@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.4

package/dist/realtimeSessions/verificationPages.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @fileoverview Pure builders for the two pieces of content identity verification puts in front of a
+ * person: the verification EMAIL and the self-contained HTML PAGES the verify link lands on. No DB, no
+ * network, no MJ runtime — deterministic strings in, strings out.
+ *
+ * ## What the pages never contain
+ *
+ * Nothing about the session: no agent name, no conversation, no email address, no name, no hint that a
+ * session with this id exists. The page for an unknown token, an expired token and a used token is the
+ * **same page**, so the link cannot be used to probe which sessions exist or what state they are in.
+ *
+ * ## Why GET does not redeem
+ *
+ * Mail security scanners, link previewers and browser prefetchers issue GET requests for every URL in a
+ * message. A GET that consumed the single-use token would let a scanner burn it before the human clicks
+ * — the person would then see "already used". So the link opens a page with one button ({@link
+ * BuildVerifyConfirmHtml}) and only the human's POST redeems. The magic-link redeem endpoint made the
+ * same choice for the same reason.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+/** Inputs to {@link BuildVerificationEmail}. */
+export interface VerificationEmailInput {
+    /** The person's sanitised name. */
+    Name: string;
+    /** The typed code (fallback for opening the email on another device). */
+    Code: string;
+    /** The full link that opens the confirmation page. */
+    LinkUrl: string;
+    /** Minutes the link and code stay valid. */
+    TtlMinutes: number;
+}
+/** A ready-to-send email. */
+export interface VerificationEmail {
+    Subject: string;
+    Text: string;
+    Html: string;
+}
+/**
+ * Builds the verification email.
+ *
+ * The subject never carries the name or the code (subjects surface on lock screens and in notification
+ * previews). The name is HTML-escaped in the HTML body and reduced to a single line in the text body.
+ */
+export declare function BuildVerificationEmail(input: VerificationEmailInput): VerificationEmail;
+/**
+ * The page a verify link opens. Side-effect free: it renders a single confirmation button whose POST
+ * performs the redemption (see the module header for why GET must not).
+ *
+ * @param token - the raw token, embedded in a hidden form field (never in the POST URL)
+ * @param actionPath - the same-origin path the form POSTs to
+ */
+export declare function BuildVerifyConfirmHtml(token: string, actionPath: string): string;
+/** The page shown after a successful redemption. Says nothing about the session. */
+export declare function BuildVerifySuccessHtml(): string;
+/**
+ * The page shown for EVERY failed redemption — unknown, malformed, expired, used, or voided token alike —
+ * so the response cannot be used to learn anything about a session.
+ */
+export declare function BuildVerifyFailureHtml(): string;
+/**
+ * The page shown when the server hit a fault while recording a verification (the link was valid but
+ * nothing was saved, so trying the link again is correct). Only a holder of a valid token can reach it.
+ */
+export declare function BuildVerifyErrorHtml(): string;
+//# sourceMappingURL=verificationPages.d.ts.map

package/dist/realtimeSessions/verificationPages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationPages.d.ts","sourceRoot":"","sources":["../../src/realtimeSessions/verificationPages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACnC,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAmBvF;AA8BD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAUhF;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,IAAI,MAAM,CAM/C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAM/C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C"}

package/dist/realtimeSessions/verificationPages.js

@@ -0,0 +1,110 @@
+/**
+ * @fileoverview Pure builders for the two pieces of content identity verification puts in front of a
+ * person: the verification EMAIL and the self-contained HTML PAGES the verify link lands on. No DB, no
+ * network, no MJ runtime — deterministic strings in, strings out.
+ *
+ * ## What the pages never contain
+ *
+ * Nothing about the session: no agent name, no conversation, no email address, no name, no hint that a
+ * session with this id exists. The page for an unknown token, an expired token and a used token is the
+ * **same page**, so the link cannot be used to probe which sessions exist or what state they are in.
+ *
+ * ## Why GET does not redeem
+ *
+ * Mail security scanners, link previewers and browser prefetchers issue GET requests for every URL in a
+ * message. A GET that consumed the single-use token would let a scanner burn it before the human clicks
+ * — the person would then see "already used". So the link opens a page with one button ({@link
+ * BuildVerifyConfirmHtml}) and only the human's POST redeems. The magic-link redeem endpoint made the
+ * same choice for the same reason.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { EscapeHtml } from '../auth/magicLink/redeemLanding.js';
+/**
+ * Builds the verification email.
