@gaballahtech/seba 0.2.1 → 0.5.0

package/dist/core/oidc.js

@@ -116,32 +116,32 @@ export function parseAuthorizationResponse(callbackUrl, pending) {
         url = new URL(callbackUrl);
     }
     catch {
-        throw new SebaAuthError(`The authorization response "${callbackUrl}" is not a valid URL.`);
+        throw new SebaAuthError(`The authorization response "${callbackUrl}" is not a valid URL.`, { stage: "authorization-response" });
     }
     const params = url.searchParams;
     const providerError = params.get("error");
     if (providerError !== null) {
         const description = params.get("error_description");
         throw new SebaAuthError(`The identity provider returned the error "${providerError}"` +
-            (description === null ? "." : `: ${description}`));
+            (description === null ? "." : `: ${description}`), { stage: "authorization-response" });
     }
     const state = params.get("state");
     if (state === null || state !== pending.state) {
         throw new SebaAuthError("The authorization response state does not match the pending login. " +
-            "The response was ignored; start the login again from the application.");
+            "The response was ignored; start the login again from the application.", { stage: "authorization-response-state" });
     }
     const issuer = params.get("iss");
     if (issuer === null || issuer === "") {
         throw new SebaAuthError("The authorization response does not contain the RFC 9207 \"iss\" parameter. " +
-            `Expected "${pending.issuer}". Solid-OIDC requires providers to return it; the response was rejected.`);
+            `Expected "${pending.issuer}". Solid-OIDC requires providers to return it; the response was rejected.`, { stage: "authorization-response-iss" });
     }
     if (issuer !== pending.issuer) {
         throw new SebaAuthError(`The authorization response was issued by "${issuer}", but this login was started for "${pending.issuer}". ` +
-            "This is a mix-up attempt or a misconfigured provider; the response was rejected.");
+            "This is a mix-up attempt or a misconfigured provider; the response was rejected.", { stage: "authorization-response-iss" });
     }
     const code = params.get("code");
     if (code === null || code === "") {
-        throw new SebaAuthError("The authorization response does not contain an authorization code.");
+        throw new SebaAuthError("The authorization response does not contain an authorization code.", { stage: "authorization-response" });
     }
     return code;
 }
@@ -156,7 +156,8 @@ export function parseAuthorizationResponse(callbackUrl, pending) {
  */
 export async function requestTokenResponse(input) {
     let nonce = input.nonce;
-    for (let attempt = 0; attempt < 2; attempt += 1) {
+    const attempts = 1 + (input.maxNonceRetries === undefined ? 1 : Math.max(0, input.maxNonceRetries));
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
         const headers = {
             "content-type": "application/x-www-form-urlencoded",
             accept: "application/json",
@@ -174,9 +175,9 @@ export async function requestTokenResponse(input) {
         const response = await httpFetch(input.tokenEndpoint, { method: "POST", headers, body: input.body.toString(), redirect: "manual" }, { fetchImpl: input.fetchImpl });
         if (isOk(response)) {
             const text = await readText(response, "token");
-            const body = parseJson(text, "The token response", (message) => new SebaAuthError(message));
+            const body = parseJson(text, "The token response", (message) => new SebaAuthError(message, { stage: "token-response" }));
             if (typeof body !== "object" || body === null || Array.isArray(body)) {
-                throw new SebaAuthError("The token response is not a JSON object.");
+                throw new SebaAuthError("The token response is not a JSON object.", { stage: "token-response" });
             }
             return { ok: true, body: body, response };
         }
@@ -185,7 +186,7 @@ export async function requestTokenResponse(input) {
         const parsed = safeJson(text);
         const error = typeof parsed?.["error"] === "string" ? parsed["error"] : `http_${String(response.status)}`;
         const description = typeof parsed?.["error_description"] === "string" ? parsed["error_description"] : undefined;
-        if (error === "use_dpop_nonce" && challenge !== null && attempt === 0) {
+        if (error === "use_dpop_nonce" && challenge !== null && attempt + 1 < attempts) {
             nonce = challenge;
             continue;
         }
@@ -227,10 +228,11 @@ export async function exchangeAuthorizationCode(input) {
         body,
         signer: input.signer,
         fetchImpl: input.fetchImpl,
+        ...(input.maxDpopNonceRetries === undefined ? {} : { maxNonceRetries: input.maxDpopNonceRetries }),
     });
     if (!outcome.ok) {
         throw new SebaAuthError(`The token endpoint rejected the authorization code with "${outcome.error}"` +
-            (outcome.description === undefined ? "." : `: ${outcome.description}`));
+            (outcome.description === undefined ? "." : `: ${outcome.description}`), { stage: "token-exchange" });
     }
     const tokens = parseTokenSet(outcome.body);
     const identity = await validateIdToken({
