@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/realtimeWidget/WidgetRouter.js

@@ -15,7 +15,7 @@ import { LogStatus } from '@memberjunction/core';
 import { configInfo } from '../config.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { RegisterMagicLinkAuthProvider } from '../auth/magicLink/MagicLinkRouter.js';
-import { WidgetSessionService } from './WidgetSessionService.js';
+import { WidgetSessionService, WIDGET_REFRESH_PATH } from './WidgetSessionService.js';
 import { LooksLikeBot } from './widgetCore.js';
 /** The mount path for the widget public router (`/widget`). */
 export const WIDGET_MOUNT_PATH = '/widget';
@@ -47,7 +47,9 @@ function ensureWidgetSigning(publicUrl, widgetConfig) {
  */
 export function CreateWidgetHandler(publicUrl, config) {
     ensureWidgetSigning(publicUrl, config);
-    const service = new WidgetSessionService(publicUrl, config);
+    // A widget may hand an anonymous guest only a scope-isolated role (MJ#6043); the opt-in list is the one
+    // magic-link invites already use, so an admin declares "safe for anonymous visitors" in one place.
+    const service = new WidgetSessionService(publicUrl, config, { GrantableRoleNames: configInfo.magicLink?.grantableRoleNames ?? [] });
     // Per-instance DYNAMIC mint limiter (W6 hardening): keyed by (widgetKey + IP) so each widget
     // deployment gets its own bucket and one abusive IP can't exhaust a shared instance's budget for
     // everyone. The per-request `limit` is the widget instance's stored `RateLimitPerMinute` (cached,
@@ -69,7 +71,7 @@ export function CreateWidgetHandler(publicUrl, config) {
     publicRouter.post('/session', json(), mintLimiter, async (req, res) => {
         await handleMint(service, req, res, false);
     });
-    publicRouter.post('/session/refresh', json(), mintLimiter, async (req, res) => {
+    publicRouter.post(WIDGET_REFRESH_PATH, json(), mintLimiter, async (req, res) => {
         await handleMint(service, req, res, true);
     });
     // W5 magic-link upgrade ("Verify it's you"): emails a verification link scoped to the widget's app.
@@ -150,6 +152,15 @@ async function handleUpgrade(service, req, res) {
     const status = result.success ? 200 : result.errorCode === 'invalid_email' ? 400 : result.errorCode === 'server_error' ? 500 : 403;
     res.status(status).json(result);
 }
+/** Extracts a raw JWT from an `Authorization: Bearer <token>` header, or undefined when absent/malformed. */
+function extractBearerToken(authHeader) {
+    if (!authHeader) {
+        return undefined;
+    }
+    const match = /^Bearer\s+(\S+)$/i.exec(authHeader.trim());
+    const token = match?.[1]?.trim();
+    return token && token.length > 0 ? token : undefined;
+}
 /** Shared mint/refresh handler — parses the request, calls the service, maps the status. */
 async function handleMint(service, req, res, refresh) {
     const body = (req.body ?? {});
@@ -158,6 +169,8 @@ async function handleMint(service, req, res, refresh) {
         res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
         return;
     }
+    // The service validates the key's shape (ToProofPublicJwk) and refuses anything that is not a public P-256 JWK.
+    const proofKey = body.proofKey === undefined ? undefined : body.proofKey;
     // W6 hardening: coarse bot/automation rejection before any DB lookup or token mint. Returns the same
     // 403 as a policy rejection so a probe can't distinguish "bot-blocked" from "bad key/origin".
