@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/dist/realtimeWidget/WidgetSessionService.js

@@ -9,18 +9,20 @@
  * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
  * carried in the token, plus best-effort structured audit logging. The minted
  * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
- * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ * JWKS) and synthesized into a constrained guest principal by `BuildMagicLinkSessionUser`.
  *
  * @module @memberjunction/server/widget
  */
+import { createPublicKey } from 'node:crypto';
+import jwt from 'jsonwebtoken';
 import { Metadata, RunView, LogError, LogStatus } from '@memberjunction/core';
-import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
+import { ComputeJwkThumbprint, MJLruCache, ToProofPublicJwk, UUIDsEqual, VerifyProofOfPossessionJwt } from '@memberjunction/global';
 import { ResolveConfiguredPrincipal } from '../auth/principals.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { GenerateSessionId } from '../auth/magicLink/magicLinkCore.js';
 import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
 import { configInfo } from '../config.js';
-import { BuildWidgetGuestClaims, EvaluateWidgetMint, ParseEnabledChannels } from './widgetCore.js';
+import { BuildWidgetGuestClaims, EvaluateWidgetMint, IsIsolatedGuestRole, ParseEnabledChannels } from './widgetCore.js';
 import { VerifyHostAssertion } from './host-identity.js';
 import { WriteReturningVisitorRecap } from '../agentSessions/ReturningVisitorRecap.js';
 import { ResolveIdentityByEmail, MergeVisitorIdentity, ForgetVisitor } from './visitorIdentity.js';
@@ -28,6 +30,28 @@ const WIDGET_ENTITY = 'MJ: Conversation Widget Instances';
 const CONVERSATIONS_ENTITY = 'MJ: Conversations';
 /** Shape of the durable visitor anchor key (opaque base64url, same alphabet as generateSessionId). */
 const VISITOR_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+/**
+ * Maximum clock-skew / late-timer grace window (seconds) after `exp` during which
+ * `RefreshGuestSession` still accepts a widget guest Bearer token and preserves its `mj_sid`.
+ */
+export const REFRESH_GRACE_SECONDS = 300;
+/**
+ * Hard end of a widget guest session (seconds after its first mint, `mj_sid_iat`). Refresh keeps the
+ * visitor's `mj_sid`, so without an end a token captured once could be renewed forever and keep reading
+ * that visitor's conversations; past this point refresh is refused and no token outlives it.
+ */
+export const MAX_GUEST_SESSION_SECONDS = 12 * 3600;
+/**
+ * The least lifetime a refreshed token may have. Refresh is refused once less than this remains before the hard end,
+ * so the last refresh gets the 403 that makes the widget start a new session. It must exceed the widget's refresh
+ * lead (60 s before `exp`): a token issued with less would be due for refresh at once, every time, until the rate
+ * limiter answered 429 instead. It also keeps a re-minted token's `exp` after its `iat`.
+ */
+export const MIN_REFRESHED_TOKEN_SECONDS = 120;
+/** The refresh route's path under the widget mount; the refresh proof must name it (`htu`). */
+export const WIDGET_REFRESH_PATH = '/session/refresh';
+/** How far a refresh proof's signing time (`iat`) may be from the server clock, either way. */
+export const REFRESH_PROOF_MAX_SKEW_SECONDS = 60;
 /** Minimal email sanity check (presence + single `@` with a dotted domain) — not full RFC validation. */
 function isLikelyEmail(email) {
     return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email);
@@ -37,9 +61,12 @@ function isLikelyEmail(email) {
  * Stateless; constructed once at server startup alongside the magic-link service.
  */
 export class WidgetSessionService {
-    constructor(publicUrl, config) {
+    constructor(publicUrl, config, 
+    /** Which roles a widget may hand to an anonymous guest; by default only the scope-isolated `Widget Guest`. */
+    guestRolePolicy = { GrantableRoleNames: [] }) {
         this.publicUrl = publicUrl;
         this.config = config;
+        this.guestRolePolicy = guestRolePolicy;
         /**
          * Short-TTL, size-bounded cache of resolved per-instance rate limits, so the limiter doesn't hit
          * the DB per request. The cache key (`widgetKey`) is presented by an UNAUTHENTICATED caller on the
@@ -73,11 +100,11 @@ export class WidgetSessionService {
             if (!eligibility.ok) {
                 return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
             }
-            const guestRoleName = this.resolveGuestRoleName(widget.GuestRoleID);
-            if (!guestRoleName) {
-                LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
-                return this.audited({ success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' }, input, widget);
+            const guestRole = this.resolveIsolatedGuestRole(widget);
+            if (guestRole.ok === false) {
+                return this.audited(guestRole.refusal, input, widget);
             }
+            const guestRoleName = guestRole.name;
             // D1 host-identity strategy: a HostIdentity widget MUST present a valid host assertion.
             let hostIdentity;
             if (widget.AuthStrategy === 'HostIdentity') {
@@ -98,7 +125,16 @@ export class WidgetSessionService {
             // RV4 (host-identity path): when a host asserts a resolvable identity, promote the visitor's prior
             // anonymous trail to that record and surface the pair so the client stamps the new conversation.
             const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
-            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity), input, widget);
+            let proofKeyThumbprint;
+            if (input.ProofKey !== undefined) {
+                const proofKey = ToProofPublicJwk(input.ProofKey);
+                if (!proofKey) {