+ *
+ * The subject never carries the name or the code (subjects surface on lock screens and in notification
+ * previews). The name is HTML-escaped in the HTML body and reduced to a single line in the text body.
+ */
+export function BuildVerificationEmail(input) {
+    const name = input.Name.replace(/\s+/g, ' ').trim();
+    const greeting = name ? `Hi ${name},` : 'Hi,';
+    const ttl = `${input.TtlMinutes} minute${input.TtlMinutes === 1 ? '' : 's'}`;
+    const text = `${greeting}\n\n` +
+        `Confirm your email address to continue your conversation. Open this link:\n\n${input.LinkUrl}\n\n` +
+        `Or, if you opened this email on a different device, type this code into your conversation:\n\n${input.Code}\n\n` +
+        `The link and the code work once and expire in ${ttl}.\n\n` +
+        `If you did not ask for this, you can ignore this email — nothing happens unless the link is opened or the code is entered.`;
+    const html = `<p>${EscapeHtml(greeting)}</p>` +
+        `<p>Confirm your email address to continue your conversation.</p>` +
+        `<p><a href="${EscapeHtml(input.LinkUrl)}">Confirm my email address</a></p>` +
+        `<p>Or, if you opened this email on a different device, type this code into your conversation:</p>` +
+        `<p style="font-size:1.5em;letter-spacing:.15em"><strong>${EscapeHtml(input.Code)}</strong></p>` +
+        `<p>The link and the code work once and expire in ${EscapeHtml(ttl)}.</p>` +
+        `<p>If you did not ask for this, you can ignore this email — nothing happens unless the link is opened or the code is entered.</p>`;
+    return { Subject: 'Confirm your email address', Text: text, Html: html };
+}
+/** Shared document shell for the verify pages. Hardcoded colours are intentional: standalone server-rendered HTML, not Angular CSS. */
+function page(title, bodyInner) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<meta name="referrer" content="no-referrer">
+<title>${EscapeHtml(title)}</title>
+<style>
+  body { font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; background:#f5f5f5; margin:0; display:flex; min-height:100vh; align-items:center; justify-content:center; }
+  .card { background:#fff; padding:2.5rem; border-radius:12px; box-shadow:0 1px 4px rgba(0,0,0,.12); max-width:24rem; text-align:center; margin:1rem; }
+  h1 { font-size:1.25rem; margin:0 0 .5rem; color:#1f2937; }
+  p { color:#4b5563; margin:0 0 1.5rem; font-size:.95rem; }
+  p:last-child { margin-bottom:0; }
+  button { background:#264FAF; color:#fff; border:0; border-radius:8px; padding:.75rem 1.5rem; font-size:1rem; cursor:pointer; width:100%; }
+  button:hover { background:#1e3f8c; }
+</style>
+</head>
+<body>
+  <div class="card">
+${bodyInner}
+  </div>
+</body>
+</html>`;
+}
+/**
+ * The page a verify link opens. Side-effect free: it renders a single confirmation button whose POST
+ * performs the redemption (see the module header for why GET must not).
+ *
+ * @param token - the raw token, embedded in a hidden form field (never in the POST URL)
+ * @param actionPath - the same-origin path the form POSTs to
+ */
+export function BuildVerifyConfirmHtml(token, actionPath) {
+    return page('Confirm your email', `    <h1>Confirm your email address</h1>
+    <p>Press the button to confirm. Then return to your conversation.</p>
+    <form method="POST" action="${EscapeHtml(actionPath)}">
+      <input type="hidden" name="token" value="${EscapeHtml(token)}">
+      <button type="submit">Confirm my email address</button>
+    </form>`);
+}
+/** The page shown after a successful redemption. Says nothing about the session. */
+export function BuildVerifySuccessHtml() {
+    return page("You're verified", `    <h1>You're verified</h1>
+    <p>Return to your conversation — it will carry on from where you left off. You can close this tab.</p>`);
+}
+/**
+ * The page shown for EVERY failed redemption — unknown, malformed, expired, used, or voided token alike —
+ * so the response cannot be used to learn anything about a session.
+ */
+export function BuildVerifyFailureHtml() {
+    return page('Link not valid', `    <h1>This link is no longer valid</h1>
+    <p>It may have expired or already been used. Return to your conversation to request a new one.</p>`);
+}
+/**
+ * The page shown when the server hit a fault while recording a verification (the link was valid but
+ * nothing was saved, so trying the link again is correct). Only a holder of a valid token can reach it.