     if (LooksLikeBot(req.get('user-agent'))) {
@@ -170,6 +183,9 @@ async function handleMint(service, req, res, refresh) {
         origin,
         hostAssertion: typeof body.hostAssertion === 'string' ? body.hostAssertion : undefined,
         visitorKey: typeof body.visitorKey === 'string' ? body.visitorKey : undefined,
+        BearerToken: refresh ? extractBearerToken(req.get('authorization')) : undefined,
+        Proof: refresh ? req.get('dpop') : undefined,
+        ProofKey: refresh ? undefined : proofKey,
         audit: { ipAddress: req.ip, userAgent: req.get('user-agent') ?? undefined, origin },
     };
     const result = refresh ? await service.RefreshGuestSession(input) : await service.MintGuestSession(input);

package/dist/realtimeWidget/WidgetRouter.js.map

@@ -1 +1 @@
-{"version":3,"file":"WidgetRouter.js","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAA+B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAA+B,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,YAA0B;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtE,SAAS,CACP,uCAAuC,YAAY,CAAC,QAAQ,8BAA8B,QAAQ,CAAC,QAAQ,MAAM;YACjH,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjE,iFAAiF;IACjF,sEAAsE;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,6BAA6B,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAoB;IACzE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE5D,6FAA6F;IAC7F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,WAAW,GAAG,SAAS,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,0FAA0F;QAC1F,wFAAwF;QACxF,yFAAyF;QACzF,2FAA2F;QAC3F,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;QACnG,KAAK,EAAE,KAAK,EAAE,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;KACpH,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,oGAAoG;IACpG,6FAA6F;IAC7F,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,qGAAqG;IACrG,wFAAwF;IACxF,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtF,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,sGAAsG;IACtG,wGAAwG;IACxG,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IACrC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvG,MAAM,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAoB;IACzE,OAAO,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,0GAA0G;AAC1G,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;IACxD,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,YAAY,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IACpF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IACrI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IAC7F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;IACjD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC;QAClD,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,aAAa,EAAE,YAAY,CAAC,KAAK;QACjC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;KACvC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IACrF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2C,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IACrH,mHAAmH;IACnH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa,EAAE,OAAgB;IACpG,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwE,CAAC;IACrG,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,qGAAqG;IACrG,8FAA8F;IAC9F,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,SAAS;QACT,MAAM;QACN,aAAa,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACtF,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,MAAM,EAAE;KACpF,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1G,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAA8B;IACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC"}
+{"version":3,"file":"WidgetRouter.js","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAA+B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAA+B,MAAM,2BAA2B,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAAiB,EAAE,YAA0B;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACtE,SAAS,CACP,uCAAuC,YAAY,CAAC,QAAQ,8BAA8B,QAAQ,CAAC,QAAQ,MAAM;YACjH,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjE,iFAAiF;IACjF,sEAAsE;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,6BAA6B,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAoB;IACzE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvC,wGAAwG;IACxG,mGAAmG;IACnG,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,SAAS,EAAE,kBAAkB,IAAI,EAAE,EAAE,CAAC,CAAC;IAEpI,6FAA6F;IAC7F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,kFAAkF;IAClF,MAAM,WAAW,GAAG,SAAS,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,0FAA0F;QAC1F,wFAAwF;QACxF,yFAAyF;QACzF,2FAA2F;QAC3F,YAAY,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;QACnG,KAAK,EAAE,KAAK,EAAE,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,oDAAoD,EAAE;KACpH,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,oGAAoG;IACpG,6FAA6F;IAC7F,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvF,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,qGAAqG;IACrG,wFAAwF;IACxF,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtF,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,sGAAsG;IACtG,wGAAwG;IACxG,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IACrC,mBAAmB,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACvG,MAAM,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAoB;IACzE,OAAO,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,0GAA0G;AAC1G,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2B,CAAC;IACxD,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,YAAY,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IACpF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IACrI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IAC7F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;IACjD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvG,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAgD,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC;QAClD,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,aAAa,EAAE,YAAY,CAAC,KAAK;QACjC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;KACvC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClG,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,aAAa,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa;IACrF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA2C,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IACrH,mHAAmH;IACnH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACnI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,6GAA6G;AAC7G,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,OAA6B,EAAE,GAAY,EAAE,GAAa,EAAE,OAAgB;IACpG,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4F,CAAC;IACzH,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IACD,gHAAgH;IAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,QAA2B,CAAC;IAE7F,qGAAqG;IACrG,8FAA8F;IAC9F,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,SAAS;QACT,MAAM;QACN,aAAa,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACtF,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC7E,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/E,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5C,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACxC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,EAAE,MAAM,EAAE;KACpF,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1G,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAA8B;IACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC"}

package/dist/realtimeWidget/WidgetSessionService.d.ts

@@ -9,13 +9,36 @@
  * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
  * carried in the token, plus best-effort structured audit logging. The minted
  * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
- * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ * JWKS) and synthesized into a constrained guest principal by `BuildMagicLinkSessionUser`.
  *
  * @module @memberjunction/server/widget
  */
+import { type ProofPublicJwk } from '@memberjunction/global';
 import { type WidgetConfig } from '../config.js';
-import { type WidgetMintErrorCode } from './widgetCore.js';
+import { type GuestRolePolicy, type WidgetMintErrorCode } from './widgetCore.js';
 import { type ResolvedVisitorIdentity } from './visitorIdentity.js';
+/**
+ * Maximum clock-skew / late-timer grace window (seconds) after `exp` during which
+ * `RefreshGuestSession` still accepts a widget guest Bearer token and preserves its `mj_sid`.
