@idp.global/sdk 19.2.1 → 19.3.0

package/dist_ts_relyingparty/classes.rpmodels.d.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import type { TRelyingPartyBearerClientKind } from './interfaces.js';
 /**
  * One browser session of a relying party. The persisted field names, their
  * types and the index declarations are the ones nevermind.finance has stored
@@ -33,7 +34,8 @@ export declare class RelyingPartySessionDoc extends plugins.nosqldb.SmartDataDbD
  * against, the binding to the browser that started it, the sealed PKCE
  * verifier and the return path. Consumed exactly once by a conditional update.
  * Field names and indexes are the ones nevermind.finance stores under
- * `LoginAttemptDoc`.
+ * `LoginAttemptDoc`; the `bearer…` fields exist only on the attempt of a
+ * bearer login, whose binding token is never issued.
  */
 export declare class RelyingPartyLoginAttemptDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyLoginAttemptDoc, RelyingPartyLoginAttemptDoc> {
     id: string;
@@ -53,10 +55,57 @@ export declare class RelyingPartyLoginAttemptDoc extends plugins.nosqldb.SmartDa
     consumedAt?: number | null;
     /** the session the callback created; finalize releases the return path against it */
     createdSessionId?: string | null;
+    /** how the bearer client of this login receives its outcome; absent on a cookie login */
+    bearerClientKind?: TRelyingPartyBearerClientKind;
+    /** the return target the bearer client named, exactly */
+    bearerReturnTarget?: string;
+    /** the bearer client's S256 code challenge; its hand-off is claimed with the matching verifier */
+    bearerCodeChallenge?: string;
+    /** the bearer client's own `state`, handed back with the outcome */
+    bearerClientState?: string;
+}
+/**
+ * The single-use code a bearer login hands its client. Only the hash of the
+ * code is stored; the code is bound to the client's S256 challenge, lives at
+ * most a minute and is consumed by one conditional update.
+ */
+export declare class RelyingPartyBearerHandoffDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyBearerHandoffDoc, RelyingPartyBearerHandoffDoc> {
+    id: string;
+    /** sha256 of the code */
+    codeHash: string;
+    /** the session the login opened; the code is its only way out */
+    sessionId: string;
+    codeChallenge: string;
+    createdAt: number;
+    /** at most a minute after the callback; the sweep ends the session of a code nobody claimed by then */
+    expiresAt: number;
+    /** `null` until a claim consumes the code */
+    consumedAt: number | null;
+}
+/**
+ * One generation of a bearer session's tokens: an access token and the
+ * refresh token that replaces both. Only hashes are stored. Exactly one
+ * generation of a session is current (`rotatedAt` `null`); a rotated one is
+ * kept until the session expires, so its refresh token coming back is
+ * recognized as reuse.
+ */
+export declare class RelyingPartyBearerTokenDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyBearerTokenDoc, RelyingPartyBearerTokenDoc> {
+    id: string;
+    accessTokenHash: string;
+    refreshTokenHash: string;
+    sessionId: string;
+    createdAt: number;
+    accessTokenExpiresAt: number;
+    /** the session's end; the refresh token never outlives it, and the sweep removes the generation after it */
+    expiresAt: number;
+    /** `null` while this generation is current; when its refresh token was spent otherwise */
+    rotatedAt: number | null;
 }
 export declare const RELYING_PARTY_DEFAULT_COLLECTION_NAMES: {
     readonly sessions: 'IdpRelyingPartySession';
     readonly loginAttempts: 'IdpRelyingPartyLoginAttempt';
+    readonly bearerHandoffs: 'IdpRelyingPartyBearerHandoff';
+    readonly bearerTokens: 'IdpRelyingPartyBearerToken';
 };
 export interface IRelyingPartyModelsOptions {
     /**
@@ -73,17 +122,29 @@ export interface IRelyingPartyModelsOptions {
     collectionNames?: {
         sessions?: string;
         loginAttempts?: string;
+        bearerHandoffs?: string;
+        bearerTokens?: string;
     };
 }
-export interface IRelyingPartyModels {
+/** The models bearer hand-off mode stores its codes and tokens in. */
+export interface IRelyingPartyBearerModels {
+    readonly BearerHandoff: typeof RelyingPartyBearerHandoffDoc;
+    readonly BearerToken: typeof RelyingPartyBearerTokenDoc;
+}
+/**
+ * The models of the session layer. The bearer models are needed only when
+ * `RelyingPartySessions` runs with `bearer`; `createRelyingPartyModels`
+ * always binds them.
+ */
+export interface IRelyingPartyModels extends Partial<IRelyingPartyBearerModels> {
     readonly Session: typeof RelyingPartySessionDoc;
     readonly LoginAttempt: typeof RelyingPartyLoginAttemptDoc;
 }
 /**
- * Binds the two relying-party models to one database. Each call declares its
+ * Binds the relying-party models to one database. Each call declares its
  * own model classes, so several databases — and several applications in one
  * process — never share a binding. A deferred `db` is resolved on every use,
  * the way `@Collection(() => db)` resolves it; a use before it answers a
  * `SmartdataDb` throws `RelyingPartyDatabaseUnavailableError`.
  */
-export declare const createRelyingPartyModels: (optionsArg: IRelyingPartyModelsOptions) => IRelyingPartyModels;
+export declare const createRelyingPartyModels: (optionsArg: IRelyingPartyModelsOptions) => IRelyingPartyModels & IRelyingPartyBearerModels;

package/dist_ts_relyingparty/classes.rpmodels.js

@@ -145,7 +145,8 @@ export { RelyingPartySessionDoc };
  * against, the binding to the browser that started it, the sealed PKCE
  * verifier and the return path. Consumed exactly once by a conditional update.
  * Field names and indexes are the ones nevermind.finance stores under
- * `LoginAttemptDoc`.
+ * `LoginAttemptDoc`; the `bearer…` fields exist only on the attempt of a
+ * bearer login, whose binding token is never issued.
