@idp.global/sdk 11.0.0 → 13.0.0

package/changelog.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2026-07-18 - 13.0.0
+
+### Breaking Changes
+
+- adopt encrypted OIDC client-secret delivery contracts (secret-delivery)
+  - Upgrade @idp.global/interfaces to ^22.0.0.
+  - Expose RSA-OAEP-256 secret-delivery context creation and verified envelope decryption from the browser entrypoint.
+  - Add acknowledgeAppSecretDelivery typed request accessor.
+  - Add tests for operation-bound envelope validation and malformed delivery rejection.
+
+## 2026-07-18 - 12.0.0
+
+### Breaking Changes
+
+- adopt interfaces v20 current-user DTO for password auth results (server-client)
+  - Upgrade @idp.global/interfaces to ^20.0.1.
+  - Change IIdpPasswordAuthResult.user from IUser to ICurrentUserDto to match the privacy-safe whoIs response.
+
+## 2026-07-18 - next
+
+### Breaking Changes
+
+- adopt encrypted OIDC client-secret delivery contracts
+  - Upgrade `@idp.global/interfaces` to ^22.0.0.
+  - Expose RSA-OAEP-256 delivery-key creation and verified envelope decryption in the browser entrypoint.
+  - Add the `acknowledgeAppSecretDelivery` typed request accessor.
+- adopt `@idp.global/interfaces` 20 and type password-login identity data as the
+  privacy-safe `ICurrentUserDto` actually returned by `whoIs`, rather than the
+  persisted `IUser` shape that includes server-only credential fields
+
 ## 2026-07-16 - 11.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '11.0.0',
+    version: '13.0.0',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_browser/classes.idprequests.d.ts

@@ -87,6 +87,7 @@ export declare class IdpRequests {
     get updateGlobalApp(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_UpdateGlobalApp>;
     get deleteGlobalApp(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_DeleteGlobalApp>;
     get regenerateAppCredentials(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_RegenerateAppCredentials>;
+    get acknowledgeAppSecretDelivery(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_AcknowledgeAppSecretDelivery>;
     get rotateOidcSigningKey(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_RotateOidcSigningKey>;
     get getGlobalUsers(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_GetGlobalUsers>;
     get setUserSuspension(): plugins.typedrequest.TypedRequest<plugins.idpInterfaces.request.IReq_SetUserSuspension>;