+ */
+export declare const REFRESH_GRACE_SECONDS = 300;
+/**
+ * Hard end of a widget guest session (seconds after its first mint, `mj_sid_iat`). Refresh keeps the
+ * visitor's `mj_sid`, so without an end a token captured once could be renewed forever and keep reading
+ * that visitor's conversations; past this point refresh is refused and no token outlives it.
+ */
+export declare const MAX_GUEST_SESSION_SECONDS: number;
+/**
+ * The least lifetime a refreshed token may have. Refresh is refused once less than this remains before the hard end,
+ * so the last refresh gets the 403 that makes the widget start a new session. It must exceed the widget's refresh
+ * lead (60 s before `exp`): a token issued with less would be due for refresh at once, every time, until the rate
+ * limiter answered 429 instead. It also keeps a re-minted token's `exp` after its `iat`.
+ */
+export declare const MIN_REFRESHED_TOKEN_SECONDS = 120;
+/** The refresh route's path under the widget mount; the refresh proof must name it (`htu`). */
+export declare const WIDGET_REFRESH_PATH = "/session/refresh";
+/** How far a refresh proof's signing time (`iat`) may be from the server clock, either way. */
+export declare const REFRESH_PROOF_MAX_SKEW_SECONDS = 60;
 /** Per-request forensic context captured for audit (sourced from the HTTP request). */
 export interface WidgetMintAuditContext {
     ipAddress?: string;
@@ -41,6 +64,19 @@ export interface MintGuestSessionInput {
      * server mints a fresh one. Ignored entirely when remembering is off.
      */
     visitorKey?: string;
+    /**
+     * The caller's current guest session JWT (`Authorization: Bearer <token>`), required by
+     * `RefreshGuestSession` so a refresh proves possession of the session being renewed and
+     * preserves its `mj_sid` (`sessionId`).
+     */
+    BearerToken?: string;
+    /**
+     * The widget's proof key (public P-256 JWK, from the mint body's `proofKey`). Its thumbprint is signed into
+     * the token as `cnf.jkt`; a token minted without one cannot be refreshed.
+     */
+    ProofKey?: ProofPublicJwk;
+    /** The refresh proof (`DPoP` header), signed by the key registered at mint. Required by `RefreshGuestSession`. */
+    Proof?: string;
     audit?: WidgetMintAuditContext;
 }
 /** Result of a guest-session mint. */
@@ -157,18 +193,35 @@ export interface UpgradeGuestSessionResult {
 export declare class WidgetSessionService {
     private readonly publicUrl;
     private readonly config;
-    constructor(publicUrl: string, config: WidgetConfig);
+    /** Which roles a widget may hand to an anonymous guest; by default only the scope-isolated `Widget Guest`. */
+    private readonly guestRolePolicy;
+    constructor(publicUrl: string, config: WidgetConfig, 
+    /** Which roles a widget may hand to an anonymous guest; by default only the scope-isolated `Widget Guest`. */
+    guestRolePolicy?: GuestRolePolicy);
     /**
      * Resolves the widget instance, enforces guardrails, and mints a guest JWT.
      * Never throws for business failures — returns `{ success: false, errorCode }`.
      */
     MintGuestSession(input: MintGuestSessionInput): Promise<MintGuestSessionResult>;
     /**
-     * Refreshes a live guest session. The widget always holds its public key, so a
-     * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
-     * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+     * Refreshes a live guest session while preserving its per-visitor `sessionId` (`mj_sid`).
+     * Requires the caller's current widget guest JWT (`input.BearerToken`), verified against the
+     * magic-link signing key with a {@link REFRESH_GRACE_SECONDS} post-expiry grace window, and
+     * bound to the resolved widget instance (`mj_widget_id === widget.ID`, `mj_anon === true`,
+     * `mj_magic_link === true`). Any failure returns the same uniform 403 shape as an unknown widget key.
      */
     RefreshGuestSession(input: MintGuestSessionInput): Promise<MintGuestSessionResult>;
+    /**
+     * Verifies a `RefreshGuestSession` request: the caller's current widget guest JWT and the proof that the
+     * caller holds the key the token is bound to. Returns the session to carry forward, or `null` when the token
+     * is missing, tampered, expired past {@link REFRESH_GRACE_SECONDS}, past the session's hard end
+     * ({@link MAX_GUEST_SESSION_SECONDS}) or without a session start, non-anonymous, minted for a different
+     * widget, issued by another deployment, or not bound to a key; or when the proof is missing or not made by
+     * that key for this request and token.