+ */
+export function BuildVerifyErrorHtml() {
+    return page('Something went wrong', `    <h1>We could not complete this just now</h1>
+    <p>Please open the link from your email again in a moment.</p>`);
+}
+//# sourceMappingURL=verificationPages.js.map

package/dist/realtimeSessions/verificationPages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationPages.js","sourceRoot":"","sources":["../../src/realtimeSessions/verificationPages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAqBhE;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA6B;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,UAAU,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7E,MAAM,IAAI,GACN,GAAG,QAAQ,MAAM;QACjB,gFAAgF,KAAK,CAAC,OAAO,MAAM;QACnG,iGAAiG,KAAK,CAAC,IAAI,MAAM;QACjH,iDAAiD,GAAG,OAAO;QAC3D,4HAA4H,CAAC;IACjI,MAAM,IAAI,GACN,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM;QAChC,kEAAkE;QAClE,eAAe,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,oCAAoC;QAC5E,mGAAmG;QACnG,2DAA2D,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe;QAChG,oDAAoD,UAAU,CAAC,GAAG,CAAC,OAAO;QAC1E,mIAAmI,CAAC;IACxI,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,uIAAuI;AACvI,SAAS,IAAI,CAAC,KAAa,EAAE,SAAiB;IAC1C,OAAO;;;;;;;SAOF,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;EAaxB,SAAS;;;QAGH,CAAC;AACT,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,UAAkB;IACpE,OAAO,IAAI,CACP,oBAAoB,EACpB;;kCAE0B,UAAU,CAAC,UAAU,CAAC;iDACP,UAAU,CAAC,KAAK,CAAC;;YAEtD,CACP,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB;IAClC,OAAO,IAAI,CACP,iBAAiB,EACjB;2GACmG,CACtG,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IAClC,OAAO,IAAI,CACP,gBAAgB,EAChB;uGAC+F,CAClG,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAChC,OAAO,IAAI,CACP,sBAAsB,EACtB;mEAC2D,CAC9D,CAAC;AACN,CAAC"}

package/dist/realtimeSessions/verificationPolicy.d.ts

@@ -0,0 +1,147 @@
+/**
+ * @fileoverview The policy a realtime session's identity verification is held to — pure, no I/O.
+ *
+ * Policy arrives in layers and the most specific layer wins:
+ *
+ *   1. built-in defaults (this file)
+ *   2. server config  — `realtime.identityVerification` in `mj.config.cjs`
+ *   3. the config cascade — `channels.config.IdentityVerification` (+ `session.unverifiedMaxSeconds` /
+ *      `session.verifiedMaxSeconds`) resolved for this session at mint, **snapshotted onto the session**
+ *
+ * Layer 3 is stored server-side on the session at mint and never read from the client: a request to
+ * verify carries only `{ agentSessionId, name, email }`, so a caller cannot choose the rules it is
+ * judged by.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+/**
+ * Consumer ("free mail") email domains, matched exactly or as a parent of the address's domain.
+ *
+ * **Curated, not exhaustive**, and deliberately about *consumer mailbox providers*, not about
+ * disposable/throwaway domains (a different, much larger, constantly-moving list). A deployment can
+ * replace it entirely through `consumerDomains`. Lower-case, no leading `@`.
+ */
+export declare const DEFAULT_CONSUMER_EMAIL_DOMAINS: readonly string[];
+/**
+ * The knobs of identity verification, in the shape an administrator authors them (JSON in the config
+ * cascade or `mj.config.cjs`). Every field is optional; absent means "inherit the next layer".
+ *
+ * Members are camelCase on purpose: they ARE the JSON config keys (`mj.config.cjs`,
+ * `channels.config.IdentityVerification`, and the snapshot stored on the session). Renaming one would
+ * rename a configuration key that deployments and stored sessions already use.
+ */
+export interface IdentityVerificationPolicy {
+    /** Refuse consumer mailbox domains (see {@link DEFAULT_CONSUMER_EMAIL_DOMAINS}). Default `false`. */
+    requireBusinessDomain?: boolean;
+    /** Domains refused outright (matched exactly or as a parent domain), whatever else is allowed. */
+    blockedDomains?: string[];
+    /** REPLACES the built-in consumer-domain list when set (and non-empty). */
+    consumerDomains?: string[];
+    /** Minutes an emailed link/code stays redeemable. Default 30, clamped to 1–1440. */
+    linkTtlMinutes?: number;
+    /** Most verification emails one session may trigger. Default 3, clamped to 1–20. */
+    maxSendsPerSession?: number;
+    /** Most wrong code entries before the pending verification is voided. Default 5, clamped to 1–10. */
+    maxCodeAttempts?: number;
+    /**
+     * Session duration cap while UNVERIFIED, in seconds. Stamped at mint as the session's absolute
+     * deadline. Absent ⇒ no cap from this layer.
