@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/dist/realtimeSessions/RealtimeSessionEventService.d.ts

@@ -0,0 +1,148 @@
+/**
+ * @fileoverview Server-side publisher for **realtime session events** — the hook an app (or MJ itself)
+ * calls to push a typed event into ONE live realtime session.
+ *
+ * The wire contract (event types, payload shapes, parsing) lives in `@memberjunction/ai-core-plus`
+ * (`realtime-session-events.ts`). This module owns the transport: it publishes onto MJServer's
+ * existing PubSub (`PubSubManager`) so the `RealtimeSessionEvents` GraphQL subscription can deliver it.
+ *
+ * ## Routing is part of the payload
+ *
+ * Every published event carries a snapshot of who may see it — the session's owner (`OwnerUserID`) and
+ * the session's anonymous scope id (`ScopeKey`). The subscription filter compares that snapshot with
+ * the **connection's** authenticated identity, so a subscriber who guesses another session's id still
+ * receives nothing. These two fields are server-internal: the GraphQL notification type does not
+ * expose them.
+ *
+ * ## Multiple server instances
+ *
+ * PubSub is in-process. Behind a load balancer the browser's WebSocket can live on a different replica
+ * than the one that handled the verification link. {@link RealtimeSessionEventService.SetReplicationHook}
+ * lets the host fan events out (the server wires it to Redis when `REDIS_URL` is set, exactly as it does
+ * for push-status updates), and {@link RealtimeSessionEventService.PublishReplicated} republishes an event
+ * that arrived from another instance.
+ *
+ * @example
+ * ```ts
+ * // From an Open App's server code, after it finished some work for a live session:
+ * await RealtimeSessionEventService.Instance.Publish({
+ *     AgentSessionID: sessionId,
+ *     Type: 'acme.quote.ready',
+ *     Payload: { QuoteID: quote.ID },
+ *     ContextUser: systemUser,
+ * });
+ * ```
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { BaseSingleton } from '@memberjunction/global';
+import { type RealtimeSessionEventPayload, type RealtimeSessionEventType } from '@memberjunction/ai-core-plus';
+/** The PubSub topic every realtime session event is published on. */
+export declare const REALTIME_SESSION_EVENTS_TOPIC = "REALTIME_SESSION_EVENTS";
+/**
+ * What is actually published on {@link REALTIME_SESSION_EVENTS_TOPIC}: the wire event plus the
+ * server-internal routing snapshot.
+ */
+export type RealtimeSessionEventTopicPayload = {
+    Type: string;
+    AgentSessionID: string;
+    OccurredAt: string;
+    /** The event payload, JSON-encoded. */
+    PayloadJson: string;
+    /** `AIAgentSession.UserID` — compared with the subscriber connection's user. Server-internal. */
+    OwnerUserID: string;
+    /** `Conversation.ExternalID` — compared with the subscriber's signed scope. Server-internal. */
+    ScopeKey: string | null;
+    /**
+     * `MJGlobal.ProcessUUID` of the instance that first published the event; lets an instance drop its
+     * own message when it echoes back from the replication bus.
+     */
+    SourceServerId?: string;
+};
+/** Who may receive an event, resolved from the session at publish time. */
+export interface RealtimeSessionEventRouting {
+    /** The session the event is addressed to. */
+    AgentSessionID: string;
+    /** The session's owner. */
+    OwnerUserID: string;
+    /** The session conversation's `ExternalID` (anonymous scope id), or null. */
+    ScopeKey: string | null;
+}
+/** Input to {@link RealtimeSessionEventService.Publish}. */
+export interface PublishRealtimeSessionEventInput<T extends RealtimeSessionEventType> {
+    /** The session to address. */
+    AgentSessionID: string;
+    /** Event type — a key of `RealtimeSessionEventPayloadMap`. */
+    Type: T;
+    /** Type-specific data; must be JSON-serializable. */
+    Payload: RealtimeSessionEventPayload<T>;
+    /**
+     * The identity to read the session under. Server-side publishers pass a system/service user — the
+     * session row is being addressed by the server, not on a caller's behalf.
+     */
+    ContextUser: UserInfo;
+    /** Provider to read the session with. Defaults to the process-global provider (server bootstrap use). */
+    Provider?: IMetadataProvider;
+}
+/** Outcome of a publish. A failure is never silent: it is also logged. */
+export interface PublishRealtimeSessionEventResult {
+    /** True when the event was handed to the PubSub. */
+    Success: boolean;
+    /** Why it was not, when it was not. */
+    ErrorMessage?: string;
+}
+/** Called for every locally-published event so the host can replicate it to other instances. */
+export type RealtimeSessionEventReplicationHook = (payload: RealtimeSessionEventTopicPayload) => void;
+/**
+ * Publishes realtime session events. A {@link BaseSingleton}: there is one publisher per process, and
+ * the replication hook is process-wide state.
