@idp.global/sdk 19.2.1 → 19.4.0

package/dist_ts_browser/secret-delivery.js

@@ -87,4 +87,4 @@ export const decryptSecretDeliveryEnvelope = async (contextArg, envelopeArg) =>
     }
     return secret;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LWRlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfYnJvd3Nlci9zZWNyZXQtZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBUUEsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQWdCLEVBQUUsRUFBRTtJQUM5QyxJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDekIsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNyQixRQUFRLENBQUMsSUFBSSxFQUFFLEtBQUssUUFBUTtXQUM1Qix1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3pDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBb0IsRUFBRSxFQUFFO0lBQzdDLElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVE7UUFBRSxNQUFNLElBQUksTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRSxPQUFPLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFnQixFQUFFLEVBQUU7SUFDekMsSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQ3pCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLE1BQU07V0FDeEIsQ0FBQyxrRUFBa0UsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3JGLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRixJQUFJLGFBQWEsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQW9CLEVBQUUsRUFBRTtJQUNqRCxNQUFNLElBQUksR0FBRyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDakQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLFFBQW9CLEVBQUUsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxDQUM1QixDQUFDLENBQUM7SUFDSCxPQUFPLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUN0RixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxLQUFLLEVBQzlDLGNBQWMsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxFQUNkLEVBQUU7SUFDbkMsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDdkQsTUFBTSxTQUFTLEdBQTBCO1FBQ3ZDLElBQUksRUFBRSxVQUFVO1FBQ2hCLGFBQWEsRUFBRSxJQUFJO1FBQ25CLGNBQWMsRUFBRSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekMsSUFBSSxFQUFFLFNBQVM7S0FDaEIsQ0FBQztJQUNGLE1BQU0sU0FBUyxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUMxRCxTQUFTLEVBQ1QsSUFBSSxFQUNKLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUNOLENBQUM7SUFDbkIsTUFBTSxDQUFDLGFBQWEsRUFBRSxlQUFlLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDekQsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsU0FBUyxDQUFDO1FBQy9ELFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQztLQUNsRSxDQUFDLENBQUM7SUFDSCxNQUFNLFVBQVUsR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDekQsT0FBTyxFQUNQLGVBQWUsRUFDZixFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUNyQyxLQUFLLEVBQ0wsQ0FBQyxTQUFTLENBQUMsQ0FDWixDQUFDO0lBQ0YsSUFBSSxVQUFVLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLE9BQU87UUFDTCxXQUFXO1FBQ1gsT0FBTyxFQUFFO1lBQ1AsU0FBUyxFQUFFLGNBQWM7WUFDekIsbUJBQW1CLEVBQUUsYUFBYSxDQUFDLElBQUksVUFBVSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1NBQ2xFO1FBQ0QsVUFBVTtLQUNYLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwyREFBMkQ7QUFDM0QsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxVQUFrQyxFQUNsQyxXQUFrRSxFQUNsRSxFQUFFO0lBQ0YsSUFDRSxXQUFXLENBQUMsTUFBTSxLQUFLLFNBQVM7V0FDN0IsV0FBVyxDQUFDLFdBQVcsS0FBSyxVQUFVLENBQUMsV0FBVztXQUNsRCxXQUFXLENBQUMsU0FBUyxLQUFLLGNBQWMsRUFDM0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUM3RSxJQUFJLE1BQU0sU0FBUyxDQUFDLGNBQWMsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUMvRCxJQUFJLE1BQU0sU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQ3RELEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUNwQixVQUFVLENBQUMsVUFBVSxFQUNyQixpQkFBaUIsQ0FBQyxVQUFVLENBQUMsQ0FDOUIsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRSxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LWRlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfYnJvd3Nlci9zZWNyZXQtZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBUUEsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQWdCLEVBQUUsRUFBRTtJQUM5QyxJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDekIsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNyQixRQUFRLENBQUMsSUFBSSxFQUFFLEtBQUssUUFBUTtXQUM1Qix1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3pDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBb0IsRUFBRSxFQUFFO0lBQzdDLElBQUksTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLFFBQVE7UUFBRSxNQUFNLElBQUksTUFBTSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRSxPQUFPLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFnQixFQUFFLEVBQUU7SUFDekMsSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQ3pCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLE1BQU07V0FDeEIsQ0FBQyxrRUFBa0UsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3JGLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRixJQUFJLGFBQWEsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQW9CLEVBQUUsRUFBRTtJQUNqRCxNQUFNLElBQUksR0FBRyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDakQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLFFBQW9CLEVBQUUsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxDQUM1QixDQUFDLENBQUM7SUFDSCxPQUFPLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUN0RixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxLQUFLLEVBQzlDLGNBQWMsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxFQUNkLEVBQUU7SUFDbkMsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDdkQsTUFBTSxTQUFTLEdBQTBCO1FBQ3ZDLElBQUksRUFBRSxVQUFVO1FBQ2hCLGFBQWEsRUFBRSxJQUFJO1FBQ25CLGNBQWMsRUFBRSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekMsSUFBSSxFQUFFLFNBQVM7S0FDaEIsQ0FBQztJQUNGLE1BQU0sU0FBUyxHQUFHLE1BQU0sVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUMxRCxTQUFTLEVBQ1QsSUFBSSxFQUNKLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUNOLENBQUM7SUFDbkIsTUFBTSxDQUFDLGFBQWEsRUFBRSxlQUFlLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDekQsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsU0FBUyxDQUFDO1FBQy9ELFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQztLQUNsRSxDQUFDLENBQUM7SUFDSCxNQUFNLFVBQVUsR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FDekQsT0FBTyxFQUNQLGVBQWUsRUFDZixFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUNyQyxLQUFLLEVBQ0wsQ0FBQyxTQUFTLENBQUMsQ0FDWixDQUFDO0lBQ0YsSUFBSSxVQUFVLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLE9BQU87UUFDTCxXQUFXO1FBQ1gsT0FBTyxFQUFFO1lBQ1AsU0FBUyxFQUFFLGNBQWM7WUFDekIsbUJBQW1CLEVBQUUsYUFBYSxDQUFDLElBQUksVUFBVSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1NBQ2xFO1FBQ0QsVUFBVTtLQUNYLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwyREFBMkQ7QUFDM0QsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxVQUFrQyxFQUNsQyxXQUFrRSxFQUNsRSxFQUFFO0lBQ0YsSUFDRSxXQUFXLENBQUMsTUFBTSxLQUFLLFNBQVM7V0FDN0IsV0FBVyxDQUFDLFdBQVcsS0FBSyxVQUFVLENBQUMsV0FBVztXQUNsRCxXQUFXLENBQUMsU0FBUyxLQUFLLGNBQWMsRUFDM0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUM3RSxJQUFJLE1BQU0sU0FBUyxDQUFDLGNBQWMsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUMvRCxJQUFJLE1BQU0sU0FBUyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFdBQVcsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQ3RELEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUNwQixVQUFVLENBQUMsVUFBVSxFQUNyQixpQkFBaUIsQ0FBQyxVQUFVLENBQUMsQ0FDOUIsQ0FBQztJQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRSxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts_relyingparty/classes.authorityobserver.d.ts

@@ -44,6 +44,8 @@ export interface IAuthorityObserverOptions<TGrant> {
     maxEntries?: number;
     now?: () => number;
 }
+/** a session's token is rotated for an inactive answer at most once in this long */
+export declare const AUTHORITY_FORCED_REFRESH_INTERVAL_MS = 60000;
 /**
  * Live organization authority through idp.global: one `POST /oauth/introspect`
  * observation of a login session's subject in one organization, projected by
@@ -54,6 +56,20 @@ export interface IAuthorityObserverOptions<TGrant> {
  * every attempt while the provider is unreachable. A session that is forgotten
  * while its observation is in flight never stores a positive answer. Nothing
  * runs on a timer: the cache is pruned when it is written to.
+ *
+ * idp.global answers inactive both for a login that ended and for a
+ * membership that is gone, so an inactive answer rotates the session's token
+ * (`rejectedAccessToken`) before it counts. A refused rotation is the ended
+ * login: it throws `authority_login_required` and stores nothing. Only an
+ * inactive answer on a token from a rotation that started after the
+ * observation's own inactive answer is a refusal (`idp_membership_absent`). A session's token is
+ * rotated so at most once per `AUTHORITY_FORCED_REFRESH_INTERVAL_MS`. An inactive
+ * answer that no rotation followed — it came within that time of the last
+ * one, the rotation started before it, or the source did not mark the token
+ * as its own rotation — confirms nothing: it throws `authority_unavailable`
+ * and stores nothing, and after the interval the next one rotates and
+ * decides. One monotonic sequence orders answers and rotation starts, so no
+ * token is compared with another and no clock with another's.