+     */
+    unverifiedMaxSeconds?: number;
+    /**
+     * Session duration cap once VERIFIED, in seconds (measured from the session's start). On
+     * verification the deadline is moved out to this — never pulled in. Absent ⇒ verification does not
+     * change the deadline.
+     */
+    verifiedMaxSeconds?: number;
+}
+/**
+ * A policy with every knob resolved. camelCase for the same reason as {@link IdentityVerificationPolicy}:
+ * it is that shape with its defaults applied.
+ */
+export interface ResolvedIdentityVerificationPolicy {
+    requireBusinessDomain: boolean;
+    blockedDomains: string[];
+    consumerDomains: string[];
+    linkTtlMinutes: number;
+    maxSendsPerSession: number;
+    maxCodeAttempts: number;
+    unverifiedMaxSeconds: number | undefined;
+    verifiedMaxSeconds: number | undefined;
+}
+/** Built-in numeric defaults. */
+export declare const DEFAULT_LINK_TTL_MINUTES = 30;
+export declare const DEFAULT_MAX_SENDS_PER_SESSION = 3;
+export declare const DEFAULT_MAX_CODE_ATTEMPTS = 5;
+/**
+ * Reads ONE policy layer from untrusted JSON (a cascade section, a stored snapshot, a config file).
+ * Every field is type-checked; anything that is not the right type is ignored rather than coerced.
+ *
+ * @param raw - the layer, as parsed JSON of unknown shape
+ */
+export declare function ReadIdentityVerificationPolicyLayer(raw: unknown): IdentityVerificationPolicy;
+/**
+ * Extracts the session-scoped policy layer from a RESOLVED realtime configuration (the object the
+ * config cascade produced at mint).
+ *
+ * Reads, defensively and without depending on the cascade's TypeScript types (so this keeps working as
+ * the cascade gains fields):
+ *
+ * - `channels.config.IdentityVerification` — the verification channel's own knobs
+ * - `session.unverifiedMaxSeconds` / `session.verifiedMaxSeconds` — the duration caps
+ *
+ * Duration caps in the channel's own config are honoured too; the `session` section wins when both
+ * are present, because it is the dedicated, documented home for them.
+ *
+ * @param realtimeConfig - the effective `realtime` section (`EffectiveConfig.realtime`), or anything
+ * @returns the layer; `{}` when the cascade carries nothing relevant
+ */
+export declare function ExtractIdentityVerificationPolicyFromRealtimeConfig(realtimeConfig: unknown): IdentityVerificationPolicy;
+/**
+ * Merges policy layers (later layers win per knob) into a fully-resolved policy, applying defaults
+ * and clamping every numeric knob into a safe range. An empty `consumerDomains` in a layer is treated
+ * as absent (it would silently turn `requireBusinessDomain` into a no-op).
+ *
+ * @param layers - lowest-precedence first; `undefined` entries are skipped
+ */
+export declare function ResolveIdentityVerificationPolicy(layers: ReadonlyArray<IdentityVerificationPolicy | undefined>): ResolvedIdentityVerificationPolicy;
+/** Outcome of {@link ParseEmailAddress}. */
+export type ParsedEmail = {
+    Ok: true;
+    Email: string;
+    Domain: string;
+} | {
+    Ok: false;
+};
+/**
+ * Normalises and validates an email address (trim + lower-case). Deliberately conservative: it rejects
+ * anything with whitespace, control characters, quotes, angle brackets or a display-name form, because
+ * the address is about to be placed in a message header and a link context.
+ *
+ * @param raw - what the person typed
+ */
+export declare function ParseEmailAddress(raw: string): ParsedEmail;
+/** Outcome of {@link EvaluateEmailDomainPolicy}. */
+export type EmailPolicyDecision = {
+    Allowed: true;
+} | {
+    Allowed: false;
+    Reason: 'domain_blocked' | 'consumer_domain';
+};
+/**
+ * Applies the domain rules of a policy to an address's domain: `blockedDomains` first (always wins),
+ * then — when `requireBusinessDomain` — the consumer-domain list.