package/dist_ts_browser/classes.idprequests.js

@@ -256,6 +256,9 @@ export class IdpRequests {
     get regenerateAppCredentials() {
         return this.idpClientArg.typedsocket.createTypedRequest('regenerateAppCredentials');
     }
+    get acknowledgeAppSecretDelivery() {
+        return this.idpClientArg.typedsocket.createTypedRequest('acknowledgeAppSecretDelivery');
+    }
     get rotateOidcSigningKey() {
         return this.idpClientArg.typedsocket.createTypedRequest('rotateOidcSigningKey');
     }
@@ -305,4 +308,4 @@ export class IdpRequests {
         return this.idpClientArg.typedsocket.createTypedRequest('discoverSsoForEmail');
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHByZXF1ZXN0cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2Jyb3dzZXIvY2xhc3Nlcy5pZHByZXF1ZXN0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUd4QyxNQUFNLE9BQU8sV0FBVztJQUNGO0lBQXBCLFlBQW9CLFlBQXVCO1FBQXZCLGlCQUFZLEdBQVosWUFBWSxDQUFXO0lBQUcsQ0FBQztJQUUvQyxJQUFXLDZCQUE2QjtRQUN0QyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFtRSwrQkFBK0IsQ0FBQyxDQUFDO0lBQzdKLENBQUM7SUFFRCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBNEQsd0JBQXdCLENBQUMsQ0FBQztJQUMvSSxDQUFDO0lBRUQsSUFBVyxrQkFBa0I7UUFDM0IsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBd0Qsb0JBQW9CLENBQUMsQ0FBQztJQUN2SSxDQUFDO0lBRUQsSUFBVyw0QkFBNEI7UUFDckMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBeUUscUNBQXFDLENBQUMsQ0FBQztJQUN6SyxDQUFDO0lBRUQsSUFBVyxTQUFTO1FBQ2xCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQWdELFlBQVksQ0FBQyxDQUFDO0lBQ3ZILENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRSxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzNLLENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBb0QsZ0JBQWdCLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBVyx3QkFBd0I7UUFDakMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMEUsc0NBQXNDLENBQUMsQ0FBQztJQUMzSyxDQUFDO0lBRUQsSUFBVyx5QkFBeUI7UUFDbEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztJQUNySixDQUFDO0lBRUQsSUFBVyx3QkFBd0I7UUFDakMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBOEQsMEJBQTBCLENBQUMsQ0FBQztJQUNuSixDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBb0QsZ0JBQWdCLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBVyxjQUFjO1FBQ3ZCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW9ELGdCQUFnQixDQUFDLENBQUM7SUFDL0gsQ0FBQztJQUVELElBQVcsY0FBYztRQUN2QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFvRCxnQkFBZ0IsQ0FBQyxDQUFDO0lBQy9ILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCwwQkFBMEIsQ0FBQyxDQUFDO0lBQzVJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLFlBQVk7UUFDckIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBa0QsY0FBYyxDQUFDLENBQUM7SUFDM0gsQ0FBQztJQUVELElBQVcsbUJBQW1CO1FBQzVCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXlELHFCQUFxQixDQUFDLENBQUM7SUFDekksQ0FBQztJQUVELElBQVcsb0JBQW9CO1FBQzdCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQTBELHNCQUFzQixDQUFDLENBQUM7SUFDM0ksQ0FBQztJQUVELElBQVcsV0FBVztRQUNwQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFpRCxhQUFhLENBQUMsQ0FBQztJQUN6SCxDQUFDO0lBRUQsSUFBVyxxQkFBcUI7UUFDOUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMkQsdUJBQXVCLENBQUMsQ0FBQztJQUM3SSxDQUFDO0lBRUQsSUFBVyxrQkFBa0I7UUFDM0IsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBd0Qsb0JBQW9CLENBQUMsQ0FBQztJQUN2SSxDQUFDO0lBRUQsSUFBVyx3QkFBd0I7UUFDakMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBOEQsMEJBQTBCLENBQUMsQ0FBQztJQUNuSixDQUFDO0lBRUQsSUFBVyx5QkFBeUI7UUFDbEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztJQUNySixDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxnQkFBZ0I7UUFDekIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBc0Qsa0JBQWtCLENBQUMsQ0FBQztJQUNuSSxDQUFDO0lBRUQsSUFBVyxlQUFlO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXFELGlCQUFpQixDQUFDLENBQUM7SUFDakksQ0FBQztJQUVELElBQVcsa0JBQWtCO1FBQzNCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXdELG9CQUFvQixDQUFDLENBQUM7SUFDdkksQ0FBQztJQUVELElBQVcsYUFBYTtRQUN0QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFtRCxlQUFlLENBQUMsQ0FBQztJQUM3SCxDQUFDO0lBRUQsSUFBVyxtQkFBbUI7UUFDNUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBeUQscUJBQXFCLENBQUMsQ0FBQztJQUN6SSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLHFCQUFxQjtRQUM5QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEyRCx1QkFBdUIsQ0FBQyxDQUFDO0lBQzdJLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLGdCQUFnQjtRQUN6QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFzRCxrQkFBa0IsQ0FBQyxDQUFDO0lBQ25JLENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLGFBQWE7UUFDdEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBbUQsZUFBZSxDQUFDLENBQUM7SUFDN0gsQ0FBQztJQUVELElBQVcsZ0JBQWdCO1FBQ3pCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXNELGtCQUFrQixDQUFDLENBQUM7SUFDbkksQ0FBQztJQUVELElBQVcsZ0JBQWdCO1FBQ3pCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXNELGtCQUFrQixDQUFDLENBQUM7SUFDbkksQ0FBQztJQUVELElBQVcsWUFBWTtRQUNyQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFrRCxjQUFjLENBQUMsQ0FBQztJQUMzSCxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyxvQkFBb0I7UUFDN0IsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMEQsc0JBQXNCLENBQUMsQ0FBQztJQUMzSSxDQUFDO0lBRUQsSUFBVyxnQkFBZ0I7UUFDekIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBc0Qsa0JBQWtCLENBQUMsQ0FBQztJQUNuSSxDQUFDO0lBRUQsSUFBVyxxQkFBcUI7UUFDOUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMkQsdUJBQXVCLENBQUMsQ0FBQztJQUM3SSxDQUFDO0lBRUQsSUFBVyxxQkFBcUI7UUFDOUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMkQsdUJBQXVCLENBQUMsQ0FBQztJQUM3SSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLGlDQUFpQztRQUMxQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RSxtQ0FBbUMsQ0FBQyxDQUFDO0lBQ3JLLENBQUM7SUFFRCxJQUFXLDBCQUEwQjtRQUNuQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFnRSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZKLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLHdCQUF3QjtRQUNqQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE4RCwwQkFBMEIsQ0FBQyxDQUFDO0lBQ25KLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLHlCQUF5QjtRQUNsQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUErRCwyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JKLENBQUM7SUFFRCxJQUFXLDZCQUE2QjtRQUN0QyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFtRSwrQkFBK0IsQ0FBQyxDQUFDO0lBQzdKLENBQUM7SUFFRCxJQUFXLDBCQUEwQjtRQUNuQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFnRSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZKLENBQUM7SUFFRCxJQUFXLHlCQUF5QjtRQUNsQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUErRCwyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JKLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLHNCQUFzQjtRQUMvQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE0RCx3QkFBd0IsQ0FBQyxDQUFDO0lBQy9JLENBQUM7SUFFRCxJQUFXLHFCQUFxQjtRQUM5QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEyRCx1QkFBdUIsQ0FBQyxDQUFDO0lBQzdJLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxjQUFjO1FBQ3ZCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW9ELGdCQUFnQixDQUFDLENBQUM7SUFDL0gsQ0FBQztJQUVELElBQVcsZ0NBQWdDO1FBQ3pDLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQStELGtDQUFrQyxDQUFDLENBQUM7SUFDNUosQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLGdCQUFnQjtRQUN6QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFzRCxrQkFBa0IsQ0FBQyxDQUFDO0lBQ25JLENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxlQUFlO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXFELGlCQUFpQixDQUFDLENBQUM7SUFDakksQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLHdCQUF3QjtRQUNqQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE4RCwwQkFBMEIsQ0FBQyxDQUFDO0lBQ25KLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBb0QsZ0JBQWdCLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyx5QkFBeUI7UUFDbEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztJQUNySixDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxlQUFlO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXFELGlCQUFpQixDQUFDLENBQUM7SUFDakksQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLGFBQWE7UUFDdEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBbUQsZUFBZSxDQUFDLENBQUM7SUFDN0gsQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHByZXF1ZXN0cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2Jyb3dzZXIvY2xhc3Nlcy5pZHByZXF1ZXN0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUd4QyxNQUFNLE9BQU8sV0FBVztJQUNGO0lBQXBCLFlBQW9CLFlBQXVCO1FBQXZCLGlCQUFZLEdBQVosWUFBWSxDQUFXO0lBQUcsQ0FBQztJQUUvQyxJQUFXLDZCQUE2QjtRQUN0QyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFtRSwrQkFBK0IsQ0FBQyxDQUFDO0lBQzdKLENBQUM7SUFFRCxJQUFXLE9BQU87UUFDaEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBNEQsd0JBQXdCLENBQUMsQ0FBQztJQUMvSSxDQUFDO0lBRUQsSUFBVyxrQkFBa0I7UUFDM0IsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBd0Qsb0JBQW9CLENBQUMsQ0FBQztJQUN2SSxDQUFDO0lBRUQsSUFBVyw0QkFBNEI7UUFDckMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBeUUscUNBQXFDLENBQUMsQ0FBQztJQUN6SyxDQUFDO0lBRUQsSUFBVyxTQUFTO1FBQ2xCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQWdELFlBQVksQ0FBQyxDQUFDO0lBQ3ZILENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRSxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzNLLENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBb0QsZ0JBQWdCLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBVyx3QkFBd0I7UUFDakMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMEUsc0NBQXNDLENBQUMsQ0FBQztJQUMzSyxDQUFDO0lBRUQsSUFBVyx5QkFBeUI7UUFDbEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztJQUNySixDQUFDO0lBRUQsSUFBVyx3QkFBd0I7UUFDakMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBOEQsMEJBQTBCLENBQUMsQ0FBQztJQUNuSixDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBb0QsZ0JBQWdCLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBVyxjQUFjO1FBQ3ZCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW9ELGdCQUFnQixDQUFDLENBQUM7SUFDL0gsQ0FBQztJQUVELElBQVcsY0FBYztRQUN2QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFvRCxnQkFBZ0IsQ0FBQyxDQUFDO0lBQy9ILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCwwQkFBMEIsQ0FBQyxDQUFDO0lBQzVJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLFlBQVk7UUFDckIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBa0QsY0FBYyxDQUFDLENBQUM7SUFDM0gsQ0FBQztJQUVELElBQVcsbUJBQW1CO1FBQzVCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXlELHFCQUFxQixDQUFDLENBQUM7SUFDekksQ0FBQztJQUVELElBQVcsb0JBQW9CO1FBQzdCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQTBELHNCQUFzQixDQUFDLENBQUM7SUFDM0ksQ0FBQztJQUVELElBQVcsV0FBVztRQUNwQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFpRCxhQUFhLENBQUMsQ0FBQztJQUN6SCxDQUFDO0lBRUQsSUFBVyxxQkFBcUI7UUFDOUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMkQsdUJBQXVCLENBQUMsQ0FBQztJQUM3SSxDQUFDO0lBRUQsSUFBVyxrQkFBa0I7UUFDM0IsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBd0Qsb0JBQW9CLENBQUMsQ0FBQztJQUN2SSxDQUFDO0lBRUQsSUFBVyx3QkFBd0I7UUFDakMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBOEQsMEJBQTBCLENBQUMsQ0FBQztJQUNuSixDQUFDO0lBRUQsSUFBVyx5QkFBeUI7UUFDbEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztJQUNySixDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxnQkFBZ0I7UUFDekIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBc0Qsa0JBQWtCLENBQUMsQ0FBQztJQUNuSSxDQUFDO0lBRUQsSUFBVyxlQUFlO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXFELGlCQUFpQixDQUFDLENBQUM7SUFDakksQ0