+     */
+    private verifyRefreshRequest;
+    /** The token half of {@link verifyRefreshRequest}: everything except the proof. */
+    private verifyRefreshBearerToken;
     /**
      * Short-TTL, size-bounded cache of resolved per-instance rate limits, so the limiter doesn't hit
      * the DB per request. The cache key (`widgetKey`) is presented by an UNAUTHENTICATED caller on the
@@ -197,7 +250,7 @@ export declare class WidgetSessionService {
      * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
      * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
      *
-     * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+     * This converges on the SAME `AuthProviderFactory` + `BuildMagicLinkSessionUser` path as the guest
      * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
      * throws for business failures — returns a structured result.
      */
@@ -263,6 +316,13 @@ export declare class WidgetSessionService {
     private loadWidgetByKey;
     /** Resolves the guest role's NAME from its id (claims carry the name, not the id). */
     private resolveGuestRoleName;
+    /**
+     * The ONE decision, for mint and refresh alike, of which role a guest token carries: the widget's `GuestRoleID`
+     * must resolve, and it must be a role the deployment may hand to an anonymous visitor
+     * ({@link IsIsolatedGuestRole}). Both refusals are the admin's to fix, so both are logged with the widget id;
+     * the visitor gets a uniform rejection.
+     */
+    private resolveIsolatedGuestRole;
     /** Resolves the server-side context user used to READ widget config (not the guest principal). */
     private resolveLookupUser;
     /**

package/dist/realtimeWidget/WidgetSessionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WidgetSessionService.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAoE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG7H,OAAO,EAA+D,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAgBjI,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oHAAoH;IACpH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,wGAAwG;AACxG,MAAM,WAAW,2BAA2B;IAC1C,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yGAAyG;AACzG,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kGAAkG;IAClG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAOD;;;GAGG;AACH,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY;IAGvC;;;OAGG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA0D5F;;;;OAIG;IACU,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI/F;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG5B;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAE3D,yFAAyF;IACzF,IAAW,kBAAkB,IAAI,MAAM,CAEtC;IAED;;;;;OAKG;IACU,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B5E;;;;;;;;;;OAUG;IACU,cAAc,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAyChG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAYlB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IAwDjB;;;;;OAKG;YACW,+BAA+B;IAuB7C;;;;;OAKG;IACU,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyB9G;;;;OAIG;IACU,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmBnF;;;;OAIG;YACW,yBAAyB;IA6BvC;;;;;;OAMG;YACW,uBAAuB;IAiBrC;;;;;;;OAOG;YACW,8BAA8B;IAmB5C;;;;OAIG;YACW,oCAAoC;IA0BlD,mFAAmF;YACrE,eAAe;IAsB7B,sFAAsF;IACtF,OAAO,CAAC,oBAAoB;IAM5B,kGAAkG;IAClG,OAAO,CAAC,iBAAiB;IAIzB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;CAYhB"}
+{"version":3,"file":"WidgetSessionService.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/WidgetSessionService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAA8F,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMzJ,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAyF,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGxK,OAAO,EAA+D,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAQjI;;;GAGG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD,+FAA+F;AAC/F,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAoBjD,uFAAuF;AACvF,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,kHAAkH;IAClH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,iGAAiG;IACjG,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oHAAoH;IACpH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,wGAAwG;AACxG,MAAM,WAAW,2BAA2B;IAC1C,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,UAAU,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yGAAyG;AACzG,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kGAAkG;IAClG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAOD;;;GAGG;AACH,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,8GAA8G;IAC9G,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAHf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY;IACrC,8GAA8G;IAC7F,eAAe,GAAE,eAA4C;IAGhF;;;OAGG;IACU,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwE5F;;;;;;OAMG;IACU,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAuD/F;;;;;;;OAOG;YACW,oBAAoB;IAuBlC,mFAAmF;IACnF,OAAO,CAAC,wBAAwB;IAkDhC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG5B;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAU;IAE3D,yFAAyF;IACzF,IAAW,kBAAkB,IAAI,MAAM,CAEtC;IAED;;;;;OAKG;IACU,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0B5E;;;;;;;;;;OAUG;IACU,cAAc,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAyChG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAYlB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IAgEjB;;;;;OAKG;YACW,+BAA+B;IAuB7C;;;;;OAKG;IACU,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyB9G;;;;OAIG;IACU,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmBnF;;;;OAIG;YACW,yBAAyB;IA6BvC;;;;;;OAMG;YACW,uBAAuB;IAiBrC;;;;;;;OAOG;YACW,8BAA8B;IAmB5C;;;;OAIG;YACW,oCAAoC;IA2BlD,mFAAmF;YACrE,eAAe;IAuB7B,sFAAsF;IACtF,OAAO,CAAC,oBAAoB;IAM5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAkBhC,kGAAkG;IAClG,OAAO,CAAC,iBAAiB;IAIzB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;CAYhB"}

package/dist/realtimeWidget/WidgetSessionService.js

@@ -9,18 +9,20 @@
  * widget guest is ephemeral). Forensics ride the opaque per-session id (`mj_sid`)
  * carried in the token, plus best-effort structured audit logging. The minted
  * token is validated by the SAME `magic-link` auth provider (same issuer/audience/
- * JWKS) and synthesized into a constrained guest principal by `buildMagicLinkSessionUser`.