+ */
+export declare class RealtimeSessionEventService extends BaseSingleton<RealtimeSessionEventService> {
+    private replicationHook;
+    protected constructor();
+    /** The process-wide instance. */
+    static get Instance(): RealtimeSessionEventService;
+    /**
+     * Publishes an event to one live session. Reads the session to snapshot its owner and scope, so the
+     * caller never supplies (and can never get wrong) who may receive the event.
+     *
+     * Does not require the session to be open: an event for a closed session simply reaches no
+     * subscriber.
+     *
+     * @returns a result rather than throwing — event delivery is best-effort, durable state lives
+     *   elsewhere (the verification status query is the backstop for a missed `identity.verified`).
+     */
+    Publish<T extends RealtimeSessionEventType>(input: PublishRealtimeSessionEventInput<T>): Promise<PublishRealtimeSessionEventResult>;
+    /**
+     * Publishes an event when the caller already holds the session's routing (the verification service
+     * has just loaded the session, so it must not pay a second read).
+     */
+    PublishRouted<T extends RealtimeSessionEventType>(routing: RealtimeSessionEventRouting, type: T, payload: RealtimeSessionEventPayload<T>): PublishRealtimeSessionEventResult;
+    /**
+     * Republishes an event that arrived from another server instance onto THIS instance's local topic
+     * only (never back through the replication hook, so there is no loop). The subscription filter still
+     * decides who receives it — a replica has no say in who sees what.
+     */
+    PublishReplicated(payload: RealtimeSessionEventTopicPayload): void;
+    /**
+     * Registers (or, with no argument, clears) the cross-instance fan-out hook. Inversion of control:
+     * this module must not know that Redis exists.
+     */
+    SetReplicationHook(hook?: RealtimeSessionEventReplicationHook): void;
+    /** Hands a locally-published event to the replication hook, never letting a bus failure break local delivery. */
+    private replicate;
+    private fail;
+}
+/**
+ * Validates an event received from the cross-instance message bus before it is republished locally.
+ *
+ * The bus carries messages from other processes, so every field is type-checked. Fails closed: an event
+ * with no routing identity can never be delivered safely, so it is dropped.
+ *
+ * @param raw - the JSON text taken off the bus
+ * @param localServerId - this process's `MJGlobal.ProcessUUID`, used to drop our own echo
+ * @returns the event to republish, or `null` to drop it
+ */
+export declare function ParseReplicatedRealtimeSessionEvent(raw: string, localServerId: string): RealtimeSessionEventTopicPayload | null;
+//# sourceMappingURL=RealtimeSessionEventService.d.ts.map

package/dist/realtimeSessions/RealtimeSessionEventService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RealtimeSessionEventService.d.ts","sourceRoot":"","sources":["../../src/realtimeSessions/RealtimeSessionEventService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,iBAAiB,EAAsB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAY,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAEH,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAChC,MAAM,8BAA8B,CAAC;AAItC,qEAAqE;AACrE,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;GAGG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,2EAA2E;AAC3E,MAAM,WAAW,2BAA2B;IACxC,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,4DAA4D;AAC5D,MAAM,WAAW,gCAAgC,CAAC,CAAC,SAAS,wBAAwB;IAChF,8BAA8B;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,IAAI,EAAE,CAAC,CAAC;IACR,qDAAqD;IACrD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACxC;;;OAGG;IACH,WAAW,EAAE,QAAQ,CAAC;IACtB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAC9C,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,gGAAgG;AAChG,MAAM,MAAM,mCAAmC,GAAG,CAAC,OAAO,EAAE,gCAAgC,KAAK,IAAI,CAAC;AAEtG;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,2BAA2B,CAAC;IACvF,OAAO,CAAC,eAAe,CAAkD;IAEzE,SAAS;IAIT,iCAAiC;IACjC,WAAkB,QAAQ,IAAI,2BAA2B,CAExD;IAED;;;;;;;;;OASG;IACU,OAAO,CAAC,CAAC,SAAS,wBAAwB,EACnD,KAAK,EAAE,gCAAgC,CAAC,CAAC,CAAC,GAC3C,OAAO,CAAC,iCAAiC,CAAC;IAqB7C;;;OAGG;IACI,aAAa,CAAC,CAAC,SAAS,wBAAwB,EACnD,OAAO,EAAE,2BAA2B,EACpC,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACxC,iCAAiC;IAqBpC;;;;OAIG;IACI,iBAAiB,CAAC,OAAO,EAAE,gCAAgC,GAAG,IAAI;IAIzE;;;OAGG;IACI,kBAAkB,CAAC,IAAI,CAAC,EAAE,mCAAmC,GAAG,IAAI;IAI3E,iHAAiH;IACjH,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,IAAI;CAIf;AAED;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,gCAAgC,GAAG,IAAI,CAkC/H"}

package/dist/realtimeSessions/RealtimeSessionEventService.js

@@ -0,0 +1,191 @@
+/**
+ * @fileoverview Server-side publisher for **realtime session events** — the hook an app (or MJ itself)
+ * calls to push a typed event into ONE live realtime session.
+ *
+ * The wire contract (event types, payload shapes, parsing) lives in `@memberjunction/ai-core-plus`
+ * (`realtime-session-events.ts`). This module owns the transport: it publishes onto MJServer's
+ * existing PubSub (`PubSubManager`) so the `RealtimeSessionEvents` GraphQL subscription can deliver it.
+ *
+ * ## Routing is part of the payload
+ *
+ * Every published event carries a snapshot of who may see it — the session's owner (`OwnerUserID`) and
+ * the session's anonymous scope id (`ScopeKey`). The subscription filter compares that snapshot with
+ * the **connection's** authenticated identity, so a subscriber who guesses another session's id still
+ * receives nothing. These two fields are server-internal: the GraphQL notification type does not
+ * expose them.
+ *
+ * ## Multiple server instances
+ *
+ * PubSub is in-process. Behind a load balancer the browser's WebSocket can live on a different replica
+ * than the one that handled the verification link. {@link RealtimeSessionEventService.SetReplicationHook}
+ * lets the host fan events out (the server wires it to Redis when `REDIS_URL` is set, exactly as it does
+ * for push-status updates), and {@link RealtimeSessionEventService.PublishReplicated} republishes an event
+ * that arrived from another instance.
+ *
+ * @example
+ * ```ts
+ * // From an Open App's server code, after it finished some work for a live session:
+ * await RealtimeSessionEventService.Instance.Publish({
+ *     AgentSessionID: sessionId,
+ *     Type: 'acme.quote.ready',
+ *     Payload: { QuoteID: quote.ID },
+ *     ContextUser: systemUser,
+ * });
+ * ```
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { LogError, Metadata } from '@memberjunction/core';
+import { BaseSingleton, MJGlobal } from '@memberjunction/global';
+import { SerializeRealtimeSessionEvent, } from '@memberjunction/ai-core-plus';
+import { PubSubManager } from '../generic/PubSubManager.js';
+import { LoadSessionForAccess } from './sessionAccess.js';
+/** The PubSub topic every realtime session event is published on. */
+export const REALTIME_SESSION_EVENTS_TOPIC = 'REALTIME_SESSION_EVENTS';
+/**
+ * Publishes realtime session events. A {@link BaseSingleton}: there is one publisher per process, and
+ * the replication hook is process-wide state.
+ */
+export class RealtimeSessionEventService extends BaseSingleton {
+    constructor() {
+        super();
+    }
+    /** The process-wide instance. */
+    static get Instance() {
+        return super.getInstance();
+    }
+    /**
+     * Publishes an event to one live session. Reads the session to snapshot its owner and scope, so the
+     * caller never supplies (and can never get wrong) who may receive the event.
+     *
+     * Does not require the session to be open: an event for a closed session simply reaches no
+     * subscriber.
+     *
+     * @returns a result rather than throwing — event delivery is best-effort, durable state lives
+     *   elsewhere (the verification status query is the backstop for a missed `identity.verified`).
+     */
+    async Publish(input) {
+        try {
+            const provider = input.Provider ?? Metadata.Provider; // global-provider-ok: documented last-resort fallback for server-bootstrap publishers
+            const loaded = await LoadSessionForAccess(input.AgentSessionID, input.ContextUser, provider);
+            if (!loaded) {
+                return this.fail(`Realtime session ${input.AgentSessionID} not found; event '${input.Type}' not published.`);
+            }
+            return this.PublishRouted({
+                AgentSessionID: loaded.Session.ID,
+                OwnerUserID: loaded.Session.UserID,
+                ScopeKey: loaded.ConversationExternalID,
+            }, input.Type, input.Payload);
+        }
+        catch (error) {
+            return this.fail(`Publishing '${input.Type}' to session ${input.AgentSessionID} failed: ${errorText(error)}`);
+        }
+    }
+    /**
+     * Publishes an event when the caller already holds the session's routing (the verification service
+     * has just loaded the session, so it must not pay a second read).
