@idp.global/sdk 14.4.1 → 15.0.1

package/changelog.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 2026-08-02 - 15.0.1
+
+### Fixes
+
+- default server client to app.idp.global TypedSocket endpoint (idp-global-server-client)
+  - Updated the default hosted base URL from https://idp.global to https://app.idp.global for server client requests.
+  - Adjusted tests and documentation to reflect the new default hosted endpoint.
+
+## 2026-08-02 - 15.0.0
+
+### Breaking Changes
+
+- adopt explicit backend connection registration (server-client)
+  - Replace client-owned backend-service tag assignment with registerBackendServiceConnection requests.
+  - Authenticate backend physical connections and reconnects through TypedSocket restoration before they become available.
+  - Persist successful explicit backend token registration as reconnect restoration state.
+  - Upgrade TypedRequest, TypedSocket, idp.global interfaces, and add SmartServe for the updated RPC contract.
+
 ## 2026-07-27 - 14.4.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '14.4.1',
+    version: '15.0.1',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_server/classes.idp-global-server-client.d.ts

@@ -3,7 +3,7 @@ export interface IIdpGlobalServerClientOptions {
     baseUrl?: string;
     backendToken?: string;
 }
-export declare const defaultIdpGlobalBaseUrl = "https://idp.global";
+export declare const defaultIdpGlobalBaseUrl = "https://app.idp.global";
 export interface IIdpPasswordAuthResult {
     user: plugins.idpInterfaces.dto.ICurrentUserDto;
     jwt: string;
@@ -29,6 +29,7 @@ export declare class IdpGlobalServerClient {
     private connectionAbortController?;
     private stopWaiters;
     private stopping;
+    private backendToken?;
     constructor(optionsArg?: IIdpGlobalServerClientOptions);
     connect(): Promise<plugins.typedsocket.TypedSocket>;
     stop(): Promise<void>;
@@ -43,7 +44,6 @@ export declare class IdpGlobalServerClient {
     }): Promise<IIdpPasswordAuthResult>;
     private getTypedRequestUrl;
     private requireBackendToken;
-    private applyBackendServiceTag;
     private createConnectionDeferred;
     private raceWithStop;
     private rejectStopWaiters;

package/dist_ts_server/classes.idp-global-server-client.js

@@ -1,5 +1,5 @@
 import * as plugins from './plugins.js';
-export const defaultIdpGlobalBaseUrl = 'https://idp.global';
+export const defaultIdpGlobalBaseUrl = 'https://app.idp.global';
 export class IdpMfaRequiredError extends Error {
     mfaChallengeToken;
     availableMfaMethods;
@@ -22,8 +22,10 @@ export class IdpGlobalServerClient {
     connectionAbortController;
     stopWaiters = new Set();
     stopping = false;
+    backendToken;
     constructor(optionsArg = {}) {
         this.optionsArg = optionsArg;
+        this.backendToken = optionsArg.backendToken;
         this.typedrouter.addTypedHandler(new plugins.typedrequest.TypedHandler('pushPublicKeysForValidation', async (requestArg) => {
             await Promise.all(this.publicKeysPushHandlers.map((handlerArg) => handlerArg(requestArg.publicKeys)));
             return {};
@@ -50,7 +52,20 @@ export class IdpGlobalServerClient {
         const connectionAbortController = new AbortController();
         try {
             this.connectionAbortController = connectionAbortController;
-            socketPromise = plugins.typedsocket.TypedSocket.createClient(this.typedrouter, this.getTypedRequestUrl(), { autoReconnect: true, abortSignal: connectionAbortController.signal });
+            socketPromise = plugins.typedsocket.TypedSocket.createClient(this.typedrouter, this.getTypedRequestUrl(), {
+                autoReconnect: true,
+                abortSignal: connectionAbortController.signal,
+                restoreConnection: async ({ createTypedRequest }) => {
+                    const backendToken = this.backendToken;
+                    if (!backendToken) {
+                        return;
+                    }
+                    const response = await createTypedRequest('registerBackendServiceConnection').fire({ backendToken });
+                    if (response.registered !== true) {
+                        throw new Error('IdP rejected backend-service connection registration.');
+                    }
+                },
+            });
             this.pendingSocketPromise = socketPromise;
             createdSocket = await this.raceWithStop(socketPromise);
             if (generation !== this.connectionGeneration) {
@@ -64,7 +79,8 @@ export class IdpGlobalServerClient {
             deferred.resolve(createdSocket);
         }
         catch (error) {
-            if (generation === this.connectionGeneration && (!createdSocket || this.typedsocket === createdSocket)) {
+            if (generation === this.connectionGeneration &&
+                (!createdSocket || this.typedsocket === createdSocket)) {
                 this.typedsocket = undefined;
             }
             await createdSocket?.stop().catch(() => undefined);
@@ -120,12 +136,17 @@ export class IdpGlobalServerClient {
             this.blocklistPushHandlers = this.blocklistPushHandlers.filter((handler) => handler !== handlerArg);
         };
     }
-    async registerBackendService(backendTokenArg = this.optionsArg.backendToken) {
+    async registerBackendService(backendTokenArg = this.backendToken) {
         const backendToken = this.requireBackendToken(backendTokenArg);
         const socket = await this.connect();
-        await this.applyBackendServiceTag(socket, backendToken);
+        const request = socket.createTypedRequest('registerBackendServiceConnection');
+        const response = await this.raceWithStop(request.fire({ backendToken }));
+        if (response.registered !== true) {
+            throw new Error('IdP rejected backend-service connection registration.');
+        }
+        this.backendToken = backendToken;
     }
-    async getPublicKeysForValidation(backendTokenArg = this.optionsArg.backendToken) {
