ` +
+            'storing as the caller.');
+        return contextUser;
+    }
+    return systemUser;
+}
 /**
  * Builds an elevated {@link UserPayload} that runs subsequent agent work as `elevatedUser` while
  * preserving the guest's `sessionId` — so progress/streaming PubSub still routes to the guest's

package/dist/realtimeWidget/widgetGuestElevation.js.map

@@ -1 +1 @@
-{"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,OAAO,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}
+{"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,OAAO,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAqB;IAC7D,IAAI,WAAW,EAAE,oBAAoB,IAAI,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACnF,OAAO,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,0DAA0D,WAAW,EAAE,EAAE,8BAA8B;YACrG,wBAAwB,CAC3B,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}

package/dist/resolvers/ActionResolver.d.ts

@@ -34,8 +34,8 @@ export declare class RunActionInput {
      */
     Params?: ActionParamInput[];
     /**
-     * Whether to skip logging the action execution
-     * Defaults to false
+     * Ignored. A run started through this API always writes an action execution log row; the field
+     * remains so that clients which send it still validate.
      */
     SkipActionLog?: boolean;
 }
@@ -121,12 +121,39 @@ export declare class ActionResultOutput {
  */
 export declare class ActionResolver extends ResolverBase {
     /**
-     * Mutation for running an action
+     * Mutation for running an action.
+     *
+     * Scope-limited sessions are refused. Any other caller must be authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}: an Owner may run any action; anyone else needs a role that
+     * holds an authorization linked to the action through `MJ: Action Authorizations`, or, when the
+     * action has no such link, an action class that authorizes its caller itself. The run is always
+     * logged.
      * @param input The input parameters for running the action
      * @param ctx The GraphQL context containing user authentication information
      * @returns The result of running the action
      */
     RunAction(input: RunActionInput, ctx: AppContext): Promise<ActionResultOutput>;
+    /**
+     * The authenticated caller of RunAction. A scope-limited session is refused: its confinement exists
+     * only as row-level-security filters, and an action can reach data and services those filters never
+     * cover.
+     * @throws Error when there is no user or the session is scope-limited
+     */
+    private getRunActionPrincipal;
+    /**
+     * Refuses the run unless the caller is authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}. The `MJ: Action Authorizations` rows, the authorization
+     * tree and the role grants all come from the request's provider, or all from the global provider
+     * when the request carries none.
+     * @throws Error when the caller may not run the action
+     */
+    private assertCanRunAction;
+    /**
+     * The AuthorizationID of each `MJ: Action Authorizations` row for the action. Read as the system
+     * user: this is the server's own authorization decision, so it must not depend on whether the
+     * caller can read that entity.
+     */
+    private loadActionAuthorizationIDs;
     /**
      * Finds an action by its ID
      * @param actionID The ID of the action to find
@@ -143,11 +170,10 @@ export declare class ActionResolver extends ResolverBase {
      */
     private parseActionParameters;
     /**
-     * Executes an action
+     * Executes an action. The run is always logged: a client cannot switch off the action execution log.
      * @param action The action to execute
      * @param user The user context
      * @param params The action parameters
-     * @param skipActionLog Whether to skip action logging
      * @returns The action result
      * @private
      */