+     */
+    PublishRouted(routing, type, payload) {
+        const wire = SerializeRealtimeSessionEvent({
+            Type: type,
+            AgentSessionID: routing.AgentSessionID,
+            OccurredAt: new Date().toISOString(),
+            Payload: payload,
+        });
+        const topicPayload = {
+            ...wire,
+            OwnerUserID: routing.OwnerUserID,
+            ScopeKey: routing.ScopeKey,
+            SourceServerId: MJGlobal.Instance.ProcessUUID,
+        };
+        if (!PubSubManager.Instance.PubSubEngine) {
+            return this.fail(`PubSub is not configured; event '${type}' for session ${routing.AgentSessionID} not published.`);
+        }
+        PubSubManager.Instance.Publish(REALTIME_SESSION_EVENTS_TOPIC, topicPayload);
+        this.replicate(topicPayload);
+        return { Success: true };
+    }
+    /**
+     * Republishes an event that arrived from another server instance onto THIS instance's local topic
+     * only (never back through the replication hook, so there is no loop). The subscription filter still
+     * decides who receives it — a replica has no say in who sees what.
+     */
+    PublishReplicated(payload) {
+        PubSubManager.Instance.Publish(REALTIME_SESSION_EVENTS_TOPIC, payload);
+    }
+    /**
+     * Registers (or, with no argument, clears) the cross-instance fan-out hook. Inversion of control:
+     * this module must not know that Redis exists.
+     */
+    SetReplicationHook(hook) {
+        this.replicationHook = hook;
+    }
+    /** Hands a locally-published event to the replication hook, never letting a bus failure break local delivery. */
+    replicate(payload) {
+        if (!this.replicationHook) {
+            return;
+        }
+        try {
+            this.replicationHook(payload);
+        }
+        catch (error) {
+            // Replication is an optimisation over the durable status query; local delivery already happened.
+            LogError(`RealtimeSessionEventService: replication hook failed: ${errorText(error)}`);
+        }
+    }
+    fail(message) {
+        LogError(`RealtimeSessionEventService: ${message}`);
+        return { Success: false, ErrorMessage: message };
+    }
+}
+/**
+ * Validates an event received from the cross-instance message bus before it is republished locally.
+ *
+ * The bus carries messages from other processes, so every field is type-checked. Fails closed: an event
+ * with no routing identity can never be delivered safely, so it is dropped.
+ *
+ * @param raw - the JSON text taken off the bus
+ * @param localServerId - this process's `MJGlobal.ProcessUUID`, used to drop our own echo
+ * @returns the event to republish, or `null` to drop it
+ */
+export function ParseReplicatedRealtimeSessionEvent(raw, localServerId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null; // not JSON: nothing to deliver
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return null;
+    }
+    const record = parsed;
+    const { Type, AgentSessionID, OccurredAt, PayloadJson, OwnerUserID, ScopeKey, SourceServerId } = record;
+    if (SourceServerId === localServerId) {
+        return null; // our own message, echoed back
+    }
+    const requiredStrings = [Type, AgentSessionID, OccurredAt, PayloadJson, OwnerUserID];
+    if (requiredStrings.some((value) => typeof value !== 'string' || value.length === 0)) {
+        return null; // includes a missing owner: fail closed
+    }
+    if (ScopeKey !== null && ScopeKey !== undefined && typeof ScopeKey !== 'string') {
+        return null;
+    }
+    if (SourceServerId !== undefined && typeof SourceServerId !== 'string') {
+        return null;
+    }
+    return {
+        Type: Type,
+        AgentSessionID: AgentSessionID,
+        OccurredAt: OccurredAt,
+        PayloadJson: PayloadJson,
+        OwnerUserID: OwnerUserID,
+        ScopeKey: typeof ScopeKey === 'string' ? ScopeKey : null,
+        SourceServerId: typeof SourceServerId === 'string' ? SourceServerId : undefined,
+    };
+}
+/** Message text of an unknown thrown value. */
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=RealtimeSessionEventService.js.map

package/dist/realtimeSessions/RealtimeSessionEventService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RealtimeSessionEventService.js","sourceRoot":"","sources":["../../src/realtimeSessions/RealtimeSessionEventService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAqB,QAAQ,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACH,6BAA6B,GAGhC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AA6DvE;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,aAA0C;IAGvF;QACI,KAAK,EAAE,CAAC;IACZ,CAAC;IAED,iCAAiC;IAC1B,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAA+B,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,OAAO,CAChB,KAA0C;QAE1C,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,sFAAsF;YAC5I,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,cAAc,sBAAsB,KAAK,CAAC,IAAI,kBAAkB,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,IAAI,CAAC,aAAa,CACrB;gBACI,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;gBACjC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;gBAClC,QAAQ,EAAE,MAAM,CAAC,sBAAsB;aAC1C,EACD,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,OAAO,CAChB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