FBQztJQUVELElBQVcsa0JBQWtCO1FBQzNCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXdELG9CQUFvQixDQUFDLENBQUM7SUFDdkksQ0FBQztJQUVELElBQVcsYUFBYTtRQUN0QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFtRCxlQUFlLENBQUMsQ0FBQztJQUM3SCxDQUFDO0lBRUQsSUFBVyxtQkFBbUI7UUFDNUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBeUQscUJBQXFCLENBQUMsQ0FBQztJQUN6SSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLHFCQUFxQjtRQUM5QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEyRCx1QkFBdUIsQ0FBQyxDQUFDO0lBQzdJLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLGdCQUFnQjtRQUN6QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFzRCxrQkFBa0IsQ0FBQyxDQUFDO0lBQ25JLENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLGFBQWE7UUFDdEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBbUQsZUFBZSxDQUFDLENBQUM7SUFDN0gsQ0FBQztJQUVELElBQVcsZ0JBQWdCO1FBQ3pCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXNELGtCQUFrQixDQUFDLENBQUM7SUFDbkksQ0FBQztJQUVELElBQVcsZ0JBQWdCO1FBQ3pCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXNELGtCQUFrQixDQUFDLENBQUM7SUFDbkksQ0FBQztJQUVELElBQVcsWUFBWTtRQUNyQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFrRCxjQUFjLENBQUMsQ0FBQztJQUMzSCxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyxvQkFBb0I7UUFDN0IsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMEQsc0JBQXNCLENBQUMsQ0FBQztJQUMzSSxDQUFDO0lBRUQsSUFBVyxnQkFBZ0I7UUFDekIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBc0Qsa0JBQWtCLENBQUMsQ0FBQztJQUNuSSxDQUFDO0lBRUQsSUFBVyxxQkFBcUI7UUFDOUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMkQsdUJBQXVCLENBQUMsQ0FBQztJQUM3SSxDQUFDO0lBRUQsSUFBVyxxQkFBcUI7UUFDOUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBMkQsdUJBQXVCLENBQUMsQ0FBQztJQUM3SSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLGlDQUFpQztRQUMxQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RSxtQ0FBbUMsQ0FBQyxDQUFDO0lBQ3JLLENBQUM7SUFFRCxJQUFXLDBCQUEwQjtRQUNuQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFnRSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZKLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLHdCQUF3QjtRQUNqQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE4RCwwQkFBMEIsQ0FBQyxDQUFDO0lBQ25KLENBQUM7SUFFRCxJQUFXLHVCQUF1QjtRQUNoQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE2RCx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pKLENBQUM7SUFFRCxJQUFXLHlCQUF5QjtRQUNsQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUErRCwyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JKLENBQUM7SUFFRCxJQUFXLDZCQUE2QjtRQUN0QyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFtRSwrQkFBK0IsQ0FBQyxDQUFDO0lBQzdKLENBQUM7SUFFRCxJQUFXLDBCQUEwQjtRQUNuQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFnRSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZKLENBQUM7SUFFRCxJQUFXLHlCQUF5QjtRQUNsQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUErRCwyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JKLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLGtCQUFrQjtRQUMzQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF3RCxvQkFBb0IsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7SUFFRCxJQUFXLHNCQUFzQjtRQUMvQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE0RCx3QkFBd0IsQ0FBQyxDQUFDO0lBQy9JLENBQUM7SUFFRCxJQUFXLHFCQUFxQjtRQUM5QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEyRCx1QkFBdUIsQ0FBQyxDQUFDO0lBQzdJLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxjQUFjO1FBQ3ZCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW9ELGdCQUFnQixDQUFDLENBQUM7SUFDL0gsQ0FBQztJQUVELElBQVcsZ0NBQWdDO1FBQ3pDLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQStELGtDQUFrQyxDQUFDLENBQUM7SUFDNUosQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLGdCQUFnQjtRQUN6QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFzRCxrQkFBa0IsQ0FBQyxDQUFDO0lBQ25JLENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxlQUFlO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXFELGlCQUFpQixDQUFDLENBQUM7SUFDakksQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLHdCQUF3QjtRQUNqQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUE4RCwwQkFBMEIsQ0FBQyxDQUFDO0lBQ25KLENBQUM7SUFFRCxJQUFXLDRCQUE0QjtRQUNyQyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFrRSw4QkFBOEIsQ0FBQyxDQUFDO0lBQzNKLENBQUM7SUFFRCxJQUFXLG9CQUFvQjtRQUM3QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUEwRCxzQkFBc0IsQ0FBQyxDQUFDO0lBQzNJLENBQUM7SUFFRCxJQUFXLGNBQWM7UUFDdkIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBb0QsZ0JBQWdCLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyxpQkFBaUI7UUFDMUIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBdUQsbUJBQW1CLENBQUMsQ0FBQztJQUNySSxDQUFDO0lBRUQsSUFBVyx5QkFBeUI7UUFDbEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBK0QsMkJBQTJCLENBQUMsQ0FBQztJQUNySixDQUFDO0lBRUQsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQW1ELGVBQWUsQ0FBQyxDQUFDO0lBQzdILENBQUM7SUFFRCxJQUFXLGlCQUFpQjtRQUMxQixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF1RCxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7SUFFRCxJQUFXLGVBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBcUQsaUJBQWlCLENBQUMsQ0FBQztJQUNqSSxDQUFDO0lBRUQsSUFBVyxlQUFlO1FBQ3hCLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQXFELGlCQUFpQixDQUFDLENBQUM7SUFDakksQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLGFBQWE7UUFDdEIsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBbUQsZUFBZSxDQUFDLENBQUM7SUFDN0gsQ0FBQztJQUVELElBQVcsZUFBZTtRQUN4QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFxRCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFFRCxJQUFXLG1CQUFtQjtRQUM1QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUF5RCxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3pJLENBQUM7Q0FDRiJ9