+ *
+ * @param domain - lower-case domain of the (already parsed) address
+ */
+export declare function EvaluateEmailDomainPolicy(domain: string, policy: ResolvedIdentityVerificationPolicy): EmailPolicyDecision;
+/**
+ * Tightens a session deadline: returns the earlier of the existing deadline (ISO) and `candidateMs`,
+ * as an ISO string. Used at mint so a configured unverified cap never LOOSENS a deadline another rule
+ * (the widget voice cap) already set.
+ *
+ * @param existingIso - the deadline already stamped, if any
+ * @param candidateMs - the candidate deadline, epoch ms
+ */
+export declare function TightenSessionDeadline(existingIso: string | undefined, candidateMs: number): string;
+//# sourceMappingURL=verificationPolicy.d.ts.map

package/dist/realtimeSessions/verificationPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationPolicy.d.ts","sourceRoot":"","sources":["../../src/realtimeSessions/verificationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAqB3D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACvC,qGAAqG;IACrG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qGAAqG;IACrG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,kCAAkC;IAC/C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,iCAAiC;AACjC,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAC3C,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAC/C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAsC3C;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,OAAO,GAAG,0BAA0B,CAqC5F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mDAAmD,CAAC,cAAc,EAAE,OAAO,GAAG,0BAA0B,CAmBvH;AAOD;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC7C,MAAM,EAAE,aAAa,CAAC,0BAA0B,GAAG,SAAS,CAAC,GAC9D,kCAAkC,CA2BpC;AAOD,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAOtF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAM1D;AAED,oDAAoD;AACpD,MAAM,MAAM,mBAAmB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAEvH;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,GAAG,mBAAmB,CAQzH;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGnG"}

package/dist/realtimeSessions/verificationPolicy.js

@@ -0,0 +1,249 @@
+/**
+ * @fileoverview The policy a realtime session's identity verification is held to — pure, no I/O.
+ *
+ * Policy arrives in layers and the most specific layer wins:
+ *
+ *   1. built-in defaults (this file)
+ *   2. server config  — `realtime.identityVerification` in `mj.config.cjs`
+ *   3. the config cascade — `channels.config.IdentityVerification` (+ `session.unverifiedMaxSeconds` /
+ *      `session.verifiedMaxSeconds`) resolved for this session at mint, **snapshotted onto the session**
+ *
+ * Layer 3 is stored server-side on the session at mint and never read from the client: a request to
+ * verify carries only `{ agentSessionId, name, email }`, so a caller cannot choose the rules it is
+ * judged by.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+/**
+ * Consumer ("free mail") email domains, matched exactly or as a parent of the address's domain.
+ *
+ * **Curated, not exhaustive**, and deliberately about *consumer mailbox providers*, not about
+ * disposable/throwaway domains (a different, much larger, constantly-moving list). A deployment can
+ * replace it entirely through `consumerDomains`. Lower-case, no leading `@`.
+ */
+export const DEFAULT_CONSUMER_EMAIL_DOMAINS = [
+    // Google
+    'gmail.com', 'googlemail.com',
+    // Yahoo / AOL (Verizon Media lineage)
+    'yahoo.com', 'yahoo.co.uk', 'yahoo.co.in', 'yahoo.co.jp', 'yahoo.ca', 'yahoo.com.au', 'yahoo.com.br',
+    'yahoo.fr', 'yahoo.de', 'yahoo.es', 'yahoo.it', 'ymail.com', 'rocketmail.com', 'aol.com', 'aim.com',
+    // Microsoft consumer
+    'outlook.com', 'outlook.fr', 'outlook.de', 'hotmail.com', 'hotmail.co.uk', 'hotmail.fr', 'hotmail.de',
+    'hotmail.it', 'hotmail.es', 'live.com', 'live.co.uk', 'live.fr', 'msn.com',
+    // Apple
+    'icloud.com', 'me.com', 'mac.com',
+    // Privacy-focused
+    'proton.me', 'protonmail.com', 'pm.me', 'tutanota.com', 'tuta.io', 'hey.com', 'fastmail.com', 'fastmail.fm',
+    // Portal / regional