+ * JWKS) and synthesized into a constrained guest principal by `BuildMagicLinkSessionUser`.
  *
  * @module @memberjunction/server/widget
  */
+import { createPublicKey } from 'node:crypto';
+import jwt from 'jsonwebtoken';
 import { Metadata, RunView, LogError, LogStatus } from '@memberjunction/core';
-import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
+import { ComputeJwkThumbprint, MJLruCache, ToProofPublicJwk, UUIDsEqual, VerifyProofOfPossessionJwt } from '@memberjunction/global';
 import { ResolveConfiguredPrincipal } from '../auth/principals.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { GenerateSessionId } from '../auth/magicLink/magicLinkCore.js';
 import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';
 import { configInfo } from '../config.js';
-import { BuildWidgetGuestClaims, EvaluateWidgetMint, ParseEnabledChannels } from './widgetCore.js';
+import { BuildWidgetGuestClaims, EvaluateWidgetMint, IsIsolatedGuestRole, ParseEnabledChannels } from './widgetCore.js';
 import { VerifyHostAssertion } from './host-identity.js';
 import { WriteReturningVisitorRecap } from '../agentSessions/ReturningVisitorRecap.js';
 import { ResolveIdentityByEmail, MergeVisitorIdentity, ForgetVisitor } from './visitorIdentity.js';
@@ -28,6 +30,28 @@ const WIDGET_ENTITY = 'MJ: Conversation Widget Instances';
 const CONVERSATIONS_ENTITY = 'MJ: Conversations';
 /** Shape of the durable visitor anchor key (opaque base64url, same alphabet as generateSessionId). */
 const VISITOR_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
+/**
+ * Maximum clock-skew / late-timer grace window (seconds) after `exp` during which
+ * `RefreshGuestSession` still accepts a widget guest Bearer token and preserves its `mj_sid`.
+ */
+export const REFRESH_GRACE_SECONDS = 300;
+/**
+ * Hard end of a widget guest session (seconds after its first mint, `mj_sid_iat`). Refresh keeps the
+ * visitor's `mj_sid`, so without an end a token captured once could be renewed forever and keep reading
+ * that visitor's conversations; past this point refresh is refused and no token outlives it.
+ */
+export const MAX_GUEST_SESSION_SECONDS = 12 * 3600;
+/**
+ * The least lifetime a refreshed token may have. Refresh is refused once less than this remains before the hard end,
+ * so the last refresh gets the 403 that makes the widget start a new session. It must exceed the widget's refresh
+ * lead (60 s before `exp`): a token issued with less would be due for refresh at once, every time, until the rate
+ * limiter answered 429 instead. It also keeps a re-minted token's `exp` after its `iat`.
+ */
+export const MIN_REFRESHED_TOKEN_SECONDS = 120;
+/** The refresh route's path under the widget mount; the refresh proof must name it (`htu`). */
+export const WIDGET_REFRESH_PATH = '/session/refresh';
+/** How far a refresh proof's signing time (`iat`) may be from the server clock, either way. */
+export const REFRESH_PROOF_MAX_SKEW_SECONDS = 60;
 /** Minimal email sanity check (presence + single `@` with a dotted domain) — not full RFC validation. */
 function isLikelyEmail(email) {
     return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email);
@@ -37,9 +61,12 @@ function isLikelyEmail(email) {
  * Stateless; constructed once at server startup alongside the magic-link service.