+                    LogError(`[Widget] Mint for widget ${widget.ID} refused: the proof key is not a public P-256 JWK.`);
+                    return this.audited({ success: false, errorCode: 'not_found', error: 'Widget mint rejected.' }, input, widget);
+                }
+                proofKeyThumbprint = await ComputeJwkThumbprint(proofKey);
+            }
+            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, undefined, proofKeyThumbprint), input, widget);
         }
         catch (e) {
             LogError(e);
@@ -106,12 +142,133 @@ export class WidgetSessionService {
         }
     }
     /**
-     * Refreshes a live guest session. The widget always holds its public key, so a
-     * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
-     * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+     * Refreshes a live guest session while preserving its per-visitor `sessionId` (`mj_sid`).
+     * Requires the caller's current widget guest JWT (`input.BearerToken`), verified against the
+     * magic-link signing key with a {@link REFRESH_GRACE_SECONDS} post-expiry grace window, and
+     * bound to the resolved widget instance (`mj_widget_id === widget.ID`, `mj_anon === true`,
+     * `mj_magic_link === true`). Any failure returns the same uniform 403 shape as an unknown widget key.
      */
     async RefreshGuestSession(input) {
-        return this.MintGuestSession(input);
+        try {
+            const contextUser = this.resolveLookupUser();
+            if (!contextUser) {
+                LogError('[Widget] No lookup context user available; server not configured.');
+                return { success: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+            }
+            const widget = await this.loadWidgetByKey(input.widgetKey, contextUser);
+            if (!widget) {
+                return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, undefined);
+            }
+            const eligibility = EvaluateWidgetMint({ Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality }, input.origin);
+            if (!eligibility.ok) {
+                return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
+            }
+            const guestRole = this.resolveIsolatedGuestRole(widget);
+            if (guestRole.ok === false) {
+                return this.audited(guestRole.refusal, input, widget);
+            }
+            const guestRoleName = guestRole.name;
+            let hostIdentity;
+            if (widget.AuthStrategy === 'HostIdentity') {
+                const verified = this.verifyHost(widget, input.hostAssertion);
+                if (!verified) {
+                    return this.audited({ success: false, errorCode: 'host_assertion_invalid', error: 'Host identity assertion invalid.' }, input, widget);
+                }
+                hostIdentity = verified;
+            }
+            const existingSession = await this.verifyRefreshRequest(input.BearerToken, input.Proof, widget.ID);
+            if (!existingSession) {
+                return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, widget);
+            }
+            const returningVisitor = await this.resolveReturningVisitor(widget, input.visitorKey, contextUser);
+            const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
+            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, existingSession, existingSession.KeyThumbprint), input, widget);
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * Verifies a `RefreshGuestSession` request: the caller's current widget guest JWT and the proof that the
+     * caller holds the key the token is bound to. Returns the session to carry forward, or `null` when the token
+     * is missing, tampered, expired past {@link REFRESH_GRACE_SECONDS}, past the session's hard end
+     * ({@link MAX_GUEST_SESSION_SECONDS}) or without a session start, non-anonymous, minted for a different
+     * widget, issued by another deployment, or not bound to a key; or when the proof is missing or not made by
+     * that key for this request and token.
+     */
+    async verifyRefreshRequest(bearerToken, proof, widgetId) {
+        const session = this.verifyRefreshBearerToken(bearerToken, widgetId);
+        if (!session) {
+            return null;
+        }
+        const verification = await VerifyProofOfPossessionJwt(proof ?? '', {
+            Method: 'POST',
+            PathSuffix: WIDGET_REFRESH_PATH,
+            AccessToken: (bearerToken ?? '').trim(),
+            NowSeconds: Math.floor(Date.now() / 1000),
+            MaxSkewSeconds: REFRESH_PROOF_MAX_SKEW_SECONDS,
+        });
+        if (verification.Valid === false) {
+            LogError(`[Widget] Refresh proof refused for widget ${widgetId} (${verification.Reason}).`);
+            return null;
+        }
+        if (verification.Thumbprint !== session.KeyThumbprint) {
+            LogError(`[Widget] Refresh proof refused for widget ${widgetId}: signed by a key the token is not bound to.`);
+            return null;
+        }
+        return session;
+    }
+    /** The token half of {@link verifyRefreshRequest}: everything except the proof. */
+    verifyRefreshBearerToken(bearerToken, widgetId) {
+        const token = (bearerToken ?? '').trim();
+        if (!token) {
+            return null;
+        }
+        try {
+            const jwk = MagicLinkKeyManager.Instance.GetJWKS().keys[0];
+            if (!jwk) {
+                return null;
+            }
+            const publicKey = createPublicKey({ key: { ...jwk }, format: 'jwk' });
+            const verified = jwt.verify(token, publicKey, {
+                algorithms: ['RS256'],
+                audience: this.config.audience,
+                issuer: this.publicUrl,
+                ignoreExpiration: true,
+            });