+    'gmx.com', 'gmx.net', 'gmx.de', 'gmx.us', 'web.de', 'mail.com', 'zoho.com', 'zohomail.com',
+    'yandex.com', 'yandex.ru', 'mail.ru', 'qq.com', '163.com', '126.com', 'sina.com', 'naver.com',
+    'daum.net', 'hanmail.net', 'rediffmail.com', 'orange.fr', 'free.fr', 'laposte.net', 'libero.it', 't-online.de',
+    // ISP mailboxes
+    'comcast.net', 'verizon.net', 'att.net', 'sbcglobal.net', 'bellsouth.net', 'cox.net', 'charter.net',
+    'earthlink.net', 'juno.com', 'optonline.net', 'btinternet.com', 'sky.com', 'virginmedia.com',
+    'shaw.ca', 'rogers.com', 'bell.net',
+];
+/** Built-in numeric defaults. */
+export const DEFAULT_LINK_TTL_MINUTES = 30;
+export const DEFAULT_MAX_SENDS_PER_SESSION = 3;
+export const DEFAULT_MAX_CODE_ATTEMPTS = 5;
+const MIN_LINK_TTL_MINUTES = 1;
+const MAX_LINK_TTL_MINUTES = 24 * 60;
+const MIN_MAX_SENDS = 1;
+const MAX_MAX_SENDS = 20;
+const MIN_MAX_ATTEMPTS = 1;
+const MAX_MAX_ATTEMPTS = 10;
+/** Sanity ceiling for a session-duration knob: 24 h. A larger value is a config mistake, not a policy. */
+const MAX_SESSION_SECONDS = 24 * 60 * 60;
+/** True for a plain object. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** A finite number, or undefined. */
+function readNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+/** A positive finite number within the session-duration ceiling, or undefined. */
+function readSessionSeconds(value) {
+    const n = readNumber(value);
+    return n !== undefined && n > 0 ? Math.min(Math.floor(n), MAX_SESSION_SECONDS) : undefined;
+}
+/** A list of non-empty strings, normalised to lower-case domains without a leading `@`; undefined when not a list. */
+function readDomainList(value) {
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    return value
+        .filter((entry) => typeof entry === 'string')
+        .map((entry) => entry.trim().toLowerCase().replace(/^@/, ''))
+        .filter((entry) => entry.length > 0);
+}
+/**
+ * Reads ONE policy layer from untrusted JSON (a cascade section, a stored snapshot, a config file).
+ * Every field is type-checked; anything that is not the right type is ignored rather than coerced.
+ *
+ * @param raw - the layer, as parsed JSON of unknown shape
+ */
+export function ReadIdentityVerificationPolicyLayer(raw) {
+    if (!isRecord(raw)) {
+        return {};
+    }
+    const layer = {};
+    if (typeof raw['requireBusinessDomain'] === 'boolean') {
+        layer.requireBusinessDomain = raw['requireBusinessDomain'];
+    }
+    const blocked = readDomainList(raw['blockedDomains']);
+    if (blocked) {
+        layer.blockedDomains = blocked;
+    }
+    const consumer = readDomainList(raw['consumerDomains']);
+    if (consumer) {
+        layer.consumerDomains = consumer;
+    }
+    const ttl = readNumber(raw['linkTtlMinutes']);
+    if (ttl !== undefined) {
+        layer.linkTtlMinutes = ttl;
+    }
+    const sends = readNumber(raw['maxSendsPerSession']);
+    if (sends !== undefined) {
+        layer.maxSendsPerSession = sends;
+    }
+    const attempts = readNumber(raw['maxCodeAttempts']);
+    if (attempts !== undefined) {
+        layer.maxCodeAttempts = attempts;
+    }
+    const unverified = readSessionSeconds(raw['unverifiedMaxSeconds']);
+    if (unverified !== undefined) {
+        layer.unverifiedMaxSeconds = unverified;
+    }
+    const verified = readSessionSeconds(raw['verifiedMaxSeconds']);
+    if (verified !== undefined) {
+        layer.verifiedMaxSeconds = verified;
+    }
+    return layer;
+}
+/**
+ * Extracts the session-scoped policy layer from a RESOLVED realtime configuration (the object the
+ * config cascade produced at mint).
+ *
+ * Reads, defensively and without depending on the cascade's TypeScript types (so this keeps working as
+ * the cascade gains fields):
+ *
+ * - `channels.config.IdentityVerification` — the verification channel's own knobs
+ * - `session.unverifiedMaxSeconds` / `session.verifiedMaxSeconds` — the duration caps
+ *
+ * Duration caps in the channel's own config are honoured too; the `session` section wins when both
+ * are present, because it is the dedicated, documented home for them.