@@ -241,6 +243,7 @@ export async function exchangeAuthorizationCode(input) {
         signer: input.signer,
         fetchImpl: input.fetchImpl,
         requireDpopBinding: input.configuration.scopesSupported?.includes("webid") === true,
+        ...(input.configuration.allowNonCompliantCnf === true ? { allowNonCompliantCnf: true } : {}),
         ...(input.expectedWebId === undefined ? {} : { expectedWebId: input.expectedWebId }),
         ...(input.jwks === undefined ? {} : { jwks: input.jwks }),
     });
@@ -259,7 +262,7 @@ export function parseTokenSet(body) {
     const tokenType = requireString(body["token_type"], "token_type");
     if (tokenType.toLowerCase() !== "dpop") {
         throw new SebaAuthError(`The provider returned token_type "${tokenType}", but SEBA requires DPoP-bound tokens. ` +
-            "The token was discarded; check that the provider supports DPoP.");
+            "The token was discarded; check that the provider supports DPoP.", { stage: "token-response" });
     }
     const idToken = requireString(body["id_token"], "id_token");
     const tokens = { accessToken, tokenType: "DPoP", idToken };
@@ -283,10 +286,24 @@ export function parseTokenSet(body) {
 function requireString(value, field) {
     if (typeof value !== "string" || value === "") {
         throw new SebaAuthError(`The token response does not contain a usable "${field}" value. ` +
-            "SEBA requires DPoP-bound access tokens together with an ID token.");
+            "SEBA requires DPoP-bound access tokens together with an ID token.", { stage: "token-response" });
     }
     return value;
 }
+/**
+ * Copy the user's compliance-tolerance opt-ins onto a freshly discovered provider
+ * configuration, so every token-validation path (login, restore, refresh) honours
+ * flags that were declared on {@link SebaConfig} instead of being silently dropped.
+ * Only `true` values are copied; omitempty otherwise.
+ */
+export function applyComplianceTolerances(configuration, tolerances) {
+    if (tolerances?.allowNonCompliantAudience === true) {
+        configuration.allowNonCompliantAudience = true;
+    }
+    if (tolerances?.allowNonCompliantCnf === true) {
+        configuration.allowNonCompliantCnf = true;
+    }
+}
 /**
  * Validate an ID token and derive the authenticated identity.
  *
@@ -296,6 +313,20 @@ function requireString(value, field) {
  *
  * @param input - Token, provider configuration, client identity and expectations.
  */
+let nonCompliantAudienceWarned = false;
+export function hasNonCompliantAudienceWarned() {
+    return nonCompliantAudienceWarned;
+}
+export function setNonCompliantAudienceWarned(value) {
+    nonCompliantAudienceWarned = value;
+}
+let nonCompliantCnfWarned = false;
+export function hasNonCompliantCnfWarned() {
+    return nonCompliantCnfWarned;
+}
+export function setNonCompliantCnfWarned(value) {
+    nonCompliantCnfWarned = value;
+}
 export async function validateIdToken(input) {
     const jwks = input.jwks ?? createJwks(input.configuration.jwksUri, input.fetchImpl);
     let payload;
@@ -311,41 +342,49 @@ export async function validateIdToken(input) {
     }
     catch (error) {
         if (error instanceof joseErrors.JOSEError) {
-            throw new SebaAuthError(`The ID token failed validation: ${error.message}.`, { cause: error });
+            throw new SebaAuthError(`The ID token failed validation: ${error.message}.`, { cause: error, stage: "id-token-signature" });
         }
         if (error instanceof SebaError) {
             throw error;
         }
-        throw new SebaAuthError("The ID token could not be verified.", { cause: error });
+        throw new SebaAuthError("The ID token could not be verified.", { cause: error, stage: "id-token-signature" });
     }
     const audience = payload["aud"];
     const audiences = Array.isArray(audience) ? audience : [audience];
     const azp = payload["azp"];
     if (azp !== undefined && azp !== input.clientId) {
-        throw new SebaAuthError(`The ID token was issued to authorized party "${String(azp)}", not to this client ("${input.clientId}").`);
+        throw new SebaAuthError(`The ID token was issued to authorized party "${String(azp)}", not to this client ("${input.clientId}").`, { stage: "id-token-azp" });
     }
     if (audiences.length > 1 && azp === undefined) {
-        throw new SebaAuthError("The ID token has multiple audiences but no \"azp\" claim.");
+        throw new SebaAuthError("The ID token has multiple audiences but no \"azp\" claim.", { stage: "id-token-azp" });
     }
     const solidRequired = input.configuration.scopesSupported?.includes("webid") === true;
     if (solidRequired && !audiences.includes("solid")) {
-        throw new SebaAuthError("The ID token audience does not include \"solid\". Solid-OIDC requires it when the provider advertises the webid scope.");
+        if (!input.configuration.allowNonCompliantAudience) {
+            throw new SebaAuthError("The ID token audience does not include \"solid\". Solid-OIDC requires it when the provider advertises the webid scope.", { stage: "id-token-audience" });
+        }
+        if (!hasNonCompliantAudienceWarned()) {
+            setNonCompliantAudienceWarned(true);
+            console.warn("[SEBA] WARNING: Accepting an ID token without \"solid\" in aud because " +