,gBAAgB,KAAK,CAAC,cAAc,YAAY,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,aAAa,CAChB,OAAoC,EACpC,IAAO,EACP,OAAuC;QAEvC,MAAM,IAAI,GAAG,6BAA6B,CAAC;YACvC,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,YAAY,GAAqC;YACnD,GAAG,IAAI;YACP,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;SAChD,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,IAAI,CAAC,oCAAoC,IAAI,iBAAiB,OAAO,CAAC,cAAc,iBAAiB,CAAC,CAAC;QACvH,CAAC;QACD,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,6BAA6B,EAAE,YAAY,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,OAAyC;QAC9D,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,6BAA6B,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,IAA0C;QAChE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAChC,CAAC;IAED,iHAAiH;IACzG,SAAS,CAAC,OAAyC;QACvD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACxB,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,iGAAiG;YACjG,QAAQ,CAAC,yDAAyD,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,OAAe;QACxB,QAAQ,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;CACJ;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CAAC,GAAW,EAAE,aAAqB;IAClF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAChD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IACxG,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAChD,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC,CAAC,wCAAwC;IACzD,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO;QACH,IAAI,EAAE,IAAc;QACpB,cAAc,EAAE,cAAwB;QACxC,UAAU,EAAE,UAAoB;QAChC,WAAW,EAAE,WAAqB;QAClC,WAAW,EAAE,WAAqB;QAClC,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACxD,cAAc,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAClF,CAAC;AACN,CAAC;AAED,+CAA+C;AAC/C,SAAS,SAAS,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/realtimeSessions/RealtimeSessionVerificationService.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @fileoverview `RealtimeSessionVerificationService` — the production wiring of mid-session identity
+ * verification: the real {@link VerificationPorts} (session read/write, email, event publish, audit)
+ * behind a process-wide singleton the GraphQL resolver and the public verify route both call.
+ *
+ * The decisions live in `verificationWorkflow.ts`; this file is deliberately thin glue. See that
+ * module's header for the operation table, what verification does and does not do, and the
+ * concurrency contract; see `README.md` in this folder for the end-to-end flow and security model.
+ *
+ * The session-facing half of the ports (reads, trusted writes, event publish, audit — and the reasoning
+ * for which identity performs which) is {@link SessionVerificationPortsBase}; this file adds the server
+ * configuration to it.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import type { UserInfo } from '@memberjunction/core';
+import { BaseSingleton } from '@memberjunction/global';
+import { SessionVerificationPortsBase } from './SessionVerificationPortsBase.js';
+import { type OutboundEmail, type PrincipalCaller, type VerificationOperationResult, type VerificationSettings } from './verificationWorkflow.js';
+/**
+ * The production ports: {@link SessionVerificationPortsBase} plus the server configuration — the settings
+ * read from `realtime.identityVerification`, the configured service principal, and delivery through the
+ * configured communication provider. Exported for tests and for hosts that want to compose their own
+ * workflow around them; application code should use {@link RealtimeSessionVerificationService}.
+ */
+export declare class RuntimeVerificationPorts extends SessionVerificationPortsBase {
+    GetSettings(): VerificationSettings;
+    SendEmail(email: OutboundEmail): Promise<{
+        Success: boolean;
+        ErrorMessage?: string;
+    }>;
+    /** The configured service principal (see {@link SessionVerificationPortsBase}). */
+    protected ResolveServiceUser(): UserInfo | null;
+}
+/**
+ * The process-wide verification service. Call it from the `RealtimeSessionVerificationResolver`
+ * (authenticated principal) and the public `/realtime/verify` router (link capability).
+ */
+export declare class RealtimeSessionVerificationService extends BaseSingleton<RealtimeSessionVerificationService> {
+    private workflow;
+    protected constructor();
+    /** The process-wide instance. */
+    static get Instance(): RealtimeSessionVerificationService;
+    /** Whether verification is switched on and able to send mail. */
+    get IsEnabled(): boolean;
+    /** See {@link RealtimeSessionVerificationWorkflow.RequestVerification}. */
+    RequestVerification(input: {
+        AgentSessionID: string;
+        Name: string;
+        Email: string;
+    }, caller: PrincipalCaller): Promise<VerificationOperationResult>;
+    /** See {@link RealtimeSessionVerificationWorkflow.SubmitCode}. */
+    SubmitCode(input: {
+        AgentSessionID: string;
+        Code: string;
+    }, caller: PrincipalCaller): Promise<VerificationOperationResult>;
+    /** See {@link RealtimeSessionVerificationWorkflow.RedeemLink}. */
+    RedeemLink(token: string, clientIp?: string): Promise<VerificationOperationResult>;
+    /** See {@link RealtimeSessionVerificationWorkflow.GetStatus}. */
+    GetStatus(input: {
+        AgentSessionID: string;