+    async getPublicKeysForValidation(backendTokenArg = this.backendToken) {
         const backendToken = this.requireBackendToken(backendTokenArg);
         const socket = await this.connect();
         const request = socket.createTypedRequest('getPublicKeysForValidation');
@@ -135,7 +156,7 @@ export class IdpGlobalServerClient {
         }
         return response.publicKeys;
     }
-    async getJwtIdBlocklist(backendTokenArg = this.optionsArg.backendToken) {
+    async getJwtIdBlocklist(backendTokenArg = this.backendToken) {
         const backendToken = this.requireBackendToken(backendTokenArg);
         const socket = await this.connect();
         const request = socket.createTypedRequest('pushOrGetJwtIdBlocklist');
@@ -187,11 +208,6 @@ export class IdpGlobalServerClient {
         }
         return backendTokenArg;
     }
-    async applyBackendServiceTag(socketArg, backendTokenArg) {
-        await this.raceWithStop(socketArg.setTag('backend-service', {
-            backendToken: backendTokenArg,
-        }));
-    }
     createConnectionDeferred() {
         const deferred = plugins.smartpromise.defer();
         deferred.promise.catch(() => undefined);
@@ -217,4 +233,4 @@ export class IdpGlobalServerClient {
         this.stopWaiters.clear();
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFPeEMsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsb0JBQW9CLENBQUM7QUFRNUQsTUFBTSxPQUFPLG1CQUFvQixTQUFRLEtBQUs7SUFDckMsaUJBQWlCLENBQVM7SUFDMUIsbUJBQW1CLENBQTBDO0lBRXBFLFlBQVksVUFBeUc7UUFDbkgsS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDL0MsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztRQUNsQyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsVUFBVSxDQUFDLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztRQUM1RCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixJQUFJLEVBQUUsQ0FBQztJQUNsRSxDQUFDO0NBQ0Y7QUFFRCxNQUFNLE9BQU8scUJBQXFCO0lBY1o7SUFiWixXQUFXLEdBQVEsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQzFELFdBQVcsQ0FBbUM7SUFDOUMsbUJBQW1CLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7SUFDdEQsc0JBQXNCLEdBRUQsRUFBRSxDQUFDO0lBQ3hCLHFCQUFxQixHQUFnRSxFQUFFLENBQUM7SUFDeEYsb0JBQW9CLEdBQUcsQ0FBQyxDQUFDO0lBQ3pCLG9CQUFvQixDQUE0QztJQUNoRSx5QkFBeUIsQ0FBbUI7SUFDNUMsV0FBVyxHQUFHLElBQUksR0FBRyxFQUE2QixDQUFDO0lBQ25ELFFBQVEsR0FBRyxLQUFLLENBQUM7SUFFekIsWUFBb0IsYUFBNEMsRUFBRTtRQUE5QyxlQUFVLEdBQVYsVUFBVSxDQUFvQztRQUNoRSxJQUFJLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FDOUIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDbkMsNkJBQTZCLEVBQzdCLEtBQUssRUFBRSxVQUFVLEVBQUUsRUFBRTtZQUNuQixNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQ2YsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUNuRixDQUFDO1lBQ0YsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDLENBQ0YsQ0FDRixDQUFDO1FBQ0YsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLHlCQUF5QixFQUN6QixLQUFLLEVBQUUsVUFBVSxFQUFFLEVBQUU7WUFDbkIsSUFBSSxVQUFVLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQzdCLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLGFBQWMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUMzRyxDQUFDO1lBQ0QsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDLENBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPO1FBQ2xCLElBQUksSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDckMsT0FBTyxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDO1FBQzFDLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUM7UUFDMUMsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLG9CQUFvQixDQUFDO1FBQzdDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNqQixJQUFJLGFBQTBELENBQUM7UUFDL0QsSUFBSSxhQUFtRSxDQUFDO1FBQ3hFLE1BQU0seUJBQXlCLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUN4RCxJQUFJLENBQUM7WUFDSCxJQUFJLENBQUMseUJBQXlCLEdBQUcseUJBQXlCLENBQUM7WUFDM0QsYUFBYSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FDMUQsSUFBSSxDQUFDLFdBQVcsRUFDaEIsSUFBSSxDQUFDLGtCQUFrQixFQUFFLEVBQ3pCLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUseUJBQXlCLENBQUMsTUFBTSxFQUFFLENBQ3ZFLENBQUM7WUFDRixJQUFJLENBQUMsb0JBQW9CLEdBQUcsYUFBYSxDQUFDO1lBQzFDLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDdkQsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7Z0JBQzdDLE1BQU0sYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUMzQixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7b0JBQ2xDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsZ0RBQWdELENBQUMsQ0FBQyxDQUFDO2dCQUMvRSxDQUFDO2dCQUNELE9BQU8sUUFBUSxDQUFDLE9BQU8sQ0FBQztZQUMxQixDQUFDO1lBQ0QsSUFBSSxDQUFDLFdBQVcsR0FBRyxhQUFhLENBQUM7WUFDakMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNsQyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyxvQkFBb0IsSUFBSSxDQUFDLENBQUMsYUFBYSxJQUFJLElBQUksQ0FBQyxXQUFXLEtBQUssYUFBYSxDQUFDLEVBQUUsQ0FBQztnQkFDdkcsSUFBSSxDQUFDLFdBQVcsR0FBRyxTQUFTLENBQUM7WUFDL0IsQ0FBQztZQUNELE1BQU0sYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ2xDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDekIsQ0FBQztZQUNELElBQUksSUFBSSxDQUFDLG1CQUFtQixLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7WUFDN0QsQ0FBQztZQUNELE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsSUFBSSxhQUFhLElBQUksSUFBSSxDQUFDLG9CQUFvQixLQUFLLGFBQWEsRUFBRSxDQUFDO2dCQUNqRSxJQUFJLENBQUMsb0JBQW9CLEdBQUcsU0FBUyxDQUFDO1lBQ3hDLENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyx5QkFBeUIsS0FBSyx5QkFBeUIsRUFBRSxDQUFDO2dCQUNqRSxJQUFJLENBQUMseUJBQXlCLEdBQUcsU0FBUyxDQUFDO1lBQzdDLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUMsT0FBTyxDQUFDO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSTtRQUNmLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1FBQzVCLE1BQU0sU0FBUyxHQUFHLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2xDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUM7UUFDaEMsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsb0JBQW9CLENBQUM7UUFDdkQsSUFBSSxDQUFDLHlCQUF5QixFQUFFLEtBQUssRUFBRSxDQUFDO1FBQ3hDLElBQUksQ0FBQyx5QkFBeUIsR0FBRyxTQUFTLENBQUM7UUFDM0MsSUFBSSxDQUFDLFdBQVcsR0FBRyxTQUFTLENBQUM7