+                "allowNonCompliantAudience is enabled. This weakens Solid-OIDC §8.1 audience " +
+                "guarantees. Disable this flag once your provider is compliant.");
+        }
     }
     if (input.nonce !== undefined && payload["nonce"] !== input.nonce) {
-        throw new SebaAuthError("The ID token nonce does not match the login that was started.");
+        throw new SebaAuthError("The ID token nonce does not match the login that was started.", { stage: "id-token-nonce" });
     }
     const issuedAt = payload["iat"];
     if (typeof issuedAt !== "number" || !Number.isFinite(issuedAt)) {
-        throw new SebaAuthError("The ID token has no usable \"iat\" claim.");
+        throw new SebaAuthError("The ID token has no usable \"iat\" claim.", { stage: "id-token-iat" });
     }
     const nowSeconds = Math.floor(Date.now() / 1000);
     if (issuedAt > nowSeconds + CLOCK_TOLERANCE_SECONDS) {
-        throw new SebaAuthError("The ID token was issued in the future; check the device clock.");
+        throw new SebaAuthError("The ID token was issued in the future; check the device clock.", { stage: "id-token-iat" });
     }
     await checkDpopBinding(payload, input);
     const subject = payload["sub"];
     if (typeof subject !== "string" || subject === "") {
-        throw new SebaAuthError("The ID token has no usable \"sub\" claim.");
+        throw new SebaAuthError("The ID token has no usable \"sub\" claim.", { stage: "id-token-sub" });
     }
     if (input.expectedSubject !== undefined && subject !== input.expectedSubject) {
         throw new SebaAuthError("The ID token subject does not match the stored session.");
@@ -353,7 +392,7 @@ export async function validateIdToken(input) {
     const webId = extractWebId(payload, subject);
     if (input.expectedWebId !== undefined && webId !== input.expectedWebId) {
         throw new SebaAuthError(`The provider authenticated "${webId}", but this login requested "${input.expectedWebId}". ` +
-            "The session was not created.");
+            "The session was not created.", { stage: "id-token-webid" });
     }
     return { webId, issuer: input.configuration.issuer, subject };
 }
@@ -364,18 +403,28 @@ async function checkDpopBinding(payload, input) {
         : undefined;
     if (boundThumbprint !== undefined) {
         if (input.signer === undefined) {
-            throw new SebaAuthError("The ID token is bound to a DPoP key that is not available locally.");
+            throw new SebaAuthError("The ID token is bound to a DPoP key that is not available locally.", { stage: "id-token-cnf-binding" });
         }
         const thumbprint = await input.signer.thumbprint();
         if (boundThumbprint !== thumbprint) {
             throw new SebaAuthError("The ID token is bound to a different DPoP key than the one used for this session. " +
-                "The token was discarded.");
+                "The token was discarded.", { stage: "id-token-cnf-binding" });
         }
         return;
     }
     if (input.requireDpopBinding === true) {
+        if (input.allowNonCompliantCnf === true) {
+            if (!hasNonCompliantCnfWarned()) {
+                setNonCompliantCnfWarned(true);
+                console.warn("[SEBA] WARNING: Accepting an ID token without \"cnf.jkt\" because " +
+                    "allowNonCompliantCnf is enabled. This weakens Solid-OIDC §8.1 DPoP-binding " +
+                    "guarantees on the ID token; DPoP proofs remain mandatory on every request. " +
+                    "Disable this flag once your provider is compliant.");
+            }
+            return;
+        }
         throw new SebaAuthError("The ID token is not bound to a DPoP key (\"cnf.jkt\"), but the provider advertises the webid scope. " +
-            "Solid-OIDC requires DPoP-bound tokens.");
+            "Solid-OIDC requires DPoP-bound tokens.", { stage: "id-token-cnf-binding" });
     }
 }
 function extractWebId(payload, subject) {
@@ -387,7 +436,7 @@ function extractWebId(payload, subject) {
     }
     catch {
         throw new SebaAuthError(`The ID token identifies the user as "${candidate}", which is not an absolute URL. ` +
-            "A WebID must be an https URL; the session was not created.");
+            "A WebID must be an https URL; the session was not created.", { stage: "id-token-webid" });
     }
     if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
         throw new SebaAuthError(`The ID token identifies the user as "${candidate}", which does not use https. ` +