  */
 export declare class AuthorityObserver<TGrant> {
     #private;
@@ -76,6 +92,13 @@ export declare class AuthorityObserver<TGrant> {
     private liveEntry;
     private observeOnce;
     private makeObservation;
+    private introspect;
+    /**
+     * The session's one forced rotation within `AUTHORITY_FORCED_REFRESH_INTERVAL_MS`,
+     * started for `rejectedArg` when there is none. Its failure is every
+     * caller's failure until the interval is over.
+     */
+    private forcedRefresh;
     /** Expired entries go first; if that is not enough, the oldest do. */
     private prune;
 }

package/dist_ts_relyingparty/classes.authorityobserver.js

@@ -21,6 +21,8 @@ export class AuthorityRefusedError extends Error {
 const DEFAULT_MAX_ENTRIES = 2_000;
 /** how much room an eviction makes, so it does not run on every insert */
 const EVICTION_HEADROOM = 0.1;
+/** a session's token is rotated for an inactive answer at most once in this long */
+export const AUTHORITY_FORCED_REFRESH_INTERVAL_MS = 60_000;
 const assertTtl = (valueArg, labelArg) => {
     if (!Number.isSafeInteger(valueArg) || valueArg < 0) {
         throw new Error(labelArg + ' must be a non-negative integer of milliseconds');
@@ -37,11 +39,28 @@ const assertTtl = (valueArg, labelArg) => {
  * every attempt while the provider is unreachable. A session that is forgotten
  * while its observation is in flight never stores a positive answer. Nothing
  * runs on a timer: the cache is pruned when it is written to.
+ *
+ * idp.global answers inactive both for a login that ended and for a
+ * membership that is gone, so an inactive answer rotates the session's token
+ * (`rejectedAccessToken`) before it counts. A refused rotation is the ended
+ * login: it throws `authority_login_required` and stores nothing. Only an
+ * inactive answer on a token from a rotation that started after the
+ * observation's own inactive answer is a refusal (`idp_membership_absent`). A session's token is
+ * rotated so at most once per `AUTHORITY_FORCED_REFRESH_INTERVAL_MS`. An inactive
+ * answer that no rotation followed — it came within that time of the last
+ * one, the rotation started before it, or the source did not mark the token
+ * as its own rotation — confirms nothing: it throws `authority_unavailable`
+ * and stores nothing, and after the interval the next one rotates and
+ * decides. One monotonic sequence orders answers and rotation starts, so no
+ * token is compared with another and no clock with another's.
  */
 export class AuthorityObserver {
     #cache = new Map();
     #inFlight = new Map();
     #forgotten = new Set();
+    #forcedRefreshes = new Map();
+    /** counts inactive answers and forced rotation starts, in the order they happen */
+    #sequence = 0;
     #provider;
     #tokens;
     #project;
@@ -89,6 +108,7 @@ export class AuthorityObserver {
     }
     /** Drops every observation of a session; wire it to the session layer's `onSessionEnded`. */
     forgetSession(sessionIdArg) {
+        this.#forcedRefreshes.delete(sessionIdArg);
         const prefix = `${sessionIdArg} `;
         for (const key of this.#cache.keys()) {
             if (key.startsWith(prefix)) {
@@ -119,19 +139,15 @@ export class AuthorityObserver {
     }
     async makeObservation(keyArg, optionsArg) {
         const token = await this.#tokens.liveProviderToken(optionsArg.loginSessionId, optionsArg.principalId);
-        let answer;
-        try {
-            answer = await this.#provider.introspectOrganization({
-                accessToken: token.accessToken,
-                subject: token.subject,
-                organizationId: optionsArg.idpOrganizationId,
-            });
-        }
-        catch (error) {
-            if (error instanceof OidcAuthorityUnavailableError) {
-                throw new AuthorityTokenError('authority_unavailable', error);
+        let answer = await this.introspect(token, optionsArg.idpOrganizationId);
+        if (!answer.active) {
+            const answeredAt = ++this.#sequence;
+            const forced = this.forcedRefresh(optionsArg.loginSessionId, optionsArg.principalId, token.accessToken);
+            const rotated = await forced.token;
+            if (forced.sequence < answeredAt || rotated.rotatedAfterRejection !== true) {
+                throw new AuthorityTokenError('authority_unavailable');
             }
-            throw error;
+            answer = await this.introspect(rotated, optionsArg.idpOrganizationId);
         }
         const grant = answer.active ? this.#project(answer.roles) : undefined;
         const active = answer.active && grant !== undefined;
@@ -159,6 +175,45 @@ export class AuthorityObserver {
         this.prune();
         return entry;
     }
+    async introspect(tokenArg, organizationIdArg) {
+        try {
+            return await this.#provider.introspectOrganization({
+                accessToken: tokenArg.accessToken,
+                subject: tokenArg.subject,
+                organizationId: organizationIdArg,
+            });
+        }
+        catch (error) {
+            if (error instanceof OidcAuthorityUnavailableError) {
+                throw new AuthorityTokenError('authority_unavailable', error);
+            }
+            throw error;
+        }
+    }
+    /**
+     * The session's one forced rotation within `AUTHORITY_FORCED_REFRESH_INTERVAL_MS`,
+     * started for `rejectedArg` when there is none. Its failure is every
+     * caller's failure until the interval is over.