+            if (typeof verified !== 'object' || verified === null) {
+                return null;
+            }
+            const payload = verified;
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            if (typeof payload.exp !== 'number' || nowSeconds > payload.exp + REFRESH_GRACE_SECONDS) {
+                return null;
+            }
+            if (payload.mj_magic_link !== true || payload.mj_anon !== true) {
+                return null;
+            }
+            if (typeof payload.mj_widget_id !== 'string' || !UUIDsEqual(payload.mj_widget_id, widgetId)) {
+                return null;
+            }
+            const sid = typeof payload.mj_sid === 'string' ? payload.mj_sid.trim() : '';
+            if (sid.length === 0) {
+                return null;
+            }
+            const startedAt = payload.mj_sid_iat;
+            if (typeof startedAt !== 'number' || !Number.isFinite(startedAt) || startedAt + MAX_GUEST_SESSION_SECONDS - nowSeconds < MIN_REFRESHED_TOKEN_SECONDS) {
+                return null;
+            }
+            const keyThumbprint = typeof payload.cnf?.jkt === 'string' ? payload.cnf.jkt : '';
+            if (keyThumbprint.length === 0) {
+                return null;
+            }
+            return { SessionId: sid, StartedAtSeconds: startedAt, KeyThumbprint: keyThumbprint };
+        }
+        catch (e) {
+            LogError(`[Widget] Refresh token verification failed for widget ${widgetId}: ${e instanceof Error ? e.message : String(e)}`);
+            return null;
+        }
     }
     static { this.RATE_LIMIT_CACHE_TTL_MS = 60_000; }
     static { this.RATE_LIMIT_CACHE_MAX_SIZE = 10_000; }
@@ -158,7 +315,7 @@ export class WidgetSessionService {
      * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
      * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
      *
-     * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+     * This converges on the SAME `AuthProviderFactory` + `BuildMagicLinkSessionUser` path as the guest
      * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
      * throws for business failures — returns a structured result.
      */
@@ -220,12 +377,16 @@ export class WidgetSessionService {
         return null;
     }
     /** Builds + signs the guest JWT for an eligible widget instance. */
-    mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity) {
+    mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, existingSession, proofKeyThumbprint) {
         const nowSeconds = Math.floor(Date.now() / 1000);
         const ttlMinutes = widget.SessionTTLMinutes || this.config.defaultSessionTtlMinutes;
-        // Generated once and returned to the client: the widget stamps Conversation.ExternalID with
-        // this id so the Widget Guest RLS filters ({{ScopeResourceID}}) isolate this guest's rows.
-        const sessionId = GenerateSessionId();
+        // Generated once on initial mint and preserved across refreshes: the widget (and server-side
+        // voice session creation) stamps Conversation.ExternalID with this id so the Widget Guest RLS
+        // filters ({{ScopeResourceID}}) and AuthorizeSessionAccess isolate this guest's rows.
+        const sessionId = existingSession?.SessionId ?? GenerateSessionId();
+        const startedAtSeconds = existingSession?.StartedAtSeconds ?? nowSeconds;
+        // No token outlives the session's hard end, so the cap holds for API calls as well as for refresh.
+        const ttlSeconds = Math.min(ttlMinutes * 60, startedAtSeconds + MAX_GUEST_SESSION_SECONDS - nowSeconds);
         const claims = BuildWidgetGuestClaims({
             issuer: this.publicUrl,
             audience: this.config.audience,
@@ -235,7 +396,9 @@ export class WidgetSessionService {
             applicationId: widget.ApplicationID,
             guestRoleName,
             nowSeconds,
-            ttlSeconds: ttlMinutes * 60,
+            ttlSeconds,
+            sessionStartedAtSeconds: startedAtSeconds,
+            proofKeyThumbprint,
             hostIdentity,
             // RV1/RV2/RV4: carry the returning-visitor anchor + resolved identity as claims so the voice path
             // (server-created conversation) stamps the same fields the text path stamps client-side.
@@ -457,6 +620,25 @@ export class WidgetSessionService {
         const role = md?.Roles.find((r) => UUIDsEqual(r.ID, guestRoleId));
         return role?.Name ?? null;
     }
+    /**
+     * The ONE decision, for mint and refresh alike, of which role a guest token carries: the widget's `GuestRoleID`
+     * must resolve, and it must be a role the deployment may hand to an anonymous visitor
+     * ({@link IsIsolatedGuestRole}). Both refusals are the admin's to fix, so both are logged with the widget id;
+     * the visitor gets a uniform rejection.
+     */
+    resolveIsolatedGuestRole(widget) {
+        const name = this.resolveGuestRoleName(widget.GuestRoleID);
+        if (!name) {
+            LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
+            return { ok: false, refusal: { success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' } };
+        }
+        if (!IsIsolatedGuestRole(name, this.guestRolePolicy)) {
+            LogError(`[Widget] Widget ${widget.ID} grants guest role '${name}', whose row filters do not isolate anonymous visitors ` +
+                `from each other. Use the Widget Guest role, or list '${name}' in magicLink.grantableRoleNames to allow it (MJ#6043).`);
+            return { ok: false, refusal: { success: false, errorCode: 'guest_role_not_isolated', error: 'Widget mint rejected.' } };
+        }
+        return { ok: true, name };
+    }
     /** Resolves the server-side context user used to READ widget config (not the guest principal). */
     resolveLookupUser() {
         return ResolveConfiguredPrincipal(this.config.contextUserForLookup, 'Widget');