  */
 export class WidgetSessionService {
-    constructor(publicUrl, config) {
+    constructor(publicUrl, config, 
+    /** Which roles a widget may hand to an anonymous guest; by default only the scope-isolated `Widget Guest`. */
+    guestRolePolicy = { GrantableRoleNames: [] }) {
         this.publicUrl = publicUrl;
         this.config = config;
+        this.guestRolePolicy = guestRolePolicy;
         /**
          * Short-TTL, size-bounded cache of resolved per-instance rate limits, so the limiter doesn't hit
          * the DB per request. The cache key (`widgetKey`) is presented by an UNAUTHENTICATED caller on the
@@ -73,11 +100,11 @@ export class WidgetSessionService {
             if (!eligibility.ok) {
                 return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
             }
-            const guestRoleName = this.resolveGuestRoleName(widget.GuestRoleID);
-            if (!guestRoleName) {
-                LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
-                return this.audited({ success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' }, input, widget);
+            const guestRole = this.resolveIsolatedGuestRole(widget);
+            if (guestRole.ok === false) {
+                return this.audited(guestRole.refusal, input, widget);
             }
+            const guestRoleName = guestRole.name;
             // D1 host-identity strategy: a HostIdentity widget MUST present a valid host assertion.
             let hostIdentity;
             if (widget.AuthStrategy === 'HostIdentity') {
@@ -98,7 +125,16 @@ export class WidgetSessionService {
             // RV4 (host-identity path): when a host asserts a resolvable identity, promote the visitor's prior
             // anonymous trail to that record and surface the pair so the client stamps the new conversation.
             const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
-            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity), input, widget);
+            let proofKeyThumbprint;
+            if (input.ProofKey !== undefined) {
+                const proofKey = ToProofPublicJwk(input.ProofKey);
+                if (!proofKey) {
+                    LogError(`[Widget] Mint for widget ${widget.ID} refused: the proof key is not a public P-256 JWK.`);
+                    return this.audited({ success: false, errorCode: 'not_found', error: 'Widget mint rejected.' }, input, widget);
+                }
+                proofKeyThumbprint = await ComputeJwkThumbprint(proofKey);
+            }
+            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, undefined, proofKeyThumbprint), input, widget);
         }
         catch (e) {
             LogError(e);
@@ -106,12 +142,133 @@ export class WidgetSessionService {
         }
     }
     /**
-     * Refreshes a live guest session. The widget always holds its public key, so a
-     * refresh is a fresh mint by the same key + origin — short-TTL tokens with no
-     * refresh-token machinery (mirrors magic-link's no-refresh-token stance).
+     * Refreshes a live guest session while preserving its per-visitor `sessionId` (`mj_sid`).
+     * Requires the caller's current widget guest JWT (`input.BearerToken`), verified against the
+     * magic-link signing key with a {@link REFRESH_GRACE_SECONDS} post-expiry grace window, and
+     * bound to the resolved widget instance (`mj_widget_id === widget.ID`, `mj_anon === true`,
+     * `mj_magic_link === true`). Any failure returns the same uniform 403 shape as an unknown widget key.
      */
     async RefreshGuestSession(input) {
-        return this.MintGuestSession(input);
+        try {
+            const contextUser = this.resolveLookupUser();
+            if (!contextUser) {
+                LogError('[Widget] No lookup context user available; server not configured.');
+                return { success: false, errorCode: 'server_error', error: 'Server not configured for widget sessions.' };
+            }
+            const widget = await this.loadWidgetByKey(input.widgetKey, contextUser);
+            if (!widget) {
+                return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, undefined);
+            }
+            const eligibility = EvaluateWidgetMint({ Status: widget.Status, AllowedOrigins: widget.AllowedOrigins, Modality: widget.Modality }, input.origin);
+            if (!eligibility.ok) {
+                return this.audited({ success: false, errorCode: eligibility.errorCode, error: 'Widget mint rejected.' }, input, widget);
+            }
+            const guestRole = this.resolveIsolatedGuestRole(widget);
+            if (guestRole.ok === false) {
+                return this.audited(guestRole.refusal, input, widget);
+            }
+            const guestRoleName = guestRole.name;
+            let hostIdentity;
+            if (widget.AuthStrategy === 'HostIdentity') {
+                const verified = this.verifyHost(widget, input.hostAssertion);
+                if (!verified) {
+                    return this.audited({ success: false, errorCode: 'host_assertion_invalid', error: 'Host identity assertion invalid.' }, input, widget);
+                }
+                hostIdentity = verified;
+            }
+            const existingSession = await this.verifyRefreshRequest(input.BearerToken, input.Proof, widget.ID);
+            if (!existingSession) {
+                return this.audited({ success: false, errorCode: 'not_found', error: 'Unknown widget key.' }, input, widget);
+            }
+            const returningVisitor = await this.resolveReturningVisitor(widget, input.visitorKey, contextUser);
+            const resolvedIdentity = await this.resolveHostIdentityIfApplicable(widget, hostIdentity, returningVisitor, contextUser);
+            return this.audited(this.mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, existingSession, existingSession.KeyThumbprint), input, widget);
+        }
+        catch (e) {
+            LogError(e);
+            return { success: false, errorCode: 'server_error', error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    /**
+     * Verifies a `RefreshGuestSession` request: the caller's current widget guest JWT and the proof that the
+     * caller holds the key the token is bound to. Returns the session to carry forward, or `null` when the token
+     * is missing, tampered, expired past {@link REFRESH_GRACE_SECONDS}, past the session's hard end
+     * ({@link MAX_GUEST_SESSION_SECONDS}) or without a session start, non-anonymous, minted for a different
+     * widget, issued by another deployment, or not bound to a key; or when the proof is missing or not made by
+     * that key for this request and token.