package/dist/core/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/core/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,MAAM,IAAI,UAAU,EACpB,SAAS,GAEV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAE7E,kEAAkE;AAClE,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAE3F,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AA0B9G;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAU,GAAG,EAAE;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7B,qFAAqF;QACrF,4EAA4E;QAC5E,OAAO,aAAa,CAAC,MAAM,CAAE,IAAI,CAAC,CAAC,CAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAKhD;IACC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,cAAc,EAAE;QAChB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,OAAO,GAAyB;QACpC,KAAK;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,iFAAiF,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,qEAAqE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,OAA6B;IAC3F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,+BAA+B,WAAW,uBAAuB,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;IAEhC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,IAAI,aAAa,CACrB,6CAA6C,aAAa,GAAG;YAC3D,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CACrB,qEAAqE;YACnE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACrB,8EAA8E;YAC5E,aAAa,OAAO,CAAC,MAAM,2EAA2E,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CACrB,6CAA6C,MAAM,sCAAsC,OAAO,CAAC,MAAM,KAAK;YAC1G,kFAAkF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CAAC,oEAAoE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAM1C;IACC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC/C,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,KAAK,CAAC,aAAa;gBACxB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,KAAK,CAAC,aAAa,EACnB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAC5E,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAU,IAAI,EAAE,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YACrG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAA+B,EAAE,QAAQ,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1G,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhH,IAAI,KAAK,KAAK,gBAAgB,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YACtE,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,iFAAiF,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAW/C;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QAChD,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,aAAa,CACrB,4DAA4D,OAAO,CAAC,KAAK,GAAG;YAC1E,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI;QACnF,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAA6B;IACzD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CACrB,qCAAqC,SAAS,0CAA0C;YACtF,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QAC5D,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CACrB,iDAAiD,KAAK,WAAW;YAC/D,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAWrC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACpD,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,mBAAmB;YAC/B,cAAc,EAAE,uBAAuB;YACvC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,mCAAmC,KAAK,CAAC,OAAO,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACrB,gDAAgD,MAAM,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,QAAQ,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,2DAA2D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACtF,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CACrB,wHAAwH,CACzH,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAClE,MAAM,IAAI,aAAa,CAAC,+DAA+D,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,GAAG,UAAU,GAAG,uBAAuB,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,gEAAgE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7E,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,+BAA+B,KAAK,gCAAgC,KAAK,CAAC,aAAa,KAAK;YAC1F,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgC,EAChC,KAA4D;IAE5D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,eAAe,GACnB,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QACvD,CAAC,CAAE,YAAwC,CAAC,KAAK,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,oEAAoE,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,aAAa,CACrB,oFAAoF;gBAClF,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,aAAa,CACrB,sGAAsG;YACpG,wCAAwC,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAgC,EAAE,OAAe;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CACrB,wCAAwC,SAAS,mCAAmC;YAClF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,aAAa,CACrB,wCAAwC,SAAS,+BAA+B;YAC9E,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,SAAmC;IACtE,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAC5E,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3G,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAA2B;IACnD,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/core/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,MAAM,IAAI,UAAU,EACpB,SAAS,GAEV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAE7E,kEAAkE;AAClE,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAE3F,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AA0B9G;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,UAAU,GAAG,EAAE;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7B,qFAAqF;QACrF,4EAA4E;QAC5E,OAAO,aAAa,CAAC,MAAM,CAAE,IAAI,CAAC,CAAC,CAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB;IACtD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAKhD;IACC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,cAAc,EAAE;QAChB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9B,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,OAAO,GAAyB;QACpC,KAAK;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAQrC;IACC,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,iFAAiF,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,aAAa,CAAC,qEAAqE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB,EAAE,OAA6B;IAC3F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,+BAA+B,WAAW,uBAAuB,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;IAEhC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,IAAI,aAAa,CACrB,6CAA6C,aAAa,GAAG;YAC3D,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