+    }, caller: PrincipalCaller): Promise<VerificationOperationResult>;
+    /** The workflow is created on first use so its limiters pick up the loaded config. */
+    private getWorkflow;
+}
+//# sourceMappingURL=RealtimeSessionVerificationService.d.ts.map

package/dist/realtimeSessions/RealtimeSessionVerificationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RealtimeSessionVerificationService.d.ts","sourceRoot":"","sources":["../../src/realtimeSessions/RealtimeSessionVerificationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAuB,MAAM,wBAAwB,CAAC;AAM5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,OAAO,EAEH,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EAC5B,MAAM,2BAA2B,CAAC;AA0CnC;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,4BAA4B;IAC/D,WAAW,IAAI,oBAAoB;IAI7B,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyBlG,mFAAmF;IACnF,SAAS,CAAC,kBAAkB,IAAI,QAAQ,GAAG,IAAI;CAIlD;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,aAAa,CAAC,kCAAkC,CAAC;IACrG,OAAO,CAAC,QAAQ,CAAkD;IAElE,SAAS;IAIT,iCAAiC;IACjC,WAAkB,QAAQ,IAAI,kCAAkC,CAE/D;IAED,iEAAiE;IACjE,IAAW,SAAS,IAAI,OAAO,CAE9B;IAED,2EAA2E;IACpE,mBAAmB,CACtB,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAC9D,MAAM,EAAE,eAAe,GACxB,OAAO,CAAC,2BAA2B,CAAC;IAIvC,kEAAkE;IAC3D,UAAU,CAAC,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAIjI,kEAAkE;IAC3D,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAIzF,iEAAiE;IAC1D,SAAS,CAAC,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAIlH,sFAAsF;IACtF,OAAO,CAAC,WAAW;CAMtB"}

package/dist/realtimeSessions/RealtimeSessionVerificationService.js

@@ -0,0 +1,139 @@
+/**
+ * @fileoverview `RealtimeSessionVerificationService` — the production wiring of mid-session identity
+ * verification: the real {@link VerificationPorts} (session read/write, email, event publish, audit)
+ * behind a process-wide singleton the GraphQL resolver and the public verify route both call.
+ *
+ * The decisions live in `verificationWorkflow.ts`; this file is deliberately thin glue. See that
+ * module's header for the operation table, what verification does and does not do, and the
+ * concurrency contract; see `README.md` in this folder for the end-to-end flow and security model.
+ *
+ * The session-facing half of the ports (reads, trusted writes, event publish, audit — and the reasoning
+ * for which identity performs which) is {@link SessionVerificationPortsBase}; this file adds the server
+ * configuration to it.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { BaseSingleton, TrimTrailingSlashes } from '@memberjunction/global';
+import { CommunicationEngine } from '@memberjunction/communication-engine';
+import { Message } from '@memberjunction/communication-types';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import { configInfo } from '../config.js';
+import { ResolveConfiguredPrincipal } from '../auth/principals.js';
+import { SessionVerificationPortsBase } from './SessionVerificationPortsBase.js';
+import { ReadIdentityVerificationPolicyLayer } from './verificationPolicy.js';
+import { RealtimeSessionVerificationWorkflow, } from './verificationWorkflow.js';
+import { ConfiguredPublicUrl } from '../apiRoot.js';
+/** Purpose label for principal-resolution diagnostics. */
+const PRINCIPAL_PURPOSE = 'RealtimeVerification';
+/** The base URL emailed links are built from: explicit setting, else the server's public URL (same derivation magic links use). */
+function resolvePublicBaseUrl(explicit) {
+    const candidate = explicit?.trim() || ConfiguredPublicUrl();
+    return candidate ? TrimTrailingSlashes(candidate) : undefined;
+}
+/** The shortest `hmacSecret` accepted. */
+const MIN_HMAC_SECRET_LENGTH = 16;
+/** True when the configured HMAC secret is long enough to protect the stored code hash. */
+function hasUsableHmacSecret(secret) {
+    return !!secret && secret.length >= MIN_HMAC_SECRET_LENGTH;
+}
+/** Reads the live settings from server config. */
+function readSettings() {
+    const cfg = configInfo.realtime?.identityVerification;
+    const limits = cfg?.rateLimits;
+    return {
+        // A feature that cannot send mail, or cannot protect the codes it issues, is not available — whatever `enabled` says.
+        Enabled: !!cfg?.enabled && !!cfg.communicationProvider && hasUsableHmacSecret(cfg.hmacSecret),
+        CodeHashKey: cfg?.hmacSecret ?? '',
+        PolicyDefaults: ReadIdentityVerificationPolicyLayer(cfg?.policy),
+        PublicBaseUrl: resolvePublicBaseUrl(cfg?.publicBaseUrl),
+        RateLimits: {
+            SendWindowMs: limits?.sendWindowMs ?? 3_600_000,
+            PerIpSends: limits?.perIpSends ?? 10,
+            PerEmailDomainSends: limits?.perEmailDomainSends ?? 30,
+            PerEmailSends: limits?.perEmailSends ?? 3,
+            CodeAttemptWindowMs: limits?.codeAttemptWindowMs ?? 600_000,
+            PerSessionCodeAttempts: limits?.perSessionCodeAttempts ?? 10,
+        },
+    };
+}
+/**
+ * The production ports: {@link SessionVerificationPortsBase} plus the server configuration — the settings
+ * read from `realtime.identityVerification`, the configured service principal, and delivery through the
+ * configured communication provider. Exported for tests and for hosts that want to compose their own
+ * workflow around them; application code should use {@link RealtimeSessionVerificationService}.