+     */
+    async verifyRefreshRequest(bearerToken, proof, widgetId) {
+        const session = this.verifyRefreshBearerToken(bearerToken, widgetId);
+        if (!session) {
+            return null;
+        }
+        const verification = await VerifyProofOfPossessionJwt(proof ?? '', {
+            Method: 'POST',
+            PathSuffix: WIDGET_REFRESH_PATH,
+            AccessToken: (bearerToken ?? '').trim(),
+            NowSeconds: Math.floor(Date.now() / 1000),
+            MaxSkewSeconds: REFRESH_PROOF_MAX_SKEW_SECONDS,
+        });
+        if (verification.Valid === false) {
+            LogError(`[Widget] Refresh proof refused for widget ${widgetId} (${verification.Reason}).`);
+            return null;
+        }
+        if (verification.Thumbprint !== session.KeyThumbprint) {
+            LogError(`[Widget] Refresh proof refused for widget ${widgetId}: signed by a key the token is not bound to.`);
+            return null;
+        }
+        return session;
+    }
+    /** The token half of {@link verifyRefreshRequest}: everything except the proof. */
+    verifyRefreshBearerToken(bearerToken, widgetId) {
+        const token = (bearerToken ?? '').trim();
+        if (!token) {
+            return null;
+        }
+        try {
+            const jwk = MagicLinkKeyManager.Instance.GetJWKS().keys[0];
+            if (!jwk) {
+                return null;
+            }
+            const publicKey = createPublicKey({ key: { ...jwk }, format: 'jwk' });
+            const verified = jwt.verify(token, publicKey, {
+                algorithms: ['RS256'],
+                audience: this.config.audience,
+                issuer: this.publicUrl,
+                ignoreExpiration: true,
+            });
+            if (typeof verified !== 'object' || verified === null) {
+                return null;
+            }
+            const payload = verified;
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            if (typeof payload.exp !== 'number' || nowSeconds > payload.exp + REFRESH_GRACE_SECONDS) {
+                return null;
+            }
+            if (payload.mj_magic_link !== true || payload.mj_anon !== true) {
+                return null;
+            }
+            if (typeof payload.mj_widget_id !== 'string' || !UUIDsEqual(payload.mj_widget_id, widgetId)) {
+                return null;
+            }
+            const sid = typeof payload.mj_sid === 'string' ? payload.mj_sid.trim() : '';
+            if (sid.length === 0) {
+                return null;
+            }
+            const startedAt = payload.mj_sid_iat;
+            if (typeof startedAt !== 'number' || !Number.isFinite(startedAt) || startedAt + MAX_GUEST_SESSION_SECONDS - nowSeconds < MIN_REFRESHED_TOKEN_SECONDS) {
+                return null;
+            }
+            const keyThumbprint = typeof payload.cnf?.jkt === 'string' ? payload.cnf.jkt : '';
+            if (keyThumbprint.length === 0) {
+                return null;
+            }
+            return { SessionId: sid, StartedAtSeconds: startedAt, KeyThumbprint: keyThumbprint };
+        }
+        catch (e) {
+            LogError(`[Widget] Refresh token verification failed for widget ${widgetId}: ${e instanceof Error ? e.message : String(e)}`);
+            return null;
+        }
     }
     static { this.RATE_LIMIT_CACHE_TTL_MS = 60_000; }
     static { this.RATE_LIMIT_CACHE_MAX_SIZE = 10_000; }
@@ -158,7 +315,7 @@ export class WidgetSessionService {
      * clicks the emailed link → the existing public `POST /magic-link/redeem` mints a VERIFIED session
      * JWT → the widget swaps it in via `transport.UpdateToken`, preserving the live conversationId.
      *
-     * This converges on the SAME `AuthProviderFactory` + `buildMagicLinkSessionUser` path as the guest
+     * This converges on the SAME `AuthProviderFactory` + `BuildMagicLinkSessionUser` path as the guest
      * mint (D1), so the verified session is just a more-privileged principal on the one pathway. Never
      * throws for business failures — returns a structured result.