package/dist_ts_browser/index.d.ts

@@ -1,2 +1,3 @@
 export * from './classes.idpclient.js';
 export * from './classes.idprequests.js';
+export * from './secret-delivery.js';

package/dist_ts_browser/index.js

@@ -1,3 +1,4 @@
 export * from './classes.idpclient.js';
 export * from './classes.idprequests.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19icm93c2VyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYywwQkFBMEIsQ0FBQyJ9
+export * from './secret-delivery.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19icm93c2VyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHNCQUFzQixDQUFDIn0=

package/dist_ts_browser/secret-delivery.d.ts

@@ -0,0 +1,13 @@
+import type * as plugins from './plugins.js';
+export interface ISecretDeliveryContext {
+    operationId: string;
+    request: plugins.idpInterfaces.request.ISecretDeliveryRequest;
+    privateKey: CryptoKey;
+}
+/**
+ * Creates one caller-held, non-exportable decryption key and its canonical
+ * RSA-OAEP-256 delivery request. Keep the returned context until acknowledgement.
+ */
+export declare const createSecretDeliveryContext: (operationIdArg?: `${string}-${string}-${string}-${string}-${string}`) => Promise<ISecretDeliveryContext>;
+/** Verifies and decrypts one pending delivery envelope. */
+export declare const decryptSecretDeliveryEnvelope: (contextArg: ISecretDeliveryContext, envelopeArg: plugins.idpInterfaces.request.TSecretDeliveryEnvelope) => Promise<string>;