,EACnD,EAAE,KAAK,EAAE,wBAAwB,EAAE,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CACrB,qEAAqE;YACnE,uEAAuE,EACzE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CACrB,8EAA8E;YAC5E,aAAa,OAAO,CAAC,MAAM,2EAA2E,EACxG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CACrB,6CAA6C,MAAM,sCAAsC,OAAO,CAAC,MAAM,KAAK;YAC1G,kFAAkF,EACpF,EAAE,KAAK,EAAE,4BAA4B,EAAE,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CAAC,oEAAoE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACpG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC/C,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,KAAK,CAAC,aAAa;gBACxB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,KAAK,CAAC,aAAa,EACnB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAC5E,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAU,IAAI,EAAE,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAClI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,aAAa,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAA+B,EAAE,QAAQ,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1G,MAAM,WAAW,GAAG,OAAO,MAAM,EAAE,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhH,IAAI,KAAK,KAAK,gBAAgB,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC/E,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,iFAAiF,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAa/C;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;KAClC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa;QAChD,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC;KACnG,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,aAAa,CACrB,4DAA4D,OAAO,CAAC,KAAK,GAAG;YAC1E,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,EACxE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI;QACnF,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAA6B;IACzD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CACrB,qCAAqC,SAAS,0CAA0C;YACtF,iEAAiE,EACnE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACrE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QAC5D,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CACrB,iDAAiD,KAAK,WAAW;YAC/D,mEAAmE,EACrE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,aAAgC,EAChC,UAA+F;IAE/F,IAAI,UAAU,EAAE,yBAAyB,KAAK,IAAI,EAAE,CAAC;QACnD,aAAa,CAAC,yBAAyB,GAAG,IAAI,CAAC;IACjD,CAAC;IACD,IAAI,UAAU,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAC9C,aAAa,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,0BAA0B,GAAG,KAAK,CAAC;AAEvC,MAAM,UAAU,6BAA6B;IAC3C,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,0BAA0B,GAAG,KAAK,CAAC;AACrC,CAAC;AAED,IAAI,qBAAqB,GAAG,KAAK,CAAC;AAElC,MAAM,UAAU,wBAAwB;IACtC,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,qBAAqB,GAAG,KAAK,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAYrC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpF,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACpD,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,mBAAmB;YAC/B,cAAc,EAAE,uBAAuB;YACvC,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,aAAa,CAAC,mCAAmC,KAAK,CAAC,OAAO,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACrB,gDAAgD,MAAM,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,QAAQ,KAAK,EACzG,EAAE,KAAK,EAAE,cAAc,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACtF,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CACrB,wHAAwH,EACxH,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,6BAA6B,EAAE,EAAE,CAAC;YACrC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CACV,yEAAyE;gBACvE,8EAA8E;gBAC9E,gEAAgE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QAClE,MAAM,IAAI,aAAa,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,aAAa,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,IAAI,QAAQ,GAAG,UAAU,GAAG,uBAAuB,EAAE,CAAC;QACpD,MAAM,IAAI,aAAa,CAAC,gEAAgE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7E,MAAM,IAAI,aAAa,CAAC,yDAAyD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,+BAA+B,KAAK,gCAAgC,KAAK,CAAC,aAAa,KAAK;YAC1F,8BAA8B,EAChC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgC,EAChC,KAA4F;IAE5F,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,eAAe,GACnB,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;QACvD,CAAC,CAAE,YAAwC,CAAC,KAAK,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,oEAAoE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACnD,IAAI,eAAe,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,aAAa,CACrB,oFAAoF;gBAClF,0BAA0B,EAC5B,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAClC,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;gBAChC,wBAAwB,CAAC,IAAI,CAAC,CAAC;gBAC/B,OAAO,CAAC,IAAI,CACV,oEAAoE;oBAClE,6EAA6E;oBAC7E,6EAA6E;oBAC7E,oDAAoD,CACvD,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,sGAAsG;YACpG,wCAAwC,EAC1C,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAgC,EAAE,OAAe;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CACrB,wCAAwC,SAAS,mCAAmC;YAClF,4DAA4D,EAC9D,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,aAAa,CACrB,wCAAwC,SAAS,+BAA+B;YAC9E,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,SAAmC;IACtE,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAC5E,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3G,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAA2B;IACnD,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/core/session.d.ts

@@ -10,7 +10,7 @@
  * - transient failures never clear a still-valid refresh token.