UUFDN0IsSUFBSSxJQUFJLENBQUMsbUJBQW1CLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEYsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsTUFBTSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDckIsTUFBTSxhQUFhLEdBQUcsTUFBTSxvQkFBb0IsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDekUsSUFBSSxhQUFhLElBQUksYUFBYSxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQzlDLE1BQU0sYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLG1CQUFtQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1FBQzNELElBQUksQ0FBQyxvQkFBb0IsR0FBRyxTQUFTLENBQUM7UUFDdEMsSUFBSSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUM7SUFDeEIsQ0FBQztJQUVNLGdCQUFnQixDQUNyQixVQUV5QjtRQUV6QixJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzdDLE9BQU8sR0FBRyxFQUFFO1lBQ1YsSUFBSSxDQUFDLHNCQUFzQixHQUFHLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQUMsQ0FBQztRQUN4RyxDQUFDLENBQUM7SUFDSixDQUFDO0lBRU0sZUFBZSxDQUFDLFVBQWdFO1FBQ3JGLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDNUMsT0FBTyxHQUFHLEVBQUU7WUFDVixJQUFJLENBQUMscUJBQXFCLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxLQUFLLFVBQVUsQ0FBQyxDQUFDO1FBQ3RHLENBQUMsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsc0JBQXNCLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWTtRQUNoRixNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDL0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEMsTUFBTSxJQUFJLENBQUMsc0JBQXNCLENBQUMsTUFBTSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFTSxLQUFLLENBQUMsMEJBQTBCLENBQ3JDLGVBQWUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVk7UUFFOUMsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBZ0UsNEJBQTRCLENBQUMsQ0FBQztRQUN2SSxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN6RSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQyxVQUFVLENBQUM7SUFDN0IsQ0FBQztJQUVNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxlQUFlLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxZQUFZO1FBQzNFLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMvRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNwQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsa0JBQWtCLENBQTZELHlCQUF5QixDQUFDLENBQUM7UUFDakksTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekUsT0FBTyxRQUFRLENBQUMsYUFBYSxJQUFJLEVBQUUsQ0FBQztJQUN0QyxDQUFDO0lBRU0sS0FBSyxDQUFDLHlCQUF5QixDQUFDLFVBQStDO1FBQ3BGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBeUUscUNBQXFDLENBQUMsQ0FBQztRQUM5SixNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQztZQUM5RCxRQUFRLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDMUIsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO1NBQzlCLENBQUMsQ0FBQyxDQUFDO1FBQ0osSUFBSSxhQUFhLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDOUIsTUFBTSxJQUFJLG1CQUFtQixDQUFDO2dCQUM1QixpQkFBaUIsRUFBRyxhQUFxQixDQUFDLGlCQUFpQjtnQkFDM0QsbUJBQW1CLEVBQUcsYUFBcUIsQ0FBQyxtQkFBbUI7YUFDaEUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDaEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3RDLENBQUM7UUFFRCxNQUFNLGNBQWMsR0FBRyxNQUFNLENBQUMsa0JBQWtCLENBQWdELFlBQVksQ0FBQyxDQUFDO1FBQzlHLE1BQU0sZUFBZSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbkgsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUVELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBMkMsT0FBTyxDQUFDLENBQUM7UUFDbEcsTUFBTSxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsZUFBZSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUMvRixPQUFPO1lBQ0wsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO1lBQ3hCLEdBQUcsRUFBRSxlQUFlLENBQUMsR0FBRztZQUN4QixZQUFZLEVBQUUsZUFBZSxDQUFDLFlBQVksSUFBSSxhQUFhLENBQUMsWUFBWTtTQUN6RSxDQUFDO0lBQ0osQ0FBQztJQUVPLGtCQUFrQjtRQUN4QixJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxJQUFJLHVCQUF1QixDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDMUUsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDdkMsT0FBTyxHQUFHLEdBQUcsT0FBTyxlQUFlLENBQUM7UUFDdEMsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxtQkFBbUIsQ0FBQyxlQUF3QjtRQUNsRCxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxPQUFPLGVBQWUsQ0FBQztJQUN6QixDQUFDO0lBRU8sS0FBSyxDQUFDLHNCQUFzQixDQUNsQyxTQUEwQyxFQUMxQyxlQUF1QjtRQUV2QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBaUQsaUJBQWlCLEVBQUU7WUFDMUcsWUFBWSxFQUFFLGVBQWU7U0FDOUIsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRU8sd0JBQXdCO1FBQzlCLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFtQyxDQUFDO1FBQy9FLFFBQVEsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFTyxZQUFZLENBQUksVUFBc0I7UUFDNUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsQyxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxPQUFPLElBQUksT0FBTyxDQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3hDLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDekQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDakMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtnQkFDNUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxpQkFBaUIsQ0FBQyxRQUFlO1FBQ3ZDLEtBQUssTUFBTSxVQUFVLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN2QixDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUMzQixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvY2xhc3Nlcy5pZHAtZ2xvYmFsLXNlcnZlci1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFPeEMsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsd0JBQXdCLENBQUM7QUFRaEUsTUFBTSxPQUFPLG1CQUFvQixTQUFRLEtBQUs7SUFDckMsaUJBQWlCLENBQVM7SUFDMUIsbUJBQW1CLENBQTBDO0lBRXBFLFlBQVksVUFHWDtRQUNDLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQy9DLElBQUksQ0FBQyxJQUFJLEdBQUcscUJBQXFCLENBQUM7UUFDbEMsSUFBSSxDQUFDLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxpQkFBaUIsSUFBSSxFQUFFLENBQUM7UUFDNUQsSUFBSSxDQUFDLG1CQUFtQixHQUFHLFVBQVUsQ0FBQyxtQkFBbUIsSUFBSSxFQUFFLENBQUM7SUFDbEUsQ0FBQztDQUNGO0FBRUQsTUFBTSxPQUFPLHFCQUFxQjtJQWlCWjtJQWhCWixXQUFXLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ3JELFdBQVcsQ0FBbUM7SUFDOUMsbUJBQW1CLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7SUFDdEQsc0JBQXNCLEdBRUQsRUFBRSxDQUFDO0lBQ3hCLHFCQUFxQixHQUV6QixFQUFFLENBQUM7SUFDQyxvQkFBb0IsR0FBRyxDQUFDLENBQUM7SUFDekIsb0JBQW9CLENBQTRDO0lBQ2hFLHlCQUF5QixDQUFtQjtJQUM1QyxXQUFXLEdBQUcsSUFBSSxHQUFHLEVBQTZCLENBQUM7SUFDbkQsUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNqQixZQUFZLENBQVU7SUFFOUIsWUFBb0IsYUFBNEMsRUFBRTtRQUE5QyxlQUFVLEdBQVYsVUFBVSxDQUFvQztRQUNoRSxJQUFJLENBQUMsWUFBWSxHQUFHLFVBQVUsQ0FBQyxZQUFZLENBQUM7UUFDNUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBRW5DLDZCQUE2QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsRUFBRTtZQUNwRCxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQ2YsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUNuRixDQUFDO1lBQ0YsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDLENBQUMsQ0FDSCxDQUFDO1FBQ0YsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBRW5DLHlCQUF5QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsRUFBRTtZQUNoRCxJQUFJLFVBQVUsQ0FBQyxhQUFhLEVBQUUsQ0FBQztnQkFDN0IsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUNmLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUM1QyxVQUFVLENBQUMsVUFBVSxDQUFDLGFBQWMsQ0FBQyxDQUN0QyxDQUNGLENBQUM7WUFDSixDQUFDO1lBQ0QsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDLENBQUMsQ0FDSCxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPO1FBQ2xCLElBQUksSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDckMsT0FBTyxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDO1FBQzFDLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUM7UUFDMUMsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLG9CQUFvQixDQUFDO1FBQzdDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNqQixJQUFJLGFBQTBELENBQUM7UUFDL0QsSUFBSSxhQUFtRSxDQUFDO1FBQ3hFLE1BQU0seUJBQXlCLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUN4RCxJQUFJLENBQUM7WUFDSCxJQUFJLENBQUMseUJBQXlCLEdBQUcseUJBQXlCLENBQUM7WUFDM0QsYUFBYSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FDMUQsSUFBSSxDQUFDLFdBQVcsRUFDaEIsSUFBSSxDQUFDLGtCQUFrQixFQUFFLEVBQ3pCO2dCQUNFLGFBQWEsRUFBRSxJQUFJO2dCQUNuQixXQUFXLEVBQUUseUJBQXlCLENBQUMsTUFBTTtnQkFDN0MsaUJBQWlCLEVBQUUsS0FBSyxFQUFFLEVBQUUsa0JBQWtCLEVBQUUsRUFBRSxFQUFFO29CQUNsRCxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDO29CQUN2QyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7d0JBQ2xCLE9BQU87b0JBQ1QsQ0FBQztvQkFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLGtCQUFrQixDQUV2QyxrQ0FBa0MsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUM7b0JBQzdELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxJQUFJLEVBQUUsQ0FBQzt3QkFDakMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO29CQUMzRSxDQUFDO2dCQUNILENBQUM7YUFDRixDQUNGLENBQUM7WUFDRixJQUFJLENBQUMsb0JBQW9CLEdBQUcsYUFBYSxDQUFDO1lBQzFDLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDdkQsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7Z0JBQzdDLE1BQU0sYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUMzQixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7b0JBQ2xDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsZ0RBQWdELENBQUMsQ0FBQyxDQUFDO2dCQUMvRSxDQUFDO2dCQUNELE9BQU8sUUFBUSxDQUFDLE9BQU8sQ0FBQztZQUMxQixDQUFDO1lBQ0QsSUFBSSxDQUFDLFdBQVcsR0FBRyxhQUFhLENBQUM7WUFDakMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNsQyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQ0UsVUFBVSxLQUFLLElBQUksQ0FBQyxvQkFBb0I7Z0JBQ3hDLENBQUMsQ0FBQyxhQUFhLElBQUksSUFBSSxDQUFDLFdBQVcsS0FBSyxhQUFhLENBQUMsRUFDdEQsQ0FBQztnQkFDRCxJQUFJLENBQUMsV0FBVyxHQUFHLFNBQVMsQ0FBQztZQUMvQixDQUFDO1lBQ0QsTUFBTSxhQUFhLEVBQUUsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ25ELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDbEMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN6QixDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMsbUJBQW1CLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzFDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxJQUFJLENBQUMsd0JBQXdCLEVBQUUsQ0FBQztZQUM3RCxDQUFDO1lBQ0QsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLGFBQWEsSUFBSSxJQUFJLENBQUMsb0JBQW9CLEtBQUssYUFBYSxFQUFFLENBQUM7Z0JBQ2pFLElBQUksQ0FBQyxvQkFBb0IsR0FBRyxTQUFTLENBQUM7WUFDeEMsQ0FBQztZQUNELElBQUksSUFBSSxDQUFDLHlCQUF5QixLQUFLLHlCQUF5QixFQUFFLENBQUM7Z0JBQ2pFLElBQUksQ0FBQyx5QkFBeUIsR0FBRyxTQUFTLENBQUM7WUFDN0MsQ0FBQztRQUNILENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQyxPQUFPLENBQUM7SUFDMUIsQ0FBQztJQUVNLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7UUFDckIsSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDNUIsTUFBTSxTQUFTLEdBQUcsSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUM3RCxJQUFJLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDbEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUNoQyxNQUFNLG9CQUFvQixHQUFHLElBQUksQ0FBQyxvQkFBb0IsQ0FBQztRQUN2RCxJQUFJLENBQUMseUJBQXlCLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFDeEMsSUFBSSxDQUFDLHlCQUF5QixHQUFHLFNBQVMsQ0FBQztRQUMzQyxJQUFJLENBQUMsV0FBVyxHQUFHLFNBQVMsQ0FBQztRQUM3QixJQUFJLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN0RixJQUFJLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzdDLENBQUM7UUFDRCxNQUFNLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUNyQixNQUFNLGFBQWEsR0FBRyxNQUFNLG9CQUFvQixFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN6RSxJQUFJLGFBQWEsSUFBSSxhQUFhLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDOUMsTUFBTSxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDLG9CQUFvQixHQUFHLFNBQVMsQ0FBQztRQUN0QyxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztJQUN4QixDQUFDO0lBRU0sZ0JBQWdCLENBQ3JCLFVBRXlCO1FBRXpCLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDN0MsT0FBTyxHQUFHLEVBQUU7WUFDVixJQUFJLENBQUMsc0JBQXNCLEdBQUcsSUFBSSxDQUFDLHNCQUFzQixDQUFDLE1BQU0sQ0FDOUQsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQ3BDLENBQUM7UUFDSixDQUFDLENBQUM7SUFDSixDQUFDO0lBRU0sZUFBZSxDQUNwQixVQUFnRTtRQUVoRSxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzVDLE9BQU8sR0FBRyxFQUFFO1lBQ1YsSUFBSSxDQUFDLHFCQUFxQixHQUFHLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxNQUFNLENBQzVELENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUNwQyxDQUFDO1FBQ0osQ0FBQyxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxzQkFBc0IsQ0FDakMsZUFBZSxHQUFHLElBQUksQ0FBQyxZQUFZO1FBRW5DLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMvRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNwQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsa0JBQWtCLENBRXZDLGtDQUFrQyxDQUFDLENBQUM7UUFDdEMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekUsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLFlBQVksR0FBRyxZQUFZLENBQUM7SUFDbkMsQ0FBQztJQUVNLEtBQUssQ0FBQywwQkFBMEIsQ0FDckMsZUFBZSxHQUFHLElBQUksQ0FBQyxZQUFZO1FBRW5DLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMvRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNwQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsa0JBQWtCLENBRXZDLDRCQUE0QixDQUFDLENBQUM7UUFDaEMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzVFLE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztRQUN2RSxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUMsVUFBVSxDQUFDO0lBQzdCLENBQUM7SUFFTSxLQUFLLENBQUMsaUJBQWlCLENBQzVCLGVBQWUsR0FBRyxJQUFJLENBQUMsWUFBWTtRQUVuQyxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDL0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLGtCQUFrQixDQUV2Qyx5QkFBeUIsQ0FBQyxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3pFLE9BQU8sUUFBUSxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUM7SUFDdEMsQ0FBQztJQUVNLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxVQUd0QztRQUNDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FFNUMscUNBQXFDLENBQUMsQ0FBQztRQUN6QyxNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQzNDLFlBQVksQ0FBQyxJQUFJLENBQUM7WUFDaEIsUUFBUSxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQzFCLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUTtTQUM5QixDQUFDLENBQ0gsQ0FBQztRQUNGLElBQUksYUFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQztnQkFDNUIsaUJBQWlCLEVBQUUsYUFBYSxDQUFDLGlCQUFpQjtnQkFDbEQsbUJBQW1CLEVBQUUsYUFBYSxDQUFDLG1CQUFtQjthQUN2RCxDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsSUFBSSxDQUFDLGFBQWEsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNoQyxNQUFNLElBQUksS0FBSyxDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDdEMsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FFOUMsWUFBWSxDQUFDLENBQUM7UUFDaEIsTUFBTSxlQUFlLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUM3QyxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsWUFBWSxFQUFFLGFBQWEsQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUNsRSxDQUFDO1FBQ0YsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDOUMsQ0FBQztRQUVELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxrQkFBa0IsQ0FFNUMsT0FBTyxDQUFDLENBQUM7UUFDWCxNQUFNLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQzNDLFlBQVksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsZUFBZSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQ2hELENBQUM7UUFDRixPQUFPO1lBQ0wsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO1lBQ3hCLEdBQUcsRUFBRSxlQUFlLENBQUMsR0FBRztZQUN4QixZQUFZLEVBQUUsZUFBZSxDQUFDLFlBQVksSUFBSSxhQUFhLENBQUMsWUFBWTtTQUN6RSxDQUFDO0lBQ0osQ0FBQztJQUVPLGtCQUFrQjtRQUN4QixJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxJQUFJLHVCQUF1QixDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDMUUsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDdkMsT0FBTyxHQUFHLEdBQUcsT0FBTyxlQUFlLENBQUM7UUFDdEMsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxtQkFBbUIsQ0FBQyxlQUF3QjtRQUNsRCxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxPQUFPLGVBQWUsQ0FBQztJQUN6QixDQUFDO0lBRU8sd0JBQXdCO1FBQzlCLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFtQyxDQUFDO1FBQy9FLFFBQVEsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFTyxZQUFZLENBQUksVUFBc0I7UUFDNUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNsQyxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsQixPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxPQUFPLElBQUksT0FBTyxDQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3hDLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBZSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDekQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDakMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtnQkFDNUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDdEMsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxpQkFBaUIsQ0FBQyxRQUFlO1FBQ3ZDLEtBQUssTUFBTSxVQUFVLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN2QixDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUMzQixDQUFDO0NBQ0YifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "14.4.1",
+  "version": "15.0.1",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
@@ -14,14 +14,15 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@api.global/typedrequest": "^3.4.0",
-    "@api.global/typedrequest-interfaces": "^3.0.19",
-    "@api.global/typedsocket": "^4.2.5",
-    "@idp.global/interfaces": "^26.2.0",
+    "@api.global/typedrequest": "^5.2.1",
+    "@api.global/typedrequest-interfaces": "^5.1.1",
+    "@api.global/typedsocket": "^6.0.0",
+    "@idp.global/interfaces": "^29.0.0",
     "@push.rocks/smartdata": "^7.2.1",
     "@push.rocks/smartjson": "^6.0.1",
     "@push.rocks/smartpromise": "^4.2.4",
     "@push.rocks/smartrx": "^3.0.12",
+    "@push.rocks/smartserve": "^4.3.0",
     "@push.rocks/smarttime": "^4.2.3",
     "@push.rocks/smarturl": "^3.1.0",
     "@push.rocks/webjwt": "^1.0.10",

package/readme.md

@@ -251,9 +251,12 @@ if (!authResult) {
 console.log(authResult.account.role, authResult.authSource);
 ```
 
-In `auto` mode, the service tries local auth first when the account allows `local`; if that fails and the account allows `idp.global`, it uses the configured `IdpGlobalServerClient`. `IdpGlobalServerClient` defaults to the hosted `https://idp.global` endpoint; pass `{ baseUrl }` only for self-hosted or staging IdP instances. Pass `{ backendToken }` when a backend service should fetch JWT validation data or subscribe to key/blocklist pushes. idp.global authentication is accepted only when the returned user email matches the local account email and the returned user ID matches the stored `idpSubject` when one is already set.