+ *
+ * @param realtimeConfig - the effective `realtime` section (`EffectiveConfig.realtime`), or anything
+ * @returns the layer; `{}` when the cascade carries nothing relevant
+ */
+export function ExtractIdentityVerificationPolicyFromRealtimeConfig(realtimeConfig) {
+    if (!isRecord(realtimeConfig)) {
+        return {};
+    }
+    const channels = realtimeConfig['channels'];
+    const channelConfig = isRecord(channels) && isRecord(channels['config']) ? channels['config']['IdentityVerification'] : undefined;
+    const layer = ReadIdentityVerificationPolicyLayer(channelConfig);
+    const session = realtimeConfig['session'];
+    if (isRecord(session)) {
+        const unverified = readSessionSeconds(session['unverifiedMaxSeconds']);
+        if (unverified !== undefined) {
+            layer.unverifiedMaxSeconds = unverified;
+        }
+        const verified = readSessionSeconds(session['verifiedMaxSeconds']);
+        if (verified !== undefined) {
+            layer.verifiedMaxSeconds = verified;
+        }
+    }
+    return layer;
+}
+/** Clamps `value` into `[min, max]`, falling back to `fallback` when it is not a finite number. */
+function clamp(value, min, max, fallback) {
+    return value === undefined ? fallback : Math.min(max, Math.max(min, Math.floor(value)));
+}
+/**
+ * Merges policy layers (later layers win per knob) into a fully-resolved policy, applying defaults
+ * and clamping every numeric knob into a safe range. An empty `consumerDomains` in a layer is treated
+ * as absent (it would silently turn `requireBusinessDomain` into a no-op).
+ *
+ * @param layers - lowest-precedence first; `undefined` entries are skipped
+ */
+export function ResolveIdentityVerificationPolicy(layers) {
+    const merged = {};
+    for (const layer of layers) {
+        if (!layer) {
+            continue;
+        }
+        for (const key of Object.keys(layer)) {
+            const value = layer[key];
+            if (value === undefined) {
+                continue;
+            }
+            if (key === 'consumerDomains' && Array.isArray(value) && value.length === 0) {
+                continue;
+            }
+            merged[key] = value;
+        }
+    }
+    return {
+        requireBusinessDomain: merged.requireBusinessDomain ?? false,
+        blockedDomains: merged.blockedDomains ?? [],
+        consumerDomains: merged.consumerDomains ?? [...DEFAULT_CONSUMER_EMAIL_DOMAINS],
+        linkTtlMinutes: clamp(merged.linkTtlMinutes, MIN_LINK_TTL_MINUTES, MAX_LINK_TTL_MINUTES, DEFAULT_LINK_TTL_MINUTES),
+        maxSendsPerSession: clamp(merged.maxSendsPerSession, MIN_MAX_SENDS, MAX_MAX_SENDS, DEFAULT_MAX_SENDS_PER_SESSION),
+        maxCodeAttempts: clamp(merged.maxCodeAttempts, MIN_MAX_ATTEMPTS, MAX_MAX_ATTEMPTS, DEFAULT_MAX_CODE_ATTEMPTS),
+        unverifiedMaxSeconds: merged.unverifiedMaxSeconds,
+        verifiedMaxSeconds: merged.verifiedMaxSeconds,
+    };
+}
+/** True when `domain` equals `entry` or is a subdomain of it. */
+function domainMatches(domain, entry) {
+    return domain === entry || domain.endsWith(`.${entry}`);
+}
+/** RFC-5321 maximum length of a forward-path. */
+const MAX_EMAIL_LENGTH = 254;
+/** A pragmatic address check: one `@`, a dotted domain of safe labels, no whitespace/control/angle characters. */
+const EMAIL_PATTERN = /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]{1,64}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$/;
+/**
+ * Normalises and validates an email address (trim + lower-case). Deliberately conservative: it rejects
+ * anything with whitespace, control characters, quotes, angle brackets or a display-name form, because
+ * the address is about to be placed in a message header and a link context.
+ *
+ * @param raw - what the person typed
+ */
+export function ParseEmailAddress(raw) {
+    const email = (raw ?? '').trim().toLowerCase();
+    if (email.length === 0 || email.length > MAX_EMAIL_LENGTH || !EMAIL_PATTERN.test(email)) {
+        return { Ok: false };
+    }
+    return { Ok: true, Email: email, Domain: email.slice(email.lastIndexOf('@') + 1) };
+}
+/**
+ * Applies the domain rules of a policy to an address's domain: `blockedDomains` first (always wins),
+ * then — when `requireBusinessDomain` — the consumer-domain list.