  */
 import { type Identity } from "./oidc.js";
-import type { DPoPSigner, OIDCConfiguration, PersistedKey, Session, SessionStorageAdapter, TokenSet } from "../types.js";
+import type { DPoPSigner, OIDCConfiguration, PersistedKey, Session, SessionChangeListener, SessionStorageAdapter, TokenSet } from "../types.js";
 /** Refresh an access token this long before it expires (milliseconds). */
 export declare const EXPIRY_SKEW_MS = 30000;
 /** A logged in session held in memory. */
@@ -25,8 +25,8 @@ export interface SessionState {
     readonly key: PersistedKey;
     /** Client identifier the session belongs to. */
     readonly clientId: string;
-    /** Discovery metadata used for refresh and revocation. */
-    readonly configuration: OIDCConfiguration;
+    /** Discovery metadata used for refresh and revocation; `null` for sessions resumed without discovery. */
+    readonly configuration: OIDCConfiguration | null;
     /** Access token expiry (epoch milliseconds), or `null` when unknown. */
     readonly expiresAt: number | null;
 }
@@ -40,8 +40,15 @@ export interface SessionManagerOptions {
     readonly fetchImpl: typeof fetch;
     /** Re-discover a provider when restoring a session. */
     readonly discover: (issuer: string) => Promise<OIDCConfiguration>;
+    /**
+     * How many `use_dpop_nonce` challenges the token endpoint may issue before giving up.
+     * @defaultValue 1
+     */
+    readonly maxDpopNonceRetries?: number;
     /** Non-sensitive diagnostics. */
     readonly debug?: (message: string) => void;
+    /** Receives session transitions (`login`, `restore`, `logout`, `expired`). */
+    readonly onSessionChange?: SessionChangeListener;
 }
 /**
  * Owns the current session and its persistence.

package/dist/core/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAwD,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,YAAY,EAEZ,OAAO,EACP,qBAAqB,EACrB,QAAQ,EACT,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,eAAO,MAAM,cAAc,QAAS,CAAC;AAKrC,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC1C,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE,iCAAiC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED;;;;GAIG;AACH,qBAAa,cAAc;;gBAKb,OAAO,EAAE,qBAAqB;IAI1C,wDAAwD;IACxD,IAAI,OAAO,IAAI,YAAY,GAAG,IAAI,CAEjC;IAED,8CAA8C;IAC9C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;;;OAIG;IACH,OAAO,IAAI,YAAY;IAOvB,sDAAsD;IACtD,eAAe,IAAI,OAAO,GAAG,IAAI;IAOjC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,QAAQ,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,GAAG,EAAE,YAAY,CAAC;QAClB,aAAa,EAAE,iBAAiB,CAAC;KAClC,GAAG,OAAO,CAAC,YAAY,CAAC;IAkCzB;;;;;;;OAOG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA2BxC,8EAA8E;IAC9E,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAED;;;;;OAKG;IACG,eAAe,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0InD;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAqD7B,yDAAyD;IACnD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IASjC,8EAA8E;IAC9E,SAAS,IAAI,OAAO;CAerB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,GAAG,QAAQ,CAItF"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/core/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAwD,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChG,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,YAAY,EAEZ,OAAO,EACP,qBAAqB,EAErB,qBAAqB,EACrB,QAAQ,EACT,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,eAAO,MAAM,cAAc,QAAS,CAAC;AAKrC,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yGAAyG;IACzG,QAAQ,CAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACjD,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;CAClD;AAED;;;;GAIG;AACH,qBAAa,cAAc;;gBAMb,OAAO,EAAE,qBAAqB;IAI1C,wDAAwD;IACxD,IAAI,OAAO,IAAI,YAAY,GAAG,IAAI,CAEjC;IAED,8CAA8C;IAC9C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;;;OAIG;IACH,OAAO,IAAI,YAAY;IAOvB,sDAAsD;IACtD,eAAe,IAAI,OAAO,GAAG,IAAI;IAOjC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,QAAQ,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,GAAG,EAAE,YAAY,CAAC;QAClB,aAAa,EAAE,iBAAiB,CAAC;KAClC,GAAG,OAAO,CAAC,YAAY,CAAC;IAgDzB;;;;;;;OAOG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAsFxC,8EAA8E;IAC9E,IAAI,SAAS,IAAI,MAAM,GAAG,IAAI,CAE7B;IAED;;;;;OAKG;IACG,eAAe,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA6JnD;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAgE7B,yDAAyD;IACnD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IASjC,8EAA8E;IAC9E,SAAS,IAAI,OAAO;CA2CrB;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,GAAG,QAAQ,CAItF"}

package/dist/core/session.js

@@ -26,6 +26,7 @@ export class SessionManager {
     #options;
     #state = null;
     #refreshing = null;
+    #expiredNotified = false;
     constructor(options) {
         this.#options = options;
     }
@@ -73,27 +74,38 @@ export class SessionManager {
             expiresAt: expiresAtFrom(input.tokens),
         };
         this.#state = state;
-        if (input.tokens.refreshToken !== undefined) {
-            const record = {
-                version: 1,
-                webId: state.identity.webId,
-                provider: state.identity.issuer,
-                clientId: state.clientId,
-                refreshToken: input.tokens.refreshToken,
-                key: input.key,
-                createdAt: Date.now(),
-                ...(input.tokens.scope === undefined ? {} : { scope: input.tokens.scope }),
-            };
-            try {
-                await this.#options.storage.save(record);
-            }
-            catch (error) {
-                this.#log("session storage is unavailable; the session will not survive a reload", error);
-            }
+        const noRefreshToken = input.tokens.refreshToken === undefined;
+        const record = {
+            version: 1,
+            webId: state.identity.webId,
+            provider: state.identity.issuer,
+            clientId: state.clientId,
+            ...(noRefreshToken
+                ? {
+                    // With no refresh token there is nothing else to fetch with after a
+                    // reload, so the access token is stored to keep the session alive
+                    // until it expires. It is never stored for refresh-token sessions.