package/dist_ts_browser/secret-delivery.js

@@ -0,0 +1,90 @@
+const requireOperationId = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || valueArg.length === 0
+        || valueArg.length > 128
+        || valueArg.trim() !== valueArg
+        || /[\u0000-\u001f\u007f]/.test(valueArg)) {
+        throw new Error('Secret-delivery operation id is malformed.');
+    }
+    return valueArg;
+};
+const bytesToBase64 = (bytesArg) => {
+    let binary = '';
+    for (const byte of bytesArg)
+        binary += String.fromCharCode(byte);
+    return globalThis.btoa(binary);
+};
+const base64ToBytes = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || valueArg.length === 0
+        || valueArg.length > 16_384
+        || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(valueArg)) {
+        throw new Error('Secret-delivery base64 value is malformed.');
+    }
+    const binary = globalThis.atob(valueArg);
+    const bytes = Uint8Array.from(binary, (characterArg) => characterArg.charCodeAt(0));
+    if (bytesToBase64(bytes) !== valueArg) {
+        throw new Error('Secret-delivery base64 value is not canonical.');
+    }
+    return bytes;
+};
+const copyToArrayBuffer = (bytesArg) => {
+    const copy = new Uint8Array(bytesArg.byteLength);
+    copy.set(bytesArg);
+    return copy.buffer;
+};
+const sha256Hex = async (bytesArg) => {
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', copyToArrayBuffer(bytesArg)));
+    return [...digest].map((byteArg) => byteArg.toString(16).padStart(2, '0')).join('');
+};
+/**
+ * Creates one caller-held, non-exportable decryption key and its canonical
+ * RSA-OAEP-256 delivery request. Keep the returned context until acknowledgement.
+ */
+export const createSecretDeliveryContext = async (operationIdArg = globalThis.crypto.randomUUID()) => {
+    const operationId = requireOperationId(operationIdArg);
+    const algorithm = {
+        name: 'RSA-OAEP',
+        modulusLength: 3072,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: 'SHA-256',
+    };
+    const generated = await globalThis.crypto.subtle.generateKey(algorithm, true, ['encrypt', 'decrypt']);
+    const [publicKeySpki, privateKeyPkcs8] = await Promise.all([
+        globalThis.crypto.subtle.exportKey('spki', generated.publicKey),
+        globalThis.crypto.subtle.exportKey('pkcs8', generated.privateKey),
+    ]);
+    const privateKey = await globalThis.crypto.subtle.importKey('pkcs8', privateKeyPkcs8, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, ['decrypt']);
+    new Uint8Array(privateKeyPkcs8).fill(0);
+    return {
+        operationId,
+        request: {
+            algorithm: 'RSA-OAEP-256',
+            publicKeySpkiBase64: bytesToBase64(new Uint8Array(publicKeySpki)),
+        },
+        privateKey,
+    };
+};
+/** Verifies and decrypts one pending delivery envelope. */
+export const decryptSecretDeliveryEnvelope = async (contextArg, envelopeArg) => {
+    if (envelopeArg.status !== 'pending'
+        || envelopeArg.operationId !== contextArg.operationId
+        || envelopeArg.algorithm !== 'RSA-OAEP-256') {
+        throw new Error('Secret-delivery envelope does not match this operation.');
+    }
+    const publicKeyBytes = base64ToBytes(contextArg.request.publicKeySpkiBase64);
+    if (await sha256Hex(publicKeyBytes) !== envelopeArg.publicKeySha256) {
+        throw new Error('Secret-delivery public-key fingerprint does not match.');
+    }
+    const ciphertext = base64ToBytes(envelopeArg.ciphertextBase64);
+    if (await sha256Hex(ciphertext) !== envelopeArg.ciphertextSha256) {
+        throw new Error('Secret-delivery ciphertext digest does not match.');
+    }
+    const plaintext = await globalThis.crypto.subtle.decrypt({ name: 'RSA-OAEP' }, contextArg.privateKey, copyToArrayBuffer(ciphertext));
+    const secret = new TextDecoder('utf-8', { fatal: true }).decode(plaintext);
+    if (!/^[A-Za-z0-9_-]{43}$/.test(secret)) {
+        throw new Error('Decrypted client secret is malformed.');
+    }
+    return secret;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LWRlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfYnJvd3Nlci9zZWNyZXQtZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBUUEsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQWdCLEVBQUUsRUFBRTtJQUM5QyxJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDekIsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNyQixRQUFRLENBQUMsSUFBSSxFQUFFLEtBQUssUUFBUTtXQUM1Qix1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3pDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBb0IsRUFBRSxFQUFFO0lBQzdDLElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVE7UUFBRSxNQUFNLElBQUksTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRSxPQUFPLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFnQixFQUFFLEVBQUU7SUFDekMsSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQ3pCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLE1BQU07V0FDeEIsQ0FBQyxrRUFBa0UsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3JGLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRixJQUFJLGFBQWEsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQW9CLEVBQUUsRUFBRTtJQUNqRCxNQUFNLElBQUksR0FBRyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDakQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLFFBQW9CLEVBQUUsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxDQUM1QixDQUFDLENBQUM7SUFDSCxPQUFPLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUN0RixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxLQUFLLEVBQzlDLGNBQWMsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxFQUNkLEVBQUU7SUFDbkMsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDdkQsTUFBTSxTQUFTLEdBQTBCO1FBQ3ZDLElBQUksRUFBRSxVQUFVO1FBQ2hCLGFBQWEsRUFBRSxJQUFJO1FBQ25CLGNBQWMsRUFBRSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekMsSUFBSSxFQUFFLFNBQVM7S0FDaEIsQ0FBQztJQUNGLE1BQU0sU0FBUyxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUMxRCxTQUFTLEVBQ1QsSUFBSSxFQUNKLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUNOLENBQUM7SUFDbkIsTUFBTSxDQUFDLGFBQWEsRUFBRSxlQUFlLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDekQsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsU0FBUyxDQUFDO1FBQy9ELFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQztLQUNsRSxDQUFDLENBQUM7SUFDSCxNQUFNLFVBQVUsR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDekQsT0FBTyxFQUNQLGVBQWUsRUFDZixFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUNyQyxLQUFLLEVBQ0wsQ0FBQyxTQUFTLENBQUMsQ0FDWixDQUFDO0lBQ0YsSUFBSSxVQUFVLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLE9BQU87UUFDTCxXQUFXO1FBQ1gsT0FBTyxFQUFFO1lBQ1AsU0FBUyxFQUFFLGNBQWM7WUFDekIsbUJBQW1CLEVBQUUsYUFBYSxDQUFDLElBQUksVUFBVSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1NBQ2xFO1FBQ0QsVUFBVTtLQUNYLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwyREFBMkQ7QUFDM0QsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxVQUFrQyxFQUNsQyxXQUFrRSxFQUNsRSxFQUFFO0lBQ0YsSUFDRSxXQUFXLENBQUMsTUFBTSxLQUFLLFNBQVM7V0FDN0IsV0FBVyxDQUFDLFdBQVcsS0FBSyxVQUFVLENBQUMsV0FBVztXQUNsRCxXQUFXLENBQUMsU0FBUyxLQUFLLGNBQWMsRUFDM0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUM3RSxJQUFJLE1BQU0sU0FBUyxDQUFDLGNBQWMsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUMvRCxJQUFJLE1BQU0sU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQ3RELEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUNwQixVQUFVLENBQUMsVUFBVSxFQUNyQixpQkFBaUIsQ0FBQyxVQUFVLENBQUMsQ0FDOUIsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRSxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts_server/classes.idp-global-server-client.d.ts