  */
 let RelyingPartyLoginAttemptDoc = (() => {
     let _classSuper = plugins.nosqldb.SmartDataDbDoc;
@@ -182,6 +183,18 @@ let RelyingPartyLoginAttemptDoc = (() => {
     let _createdSessionId_decorators;
     let _createdSessionId_initializers = [];
     let _createdSessionId_extraInitializers = [];
+    let _bearerClientKind_decorators;
+    let _bearerClientKind_initializers = [];
+    let _bearerClientKind_extraInitializers = [];
+    let _bearerReturnTarget_decorators;
+    let _bearerReturnTarget_initializers = [];
+    let _bearerReturnTarget_extraInitializers = [];
+    let _bearerCodeChallenge_decorators;
+    let _bearerCodeChallenge_initializers = [];
+    let _bearerCodeChallenge_extraInitializers = [];
+    let _bearerClientState_decorators;
+    let _bearerClientState_initializers = [];
+    let _bearerClientState_extraInitializers = [];
     return class RelyingPartyLoginAttemptDoc extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
@@ -196,6 +209,10 @@ let RelyingPartyLoginAttemptDoc = (() => {
             _expiresAt_decorators = [plugins.nosqldb.svDb()];
             _consumedAt_decorators = [plugins.nosqldb.svDb()];
             _createdSessionId_decorators = [plugins.nosqldb.svDb()];
+            _bearerClientKind_decorators = [plugins.nosqldb.svDb()];
+            _bearerReturnTarget_decorators = [plugins.nosqldb.svDb()];
+            _bearerCodeChallenge_decorators = [plugins.nosqldb.svDb()];
+            _bearerClientState_decorators = [plugins.nosqldb.svDb()];
             __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
             __esDecorate(null, null, _stateHash_decorators, { kind: "field", name: "stateHash", static: false, private: false, access: { has: obj => "stateHash" in obj, get: obj => obj.stateHash, set: (obj, value) => { obj.stateHash = value; } }, metadata: _metadata }, _stateHash_initializers, _stateHash_extraInitializers);
             __esDecorate(null, null, _bindingTokenHash_decorators, { kind: "field", name: "bindingTokenHash", static: false, private: false, access: { has: obj => "bindingTokenHash" in obj, get: obj => obj.bindingTokenHash, set: (obj, value) => { obj.bindingTokenHash = value; } }, metadata: _metadata }, _bindingTokenHash_initializers, _bindingTokenHash_extraInitializers);
@@ -207,6 +224,10 @@ let RelyingPartyLoginAttemptDoc = (() => {
             __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
             __esDecorate(null, null, _consumedAt_decorators, { kind: "field", name: "consumedAt", static: false, private: false, access: { has: obj => "consumedAt" in obj, get: obj => obj.consumedAt, set: (obj, value) => { obj.consumedAt = value; } }, metadata: _metadata }, _consumedAt_initializers, _consumedAt_extraInitializers);
             __esDecorate(null, null, _createdSessionId_decorators, { kind: "field", name: "createdSessionId", static: false, private: false, access: { has: obj => "createdSessionId" in obj, get: obj => obj.createdSessionId, set: (obj, value) => { obj.createdSessionId = value; } }, metadata: _metadata }, _createdSessionId_initializers, _createdSessionId_extraInitializers);
+            __esDecorate(null, null, _bearerClientKind_decorators, { kind: "field", name: "bearerClientKind", static: false, private: false, access: { has: obj => "bearerClientKind" in obj, get: obj => obj.bearerClientKind, set: (obj, value) => { obj.bearerClientKind = value; } }, metadata: _metadata }, _bearerClientKind_initializers, _bearerClientKind_extraInitializers);
+            __esDecorate(null, null, _bearerReturnTarget_decorators, { kind: "field", name: "bearerReturnTarget", static: false, private: false, access: { has: obj => "bearerReturnTarget" in obj, get: obj => obj.bearerReturnTarget, set: (obj, value) => { obj.bearerReturnTarget = value; } }, metadata: _metadata }, _bearerReturnTarget_initializers, _bearerReturnTarget_extraInitializers);
+            __esDecorate(null, null, _bearerCodeChallenge_decorators, { kind: "field", name: "bearerCodeChallenge", static: false, private: false, access: { has: obj => "bearerCodeChallenge" in obj, get: obj => obj.bearerCodeChallenge, set: (obj, value) => { obj.bearerCodeChallenge = value; } }, metadata: _metadata }, _bearerCodeChallenge_initializers, _bearerCodeChallenge_extraInitializers);
+            __esDecorate(null, null, _bearerClientState_decorators, { kind: "field", name: "bearerClientState", static: false, private: false, access: { has: obj => "bearerClientState" in obj, get: obj => obj.bearerClientState, set: (obj, value) => { obj.bearerClientState = value; } }, metadata: _metadata }, _bearerClientState_initializers, _bearerClientState_extraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         id = __runInitializers(this, _id_initializers, '');
@@ -226,19 +247,165 @@ let RelyingPartyLoginAttemptDoc = (() => {
         consumedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _consumedAt_initializers, void 0));
         /** the session the callback created; finalize releases the return path against it */
         createdSessionId = (__runInitializers(this, _consumedAt_extraInitializers), __runInitializers(this, _createdSessionId_initializers, void 0));
+        /** how the bearer client of this login receives its outcome; absent on a cookie login */
+        bearerClientKind = (__runInitializers(this, _createdSessionId_extraInitializers), __runInitializers(this, _bearerClientKind_initializers, void 0));
+        /** the return target the bearer client named, exactly */
+        bearerReturnTarget = (__runInitializers(this, _bearerClientKind_extraInitializers), __runInitializers(this, _bearerReturnTarget_initializers, void 0));
+        /** the bearer client's S256 code challenge; its hand-off is claimed with the matching verifier */
+        bearerCodeChallenge = (__runInitializers(this, _bearerReturnTarget_extraInitializers), __runInitializers(this, _bearerCodeChallenge_initializers, void 0));
+        /** the bearer client's own `state`, handed back with the outcome */
+        bearerClientState = (__runInitializers(this, _bearerCodeChallenge_extraInitializers), __runInitializers(this, _bearerClientState_initializers, void 0));
         constructor() {
             super(...arguments);
-            __runInitializers(this, _createdSessionId_extraInitializers);
+            __runInitializers(this, _bearerClientState_extraInitializers);
         }
     };
 })();
 export { RelyingPartyLoginAttemptDoc };
+/**
+ * The single-use code a bearer login hands its client. Only the hash of the
+ * code is stored; the code is bound to the client's S256 challenge, lives at
+ * most a minute and is consumed by one conditional update.