package/dist/realtimeWidget/WidgetSessionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"WidgetSessionService.js","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,oBAAoB,EAA4B,MAAM,iBAAiB,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,aAAa,EAAgC,MAAM,sBAAsB,CAAC;AAEjI,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAsKtD,yGAAyG;AACzG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAC/B,YACmB,SAAiB,EACjB,MAAoB;QADpB,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAc;QA0EvC;;;;;;;;WAQG;QACc,mBAAc,GAAG,IAAI,UAAU,CAAiB;YAC/D,OAAO,EAAE,oBAAoB,CAAC,yBAAyB;YACvD,KAAK,EAAE,oBAAoB,CAAC,uBAAuB;SACpD,CAAC,CAAC;IArFA,CAAC;IAEJ;;;OAGG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,KAAK,CAAC,MAAM,CACb,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3H,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACpE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,QAAQ,CAAC,uBAAuB,MAAM,CAAC,WAAW,eAAe,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBACrG,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACzH,CAAC;YAED,wFAAwF;YACxF,IAAI,YAA8C,CAAC;YACnD,IAAI,MAAM,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzI,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,6FAA6F;YAC7F,uGAAuG;YACvG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAEnG,iGAAiG;YACjG,iGAAiG;YACjG,gGAAgG;YAChG,0EAA0E;YAC1E,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEjF,mGAAmG;YACnG,iGAAiG;YACjG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEzH,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9H,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,mBAAmB,CAAC,KAA4B;QAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;aAeuB,4BAAuB,GAAG,MAAM,AAAT,CAAU;aACjC,8BAAyB,GAAG,MAAM,AAAT,CAAU;IAE3D,yFAAyF;IACzF,IAAW,kBAAkB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CAAC,SAAiB;QACxD,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,GAAG,QAAQ,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;oBAC5C,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7F,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAClF,CAAC;YACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAClJ,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YACjG,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,KAAK,kBAAkB,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;YACvH,CAAC;YACD,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,QAAQ,CAAC,4DAA4D,CAAC,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;YAC1G,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,6CAA6C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;YACxG,CAAC;YACD,iGAAiG;YACjG,kGAAkG;YAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,MAA0C,EAAE,SAA6B;QAC1F,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,QAAQ,CAAC,+CAA+C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IAC5D,SAAS,CACf,MAA0C,EAC1C,aAAqB,EACrB,YAAmC,EACnC,gBAA6C,EAC7C,gBAA0C;QAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;QACpF,4FAA4F;QAC5F,2FAA2F;QAC3F,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa;YACb,UAAU;YACV,UAAU,EAAE,UAAU,GAAG,EAAE;YAC3B,YAAY;YACZ,kGAAkG;YAClG,yFAAyF;YACzF,gBAAgB,EAAE,gBAAgB;gBAChC,CAAC,CAAC;oBACE,UAAU,EAAE,gBAAgB,CAAC,UAAU;oBACvC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;oBACvD,cAAc,EAAE,gBAAgB,EAAE,QAAQ;oBAC1C,cAAc,EAAE,gBAAgB,EAAE,QAAQ;iBAC3C;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACpD,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,mGAAmG;YACnG,kGAAkG;YAClG,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7D,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,SAAS;YAClE,yBAAyB,EAAE,CAAC,CAAC,gBAAgB;YAC7C,UAAU,EAAE,gBAAgB,EAAE,UAAU;YACxC,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;YACxD,cAAc,EAAE,gBAAgB,EAAE,QAAQ;YAC1C,cAAc,EAAE,gBAAgB,EAAE,QAAQ;SAC3C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,+BAA+B,CAC3C,MAA0C,EAC1C,YAA8C,EAC9C,gBAAwD,EACxD,WAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC;YAC/F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,yEAAyE;QAC5M,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,oBAAoB,CAAC;YACzB,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;SACvG,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CAAC,KAAkC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,yEAAyE;YAClN,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,4FAA4F;gBAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC;gBACrD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;aACvG,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,KAAyB;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,MAAM,aAAa,CAAC;gBAClE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;aACvG,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACrC,SAAiB,EACjB,UAAkB,EAClB,MAA0B;QAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;QAC5H,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAA0C,EAC1C,YAAgC,EAChC,WAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACjE,MAAM,kBAAkB,GAAG,WAAW;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;YAChG,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,8BAA8B,CAC1C,MAA0C,EAC1C,gBAAwD,EACxD,WAAqB;QAErB,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;QACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,mHAAmH;QACnH,MAAM,0BAA0B,CAC9B,mBAAmB,EACnB,MAAM,CAAC,aAAa,EACpB,WAAW,EACX,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;QAC5F,MAAM,CAAC,0BAA0B,CAClC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,oCAAoC,CAChD,UAAkB,EAClB,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,UAAU,EAAE,oBAAoB;YAChC,oGAAoG;YACpG,2FAA2F;YAC3F,WAAW,EAAE,iBAAiB,UAAU,0BAA0B,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YACtG,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;SACrB,EACD,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,6CAA6C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;IAC9C,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,WAAqB;QACpE,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,gBAAgB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YACvD,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,eAAe;SAC5B,EACD,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,0CAA0C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,sFAAsF;IAC9E,oBAAoB,CAAC,WAAmB;QAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,kFAAkF;QAChH,MAAM,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAC1F,iBAAiB;QACvB,OAAO,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,MAA8B,EAAE,KAA4B,EAAE,MAAiD;QAC7H,IAAI,CAAC;YACH,SAAS,CACP,gCAAgC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG;gBAChF,UAAU,MAAM,EAAE,EAAE,IAAI,SAAS,WAAW,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,GAAG;gBACzF,MAAM,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,EAAE,CACtC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC"}
+{"version":3,"file":"WidgetSessionService.js","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,0BAA0B,EAAuB,MAAM,wBAAwB,CAAC;AAEzJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAkD,MAAM,iBAAiB,CAAC;AACxK,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,aAAa,EAAgC,MAAM,sBAAsB,CAAC;AAEjI,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAC1D,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,sGAAsG;AACtG,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAEtD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AA6LjD,yGAAyG;AACzG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAC/B,YACmB,SAAiB,EACjB,MAAoB;IACrC,8GAA8G;IAC7F,kBAAmC,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAH7D,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAc;QAEpB,oBAAe,GAAf,eAAe,CAA8C;QA+NhF;;;;;;;;WAQG;QACc,mBAAc,GAAG,IAAI,UAAU,CAAiB;YAC/D,OAAO,EAAE,oBAAoB,CAAC,yBAAyB;YACvD,KAAK,EAAE,oBAAoB,CAAC,uBAAuB;SACpD,CAAC,CAAC;IA1OA,CAAC;IAEJ;;;OAGG;IACI,KAAK,CAAC,gBAAgB,CAAC,KAA4B;QACxD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,KAAK,CAAC,MAAM,CACb,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3H,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC;YAErC,wFAAwF;YACxF,IAAI,YAA8C,CAAC;YACnD,IAAI,MAAM,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzI,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,6FAA6F;YAC7F,uGAAuG;YACvG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAEnG,iGAAiG;YACjG,iGAAiG;YACjG,gGAAgG;YAChG,0EAA0E;YAC1E,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEjF,mGAAmG;YACnG,iGAAiG;YACjG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEzH,IAAI,kBAAsC,CAAC;YAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,CAAC,4BAA4B,MAAM,CAAC,EAAE,oDAAoD,CAAC,CAAC;oBACpG,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjH,CAAC;gBACD,kBAAkB,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,CAAC,EACtH,KAAK,EACL,