@@ -5,7 +5,7 @@ export interface IIdpGlobalServerClientOptions {
 }
 export declare const defaultIdpGlobalBaseUrl = "https://idp.global";
 export interface IIdpPasswordAuthResult {
-    user: plugins.idpInterfaces.data.IUser;
+    user: plugins.idpInterfaces.dto.ICurrentUserDto;
     jwt: string;
     refreshToken: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "11.0.0",
+  "version": "13.0.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
@@ -16,7 +16,7 @@
   "dependencies": {
     "@api.global/typedrequest": "^3.3.2",
     "@api.global/typedsocket": "^4.2.5",
-    "@idp.global/interfaces": "^13.1.0",
+    "@idp.global/interfaces": "^22.0.0",
     "@push.rocks/smartdata": "^7.2.1",
     "@push.rocks/smartjson": "^6.0.1",
     "@push.rocks/smartpromise": "^4.2.4",

package/readme.md

@@ -294,7 +294,7 @@ The server export includes these TypeScript types:
 | `IAuthenticateAccountOptions` | Input for `AccountAuthService.authenticate()`. |
 | `IAuthenticatedAccountResult` | Successful auth result with account, auth source, and optional idp.global tokens. |
 | `IIdpGlobalServerClientOptions` | Server client configuration with optional `baseUrl` and `backendToken`; defaults to `https://idp.global`. |
-| `IIdpPasswordAuthResult` | idp.global user, JWT, and refresh-token result. |
+| `IIdpPasswordAuthResult` | Privacy-safe current-user DTO, JWT, and refresh-token result. |
 
 ## Runtime Notes
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '11.0.0',
+  version: '13.0.0',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }

package/ts_browser/classes.idprequests.ts

@@ -340,6 +340,10 @@ export class IdpRequests {
     return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RegenerateAppCredentials>('regenerateAppCredentials');
   }
 
+  public get acknowledgeAppSecretDelivery() {
+    return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_AcknowledgeAppSecretDelivery>('acknowledgeAppSecretDelivery');
+  }
+
   public get rotateOidcSigningKey() {
     return this.idpClientArg.typedsocket.createTypedRequest<plugins.idpInterfaces.request.IReq_RotateOidcSigningKey>('rotateOidcSigningKey');
   }

package/ts_browser/index.ts

@@ -1,2 +1,3 @@
 export * from './classes.idpclient.js';
 export * from './classes.idprequests.js';
+export * from './secret-delivery.js';