+ */
+let RelyingPartyBearerHandoffDoc = (() => {
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
+    let _id_decorators;
+    let _id_initializers = [];
+    let _id_extraInitializers = [];
+    let _codeHash_decorators;
+    let _codeHash_initializers = [];
+    let _codeHash_extraInitializers = [];
+    let _sessionId_decorators;
+    let _sessionId_initializers = [];
+    let _sessionId_extraInitializers = [];
+    let _codeChallenge_decorators;
+    let _codeChallenge_initializers = [];
+    let _codeChallenge_extraInitializers = [];
+    let _createdAt_decorators;
+    let _createdAt_initializers = [];
+    let _createdAt_extraInitializers = [];
+    let _expiresAt_decorators;
+    let _expiresAt_initializers = [];
+    let _expiresAt_extraInitializers = [];
+    let _consumedAt_decorators;
+    let _consumedAt_initializers = [];
+    let _consumedAt_extraInitializers = [];
+    return class RelyingPartyBearerHandoffDoc extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _id_decorators = [plugins.nosqldb.unI()];
+            _codeHash_decorators = [plugins.nosqldb.unI()];
+            _sessionId_decorators = [plugins.nosqldb.svDb()];
+            _codeChallenge_decorators = [plugins.nosqldb.svDb()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
+            _consumedAt_decorators = [plugins.nosqldb.svDb()];
+            __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
+            __esDecorate(null, null, _codeHash_decorators, { kind: "field", name: "codeHash", static: false, private: false, access: { has: obj => "codeHash" in obj, get: obj => obj.codeHash, set: (obj, value) => { obj.codeHash = value; } }, metadata: _metadata }, _codeHash_initializers, _codeHash_extraInitializers);
+            __esDecorate(null, null, _sessionId_decorators, { kind: "field", name: "sessionId", static: false, private: false, access: { has: obj => "sessionId" in obj, get: obj => obj.sessionId, set: (obj, value) => { obj.sessionId = value; } }, metadata: _metadata }, _sessionId_initializers, _sessionId_extraInitializers);
+            __esDecorate(null, null, _codeChallenge_decorators, { kind: "field", name: "codeChallenge", static: false, private: false, access: { has: obj => "codeChallenge" in obj, get: obj => obj.codeChallenge, set: (obj, value) => { obj.codeChallenge = value; } }, metadata: _metadata }, _codeChallenge_initializers, _codeChallenge_extraInitializers);
+            __esDecorate(null, null, _createdAt_decorators, { kind: "field", name: "createdAt", static: false, private: false, access: { has: obj => "createdAt" in obj, get: obj => obj.createdAt, set: (obj, value) => { obj.createdAt = value; } }, metadata: _metadata }, _createdAt_initializers, _createdAt_extraInitializers);
+            __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
+            __esDecorate(null, null, _consumedAt_decorators, { kind: "field", name: "consumedAt", static: false, private: false, access: { has: obj => "consumedAt" in obj, get: obj => obj.consumedAt, set: (obj, value) => { obj.consumedAt = value; } }, metadata: _metadata }, _consumedAt_initializers, _consumedAt_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        id = __runInitializers(this, _id_initializers, '');
+        /** sha256 of the code */
+        codeHash = (__runInitializers(this, _id_extraInitializers), __runInitializers(this, _codeHash_initializers, ''));
+        /** the session the login opened; the code is its only way out */
+        sessionId = (__runInitializers(this, _codeHash_extraInitializers), __runInitializers(this, _sessionId_initializers, ''));
+        codeChallenge = (__runInitializers(this, _sessionId_extraInitializers), __runInitializers(this, _codeChallenge_initializers, ''));
+        createdAt = (__runInitializers(this, _codeChallenge_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
+        /** at most a minute after the callback; the sweep ends the session of a code nobody claimed by then */
+        expiresAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
+        /** `null` until a claim consumes the code */
+        consumedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _consumedAt_initializers, null));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _consumedAt_extraInitializers);
+        }
+    };
+})();
+export { RelyingPartyBearerHandoffDoc };
+/**
+ * One generation of a bearer session's tokens: an access token and the
+ * refresh token that replaces both. Only hashes are stored. Exactly one
+ * generation of a session is current (`rotatedAt` `null`); a rotated one is
+ * kept until the session expires, so its refresh token coming back is
+ * recognized as reuse.