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,mBAAmB,CAAC,KAA4B;QAC3D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,mEAAmE,CAAC,CAAC;gBAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAClH,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,KAAK,CAAC,MAAM,CACb,CAAC;YACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3H,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC;YAErC,IAAI,YAA8C,CAAC;YACnD,IAAI,MAAM,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzI,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;YAC1B,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACnG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/G,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACnG,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAEzH,OAAO,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,aAAa,CAAC,EACvI,KAAK,EACL,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,oBAAoB,CAAC,WAA+B,EAAE,KAAyB,EAAE,QAAgB;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,KAAK,IAAI,EAAE,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,mBAAmB;YAC/B,WAAW,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACvC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACzC,cAAc,EAAE,8BAA8B;SAC/C,CAAC,CAAC;QACH,IAAI,YAAY,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACjC,QAAQ,CAAC,6CAA6C,QAAQ,KAAK,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,YAAY,CAAC,UAAU,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YACtD,QAAQ,CAAC,6CAA6C,QAAQ,8CAA8C,CAAC,CAAC;YAC9G,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mFAAmF;IAC3E,wBAAwB,CAAC,WAA+B,EAAE,QAAgB;QAChF,MAAM,KAAK,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC5C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC9B,MAAM,EAAE,IAAI,CAAC,SAAS;gBACtB,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,QAA0B,CAAC;YAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACjD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,UAAU,GAAG,OAAO,CAAC,GAAG,GAAG,qBAAqB,EAAE,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;YACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,yBAAyB,GAAG,UAAU,GAAG,2BAA2B,EAAE,CAAC;gBACrJ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAAG,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;QACvF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,yDAAyD,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;aAeuB,4BAAuB,GAAG,MAAM,AAAT,CAAU;aACjC,8BAAyB,GAAG,MAAM,AAAT,CAAU;IAE3D,yFAAyF;IACzF,IAAW,kBAAkB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CAAC,SAAiB;QACxD,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAK,GAAG,QAAQ,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;oBAC5C,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,KAA+B;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC7F,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;YAC5G,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAClF,CAAC;YACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAClJ,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;YACjG,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,KAAK,kBAAkB,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;YACvH,CAAC;YACD,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,QAAQ,CAAC,4DAA4D,CAAC,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;YAC1G,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,6CAA6C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;gBACrH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;YACxG,CAAC;YACD,iGAAiG;YACjG,kGAAkG;YAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,MAA0C,EAAE,SAA6B;QAC1F,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,QAAQ,CAAC,+CAA+C,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IAC5D,SAAS,CACf,MAA0C,EAC1C,aAAqB,EACrB,YAAmC,EACnC,gBAA6C,EAC7C,gBAA0C,EAC1C,eAAyC,EACzC,kBAA2B;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;QACpF,6FAA6F;QAC7F,8FAA8F;QAC9F,sFAAsF;QACtF,MAAM,SAAS,GAAG,eAAe,EAAE,SAAS,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,gBAAgB,GAAG,eAAe,EAAE,gBAAgB,IAAI,UAAU,CAAC;QACzE,mGAAmG;QACnG,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,EAAE,gBAAgB,GAAG,yBAAyB,GAAG,UAAU,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa;YACb,UAAU;YACV,UAAU;YACV,uBAAuB,EAAE,gBAAgB;YACzC,kBAAkB;YAClB,YAAY;YACZ,kGAAkG;YAClG,yFAAyF;YACzF,gBAAgB,EAAE,gBAAgB;gBAChC,CAAC,CAAC;oBACE,UAAU,EAAE,gBAAgB,CAAC,UAAU;oBACvC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;oBACvD,cAAc,EAAE,gBAAgB,EAAE,QAAQ;oBAC1C,cAAc,EAAE,gBAAgB,EAAE,QAAQ;iBAC3C;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACpD,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;YACT,mGAAmG;YACnG,kGAAkG;YAClG,eAAe,EAAE,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7D,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,SAAS;YAClE,yBAAyB,EAAE,CAAC,CAAC,gBAAgB;YAC7C,UAAU,EAAE,gBAAgB,EAAE,UAAU;YACxC,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB;YACxD,cAAc,EAAE,gBAAgB,EAAE,QAAQ;YAC1C,cAAc,EAAE,gBAAgB,EAAE,QAAQ;SAC3C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,+BAA+B,CAC3C,MAA0C,EAC1C,YAA8C,EAC9C,gBAAwD,EACxD,WAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,yBAAyB,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,UAAU,EAAE,CAAC;YAC/F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,yEAAyE;QAC5M,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,oBAAoB,CAAC;YACzB,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;SACvG,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,sBAAsB,CAAC,KAAkC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,yEAAyE;YAClN,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,4FAA4F;gBAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC;gBACrD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;aACvG,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,KAAyB;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,MAAM,aAAa,CAAC;gBAClE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;gBACxC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;aACvG,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACrC,SAAiB,EACjB,UAAkB,EAClB,MAA0B;QAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,WAAW,GAAG,kBAAkB,CACpC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3F,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;QAC5H,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAA0C,EAC1C,YAAgC,EAChC,WAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACjE,MAAM,kBAAkB,GAAG,WAAW;YACpC,CAAC,CAAC,MAAM,IAAI,CAAC,oCAAoC,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC;YAChG,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,8BAA8B,CAC1C,MAA0C,EAC1C,gBAAwD,EACxD,WAAqB;QAErB,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC;QACjE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,mHAAmH;QACnH,MAAM,0BAA0B,CAC9B,mBAAmB,EACnB,MAAM,CAAC,aAAa,EACpB,WAAW,EACX,QAAQ,CAAC,QAAQ,EAAE,yEAAyE;QAC5F,MAAM,CAAC,0BAA0B,CAClC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,oCAAoC,CAChD,UAAkB,EAClB,aAAqB,EACrB,WAAqB;QAErB,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,UAAU,EAAE,oBAAoB;YAChC,oGAAoG;YACpG,2FAA2F;YAC3F,WAAW,EAAE,iBAAiB,UAAU,0BAA0B,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YACtG,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,CAAC;YACd,UAAU,EAAE,QAAQ;SACrB,EACD,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,6CAA6C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC;IAC9C,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,WAAqB;QACpE,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;YACE,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,gBAAgB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YACvD,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,eAAe;SAC5B,EACD,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,0CAA0C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,sFAAsF;IAC9E,oBAAoB,CAAC,WAAmB;QAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,kFAAkF;QAChH,MAAM,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,wBAAwB,CAC9B,MAA0C;QAE1C,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,uBAAuB,MAAM,CAAC,WAAW,eAAe,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;YACrG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACrD,QAAQ,CACN,mBAAmB,MAAM,CAAC,EAAE,uBAAuB,IAAI,yDAAyD;gBAC9G,wDAAwD,IAAI,0DAA0D,CACzH,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAC1F,iBAAiB;QACvB,OAAO,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,MAA8B,EAAE,KAA4B,EAAE,MAAiD;QAC7H,IAAI,CAAC;YACH,SAAS,CACP,gCAAgC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG;gBAChF,UAAU,MAAM,EAAE,EAAE,IAAI,SAAS,WAAW,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,GAAG;gBACzF,MAAM,KAAK,CAAC,KAAK,EAAE,SAAS,IAAI,GAAG,EAAE,CACtC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC"}