package/ts_browser/secret-delivery.ts

@@ -0,0 +1,130 @@
+import type * as plugins from './plugins.js';
+
+export interface ISecretDeliveryContext {
+  operationId: string;
+  request: plugins.idpInterfaces.request.ISecretDeliveryRequest;
+  privateKey: CryptoKey;
+}
+
+const requireOperationId = (valueArg: string) => {
+  if (
+    typeof valueArg !== 'string'
+    || valueArg.length === 0
+    || valueArg.length > 128
+    || valueArg.trim() !== valueArg
+    || /[\u0000-\u001f\u007f]/.test(valueArg)
+  ) {
+    throw new Error('Secret-delivery operation id is malformed.');
+  }
+  return valueArg;
+};
+
+const bytesToBase64 = (bytesArg: Uint8Array) => {
+  let binary = '';
+  for (const byte of bytesArg) binary += String.fromCharCode(byte);
+  return globalThis.btoa(binary);
+};
+
+const base64ToBytes = (valueArg: string) => {
+  if (
+    typeof valueArg !== 'string'
+    || valueArg.length === 0
+    || valueArg.length > 16_384
+    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(valueArg)
+  ) {
+    throw new Error('Secret-delivery base64 value is malformed.');
+  }
+  const binary = globalThis.atob(valueArg);
+  const bytes = Uint8Array.from(binary, (characterArg) => characterArg.charCodeAt(0));
+  if (bytesToBase64(bytes) !== valueArg) {
+    throw new Error('Secret-delivery base64 value is not canonical.');
+  }
+  return bytes;
+};
+
+const copyToArrayBuffer = (bytesArg: Uint8Array) => {
+  const copy = new Uint8Array(bytesArg.byteLength);
+  copy.set(bytesArg);
+  return copy.buffer;
+};
+
+const sha256Hex = async (bytesArg: Uint8Array) => {
+  const digest = new Uint8Array(await globalThis.crypto.subtle.digest(
+    'SHA-256',
+    copyToArrayBuffer(bytesArg),
+  ));
+  return [...digest].map((byteArg) => byteArg.toString(16).padStart(2, '0')).join('');
+};
+
+/**
+ * Creates one caller-held, non-exportable decryption key and its canonical
+ * RSA-OAEP-256 delivery request. Keep the returned context until acknowledgement.
+ */
+export const createSecretDeliveryContext = async (
+  operationIdArg = globalThis.crypto.randomUUID(),
+): Promise<ISecretDeliveryContext> => {
+  const operationId = requireOperationId(operationIdArg);
+  const algorithm: RsaHashedKeyGenParams = {
+    name: 'RSA-OAEP',
+    modulusLength: 3072,
+    publicExponent: new Uint8Array([1, 0, 1]),
+    hash: 'SHA-256',
+  };
+  const generated = await globalThis.crypto.subtle.generateKey(
+    algorithm,
+    true,
+    ['encrypt', 'decrypt'],
+  ) as CryptoKeyPair;
+  const [publicKeySpki, privateKeyPkcs8] = await Promise.all([
+    globalThis.crypto.subtle.exportKey('spki', generated.publicKey),
+    globalThis.crypto.subtle.exportKey('pkcs8', generated.privateKey),
+  ]);
+  const privateKey = await globalThis.crypto.subtle.importKey(
+    'pkcs8',
+    privateKeyPkcs8,
+    { name: 'RSA-OAEP', hash: 'SHA-256' },
+    false,
+    ['decrypt'],
+  );
+  new Uint8Array(privateKeyPkcs8).fill(0);
+  return {
+    operationId,
+    request: {
+      algorithm: 'RSA-OAEP-256',
+      publicKeySpkiBase64: bytesToBase64(new Uint8Array(publicKeySpki)),
+    },
+    privateKey,
+  };
+};
+
+/** Verifies and decrypts one pending delivery envelope. */
+export const decryptSecretDeliveryEnvelope = async (
+  contextArg: ISecretDeliveryContext,
+  envelopeArg: plugins.idpInterfaces.request.TSecretDeliveryEnvelope,
+) => {
+  if (
+    envelopeArg.status !== 'pending'
+    || envelopeArg.operationId !== contextArg.operationId
+    || envelopeArg.algorithm !== 'RSA-OAEP-256'
+  ) {
+    throw new Error('Secret-delivery envelope does not match this operation.');
+  }
+  const publicKeyBytes = base64ToBytes(contextArg.request.publicKeySpkiBase64);
+  if (await sha256Hex(publicKeyBytes) !== envelopeArg.publicKeySha256) {
+    throw new Error('Secret-delivery public-key fingerprint does not match.');
+  }
+  const ciphertext = base64ToBytes(envelopeArg.ciphertextBase64);
+  if (await sha256Hex(ciphertext) !== envelopeArg.ciphertextSha256) {
+    throw new Error('Secret-delivery ciphertext digest does not match.');
+  }
+  const plaintext = await globalThis.crypto.subtle.decrypt(
+    { name: 'RSA-OAEP' },
+    contextArg.privateKey,
+    copyToArrayBuffer(ciphertext),
+  );
+  const secret = new TextDecoder('utf-8', { fatal: true }).decode(plaintext);
+  if (!/^[A-Za-z0-9_-]{43}$/.test(secret)) {
+    throw new Error('Decrypted client secret is malformed.');
+  }
+  return secret;
+};

package/ts_server/classes.idp-global-server-client.ts

@@ -8,7 +8,7 @@ export interface IIdpGlobalServerClientOptions {
 export const defaultIdpGlobalBaseUrl = 'https://idp.global';
 
 export interface IIdpPasswordAuthResult {
-  user: plugins.idpInterfaces.data.IUser;
+  user: plugins.idpInterfaces.dto.ICurrentUserDto;
   jwt: string;
   refreshToken: string;
 }