+                    accessToken: input.tokens.accessToken,
+                    accessTokenExpiresAt: state.expiresAt,
+                    subject: input.identity.subject,
+                }
+                : {}),
+            ...(noRefreshToken ? {} : { refreshToken: input.tokens.refreshToken }),
+            key: input.key,
+            createdAt: Date.now(),
+            ...(input.tokens.scope === undefined ? {} : { scope: input.tokens.scope }),
+        };
+        try {
+            await this.#options.storage.save(record);
         }
-        else {
-            this.#log("the provider issued no refresh token; the session will not survive a reload");
+        catch (error) {
+            this.#log("session storage is unavailable; the session will not survive a reload", error);
+        }
+        if (noRefreshToken) {
+            this.#log("the provider issued no refresh token; the session is stored with its access token and expires when the token does");
         }
+        this.#expiredNotified = false;
+        this.#emit("login");
         return state;
     }
     /**
@@ -119,12 +131,58 @@ export class SessionManager {
         }
         catch (error) {
             await this.clearLocal();
+            this.#signalExpired();
             throw new SebaSessionExpiredError("The stored DPoP key is unusable; the session was cleared.", {
                 cause: error,
             });
         }
+        if (record.refreshToken === undefined) {
+            return this.#restoreWithoutRefreshToken(record, signer);
+        }
         const configuration = await this.#options.discover(record.provider);
         await this.#refreshWith(record, signer, configuration);
+        this.#expiredNotified = false;
+        this.#emit("restore");
+        return this.toPublicSession();
+    }
+    /**
+     * Resume a session stored without a refresh token. The stored access token is
+     * reused while it is still valid; once it expires the record is cleared with a
+     * clear error because nothing on disk can renew it.
+     */
+    async #restoreWithoutRefreshToken(record, signer) {
+        if (record.accessToken === undefined || record.accessToken === "") {
+            await this.clearLocal();
+            this.#signalExpired();
+            throw new SebaSessionExpiredError("The stored session has no usable credential; it was cleared. Sign in again.");
+        }
+        if (record.accessTokenExpiresAt !== undefined &&
+            record.accessTokenExpiresAt !== null &&
+            Date.now() >= record.accessTokenExpiresAt - EXPIRY_SKEW_MS) {
+            await this.clearLocal();
+            this.#signalExpired();
+            throw new SebaSessionExpiredError("The stored access token has expired and the provider issued no refresh token, so the session was cleared. Sign in again.");
+        }
+        const tokens = {
+            // Only the access token matters here: sessions restored without a refresh
+            // token cannot refresh, so idToken is never read on this path.
+            tokenType: "DPoP",
+            accessToken: record.accessToken,
+            idToken: "",
+            ...(record.scope === undefined ? {} : { scope: record.scope }),
+        };
+        this.#state = {
+            tokens,
+            identity: { webId: record.webId, issuer: record.provider, subject: record.subject ?? record.webId },
+            signer,
+            key: record.key,
+            clientId: this.#options.clientId,
+            configuration: null,
+            expiresAt: record.accessTokenExpiresAt ?? null,
+        };
+        this.#log("restored the session with the stored access token (the provider issued no refresh token; it expires with the token)");
+        this.#expiredNotified = false;
+        this.#emit("restore");
         return this.toPublicSession();
     }
     /** Access token expiry, or `null` when the provider did not advertise one. */
@@ -138,9 +196,14 @@ export class SessionManager {
      * @throws {@link SebaAuthError} when no session exists.