package/dist/realtimeWidget/host-identity.d.ts

@@ -5,7 +5,7 @@
  * `POST /widget/session`, which verifies it against the host's registered public key
  * and folds the host-provided identity into the minted guest claims. The minted token
  * is still validated by the same `magic-link` AuthProviderFactory path + synthesized by
- * `buildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
+ * `BuildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
  * session-validation provider (it converges on the one pathway, per D1).
  *
  * Pure + unit-testable: verification takes the PEM as an argument.

package/dist/realtimeWidget/host-identity.js

@@ -5,7 +5,7 @@
  * `POST /widget/session`, which verifies it against the host's registered public key
  * and folds the host-provided identity into the minted guest claims. The minted token
  * is still validated by the same `magic-link` AuthProviderFactory path + synthesized by
- * `buildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
+ * `BuildMagicLinkSessionUser` — host-identity is a MINT-TIME strategy, not a second
  * session-validation provider (it converges on the one pathway, per D1).
  *
  * Pure + unit-testable: verification takes the PEM as an argument.

package/dist/realtimeWidget/widgetCore.d.ts

@@ -19,7 +19,22 @@ import type { MagicLinkJWTClaims } from '../auth/magicLink/types.js';
  */
 export declare const WIDGET_SESSION_RESOURCE_TYPE = "Widget Session";
 /** Why a guest-session mint was rejected. Drives the HTTP status in the router. */
-export type WidgetMintErrorCode = 'not_found' | 'disabled' | 'origin_not_allowed' | 'modality_not_enabled' | 'host_assertion_invalid' | 'upgrade_not_enabled' | 'invalid_email' | 'server_error';
+export type WidgetMintErrorCode = 'not_found' | 'disabled' | 'origin_not_allowed' | 'modality_not_enabled' | 'host_assertion_invalid' | 'upgrade_not_enabled' | 'invalid_email' | 'guest_role_not_isolated' | 'server_error';
+/**
+ * The one stock role whose row filters key on the per-visitor scope id (`{{ScopeResourceID}}`) rather than on
+ * `UserID`. Every anonymous widget guest authenticates as the ONE shared Anonymous user, so a role whose filters
+ * compare `UserID` (the stock `UI` role, for instance) lets every guest read and update every other guest's rows
+ * through the generic API (MJ#6043). A widget may therefore grant only this role, or a role the deployment has
+ * explicitly listed as safe for anonymous visitors — the same opt-in list magic-link invites use.
+ */
+export declare const WIDGET_GUEST_ROLE_NAME = "Widget Guest";
+/** Which roles, beyond {@link WIDGET_GUEST_ROLE_NAME}, a deployment allows a widget to hand to an anonymous guest. */
+export interface GuestRolePolicy {
+    /** Role names (case-insensitive) the deployment has opted in, normally `magicLink.grantableRoleNames`. */
+    GrantableRoleNames: readonly string[];
+}
+/** Pure check: may a widget grant `roleName` to an anonymous guest under `policy`? See {@link WIDGET_GUEST_ROLE_NAME}. */
+export declare function IsIsolatedGuestRole(roleName: string | null | undefined, policy: GuestRolePolicy): boolean;
 /** The minimal widget-instance shape the pure validators need (a subset of the entity). */
 export interface WidgetInstanceEligibilityInput {
     Status: string;
@@ -96,6 +111,10 @@ export declare function BuildWidgetGuestClaims(args: {
     guestRoleName: string;
     nowSeconds: number;
     ttlSeconds: number;
+    /** When `sessionId` was first minted (`mj_sid_iat`); a refresh passes the original. Defaults to `nowSeconds`. */
+    sessionStartedAtSeconds?: number;
+    /** Thumbprint of the widget's proof key (`cnf.jkt`). Without it the token cannot be refreshed. */
+    proofKeyThumbprint?: string;
     /**
      * Host-asserted identity for a `host-identity` session. Its email/name are carried as
      * INFORMATIONAL claims only — the principal-resolving `email`/`sub` remain the shared