+In `auto` mode, the service tries local auth first when the account allows `local`; if that fails and the account allows `idp.global`, it uses the configured `IdpGlobalServerClient`. `IdpGlobalServerClient` defaults to the hosted `https://app.idp.global` TypedSocket endpoint; pass `{ baseUrl }` only for self-hosted or staging IdP instances. Pass `{ backendToken }` when a backend service should fetch JWT validation data or subscribe to key/blocklist pushes. idp.global authentication is accepted only when the returned user email matches the local account email and the returned user ID matches the stored `idpSubject` when one is already set.
 
-Backend services can register for JWT validation updates after constructing a server client with a backend token:
+Backend services register for JWT validation updates by constructing a server
+client with a backend token. The SDK authenticates every physical connection
+and reconnect through TypedSocket's bounded restoration callback before the
+connection becomes available:
 
 ```ts
 const idpClient = new IdpGlobalServerClient({
@@ -269,11 +272,17 @@ idpClient.onBlocklistPush((blockedJwtIds) => {
   // replace the local JWT ID blocklist with this complete persisted snapshot
 });
 
-await idpClient.registerBackendService();
 const publicKeys = await idpClient.getPublicKeysForValidation();
 const blockedJwtIds = await idpClient.getJwtIdBlocklist();
 ```
 
+`registerBackendService()` remains available for an explicit registration. A
+successful explicit token becomes the client's restoration state, so every
+later physical reconnect authenticates with that token before the connection
+becomes available. Both paths fire the exact `registerBackendServiceConnection`
+request; clients never assign the protected backend-service role tag
+themselves.
+
 Verification is keyset-only. Replace the cached snapshot on every push, select
 the verification key by the JWT header `kid`, and reject unknown key IDs.
 
@@ -285,7 +294,7 @@ the verification key by the JWT header `kid`, and reject unknown key IDs.
 | `AccountAuthService` | Existing-account authentication orchestration for `local`, `idp.global`, and `auto`. |
 | `IdpGlobalServerClient` | Typed-socket client for idp.global password login, JWT refresh, `whoIs` lookup, backend JWT validation fetches, and JWT key/blocklist pushes. |
 | `IdpMfaRequiredError` | Password-login error carrying the MFA challenge token and available factor methods. |
-| `defaultIdpGlobalBaseUrl` | Default hosted server origin: `https://idp.global`. |
+| `defaultIdpGlobalBaseUrl` | Default hosted server origin: `https://app.idp.global`. |
 | `PasswordHasher` | Static `hashPassword()` and `verifyPassword()` helpers using `scrypt:v1`. |
 | `IdpSdkAccountDoc` | Smartdata document class backing persisted SDK accounts. |
 | `setAccountDocSmartdataDb()` | Configure the active Smartdata DB for `IdpSdkAccountDoc`. Usually handled by `SmartdataAccountStore`. |
@@ -303,7 +312,7 @@ The server export includes these TypeScript types:
 | `ICreateIdpSdkAccountOptions` | Input for account creation. |
 | `IAuthenticateAccountOptions` | Input for `AccountAuthService.authenticate()`. |
 | `IAuthenticatedAccountResult` | Successful auth result with account, auth source, and optional idp.global tokens. |
-| `IIdpGlobalServerClientOptions` | Server client configuration with optional `baseUrl` and `backendToken`; defaults to `https://idp.global`. |
+| `IIdpGlobalServerClientOptions` | Server client configuration with optional `baseUrl` and `backendToken`; defaults to `https://app.idp.global`. |
 | `IIdpPasswordAuthResult` | Privacy-safe current-user DTO, JWT, and refresh-token result. |
 
 ## Runtime Notes

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '14.4.1',
+  version: '15.0.1',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }

package/ts_server/classes.idp-global-server-client.ts

@@ -5,7 +5,7 @@ export interface IIdpGlobalServerClientOptions {
   backendToken?: string;
 }
 
-export const defaultIdpGlobalBaseUrl = 'https://idp.global';
+export const defaultIdpGlobalBaseUrl = 'https://app.idp.global';
 
 export interface IIdpPasswordAuthResult {
   user: plugins.idpInterfaces.dto.ICurrentUserDto;
@@ -17,7 +17,10 @@ export class IdpMfaRequiredError extends Error {
   public mfaChallengeToken: string;
   public availableMfaMethods: plugins.idpInterfaces.data.TMfaMethod[];
 
-  constructor(optionsArg: { mfaChallengeToken?: string; availableMfaMethods?: plugins.idpInterfaces.data.TMfaMethod[] }) {
+  constructor(optionsArg: {
+    mfaChallengeToken?: string;
+    availableMfaMethods?: plugins.idpInterfaces.data.TMfaMethod[];
+  }) {
     super('Two-factor authentication is required');
     this.name = 'IdpMfaRequiredError';
     this.mfaChallengeToken = optionsArg.mfaChallengeToken || '';
@@ -26,41 +29,47 @@ export class IdpMfaRequiredError extends Error {
 }
 
 export class IdpGlobalServerClient {
-  private typedrouter: any = new plugins.typedrequest.TypedRouter();
+  private typedrouter = new plugins.typedrequest.TypedRouter();
   private typedsocket?: plugins.typedsocket.TypedSocket;
   private typedsocketDeferred = this.createConnectionDeferred();
   private publicKeysPushHandlers: Array<(