+ */
+let RelyingPartyBearerTokenDoc = (() => {
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
+    let _id_decorators;
+    let _id_initializers = [];
+    let _id_extraInitializers = [];
+    let _accessTokenHash_decorators;
+    let _accessTokenHash_initializers = [];
+    let _accessTokenHash_extraInitializers = [];
+    let _refreshTokenHash_decorators;
+    let _refreshTokenHash_initializers = [];
+    let _refreshTokenHash_extraInitializers = [];
+    let _sessionId_decorators;
+    let _sessionId_initializers = [];
+    let _sessionId_extraInitializers = [];
+    let _createdAt_decorators;
+    let _createdAt_initializers = [];
+    let _createdAt_extraInitializers = [];
+    let _accessTokenExpiresAt_decorators;
+    let _accessTokenExpiresAt_initializers = [];
+    let _accessTokenExpiresAt_extraInitializers = [];
+    let _expiresAt_decorators;
+    let _expiresAt_initializers = [];
+    let _expiresAt_extraInitializers = [];
+    let _rotatedAt_decorators;
+    let _rotatedAt_initializers = [];
+    let _rotatedAt_extraInitializers = [];
+    return class RelyingPartyBearerTokenDoc extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _id_decorators = [plugins.nosqldb.unI()];
+            _accessTokenHash_decorators = [plugins.nosqldb.unI()];
+            _refreshTokenHash_decorators = [plugins.nosqldb.unI()];
+            _sessionId_decorators = [plugins.nosqldb.svDb()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _accessTokenExpiresAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
+            _rotatedAt_decorators = [plugins.nosqldb.svDb()];
+            __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
+            __esDecorate(null, null, _accessTokenHash_decorators, { kind: "field", name: "accessTokenHash", static: false, private: false, access: { has: obj => "accessTokenHash" in obj, get: obj => obj.accessTokenHash, set: (obj, value) => { obj.accessTokenHash = value; } }, metadata: _metadata }, _accessTokenHash_initializers, _accessTokenHash_extraInitializers);
+            __esDecorate(null, null, _refreshTokenHash_decorators, { kind: "field", name: "refreshTokenHash", static: false, private: false, access: { has: obj => "refreshTokenHash" in obj, get: obj => obj.refreshTokenHash, set: (obj, value) => { obj.refreshTokenHash = value; } }, metadata: _metadata }, _refreshTokenHash_initializers, _refreshTokenHash_extraInitializers);
+            __esDecorate(null, null, _sessionId_decorators, { kind: "field", name: "sessionId", static: false, private: false, access: { has: obj => "sessionId" in obj, get: obj => obj.sessionId, set: (obj, value) => { obj.sessionId = value; } }, metadata: _metadata }, _sessionId_initializers, _sessionId_extraInitializers);
+            __esDecorate(null, null, _createdAt_decorators, { kind: "field", name: "createdAt", static: false, private: false, access: { has: obj => "createdAt" in obj, get: obj => obj.createdAt, set: (obj, value) => { obj.createdAt = value; } }, metadata: _metadata }, _createdAt_initializers, _createdAt_extraInitializers);
+            __esDecorate(null, null, _accessTokenExpiresAt_decorators, { kind: "field", name: "accessTokenExpiresAt", static: false, private: false, access: { has: obj => "accessTokenExpiresAt" in obj, get: obj => obj.accessTokenExpiresAt, set: (obj, value) => { obj.accessTokenExpiresAt = value; } }, metadata: _metadata }, _accessTokenExpiresAt_initializers, _accessTokenExpiresAt_extraInitializers);
+            __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
+            __esDecorate(null, null, _rotatedAt_decorators, { kind: "field", name: "rotatedAt", static: false, private: false, access: { has: obj => "rotatedAt" in obj, get: obj => obj.rotatedAt, set: (obj, value) => { obj.rotatedAt = value; } }, metadata: _metadata }, _rotatedAt_initializers, _rotatedAt_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        id = __runInitializers(this, _id_initializers, '');
+        accessTokenHash = (__runInitializers(this, _id_extraInitializers), __runInitializers(this, _accessTokenHash_initializers, ''));
+        refreshTokenHash = (__runInitializers(this, _accessTokenHash_extraInitializers), __runInitializers(this, _refreshTokenHash_initializers, ''));
+        sessionId = (__runInitializers(this, _refreshTokenHash_extraInitializers), __runInitializers(this, _sessionId_initializers, ''));
+        createdAt = (__runInitializers(this, _sessionId_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
+        accessTokenExpiresAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _accessTokenExpiresAt_initializers, 0));
+        /** the session's end; the refresh token never outlives it, and the sweep removes the generation after it */
+        expiresAt = (__runInitializers(this, _accessTokenExpiresAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
+        /** `null` while this generation is current; when its refresh token was spent otherwise */
+        rotatedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _rotatedAt_initializers, null));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _rotatedAt_extraInitializers);
+        }
+    };
+})();
+export { RelyingPartyBearerTokenDoc };
 export const RELYING_PARTY_DEFAULT_COLLECTION_NAMES = {
     sessions: 'IdpRelyingPartySession',
     loginAttempts: 'IdpRelyingPartyLoginAttempt',
+    bearerHandoffs: 'IdpRelyingPartyBearerHandoff',
+    bearerTokens: 'IdpRelyingPartyBearerToken',
 };
 /**
- * Binds the two relying-party models to one database. Each call declares its