package/dist/realtimeWidget/widgetCore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"widgetCore.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GACzB,WAAW,GACX,UAAU,GACV,oBAAoB,GACpB,sBAAsB,GACtB,wBAAwB,GACxB,qBAAqB,GACrB,eAAe,GACf,cAAc,CAAC;AAErB,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAgBvF;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAEvF;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAazF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMpH;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEpH;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAM9F;AAED,iDAAiD;AACjD,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAE9F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,8BAA8B,EACtC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAQlD;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,8BAA8B,EACtC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAElD;AAcD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAM1E;AAED,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GAAG,kBAAkB,CAsCrB;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GAAG,kBAAkB,CAErB"}
+{"version":3,"file":"widgetCore.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAC;AAE7D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,GACzB,WAAW,GACX,UAAU,GACV,oBAAoB,GACpB,sBAAsB,GACtB,wBAAwB,GACxB,qBAAqB,GACrB,eAAe,GACf,yBAAyB,GACzB,cAAc,CAAC;AAErB;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AAErD,sHAAsH;AACtH,MAAM,WAAW,eAAe;IAC9B,0GAA0G;IAC1G,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,0HAA0H;AAC1H,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAEzG;AAED,2FAA2F;AAC3F,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAgBvF;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAEvF;AAOD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAazF;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAMpH;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEpH;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAM9F;AAED,iDAAiD;AACjD,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAE9F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,8BAA8B,EACtC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAQlD;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,8BAA8B,EACtC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAAE,CAElD;AAcD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAM1E;AAED,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,iHAAiH;IACjH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kGAAkG;IAClG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GAAG,kBAAkB,CA0CrB;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GAAG,kBAAkB,CAErB"}

package/dist/realtimeWidget/widgetCore.js

@@ -11,13 +11,25 @@
  *
  * @module @memberjunction/server/widget
  */
-import { BuildSessionClaims } from '../auth/magicLink/magicLinkCore.js';
+import { BuildSessionClaims, IsRoleGrantable } from '../auth/magicLink/magicLinkCore.js';
 /**
  * The magic-link resource-scope `resourceType` used for a widget guest session. Pairs with the
  * opaque session id as `resourceId` so the synthesized principal's MagicLinkScope.ResourceID is
  * the session id — the discriminator the Widget Guest RLS filters key on for per-session isolation.
  */
 export const WIDGET_SESSION_RESOURCE_TYPE = 'Widget Session';
+/**
+ * The one stock role whose row filters key on the per-visitor scope id (`{{ScopeResourceID}}`) rather than on
+ * `UserID`. Every anonymous widget guest authenticates as the ONE shared Anonymous user, so a role whose filters
+ * compare `UserID` (the stock `UI` role, for instance) lets every guest read and update every other guest's rows
+ * through the generic API (MJ#6043). A widget may therefore grant only this role, or a role the deployment has
+ * explicitly listed as safe for anonymous visitors — the same opt-in list magic-link invites use.
+ */
+export const WIDGET_GUEST_ROLE_NAME = 'Widget Guest';
+/** Pure check: may a widget grant `roleName` to an anonymous guest under `policy`? See {@link WIDGET_GUEST_ROLE_NAME}. */
+export function IsIsolatedGuestRole(roleName, policy) {
+    return IsRoleGrantable(roleName, WIDGET_GUEST_ROLE_NAME, policy.GrantableRoleNames);
+}
 /**
  * Parses the widget's `AllowedOrigins` column into a normalized origin list.
  * Accepts a JSON array (preferred, e.g. `["https://a.com","https://b.com"]`) or a
@@ -180,6 +192,10 @@ export function BuildWidgetGuestClaims(args) {
     });
     // Additive widget claim — lets the synthesized principal be bound to one widget.
     claims.mj_widget_id = args.widgetId;
+    claims.mj_sid_iat = args.sessionStartedAtSeconds ?? args.nowSeconds;
+    if (args.proofKeyThumbprint) {
+        claims.cnf = { jkt: args.proofKeyThumbprint };
+    }
     if (args.hostIdentity) {
         claims.given_name = args.hostIdentity.firstName ?? claims.given_name;
         claims.family_name = args.hostIdentity.lastName ?? claims.family_name;

package/dist/realtimeWidget/widgetCore.js.map

@@ -1 +1 @@
-{"version":3,"file":"widgetCore.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAoB7D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,cAAyC;IAC3E,MAAM,GAAG,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;QAClC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,cAAyC;IAC3E,OAAO,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAA0C;IAC7E,MAAM,GAAG,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAe,EAAY,EAAE,CAC1C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,eAA0C;IAC7E,OAAO,oBAAoB,CAAC,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,aAAwC,EAAE,cAAiC;IACzG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,aAAwC,EAAE,cAAiC;IACzG,OAAO,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,SAA2B;IACnF,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,SAA2B;IACnF,OAAO,iBAAiB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsC,EACtC,aAAwC;IAExC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAChC,MAAsC,EACtC,aAAwC;IAExC,OAAO,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG;IAC7B,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB;IACvE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW;CAC3F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoC;IAC/D,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,YAAY,CAAC,SAAoC;IAC/D,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IA2BtC;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gFAAgF;QAChF,6EAA6E;QAC7E,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,qFAAqF;QACrF,wEAAwE;QACxE,KAAK,EAAE,IAAI,CAAC,cAAc;QAC1B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,aAAa;QAC5B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,uFAAuF;QACvF,wFAAwF;QACxF,sFAAsF;QACtF,8EAA8E;QAC9E,YAAY,EAAE,4BAA4B;QAC1C,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,iFAAiF;IACjF,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;QACrE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC;QACtE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;QACjH,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACzD,MAAM,CAAC,uBAAuB,GAAG,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QAC1E,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;QAClE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,IA2BtC;IACC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"widgetCore.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetCore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAc7D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAQrD,0HAA0H;AAC1H,MAAM,UAAU,mBAAmB,CAAC,QAAmC,EAAE,MAAuB;IAC9F,OAAO,eAAe,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACtF,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,cAAyC;IAC3E,MAAM,GAAG,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;QAClC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,cAAyC;IAC3E,OAAO,mBAAmB,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAA0C;IAC7E,MAAM,GAAG,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAe,EAAY,EAAE,CAC1C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,eAA0C;IAC7E,OAAO,oBAAoB,CAAC,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,aAAwC,EAAE,cAAiC;IACzG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,aAAwC,EAAE,cAAiC;IACzG,OAAO,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,SAA2B;IACnF,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,SAA2B;IACnF,OAAO,iBAAiB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsC,EACtC,aAAwC;IAExC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAChC,MAAsC,EACtC,aAAwC;IAExC,OAAO,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG;IAC7B,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB;IACvE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW;CAC3F,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoC;IAC/D,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,YAAY,CAAC,SAAoC;IAC/D,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IA+BtC;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gFAAgF;QAChF,6EAA6E;QAC7E,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,qFAAqF;QACrF,wEAAwE;QACxE,KAAK,EAAE,IAAI,CAAC,cAAc;QAC1B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,aAAa;QAC5B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,uFAAuF;QACvF,wFAAwF;QACxF,sFAAsF;QACtF,8EAA8E;QAC9E,YAAY,EAAE,4BAA4B;QAC1C,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,iFAAiF;IACjF,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC;IACpC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,UAAU,CAAC;IACpE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;QACrE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC;QACtE,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC;QACjH,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACzD,MAAM,CAAC,uBAAuB,GAAG,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;QAC1E,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;QAClE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,IA2BtC;IACC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/realtimeWidget/widgetGuestElevation.d.ts