      */
     async refreshIfNeeded(force = false) {
+        if (this.#state === null && this.#expiredNotified) {
+            throw new SebaSessionExpiredError("The session has expired. Sign in again.");
+        }
         const state = this.require();
         if (state.tokens.refreshToken === undefined) {
             if (force) {
+                await this.clearLocal();
+                this.#signalExpired();
                 throw new SebaSessionExpiredError("The access token was rejected and no refresh token is available. Sign in again.");
             }
             return;
@@ -169,8 +232,15 @@ export class SessionManager {
         const record = await this.#options.storage.load();
         const refreshToken = state.tokens.refreshToken ?? record?.refreshToken;
         if (refreshToken === undefined) {
+            await this.clearLocal();
+            this.#signalExpired();
             throw new SebaSessionExpiredError("No refresh token is available. Sign in again.");
         }
+        if (state.configuration === null) {
+            await this.clearLocal();
+            this.#signalExpired();
+            throw new SebaSessionExpiredError("No provider metadata is available for this session. Sign in again.");
+        }
         const stored = record ?? {
             version: 1,
             webId: state.identity.webId,
@@ -183,6 +253,9 @@ export class SessionManager {
         await this.#refreshWith(stored, state.signer, state.configuration);
     }
     async #refreshWith(record, signer, configuration) {
+        if (record.refreshToken === undefined) {
+            throw new SebaSessionExpiredError("No refresh token is available. Sign in again.");
+        }
         const body = new URLSearchParams({
             grant_type: "refresh_token",
             refresh_token: record.refreshToken,
@@ -193,6 +266,7 @@ export class SessionManager {
             body,
             signer,
             fetchImpl: this.#options.fetchImpl,
+            maxNonceRetries: this.#options.maxDpopNonceRetries,
         });
         if (!outcome.ok) {
             if (outcome.status >= 500) {
@@ -200,6 +274,7 @@ export class SessionManager {
             }
             if (TERMINAL_REFRESH_ERRORS.has(outcome.error)) {
                 await this.clearLocal();
+                this.#signalExpired();
                 throw new SebaSessionExpiredError(`The stored session is no longer valid ("${outcome.error}"). Sign in again.`);
             }
             throw new SebaAuthError(`The token endpoint rejected the refresh request with "${outcome.error}"` +
@@ -215,6 +290,7 @@ export class SessionManager {
                 signer,
                 fetchImpl: this.#options.fetchImpl,
                 requireDpopBinding: configuration.scopesSupported?.includes("webid") === true,
+                ...(configuration.allowNonCompliantCnf === true ? { allowNonCompliantCnf: true } : {}),
                 expectedWebId: record.webId,
             });
         }
@@ -225,6 +301,7 @@ export class SessionManager {
                 // repeat the failure on every restore. Network/JWKS transport errors are not
                 // SebaAuthError and keep the record.
                 await this.clearLocal();
+                this.#signalExpired();
                 throw new SebaSessionExpiredError("The refreshed ID token does not match the stored session, so the session was cleared. Sign in again.", { cause: error });
             }
             throw error;
@@ -266,7 +343,9 @@ export class SessionManager {
         const refreshToken = state?.tokens.refreshToken ?? record?.refreshToken;
         let configuration = state?.configuration;
         let signer = state?.signer;
-        if (refreshToken !== undefined && record !== null && (configuration === undefined || signer === undefined)) {
+        if (refreshToken !== undefined &&
+            record !== null &&
+            (configuration === undefined || configuration === null || signer === undefined)) {
             try {
                 configuration ??= await this.#options.discover(record.provider);
                 signer ??= await loadDPoPKey(record.key);
@@ -276,7 +355,12 @@ export class SessionManager {
             }
         }
         await this.clearLocal();
+        this.#emit("logout");
         if (refreshToken === undefined || configuration?.revocationEndpoint === undefined || signer === undefined) {
+            if (refreshToken !== undefined && configuration?.revocationEndpoint === undefined) {
+                this.#log("the provider does not advertise a revocation endpoint; the refresh token remains " +
+                    "valid on the server until it expires (or is revoked out-of-band). Local state was cleared.");
+            }
             return;
         }
         try {
@@ -326,6 +410,33 @@ export class SessionManager {
         }
         return state.expiresAt !== null && Date.now() >= state.expiresAt - EXPIRY_SKEW_MS;
     }
+    /** Emit a transition; listener failures never break the session flow. */
+    #emit(reason) {
+        const listener = this.#options.onSessionChange;
+        if (listener === undefined) {
+            return;
+        }
+        try {
+            listener({ reason, session: this.toPublicSession() });
+        }
+        catch {
+            // Application callbacks must not interrupt session handling.
+        }
+    }
+    /**
+     * Emit `expired` at most once per session.
+     *
+     * The in-memory session is dropped first so the event always carries
+     * `session: null`, matching {@link SessionChangeEvent}.
+     */
+    #signalExpired() {
+        if (this.#expiredNotified) {
+            return;
+        }
+        this.#expiredNotified = true;
+        this.#state = null;
+        this.#emit("expired");
+    }
     #log(message, error) {
         if (this.#options.debug === undefined) {
             return;