+ *
+ * @param domain - lower-case domain of the (already parsed) address
+ */
+export function EvaluateEmailDomainPolicy(domain, policy) {
+    if (policy.blockedDomains.some((entry) => domainMatches(domain, entry))) {
+        return { Allowed: false, Reason: 'domain_blocked' };
+    }
+    if (policy.requireBusinessDomain && policy.consumerDomains.some((entry) => domainMatches(domain, entry))) {
+        return { Allowed: false, Reason: 'consumer_domain' };
+    }
+    return { Allowed: true };
+}
+/**
+ * Tightens a session deadline: returns the earlier of the existing deadline (ISO) and `candidateMs`,
+ * as an ISO string. Used at mint so a configured unverified cap never LOOSENS a deadline another rule
+ * (the widget voice cap) already set.
+ *
+ * @param existingIso - the deadline already stamped, if any
+ * @param candidateMs - the candidate deadline, epoch ms
+ */
+export function TightenSessionDeadline(existingIso, candidateMs) {
+    const existingMs = existingIso ? Date.parse(existingIso) : Number.NaN;
+    return new Date(Number.isNaN(existingMs) ? candidateMs : Math.min(existingMs, candidateMs)).toISOString();
+}
+//# sourceMappingURL=verificationPolicy.js.map

package/dist/realtimeSessions/verificationPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationPolicy.js","sourceRoot":"","sources":["../../src/realtimeSessions/verificationPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC7D,SAAS;IACT,WAAW,EAAE,gBAAgB;IAC7B,sCAAsC;IACtC,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc;IACpG,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS;IACnG,qBAAqB;IACrB,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY;IACrG,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;IAC1E,QAAQ;IACR,YAAY,EAAE,QAAQ,EAAE,SAAS;IACjC,kBAAkB;IAClB,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa;IAC3G,oBAAoB;IACpB,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc;IAC1F,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW;IAC7F,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa;IAC9G,gBAAgB;IAChB,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa;IACnG,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,iBAAiB;IAC5F,SAAS,EAAE,YAAY,EAAE,UAAU;CACtC,CAAC;AAmDF,iCAAiC;AACjC,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAC/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,0GAA0G;AAC1G,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEzC,+BAA+B;AAC/B,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,qCAAqC;AACrC,SAAS,UAAU,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,KAAc;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC;AAED,sHAAsH;AACtH,SAAS,cAAc,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,KAAK;SACP,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CAAC,GAAY;IAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,uBAAuB,CAAC,KAAK,SAAS,EAAE,CAAC;QACpD,KAAK,CAAC,qBAAqB,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtD,IAAI,OAAO,EAAE,CAAC;QACV,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACX,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,kBAAkB,GAAG,KAAK,CAAC;IACrC,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACnE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,oBAAoB,GAAG,UAAU,CAAC;IAC5C,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mDAAmD,CAAC,cAAuB;IACvF,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClI,MAAM,KAAK,GAAG,mCAAmC,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACvE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,oBAAoB,GAAG,UAAU,CAAC;QAC5C,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QACxC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,mGAAmG;AACnG,SAAS,KAAK,CAAC,KAAyB,EAAE,GAAW,EAAE,GAAW,EAAE,QAAgB;IAChF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC7C,MAA6D;IAE7D,MAAM,MAAM,GAA+B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,SAAS;QACb,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAA4C,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS;YACb,CAAC;YACD,IAAI,GAAG,KAAK,iBAAiB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,SAAS;YACb,CAAC;YACA,MAAkC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrD,CAAC;IACL,CAAC;IACD,OAAO;QACH,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,KAAK;QAC5D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAC3C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,GAAG,8BAA8B,CAAC;QAC9E,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,wBAAwB,CAAC;QAClH,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,aAAa,EAAE,aAAa,EAAE,6BAA6B,CAAC;QACjH,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,yBAAyB,CAAC;QAC7G,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAChD,CAAC;AACN,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAChD,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAKD,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,kHAAkH;AAClH,MAAM,aAAa,GAAG,4GAA4G,CAAC;AAEnI;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,MAA0C;IAChG,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACvG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAA+B,EAAE,WAAmB;IACvF,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACtE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9G,CAAC"}