+ */
+export class RuntimeVerificationPorts extends SessionVerificationPortsBase {
+    GetSettings() {
+        return readSettings();
+    }
+    async SendEmail(email) {
+        const cfg = configInfo.realtime?.identityVerification;
+        const user = this.ResolveServiceUser();
+        if (!cfg?.communicationProvider || !user) {
+            return { Success: false, ErrorMessage: 'No communication provider or service principal is configured.' };
+        }
+        try {
+            const engine = CommunicationEngine.Instance;
+            await engine.Config(false, user);
+            const message = new Message();
+            // Rehearsal mode: the engine builds and LOGS the message but never delivers it (see the config docs).
+            message.DryRun = cfg.deliveryMode === 'dry-run';
+            message.From = cfg.fromAddress ?? '';
+            message.To = email.To;
+            message.Subject = email.Subject;
+            message.Body = email.Text;
+            message.HTMLBody = email.Html;
+            const result = await engine.SendSingleMessage(cfg.communicationProvider, 'Email', message);
+            return result?.Success ? { Success: true } : { Success: false, ErrorMessage: result?.Error ?? 'unknown provider error' };
+        }
+        catch (error) {
+            return { Success: false, ErrorMessage: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    /** The configured service principal (see {@link SessionVerificationPortsBase}). */
+    ResolveServiceUser() {
+        const configured = configInfo.realtime?.identityVerification?.contextUserForVerification;
+        return ResolveConfiguredPrincipal(configured, PRINCIPAL_PURPOSE) ?? UserCache.Instance.GetSystemUser() ?? null;
+    }
+}
+/**
+ * The process-wide verification service. Call it from the `RealtimeSessionVerificationResolver`
+ * (authenticated principal) and the public `/realtime/verify` router (link capability).
+ */
+export class RealtimeSessionVerificationService extends BaseSingleton {
+    constructor() {
+        super();
+    }
+    /** The process-wide instance. */
+    static get Instance() {
+        return super.getInstance();
+    }
+    /** Whether verification is switched on and able to send mail. */
+    get IsEnabled() {
+        return readSettings().Enabled;
+    }
+    /** See {@link RealtimeSessionVerificationWorkflow.RequestVerification}. */
+    RequestVerification(input, caller) {
+        return this.getWorkflow().RequestVerification(input, caller);
+    }
+    /** See {@link RealtimeSessionVerificationWorkflow.SubmitCode}. */
+    SubmitCode(input, caller) {
+        return this.getWorkflow().SubmitCode(input, caller);
+    }
+    /** See {@link RealtimeSessionVerificationWorkflow.RedeemLink}. */
+    RedeemLink(token, clientIp) {
+        return this.getWorkflow().RedeemLink(token, { Kind: 'link', ClientIp: clientIp });
+    }
+    /** See {@link RealtimeSessionVerificationWorkflow.GetStatus}. */
+    GetStatus(input, caller) {
+        return this.getWorkflow().GetStatus(input, caller);
+    }
+    /** The workflow is created on first use so its limiters pick up the loaded config. */
+    getWorkflow() {
+        if (!this.workflow) {
+            this.workflow = new RealtimeSessionVerificationWorkflow(new RuntimeVerificationPorts());
+        }
+        return this.workflow;
+    }
+}
+//# sourceMappingURL=RealtimeSessionVerificationService.js.map

package/dist/realtimeSessions/RealtimeSessionVerificationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RealtimeSessionVerificationService.js","sourceRoot":"","sources":["../../src/realtimeSessions/RealtimeSessionVerificationService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EACH,mCAAmC,GAKtC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,mIAAmI;AACnI,SAAS,oBAAoB,CAAC,QAA4B;IACtD,MAAM,SAAS,GACX,QAAQ,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE,CAAC;IAC9C,OAAO,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,0CAA0C;AAC1C,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,2FAA2F;AAC3F,SAAS,mBAAmB,CAAC,MAA0B;IACnD,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,sBAAsB,CAAC;AAC/D,CAAC;AAED,kDAAkD;AAClD,SAAS,YAAY;IACjB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACtD,MAAM,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;IAC/B,OAAO;QACH,sHAAsH;QACtH,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7F,WAAW,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE;QAClC,cAAc,EAAE,mCAAmC,CAAC,GAAG,EAAE,MAAM,CAAC;QAChE,aAAa,EAAE,oBAAoB,CAAC,GAAG,EAAE,aAAa,CAAC;QACvD,UAAU,EAAE;YACR,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,SAAS;YAC/C,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,EAAE;YACpC,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,IAAI,EAAE;YACtD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC;YACzC,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,IAAI,OAAO;YAC3D,sBAAsB,EAAE,MAAM,EAAE,sBAAsB,IAAI,EAAE;SAC/D;KACJ,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,4BAA4B;IAC/D,WAAW;QACd,OAAO,YAAY,EAAE,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAAoB;QACvC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,+DAA+D,EAAE,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC;YAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,sGAAsG;YACtG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC;YAChD,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACrC,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAChC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAC1B,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3F,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,IAAI,wBAAwB,EAAE,CAAC;QAC7H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpG,CAAC;IACL,CAAC;IAGD,mFAAmF;IACzE,kBAAkB;QACxB,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,EAAE,oBAAoB,EAAE,0BAA0B,CAAC;QACzF,OAAO,0BAA0B,CAAC,UAAU,EAAE,iBAAiB,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC;IACnH,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,OAAO,kCAAmC,SAAQ,aAAiD;IAGrG;QACI,KAAK,EAAE,CAAC;IACZ,CAAC;IAED,iCAAiC;IAC1B,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAsC,CAAC;IACnE,CAAC;IAED,iEAAiE;IACjE,IAAW,SAAS;QAChB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,2EAA2E;IACpE,mBAAmB,CACtB,KAA8D,EAC9D,MAAuB;QAEvB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,kEAAkE;IAC3D,UAAU,CAAC,KAA+C,EAAE,MAAuB;QACtF,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,kEAAkE;IAC3D,UAAU,CAAC,KAAa,EAAE,QAAiB;QAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,iEAAiE;IAC1D,SAAS,CAAC,KAAiC,EAAE,MAAuB;QACvE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,sFAAsF;IAC9E,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,IAAI,CAAC,QAAQ,GAAG,IAAI,mCAAmC,CAAC,IAAI,wBAAwB,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;CACJ"}

package/dist/realtimeSessions/RealtimeVerifyRouter.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @fileoverview The PUBLIC verify-link routes of mid-session identity verification.
+ *
+ * Mounted BEFORE the unified auth middleware (the person opening the emailed link — often on another
+ * device — holds no MJ token; the single-use token IS the capability).
+ *
+ * | Route | Effect |
+ * |---|---|
+ * | `GET  /realtime/verify/:token` | Renders a one-button confirmation page. **No side effects.** |
+ * | `POST /realtime/verify` (form field `token`) | Redeems the token; renders "You're verified" or the uniform failure page. |
+ *
+ * ## Why the redemption is a POST
+ *
+ * Mail scanners and link previewers GET every URL in a message. A GET that consumed the single-use token
+ * would let a scanner burn it before the human clicks. The magic-link redeem endpoint made the same
+ * choice. The human's click submits the form.
+ *
+ * ## What the responses reveal
+ *
+ * Nothing about any session. A malformed token, an unknown session, an expired link, a used link and a
+ * voided verification all render the SAME page with the SAME status; success is a bare "You're verified".
+ * Responses are `no-store`, never framed, sent with `Referrer-Policy: no-referrer` (the token is in the
+ * URL of the GET), and carry a CSP that forbids everything but the page's own inline style.
+ *
+ * @module @memberjunction/server/realtimeSessions
+ */
+import { Router } from 'express';
+import { RealtimeSessionVerificationService } from './RealtimeSessionVerificationService.js';
+/** Mount path of the public verify routes. Under `/realtime`, which is already reserved against server extensions. */
+export declare const REALTIME_VERIFY_MOUNT_PATH = "/realtime/verify";
+/**
+ * Builds the public verify router. Mount at {@link REALTIME_VERIFY_MOUNT_PATH} BEFORE the auth
+ * middleware.
+ *
+ * @param service - the verification service (injectable for tests; defaults to the process singleton)
+ */
+export declare function CreateRealtimeVerifyRouter(service?: Pick<RealtimeSessionVerificationService, 'RedeemLink'>): Router;
+//# sourceMappingURL=RealtimeVerifyRouter.d.ts.map

package/dist/realtimeSessions/RealtimeVerifyRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RealtimeVerifyRouter.d.ts","sourceRoot":"","sources":["../../src/realtimeSessions/RealtimeVerifyRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAA2C,MAAM,SAAS,CAAC;AAI1E,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAI7F,sHAAsH;AACtH,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAoB7D;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACtC,OAAO,GAAE,IAAI,CAAC,kCAAkC,EAAE,YAAY,CAA+C,GAC9G,MAAM,CA4CR"}