+ * Binds the relying-party models to one database. Each call declares its
  * own model classes, so several databases — and several applications in one
  * process — never share a binding. A deferred `db` is resolved on every use,
  * the way `@Collection(() => db)` resolves it; a use before it answers a
@@ -268,6 +435,10 @@ export const createRelyingPartyModels = (optionsArg) => {
     const sessions = optionsArg.collectionNames?.sessions ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.sessions;
     const loginAttempts = optionsArg.collectionNames?.loginAttempts
         ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.loginAttempts;
+    const bearerHandoffs = optionsArg.collectionNames?.bearerHandoffs
+        ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.bearerHandoffs;
+    const bearerTokens = optionsArg.collectionNames?.bearerTokens
+        ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.bearerTokens;
     let BoundSessionDoc = (() => {
         let _classDecorators = [plugins.nosqldb.Collection(resolveDb, { collectionName: sessions })];
         let _classDescriptor;
@@ -304,6 +475,47 @@ export const createRelyingPartyModels = (optionsArg) => {
         };
         return BoundLoginAttemptDoc = _classThis;
     })();
-    return { Session: BoundSessionDoc, LoginAttempt: BoundLoginAttemptDoc };
+    let BoundBearerHandoffDoc = (() => {
+        let _classDecorators = [plugins.nosqldb.Collection(resolveDb, { collectionName: bearerHandoffs })];
+        let _classDescriptor;
+        let _classExtraInitializers = [];
+        let _classThis;
+        let _classSuper = RelyingPartyBearerHandoffDoc;
+        var BoundBearerHandoffDoc = class extends _classSuper {
+            static { _classThis = this; }
+            static {
+                const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+                __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+                BoundBearerHandoffDoc = _classThis = _classDescriptor.value;
+                if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+                __runInitializers(_classThis, _classExtraInitializers);
+            }
+        };
+        return BoundBearerHandoffDoc = _classThis;
+    })();
+    let BoundBearerTokenDoc = (() => {
+        let _classDecorators = [plugins.nosqldb.Collection(resolveDb, { collectionName: bearerTokens })];
+        let _classDescriptor;
+        let _classExtraInitializers = [];
+        let _classThis;
+        let _classSuper = RelyingPartyBearerTokenDoc;
+        var BoundBearerTokenDoc = class extends _classSuper {
+            static { _classThis = this; }
+            static {
+                const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+                __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+                BoundBearerTokenDoc = _classThis = _classDescriptor.value;
+                if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+                __runInitializers(_classThis, _classExtraInitializers);
+            }
+        };
+        return BoundBearerTokenDoc = _classThis;
+    })();
+    return {
+        Session: BoundSessionDoc,
+        LoginAttempt: BoundLoginAttemptDoc,
+        BearerHandoff: BoundBearerHandoffDoc,
+        BearerToken: BoundBearerTokenDoc,
+    };
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ycG1vZGVscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLnJwbW9kZWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsb0NBQW9DLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUzRTs7Ozs7R0FLRztJQUNVLHNCQUFzQjtzQkFBUyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBQTdELHNCQUF1QixTQUFRLFdBQThFOzs7OEJBQ3ZILE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO3FDQUlyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtrQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7cUNBR3ZCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTswQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NkNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzhDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtnREFJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBNUN2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFJdkIsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFjO1lBSzlCLG9LQUFPLE1BQU0sNkJBQU4sTUFBTSx1RkFBYztZQUczQiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFHN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFhO1lBRzlCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFJMUIsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFVO1lBSTNCLDRMQUFPLGNBQWMsNkJBQWQsY0FBYyx1R0FBVTtZQUkvQixxTUFBTyxpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBVTtZQUdsQyx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBVTtZQUluQyw4TUFBTyxvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBVTtZQUlyQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBVTs7O1FBN0MxQixFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2QixtRUFBbUU7UUFFNUQsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsOERBQThEO1FBR3ZELE1BQU0seUdBQVcsRUFBRSxHQUFDO1FBR3BCLFNBQVMseUdBQVcsQ0FBQyxHQUFDO1FBR3RCLFVBQVUsNkdBQVcsQ0FBQyxHQUFDO1FBR3ZCLFNBQVMsNkdBQVcsQ0FBQyxHQUFDO1FBRTdCLHdDQUF3QztRQUVqQyxTQUFTLHFIQUFVO1FBRTFCLG1HQUFtRztRQUU1RixVQUFVLHNIQUFVO1FBRTNCLHNFQUFzRTtRQUUvRCxjQUFjLDJIQUFVO1FBRS9CLG1GQUFtRjtRQUU1RSxpQkFBaUIsa0lBQVU7UUFHM0Isa0JBQWtCLHNJQUFVO1FBRW5DLHFHQUFxRztRQUU5RixvQkFBb0IseUlBQVU7UUFFckMsaUdBQWlHO1FBRTFGLGdCQUFnQix1SUFBVTs7Ozs7OztTQS9DdEIsc0JBQXNCO0FBa0RuQzs7Ozs7O0dBTUc7SUFDVSwyQkFBMkI7c0JBQVMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O2lCQUFsRSwyQkFBNEIsU0FBUSxXQUF3Rjs7OzhCQUN0SSxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7NENBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzhDQUdyQixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtpQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7c0NBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3dDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTs0Q0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7WUFuQ3ZCLHdKQUFPLEVBQUUsNkJBQUYsRUFBRSwrRUFBYztZQUl2Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWM7WUFJOUIsa01BQU8sZ0JBQWdCLDZCQUFoQixnQkFBZ0IsMkdBQWM7WUFHckMsd01BQU8sa0JBQWtCLDZCQUFsQixrQkFBa0IsK0dBQWM7WUFHdkMsaUtBQU8sS0FBSyw2QkFBTCxLQUFLLHFGQUFjO1lBSTFCLGdMQUFPLFVBQVUsNkJBQVYsVUFBVSwrRkFBZTtZQUloQyxzTEFBTyxZQUFZLDZCQUFaLFlBQVksbUdBQVU7WUFHN0IsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBRzdCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3QixnTEFBTyxVQUFVLDZCQUFWLFVBQVUsK0ZBQWlCO1lBSWxDLGtNQUFPLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFpQjs7O1FBcENqQyxFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2Qiw0RUFBNEU7UUFFckUsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsMkZBQTJGO1FBRXBGLGdCQUFnQixtSEFBVyxFQUFFLEdBQUM7UUFHOUIsa0JBQWtCLDRIQUFXLEVBQUUsR0FBQztRQUdoQyxLQUFLLGlIQUFXLEVBQUUsR0FBQztRQUUxQiw4Q0FBOEM7UUFFdkMsVUFBVSx5R0FBVyxHQUFHLEdBQUM7UUFFaEMsaUlBQWlJO1FBRTFILFlBQVkseUhBQVU7UUFHdEIsU0FBUywrR0FBVyxDQUFDLEdBQUM7UUFHdEIsU0FBUyw0R0FBVyxDQUFDLEdBQUM7UUFFN0IsZ0dBQWdHO1FBRXpGLFVBQVUsc0hBQWlCO1FBRWxDLHFGQUFxRjtRQUU5RSxnQkFBZ0IsNkhBQWlCOzs7Ozs7O1NBdEM3QiwyQkFBMkI7QUF5Q3hDLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHO0lBQ3BELFFBQVEsRUFBRSx3QkFBd0I7SUFDbEMsYUFBYSxFQUFFLDZCQUE2QjtDQUNwQyxDQUFDO0FBeUJYOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsVUFBc0MsRUFBdUIsRUFBRTtJQUN0RyxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsRUFBRSxDQUFDO0lBQy9CLElBQUksQ0FBQyxDQUFDLFFBQVEsWUFBWSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3pGLE1BQU0sSUFBSSxLQUFLLENBQUMsMEdBQTBHLENBQUMsQ0FBQztJQUM5SCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsR0FBZ0MsRUFBRTtRQUNsRCxJQUFJLFFBQVEsWUFBWSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3BELE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFDRCxJQUFJLFFBQWlCLENBQUM7UUFDdEIsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLFFBQVEsRUFBRSxDQUFDO1FBQ3hCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLG9DQUFvQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxJQUFJLENBQUMsQ0FBQyxRQUFRLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxvQ0FBb0MsRUFBRSxDQUFDO1FBQ25ELENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDLENBQUM7SUFDRixNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsZUFBZSxFQUFFLFFBQVEsSUFBSSxzQ0FBc0MsQ0FBQyxRQUFRLENBQUM7SUFDekcsTUFBTSxhQUFhLEdBQUcsVUFBVSxDQUFDLGVBQWUsRUFBRSxhQUFhO1dBQzFELHNDQUFzQyxDQUFDLGFBQWEsQ0FBQztRQUdwRCxlQUFlO2dDQURwQixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsUUFBUSxFQUFFLENBQUM7Ozs7MEJBQ3RDLHNCQUFzQjttQ0FBOUIsU0FBUSxXQUFzQjs7OztnQkFBcEQsNktBQXVEOzs7Z0JBQWpELHVEQUFlOzs7OztRQUdmLG9CQUFvQjtnQ0FEekIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxDQUFDOzs7OzBCQUN0QywyQkFBMkI7d0NBQW5DLFNBQVEsV0FBMkI7Ozs7Z0JBQTlELDZLQUFpRTs7O2dCQUEzRCx1REFBb0I7Ozs7O0lBRTFCLE9BQU8sRUFBRSxPQUFPLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxvQkFBb0IsRUFBRSxDQUFDO0FBQzFFLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ycG1vZGVscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLnJwbW9kZWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsb0NBQW9DLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUczRTs7Ozs7R0FLRztJQUNVLHNCQUFzQjtzQkFBUyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBQTdELHNCQUF1QixTQUFRLFdBQThFOzs7OEJBQ3ZILE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO3FDQUlyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtrQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7cUNBR3ZCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTswQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NkNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzhDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtnREFJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBNUN2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFJdkIsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFjO1lBSzlCLG9LQUFPLE1BQU0sNkJBQU4sTUFBTSx1RkFBYztZQUczQiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFHN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFhO1lBRzlCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFJMUIsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFVO1lBSTNCLDRMQUFPLGNBQWMsNkJBQWQsY0FBYyx1R0FBVTtZQUkvQixxTUFBTyxpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBVTtZQUdsQyx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBVTtZQUluQyw4TUFBTyxvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBVTtZQUlyQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBVTs7O1FBN0MxQixFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2QixtRUFBbUU7UUFFNUQsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsOERBQThEO1FBR3ZELE1BQU0seUdBQVcsRUFBRSxHQUFDO1FBR3BCLFNBQVMseUdBQVcsQ0FBQyxHQUFDO1FBR3RCLFVBQVUsNkdBQVcsQ0FBQyxHQUFDO1FBR3ZCLFNBQVMsNkdBQVcsQ0FBQyxHQUFDO1FBRTdCLHdDQUF3QztRQUVqQyxTQUFTLHFIQUFVO1FBRTFCLG1HQUFtRztRQUU1RixVQUFVLHNIQUFVO1FBRTNCLHNFQUFzRTtRQUUvRCxjQUFjLDJIQUFVO1FBRS9CLG1GQUFtRjtRQUU1RSxpQkFBaUIsa0lBQVU7UUFHM0Isa0JBQWtCLHNJQUFVO1FBRW5DLHFHQUFxRztRQUU5RixvQkFBb0IseUlBQVU7UUFFckMsaUdBQWlHO1FBRTFGLGdCQUFnQix1SUFBVTs7Ozs7OztTQS9DdEIsc0JBQXNCO0FBa0RuQzs7Ozs7OztHQU9HO0lBQ1UsMkJBQTJCO3NCQUFTLE9BQU8sQ0FBQyxPQUFPLENBQUMsY0FBYzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztpQkFBbEUsMkJBQTRCLFNBQVEsV0FBd0Y7Ozs4QkFDdEksT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7cUNBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzRDQUlyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTs4Q0FHckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7aUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTt3Q0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3FDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtzQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzRDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTs4Q0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7K0NBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzZDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtZQW5EdkIsd0pBQU8sRUFBRSw2QkFBRixFQUFFLCtFQUFjO1lBSXZCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYztZQUk5QixrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBYztZQUdyQyx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBYztZQUd2QyxpS0FBTyxLQUFLLDZCQUFMLEtBQUsscUZBQWM7WUFJMUIsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFlO1lBSWhDLHNMQUFPLFlBQVksNkJBQVosWUFBWSxtR0FBVTtZQUc3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFHN0IsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBSTdCLGdMQUFPLFVBQVUsNkJBQVYsVUFBVSwrRkFBaUI7WUFJbEMsa01BQU8sZ0JBQWdCLDZCQUFoQixnQkFBZ0IsMkdBQWlCO1lBSXhDLGtNQUFPLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFpQztZQUl4RCx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBVTtZQUluQywyTUFBTyxtQkFBbUIsNkJBQW5CLG1CQUFtQixpSEFBVTtZQUlwQyxxTUFBTyxpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBVTs7O1FBcEQzQixFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2Qiw0RUFBNEU7UUFFckUsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsMkZBQTJGO1FBRXBGLGdCQUFnQixtSEFBVyxFQUFFLEdBQUM7UUFHOUIsa0JBQWtCLDRIQUFXLEVBQUUsR0FBQztRQUdoQyxLQUFLLGlIQUFXLEVBQUUsR0FBQztRQUUxQiw4Q0FBOEM7UUFFdkMsVUFBVSx5R0FBVyxHQUFHLEdBQUM7UUFFaEMsaUlBQWlJO1FBRTFILFlBQVkseUhBQVU7UUFHdEIsU0FBUywrR0FBVyxDQUFDLEdBQUM7UUFHdEIsU0FBUyw0R0FBVyxDQUFDLEdBQUM7UUFFN0IsZ0dBQWdHO1FBRXpGLFVBQVUsc0hBQWlCO1FBRWxDLHFGQUFxRjtRQUU5RSxnQkFBZ0IsNkhBQWlCO1FBRXhDLHlGQUF5RjtRQUVsRixnQkFBZ0IsbUlBQWlDO1FBRXhELHlEQUF5RDtRQUVsRCxrQkFBa0IscUlBQVU7UUFFbkMsa0dBQWtHO1FBRTNGLG1CQUFtQix3SUFBVTtRQUVwQyxvRUFBb0U7UUFFN0QsaUJBQWlCLHVJQUFVOzs7Ozs7O1NBdER2QiwyQkFBMkI7QUF5RHhDOzs7O0dBSUc7SUFDVSw0QkFBNEI7c0JBQVMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O2lCQUFuRSw0QkFBNkIsU0FBUSxXQUEwRjs7OzhCQUN6SSxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtvQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7cUNBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3lDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQ3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO3NDQUl2QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtZQXRCdkIsd0pBQU8sRUFBRSw2QkFBRixFQUFFLCtFQUFjO1lBSXZCLDBLQUFPLFFBQVEsNkJBQVIsUUFBUSwyRkFBYztZQUk3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWM7WUFHOUIseUxBQU8sYUFBYSw2QkFBYixhQUFhLHFHQUFjO1lBR2xDLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUs3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFJN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUF1Qjs7O1FBdkJqQyxFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2Qix5QkFBeUI7UUFFbEIsUUFBUSxvR0FBVyxFQUFFLEdBQUM7UUFFN0IsaUVBQWlFO1FBRTFELFNBQVMsMkdBQVcsRUFBRSxHQUFDO1FBR3ZCLGFBQWEsZ0hBQVcsRUFBRSxHQUFDO1FBRzNCLFNBQVMsZ0hBQVcsQ0FBQyxHQUFDO1FBRTdCLHVHQUF1RztRQUdoRyxTQUFTLDRHQUFXLENBQUMsR0FBQztRQUU3Qiw2Q0FBNkM7UUFFdEMsVUFBVSw2R0FBa0IsSUFBSSxHQUFDOzs7Ozs7O1NBekI3Qiw0QkFBNEI7QUE0QnpDOzs7Ozs7R0FNRztJQUNVLDBCQUEwQjtzQkFBUyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBQWpFLDBCQUEyQixTQUFRLFdBQXNGOzs7OEJBQ25JLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzJDQUdyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTs0Q0FHckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7cUNBR3JCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3FDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtnREFHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQ3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO3FDQUl2QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtZQXZCdkIsd0pBQU8sRUFBRSw2QkFBRixFQUFFLCtFQUFjO1lBR3ZCLCtMQUFPLGVBQWUsNkJBQWYsZUFBZSx5R0FBYztZQUdwQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBYztZQUdyQyw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWM7WUFHOUIsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBRzdCLDhNQUFPLG9CQUFvQiw2QkFBcEIsb0JBQW9CLG1IQUFhO1lBS3hDLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQXVCOzs7UUF4QmhDLEVBQUUsNkNBQVcsRUFBRSxFQUFDO1FBR2hCLGVBQWUsMkdBQVcsRUFBRSxHQUFDO1FBRzdCLGdCQUFnQix5SEFBVyxFQUFFLEdBQUM7UUFHOUIsU0FBUyxtSEFBVyxFQUFFLEdBQUM7UUFHdkIsU0FBUyw0R0FBVyxDQUFDLEdBQUM7UUFHdEIsb0JBQW9CLHVIQUFXLENBQUMsR0FBQztRQUV4Qyw0R0FBNEc7UUFHckcsU0FBUyx1SEFBVyxDQUFDLEdBQUM7UUFFN0IsMEZBQTBGO1FBRW5GLFNBQVMsNEdBQWtCLElBQUksR0FBQzs7Ozs7OztTQTFCNUIsMEJBQTBCO0FBNkJ2QyxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRztJQUNwRCxRQUFRLEVBQUUsd0JBQXdCO0lBQ2xDLGFBQWEsRUFBRSw2QkFBNkI7SUFDNUMsY0FBYyxFQUFFLDhCQUE4QjtJQUM5QyxZQUFZLEVBQUUsNEJBQTRCO0NBQ2xDLENBQUM7QUFzQ1g7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsVUFBc0MsRUFDVyxFQUFFO0lBQ25ELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxFQUFFLENBQUM7SUFDL0IsSUFBSSxDQUFDLENBQUMsUUFBUSxZQUFZLE9BQU8sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDekYsTUFBTSxJQUFJLEtBQUssQ0FBQywwR0FBMEcsQ0FBQyxDQUFDO0lBQzlILENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxHQUFnQyxFQUFFO1FBQ2xELElBQUksUUFBUSxZQUFZLE9BQU8sQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDcEQsT0FBTyxRQUFRLENBQUM7UUFDbEIsQ0FBQztRQUNELElBQUksUUFBaUIsQ0FBQztRQUN0QixJQUFJLENBQUM7WUFDSCxRQUFRLEdBQUcsUUFBUSxFQUFFLENBQUM7UUFDeEIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksb0NBQW9DLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUNELElBQUksQ0FBQyxDQUFDLFFBQVEsWUFBWSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDdkQsTUFBTSxJQUFJLG9DQUFvQyxFQUFFLENBQUM7UUFDbkQsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUMsQ0FBQztJQUNGLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxJQUFJLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQztJQUN6RyxNQUFNLGFBQWEsR0FBRyxVQUFVLENBQUMsZUFBZSxFQUFFLGFBQWE7V0FDMUQsc0NBQXNDLENBQUMsYUFBYSxDQUFDO0lBQzFELE1BQU0sY0FBYyxHQUFHLFVBQVUsQ0FBQyxlQUFlLEVBQUUsY0FBYztXQUM1RCxzQ0FBc0MsQ0FBQyxjQUFjLENBQUM7SUFDM0QsTUFBTSxZQUFZLEdBQUcsVUFBVSxDQUFDLGVBQWUsRUFBRSxZQUFZO1dBQ3hELHNDQUFzQyxDQUFDLFlBQVksQ0FBQztRQUduRCxlQUFlO2dDQURwQixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsUUFBUSxFQUFFLENBQUM7Ozs7MEJBQ3RDLHNCQUFzQjttQ0FBOUIsU0FBUSxXQUFzQjs7OztnQkFBcEQsNktBQXVEOzs7Z0JBQWpELHVEQUFlOzs7OztRQUdmLG9CQUFvQjtnQ0FEekIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxDQUFDOzs7OzBCQUN0QywyQkFBMkI7d0NBQW5DLFNBQVEsV0FBMkI7Ozs7Z0JBQTlELDZLQUFpRTs7O2dCQUEzRCx1REFBb0I7Ozs7O1FBR3BCLHFCQUFxQjtnQ0FEMUIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxDQUFDOzs7OzBCQUN0Qyw0QkFBNEI7eUNBQXBDLFNBQVEsV0FBNEI7Ozs7Z0JBQWhFLDZLQUFtRTs7O2dCQUE3RCx1REFBcUI7Ozs7O1FBR3JCLG1CQUFtQjtnQ0FEeEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLFlBQVksRUFBRSxDQUFDOzs7OzBCQUN0QywwQkFBMEI7dUNBQWxDLFNBQVEsV0FBMEI7Ozs7Z0JBQTVELDZLQUErRDs7O2dCQUF6RCx1REFBbUI7Ozs7O0lBRXpCLE9BQU87UUFDTCxPQUFPLEVBQUUsZUFBZTtRQUN4QixZQUFZLEVBQUUsb0JBQW9CO1FBQ2xDLGFBQWEsRUFBRSxxQkFBcUI7UUFDcEMsV0FBVyxFQUFFLG1CQUFtQjtLQUNqQyxDQUFDO0FBQ0osQ0FBQyxDQUFDIn0=

package/dist_ts_relyingparty/helpers.bearer.d.ts

@@ -0,0 +1,48 @@
+import type { IRelyingPartyBearerDelivery, IRelyingPartyBearerMessage, IRelyingPartyBearerReturnTargets, TRelyingPartyBearerClientKind } from './interfaces.js';
+export declare const RELYING_PARTY_BEARER_CLIENT_KINDS: readonly TRelyingPartyBearerClientKind[];
+/** The `type` of every message a popup delivery posts. */
+export declare const RELYING_PARTY_BEARER_MESSAGE_TYPE = "idp.global/relyingparty:bearer-handoff";
+export declare const isBearerClientKind: (valueArg: unknown) => valueArg is TRelyingPartyBearerClientKind;
+export declare const isPkceChallenge: (valueArg: unknown) => valueArg is string;
+export declare const isPkceVerifier: (valueArg: unknown) => valueArg is string;
+export declare const isBearerClientState: (valueArg: unknown) => valueArg is string;
+/** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
+export declare const pkceChallengeOf: (verifierArg: string) => string;
+/** Whether a verifier answers a challenge under S256, compared in constant time. */
+export declare const verifyPkceChallenge: (verifierArg: unknown, challengeArg: string) => boolean;
+/**
+ * The return targets of a deployment, checked once: every entry has to be
+ * the exact canonical form a client can name, or the configuration is
+ * refused. A target with a query or a fragment is refused too, because the
+ * delivery adds its own query, and so is one with a `*`: nothing is a wildcard.
+ */
+export declare const normalizeBearerReturnTargets: (targetsArg: IRelyingPartyBearerReturnTargets, publicOriginArg: string, loginPathPrefixArg: string) => Readonly<Required<IRelyingPartyBearerReturnTargets>>;
+/**
+ * Whether a client may name this return target: an entry of its kind,
+ * exactly. A loopback target names its own port, which is the only part
+ * that is not compared; it has to be given in canonical form.
+ */
+export declare const isBearerReturnTargetAllowed: (targetsArg: Readonly<Required<IRelyingPartyBearerReturnTargets>>, kindArg: TRelyingPartyBearerClientKind, candidateArg: unknown) => boolean;
+/** The token of an `Authorization: Bearer <token>` header, or `null`. */
+export declare const parseBearerAuthorization: (headerArg: string | null | undefined) => string | null;
+/** What a delivery hands the client: the code, or why there is none. */
+export type TRelyingPartyBearerOutcome = {
+    code: string;
+} | {
+    error: string;
+};
+/** The location a redirect delivery sends the client to, with the outcome and its `state` in the query. */
+export declare const bearerDeliveryLocation: (deliveryArg: IRelyingPartyBearerDelivery, outcomeArg: TRelyingPartyBearerOutcome, publicOriginArg: string) => string;
+/** The message a popup delivery posts. */
+export declare const bearerDeliveryMessage: (deliveryArg: IRelyingPartyBearerDelivery, outcomeArg: TRelyingPartyBearerOutcome) => IRelyingPartyBearerMessage;
+/** The id of the element a popup page keeps its delivery in. */
+export declare const RELYING_PARTY_BEARER_POPUP_DATA_ID = "idp-rp-bearer-delivery";
+/**
+ * The page of a popup delivery. Its one script, allowed by nonce alone,
+ * posts the message to `window.opener` with the registered origin as the
+ * target origin — never `*` — so a browser hands it to nobody else, and
+ * closes the window. The delivery is data in a JSON block, never script.
+ */
+export declare const bearerPopupPage: (deliveryArg: IRelyingPartyBearerDelivery, outcomeArg: TRelyingPartyBearerOutcome, nonceArg: string) => string;
+/** The policy of a popup page: its nonce script and nothing else. */
+export declare const bearerPopupContentSecurityPolicy: (nonceArg: string) => string;