     publicKeysArg: plugins.idpInterfaces.data.IJwtVerificationKey[]
   ) => void | Promise<void>> = [];
-  private blocklistPushHandlers: Array<(blockedJwtIdsArg: string[]) => void | Promise<void>> = [];
+  private blocklistPushHandlers: Array<
+    (blockedJwtIdsArg: string[]) => void | Promise<void>
+  > = [];
   private connectionGeneration = 0;
   private pendingSocketPromise?: Promise<plugins.typedsocket.TypedSocket>;
   private connectionAbortController?: AbortController;
   private stopWaiters = new Set<(errorArg: Error) => void>();
   private stopping = false;
+  private backendToken?: string;
 
   constructor(private optionsArg: IIdpGlobalServerClientOptions = {}) {
+    this.backendToken = optionsArg.backendToken;
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_PushPublicKeysForValidation>(
-        'pushPublicKeysForValidation',
-        async (requestArg) => {
-          await Promise.all(
-            this.publicKeysPushHandlers.map((handlerArg) => handlerArg(requestArg.publicKeys))
-          );
-          return {};
-        }
-      )
+      new plugins.typedrequest.TypedHandler<
+        plugins.idpInterfaces.request.IReq_PushPublicKeysForValidation
+      >('pushPublicKeysForValidation', async (requestArg) => {
+        await Promise.all(
+          this.publicKeysPushHandlers.map((handlerArg) => handlerArg(requestArg.publicKeys))
+        );
+        return {};
+      })
     );
     this.typedrouter.addTypedHandler(
-      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_PushOrGetJwtIdBlocklist>(
-        'pushOrGetJwtIdBlocklist',
-        async (requestArg) => {
-          if (requestArg.blockedJwtIds) {
-            await Promise.all(this.blocklistPushHandlers.map((handlerArg) => handlerArg(requestArg.blockedJwtIds!)));
-          }
-          return {};
+      new plugins.typedrequest.TypedHandler<
+        plugins.idpInterfaces.request.IReq_PushOrGetJwtIdBlocklist
+      >('pushOrGetJwtIdBlocklist', async (requestArg) => {
+        if (requestArg.blockedJwtIds) {
+          await Promise.all(
+            this.blocklistPushHandlers.map((handlerArg) =>
+              handlerArg(requestArg.blockedJwtIds!)
+            )
+          );
         }
-      )
+        return {};
+      })
     );
   }
 
@@ -82,7 +91,22 @@ export class IdpGlobalServerClient {
       socketPromise = plugins.typedsocket.TypedSocket.createClient(
         this.typedrouter,
         this.getTypedRequestUrl(),
-        { autoReconnect: true, abortSignal: connectionAbortController.signal },
+        {
+          autoReconnect: true,
+          abortSignal: connectionAbortController.signal,
+          restoreConnection: async ({ createTypedRequest }) => {
+            const backendToken = this.backendToken;
+            if (!backendToken) {
+              return;
+            }
+            const response = await createTypedRequest<
+              plugins.idpInterfaces.request.IReq_RegisterBackendServiceConnection
+            >('registerBackendServiceConnection').fire({ backendToken });
+            if (response.registered !== true) {
+              throw new Error('IdP rejected backend-service connection registration.');
+            }
+          },
+        }
       );
       this.pendingSocketPromise = socketPromise;
       createdSocket = await this.raceWithStop(socketPromise);
@@ -96,7 +120,10 @@ export class IdpGlobalServerClient {
       this.typedsocket = createdSocket;
       deferred.resolve(createdSocket);
     } catch (error) {
-      if (generation === this.connectionGeneration && (!createdSocket || this.typedsocket === createdSocket)) {
+      if (
+        generation === this.connectionGeneration &&
+        (!createdSocket || this.typedsocket === createdSocket)
+      ) {
         this.typedsocket = undefined;
       }
       await createdSocket?.stop().catch(() => undefined);
@@ -148,29 +175,46 @@ export class IdpGlobalServerClient {
   ): () => void {
     this.publicKeysPushHandlers.push(handlerArg);
     return () => {
-      this.publicKeysPushHandlers = this.publicKeysPushHandlers.filter((handler) => handler !== handlerArg);
+      this.publicKeysPushHandlers = this.publicKeysPushHandlers.filter(
+        (handler) => handler !== handlerArg
+      );
     };
   }
 
-  public onBlocklistPush(handlerArg: (blockedJwtIdsArg: string[]) => void | Promise<void>): () => void {
+  public onBlocklistPush(
+    handlerArg: (blockedJwtIdsArg: string[]) => void | Promise<void>
+  ): () => void {
     this.blocklistPushHandlers.push(handlerArg);
     return () => {
-      this.blocklistPushHandlers = this.blocklistPushHandlers.filter((handler) => handler !== handlerArg);
+      this.blocklistPushHandlers = this.blocklistPushHandlers.filter(
+        (handler) => handler !== handlerArg
+      );
     };
   }
 
-  public async registerBackendService(backendTokenArg = this.optionsArg.backendToken): Promise<void> {
+  public async registerBackendService(
+    backendTokenArg = this.backendToken
+  ): Promise<void> {
     const backendToken = this.requireBackendToken(backendTokenArg);
     const socket = await this.connect();
-    await this.applyBackendServiceTag(socket, backendToken);