      */
@@ -220,12 +377,16 @@ export class WidgetSessionService {
         return null;
     }
     /** Builds + signs the guest JWT for an eligible widget instance. */
-    mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity) {
+    mintToken(widget, guestRoleName, hostIdentity, returningVisitor, resolvedIdentity, existingSession, proofKeyThumbprint) {
         const nowSeconds = Math.floor(Date.now() / 1000);
         const ttlMinutes = widget.SessionTTLMinutes || this.config.defaultSessionTtlMinutes;
-        // Generated once and returned to the client: the widget stamps Conversation.ExternalID with
-        // this id so the Widget Guest RLS filters ({{ScopeResourceID}}) isolate this guest's rows.
-        const sessionId = GenerateSessionId();
+        // Generated once on initial mint and preserved across refreshes: the widget (and server-side
+        // voice session creation) stamps Conversation.ExternalID with this id so the Widget Guest RLS
+        // filters ({{ScopeResourceID}}) and AuthorizeSessionAccess isolate this guest's rows.
+        const sessionId = existingSession?.SessionId ?? GenerateSessionId();
+        const startedAtSeconds = existingSession?.StartedAtSeconds ?? nowSeconds;
+        // No token outlives the session's hard end, so the cap holds for API calls as well as for refresh.
+        const ttlSeconds = Math.min(ttlMinutes * 60, startedAtSeconds + MAX_GUEST_SESSION_SECONDS - nowSeconds);
         const claims = BuildWidgetGuestClaims({
             issuer: this.publicUrl,
             audience: this.config.audience,
@@ -235,7 +396,9 @@ export class WidgetSessionService {
             applicationId: widget.ApplicationID,
             guestRoleName,
             nowSeconds,
-            ttlSeconds: ttlMinutes * 60,
+            ttlSeconds,
+            sessionStartedAtSeconds: startedAtSeconds,
+            proofKeyThumbprint,
             hostIdentity,
             // RV1/RV2/RV4: carry the returning-visitor anchor + resolved identity as claims so the voice path
             // (server-created conversation) stamps the same fields the text path stamps client-side.
@@ -423,6 +586,7 @@ export class WidgetSessionService {
             ExtraFilter: `VisitorKey = '${visitorKey}' AND ApplicationID = '${applicationId.replace(/'/g, "''")}'`,
             OrderBy: '__mj_CreatedAt DESC',
             MaxRows: 1,
+            SkipTotalRowCount: true,
             Fields: ['ID'],
             ResultType: 'simple',
         }, contextUser);
@@ -443,6 +607,7 @@ export class WidgetSessionService {
             EntityName: WIDGET_ENTITY,
             ExtraFilter: `PublicKey = '${key.replace(/'/g, "''")}'`,
             MaxRows: 1,
+            SkipTotalRowCount: true,
             ResultType: 'entity_object',
         }, contextUser);
         if (!result.Success) {
@@ -457,6 +622,25 @@ export class WidgetSessionService {
         const role = md?.Roles.find((r) => UUIDsEqual(r.ID, guestRoleId));
         return role?.Name ?? null;
     }
+    /**
+     * The ONE decision, for mint and refresh alike, of which role a guest token carries: the widget's `GuestRoleID`
+     * must resolve, and it must be a role the deployment may hand to an anonymous visitor
+     * ({@link IsIsolatedGuestRole}). Both refusals are the admin's to fix, so both are logged with the widget id;
+     * the visitor gets a uniform rejection.
+     */
+    resolveIsolatedGuestRole(widget) {
+        const name = this.resolveGuestRoleName(widget.GuestRoleID);
+        if (!name) {
+            LogError(`[Widget] Guest role ${widget.GuestRoleID} for widget ${widget.ID} not found in metadata.`);
+            return { ok: false, refusal: { success: false, errorCode: 'server_error', error: 'Guest role not resolvable.' } };
+        }
+        if (!IsIsolatedGuestRole(name, this.guestRolePolicy)) {
+            LogError(`[Widget] Widget ${widget.ID} grants guest role '${name}', whose row filters do not isolate anonymous visitors ` +
+                `from each other. Use the Widget Guest role, or list '${name}' in magicLink.grantableRoleNames to allow it (MJ#6043).`);
+            return { ok: false, refusal: { success: false, errorCode: 'guest_role_not_isolated', error: 'Widget mint rejected.' } };
+        }
+        return { ok: true, name };
+    }
     /** Resolves the server-side context user used to READ widget config (not the guest principal). */
     resolveLookupUser() {
         return ResolveConfiguredPrincipal(this.config.contextUserForLookup, 'Widget');