@@ -35,7 +35,7 @@ export interface WidgetGuestRunContext {
  * Returns elevation context when the request is a public web-widget guest, else `null` (the common
  * case — every non-widget request). A widget guest is identified by the synthesized principal's
  * `IsMagicLinkAnonymous` flag plus a `WidgetGuestContext.WidgetID` (sourced from the signed
- * `mj_widget_id` claim by `buildMagicLinkSessionUser`). The widget instance is loaded under the
+ * `mj_widget_id` claim by `BuildMagicLinkSessionUser`). The widget instance is loaded under the
  * SYSTEM principal so resolving the pinned agent does not depend on the guest's narrow grants.
  *
  * Never throws: a resolution failure (no system user, widget not found, read error) returns `null`,

package/dist/realtimeWidget/widgetGuestElevation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED,4DAA4D;AAC5D,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAEvC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAazE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAEhG"}
+{"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED,4DAA4D;AAC5D,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAEvC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAazE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAQhG;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAEhG"}

package/dist/realtimeWidget/widgetGuestElevation.js

@@ -19,7 +19,7 @@ const WIDGET_ENTITY = 'MJ: Conversation Widget Instances';
  * Returns elevation context when the request is a public web-widget guest, else `null` (the common
  * case — every non-widget request). A widget guest is identified by the synthesized principal's
  * `IsMagicLinkAnonymous` flag plus a `WidgetGuestContext.WidgetID` (sourced from the signed
- * `mj_widget_id` claim by `buildMagicLinkSessionUser`). The widget instance is loaded under the
+ * `mj_widget_id` claim by `BuildMagicLinkSessionUser`). The widget instance is loaded under the
  * SYSTEM principal so resolving the pinned agent does not depend on the guest's narrow grants.
  *
  * Never throws: a resolution failure (no system user, widget not found, read error) returns `null`,
@@ -128,6 +128,7 @@ export function ElevateUserPayload(userPayload, elevatedUser) {
         email: elevatedUser.Email,
         userRecord: elevatedUser,
         isSystemUser: true,
+        ElevatedFrom: userPayload.userRecord,
     };
 }
 /** @deprecated Use {@link ElevateUserPayload}. */

package/dist/realtimeWidget/widgetGuestElevation.js.map

@@ -1 +1 @@
-{"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,OAAO,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAqB;IAC7D,IAAI,WAAW,EAAE,oBAAoB,IAAI,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACnF,OAAO,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,0DAA0D,WAAW,EAAE,EAAE,8BAA8B;YACrG,wBAAwB,CAC3B,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}
+{"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY,EAAE,YAAY;QAC1B,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,OAAO,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAqB;IAC7D,IAAI,WAAW,EAAE,oBAAoB,IAAI,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QACnF,OAAO,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,0DAA0D,WAAW,EAAE,EAAE,8BAA8B;YACrG,wBAAwB,CAC3B,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,WAAW,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}

package/dist/resolvers/ActionResolver.d.ts

@@ -179,8 +179,15 @@ export declare class ActionResolver extends ResolverBase {
      */
     private executeAction;
     /**
-     * Creates an action result from the execution result
+     * Creates an action result from the execution result. The output parameters are projected for
+     * the caller first (see {@link ProjectActionParamValuesForUser}): an action may return rows it
+     * did not load as the caller, such as engine-cached or system-user rows, so an entity object is
+     * sent as its field values projected for the caller and a plain row of a field-secured entity
+     * loses the keys the caller is denied. An entity object of an entity the caller cannot read is
+     * kept as it is, so `CopyScalarsAndArrays` drops it exactly as it always has.
      * @param result The execution result
+     * @param user The caller the result is sent to
+     * @param providers The request's providers, for the entity metadata the projection reads
      * @returns The formatted action result
      * @private
      */
@@ -224,6 +231,17 @@ export declare class ActionResolver extends ResolverBase {
      * @private
      */
     private addEntityObject;
+    /**
+     * The entity action result as it may be sent to `user`: its parameters, which the result echoes
+     * (in `Params` and in `RunParams.Params`), projected for the caller wherever their entity is known.
+     * That is any entity object among them, and the parameters bound to the record's field values
+     * (`'Entity Object Data'`), whose entity is the bound record's. Any other value then passes the
+     * general backstop ({@link ProjectActionParamValuesForUser}), which narrows plain objects shaped
+     * like a row of a field-secured entity.
+     */
+    private projectEntityActionResult;
+    /** The action parameters bound as `'Entity Object Data'`, with the entity their values belong to. */
+    private entityObjectDataBinding;
     /**
      * Creates a composite key from the input
      * @param entity The entity information