+    const request = socket.createTypedRequest<
+      plugins.idpInterfaces.request.IReq_RegisterBackendServiceConnection
+    >('registerBackendServiceConnection');
+    const response = await this.raceWithStop(request.fire({ backendToken }));
+    if (response.registered !== true) {
+      throw new Error('IdP rejected backend-service connection registration.');
+    }
+    this.backendToken = backendToken;
   }
 
   public async getPublicKeysForValidation(
-    backendTokenArg = this.optionsArg.backendToken
+    backendTokenArg = this.backendToken
   ): Promise<plugins.idpInterfaces.data.IJwtVerificationKey[]> {
     const backendToken = this.requireBackendToken(backendTokenArg);
     const socket = await this.connect();
-    const request = socket.createTypedRequest<plugins.idpInterfaces.request.IReq_GetPublicKeysForValidation>('getPublicKeysForValidation');
+    const request = socket.createTypedRequest<
+      plugins.idpInterfaces.request.IReq_GetPublicKeysForValidation
+    >('getPublicKeysForValidation');
     const response = await this.raceWithStop(request.fire({ backendToken }));
     if (!Array.isArray(response.publicKeys) || response.publicKeys.length === 0) {
       throw new Error('IdP returned an invalid JWT verification key set.');
@@ -178,39 +222,58 @@ export class IdpGlobalServerClient {
     return response.publicKeys;
   }
 
-  public async getJwtIdBlocklist(backendTokenArg = this.optionsArg.backendToken): Promise<string[]> {
+  public async getJwtIdBlocklist(
+    backendTokenArg = this.backendToken
+  ): Promise<string[]> {
     const backendToken = this.requireBackendToken(backendTokenArg);
     const socket = await this.connect();
-    const request = socket.createTypedRequest<plugins.idpInterfaces.request.IReq_PushOrGetJwtIdBlocklist>('pushOrGetJwtIdBlocklist');
+    const request = socket.createTypedRequest<
+      plugins.idpInterfaces.request.IReq_PushOrGetJwtIdBlocklist
+    >('pushOrGetJwtIdBlocklist');
     const response = await this.raceWithStop(request.fire({ backendToken }));
     return response.blockedJwtIds || [];
   }
 
-  public async loginWithEmailAndPassword(optionsArg: { email: string; password: string }): Promise<IIdpPasswordAuthResult> {
+  public async loginWithEmailAndPassword(optionsArg: {
+    email: string;
+    password: string;
+  }): Promise<IIdpPasswordAuthResult> {
     const socket = await this.connect();
-    const loginRequest = socket.createTypedRequest<plugins.idpInterfaces.request.IReq_LoginWithEmailOrUsernameAndPassword>('loginWithEmailOrUsernameAndPassword');
-    const loginResponse = await this.raceWithStop(loginRequest.fire({
-      username: optionsArg.email,
-      password: optionsArg.password,
-    }));
+    const loginRequest = socket.createTypedRequest<
+      plugins.idpInterfaces.request.IReq_LoginWithEmailOrUsernameAndPassword
+    >('loginWithEmailOrUsernameAndPassword');
+    const loginResponse = await this.raceWithStop(
+      loginRequest.fire({
+        username: optionsArg.email,
+        password: optionsArg.password,
+      })
+    );
     if (loginResponse.twoFaNeeded) {
       throw new IdpMfaRequiredError({
-        mfaChallengeToken: (loginResponse as any).mfaChallengeToken,
-        availableMfaMethods: (loginResponse as any).availableMfaMethods,
+        mfaChallengeToken: loginResponse.mfaChallengeToken,
+        availableMfaMethods: loginResponse.availableMfaMethods,
       });
     }
     if (!loginResponse.refreshToken) {
       throw new Error('IdP login failed');
     }
 
-    const refreshRequest = socket.createTypedRequest<plugins.idpInterfaces.request.IReq_RefreshJwt>('refreshJwt');
-    const refreshResponse = await this.raceWithStop(refreshRequest.fire({ refreshToken: loginResponse.refreshToken }));
+    const refreshRequest = socket.createTypedRequest<
+      plugins.idpInterfaces.request.IReq_RefreshJwt
+    >('refreshJwt');
+    const refreshResponse = await this.raceWithStop(
+      refreshRequest.fire({ refreshToken: loginResponse.refreshToken })
+    );
     if (!refreshResponse.jwt) {
       throw new Error('IdP did not return a JWT');
     }
 
-    const whoIsRequest = socket.createTypedRequest<plugins.idpInterfaces.request.IReq_WhoIs>('whoIs');
-    const whoIsResponse = await this.raceWithStop(whoIsRequest.fire({ jwt: refreshResponse.jwt }));
+    const whoIsRequest = socket.createTypedRequest<
+      plugins.idpInterfaces.request.IReq_WhoIs
+    >('whoIs');
+    const whoIsResponse = await this.raceWithStop(
+      whoIsRequest.fire({ jwt: refreshResponse.jwt })
+    );
     return {
       user: whoIsResponse.user,
       jwt: refreshResponse.jwt,
@@ -236,15 +299,6 @@ export class IdpGlobalServerClient {
     return backendTokenArg;
   }
 
-  private async applyBackendServiceTag(
-    socketArg: plugins.typedsocket.TypedSocket,
-    backendTokenArg: string
-  ): Promise<void> {
-    await this.raceWithStop(socketArg.setTag<plugins.idpInterfaces.tags.ITag_BackendService>('backend-service', {
-      backendToken: backendTokenArg,
-    }));
-  }
-
   private createConnectionDeferred() {
     const deferred = plugins.smartpromise.defer<plugins.typedsocket.TypedSocket>();
     deferred.promise.catch(() => undefined);