+     */
+    forcedRefresh(sessionIdArg, principalIdArg, rejectedArg) {
+        const now = this.#now();
+        const last = this.#forcedRefreshes.get(sessionIdArg);
+        if (last && now - last.startedAt < AUTHORITY_FORCED_REFRESH_INTERVAL_MS) {
+            return last;
+        }
+        for (const [sessionId, forced] of this.#forcedRefreshes) {
+            if (now - forced.startedAt >= AUTHORITY_FORCED_REFRESH_INTERVAL_MS) {
+                this.#forcedRefreshes.delete(sessionId);
+            }
+        }
+        const forced = {
+            startedAt: now,
+            sequence: ++this.#sequence,
+            token: this.#tokens.liveProviderToken(sessionIdArg, principalIdArg, { rejectedAccessToken: rejectedArg }),
+        };
+        this.#forcedRefreshes.set(sessionIdArg, forced);
+        return forced;
+    }
     /** Expired entries go first; if that is not enough, the oldest do. */
     prune() {
         if (this.#cache.size <= this.#maxEntries) {
@@ -182,4 +237,4 @@ export class AuthorityObserver {
         }
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlvYnNlcnZlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLmF1dGhvcml0eW9ic2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQzFELE9BQU8sRUFBRSw2QkFBNkIsRUFBc0IsTUFBTSw4QkFBOEIsQ0FBQztBQU1qRzs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxxQkFBc0IsU0FBUSxLQUFLO0lBSzVCLE1BQU07SUFDTixZQUFZO0lBTGQsSUFBSSxHQUFHLDZCQUE2QixDQUFDO0lBQ3JDLE1BQU0sR0FBRyxHQUFHLENBQUM7SUFFN0IsWUFDa0IsTUFBK0IsRUFDL0IsWUFBcUI7UUFFckMsS0FBSyxDQUFDLDZCQUE2QixDQUFDLENBQUM7c0JBSHJCLE1BQU07NEJBQ04sWUFBWTtRQUc1QixJQUFJLENBQUMsSUFBSSxHQUFHLHVCQUF1QixDQUFDO0lBQ3RDLENBQUM7Q0FDRjtBQWlDRCxNQUFNLG1CQUFtQixHQUFHLEtBQUssQ0FBQztBQUNsQywwRUFBMEU7QUFDMUUsTUFBTSxpQkFBaUIsR0FBRyxHQUFHLENBQUM7QUFlOUIsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFnQixFQUFFLFFBQWdCLEVBQVUsRUFBRTtJQUMvRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxRQUFRLEdBQUcsaURBQWlELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sT0FBTyxpQkFBaUI7SUFDbkIsTUFBTSxHQUFHLElBQUksR0FBRyxFQUFzQyxDQUFDO0lBQ3ZELFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBK0MsQ0FBQztJQUNuRSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUMvQixTQUFTLENBQWdCO0lBQ3pCLE9BQU8sQ0FBd0I7SUFDL0IsUUFBUSxDQUFzRDtJQUM5RCxjQUFjLENBQVM7SUFDdkIsY0FBYyxDQUFTO0lBQ3ZCLFdBQVcsQ0FBUztJQUNwQixJQUFJLENBQWU7SUFFNUIsWUFBWSxVQUE2QztRQUN2RCxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUM7UUFDckMsSUFBSSxDQUFDLE9BQU8sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUNuQyxJQUFJLENBQUMsY0FBYyxHQUFHLFNBQVMsQ0FBQyxVQUFVLENBQUMsYUFBYSxJQUFJLENBQUMsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUNoRixJQUFJLENBQUMsY0FBYyxHQUFHLFNBQVMsQ0FBQyxVQUFVLENBQUMsYUFBYSxJQUFJLENBQUMsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUNoRixJQUFJLENBQUMsV0FBVyxHQUFHLFVBQVUsQ0FBQyxVQUFVLElBQUksbUJBQW1CLENBQUM7UUFDaEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLElBQUksQ0FBQyxXQUFXLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDcEUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsc0RBQXNEO0lBQ3RELElBQVcsSUFBSTtRQUNiLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUM7SUFDMUIsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUlwQjtRQUNDLE1BQU0sR0FBRyxHQUFHLEdBQUcsVUFBVSxDQUFDLGNBQWMsSUFBSSxVQUFVLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUMzRSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ25DLE1BQU0sV0FBVyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUN4RSxJQUFJLFdBQVcsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLFdBQVcsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEUsTUFBTSxZQUFZLEdBQUcsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUM7WUFDbkUsV0FBVyxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7WUFDNUIsTUFBTSxJQUFJLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxNQUFNLElBQUksdUJBQXVCLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDL0YsQ0FBQztRQUNELE9BQU87WUFDTCxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7WUFDeEIsS0FBSyxFQUFFLFdBQVcsQ0FBQyxLQUFLO1lBQ3hCLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztZQUMxQyxVQUFVLEVBQUUsV0FBVyxDQUFDLFVBQVU7U0FDbkMsQ0FBQztJQUNKLENBQUM7SUFFRCw2RkFBNkY7SUFDdEYsYUFBYSxDQUFDLFlBQW9CO1FBQ3ZDLE1BQU0sTUFBTSxHQUFHLEdBQUcsWUFBWSxHQUFHLENBQUM7UUFDbEMsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDckMsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzFCLENBQUM7UUFDSCxDQUFDO1FBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDeEMsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzNCLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzNCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLFNBQVMsQ0FBQyxNQUFjO1FBQzlCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3RDLE9BQU8sS0FBSyxJQUFJLEtBQUssQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNwRSxDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FDdkIsTUFBYyxFQUNkLFVBQXNGO1FBRXRGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNDLElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixPQUFPLE9BQU8sQ0FBQztRQUNqQixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtZQUNwRSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUM5QixJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNwQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRU8sS0FBSyxDQUFDLGVBQWUsQ0FDM0IsTUFBYyxFQUNkLFVBQXNGO1FBRXRGLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN0RyxJQUFJLE1BQW9FLENBQUM7UUFDekUsSUFBSSxDQUFDO1lBQ0gsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxzQkFBc0IsQ0FBQztnQkFDbkQsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO2dCQUM5QixPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU87Z0JBQ3RCLGNBQWMsRUFBRSxVQUFVLENBQUMsaUJBQWlCO2FBQzdDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksNkJBQTZCLEVBQUUsQ0FBQztnQkFDbkQsTUFBTSxJQUFJLG1CQUFtQixDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3RFLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLElBQUksS0FBSyxLQUFLLFNBQVMsQ0FBQztRQUNwRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6QyxNQUFNLEtBQUssR0FBK0I7WUFDeEMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxVQUFVO1lBQ3ZDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQ3BHLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztZQUNuQixjQUFjLEVBQUUsTUFBTSxDQUFDLFNBQVM7WUFDaEMsVUFBVSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUU7WUFDdkIsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQztZQUM3RSw0REFBNEQ7WUFDNUQsUUFBUSxFQUFFLENBQUMsTUFBTSxJQUFJLFFBQVEsRUFBRSxPQUFPLEtBQUssVUFBVSxJQUFJLFFBQVEsQ0FBQyxRQUFRO1NBQzNFLENBQUM7UUFDRixJQUFJLE1BQU0sSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQzFDLHNFQUFzRTtZQUN0RSx5REFBeUQ7WUFDekQsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUM7WUFDcEIsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsNEVBQTRFO1FBQzVFLGlFQUFpRTtRQUNqRSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQixJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDL0IsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2IsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsc0VBQXNFO0lBQzlELEtBQUs7UUFDWCxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN6QyxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3ZDLElBQUksS0FBSyxDQUFDLFNBQVMsSUFBSSxHQUFHLEVBQUUsQ0FBQztnQkFDM0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDMUIsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN6QyxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxDQUFDLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7UUFDdEUsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDckMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDL0IsTUFBTTtZQUNSLENBQUM7WUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlvYnNlcnZlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLmF1dGhvcml0eW9ic2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQzFELE9BQU8sRUFBRSw2QkFBNkIsRUFBc0IsTUFBTSw4QkFBOEIsQ0FBQztBQU1qRzs7Ozs7R0FLRztBQUNILE1BQU0sT0FBTyxxQkFBc0IsU0FBUSxLQUFLO0lBSzVCLE1BQU07SUFDTixZQUFZO0lBTGQsSUFBSSxHQUFHLDZCQUE2QixDQUFDO0lBQ3JDLE1BQU0sR0FBRyxHQUFHLENBQUM7SUFFN0IsWUFDa0IsTUFBK0IsRUFDL0IsWUFBcUI7UUFFckMsS0FBSyxDQUFDLDZCQUE2QixDQUFDLENBQUM7c0JBSHJCLE1BQU07NEJBQ04sWUFBWTtRQUc1QixJQUFJLENBQUMsSUFBSSxHQUFHLHVCQUF1QixDQUFDO0lBQ3RDLENBQUM7Q0FDRjtBQWlDRCxNQUFNLG1CQUFtQixHQUFHLEtBQUssQ0FBQztBQUNsQywwRUFBMEU7QUFDMUUsTUFBTSxpQkFBaUIsR0FBRyxHQUFHLENBQUM7QUFDOUIsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLE1BQU0sQ0FBQztBQXVCM0QsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFnQixFQUFFLFFBQWdCLEVBQVUsRUFBRTtJQUMvRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxRQUFRLEdBQUcsaURBQWlELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXdCRztBQUNILE1BQU0sT0FBTyxpQkFBaUI7SUFDbkIsTUFBTSxHQUFHLElBQUksR0FBRyxFQUFzQyxDQUFDO0lBQ3ZELFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBK0MsQ0FBQztJQUNuRSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUMvQixnQkFBZ0IsR0FBRyxJQUFJLEdBQUcsRUFBMEIsQ0FBQztJQUM5RCxtRkFBbUY7SUFDbkYsU0FBUyxHQUFHLENBQUMsQ0FBQztJQUNMLFNBQVMsQ0FBZ0I7SUFDekIsT0FBTyxDQUF3QjtJQUMvQixRQUFRLENBQXNEO0lBQzlELGNBQWMsQ0FBUztJQUN2QixjQUFjLENBQVM7SUFDdkIsV0FBVyxDQUFTO0lBQ3BCLElBQUksQ0FBZTtJQUU1QixZQUFZLFVBQTZDO1FBQ3ZELElBQUksQ0FBQyxTQUFTLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQztRQUNyQyxJQUFJLENBQUMsT0FBTyxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7UUFDakMsSUFBSSxDQUFDLFFBQVEsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDO1FBQ25DLElBQUksQ0FBQyxjQUFjLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxhQUFhLElBQUksQ0FBQyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxjQUFjLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxhQUFhLElBQUksQ0FBQyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxXQUFXLEdBQUcsVUFBVSxDQUFDLFVBQVUsSUFBSSxtQkFBbUIsQ0FBQztRQUNoRSxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksSUFBSSxDQUFDLFdBQVcsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLEdBQUcsVUFBVSxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRCxzREFBc0Q7SUFDdEQsSUFBVyxJQUFJO1FBQ2IsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQztJQUMxQixDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBSXBCO1FBQ0MsTUFBTSxHQUFHLEdBQUcsR0FBRyxVQUFVLENBQUMsY0FBYyxJQUFJLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQzNFLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbkMsTUFBTSxXQUFXLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3hFLElBQUksV0FBVyxDQUFDLE9BQU8sS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN4RSxNQUFNLFlBQVksR0FBRyxNQUFNLEtBQUssU0FBUyxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQztZQUNuRSxXQUFXLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztZQUM1QixNQUFNLElBQUkscUJBQXFCLENBQUMsV0FBVyxDQUFDLE1BQU0sSUFBSSx1QkFBdUIsRUFBRSxZQUFZLENBQUMsQ0FBQztRQUMvRixDQUFDO1FBQ0QsT0FBTztZQUNMLEtBQUssRUFBRSxXQUFXLENBQUMsS0FBSztZQUN4QixLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUs7WUFDeEIsY0FBYyxFQUFFLFdBQVcsQ0FBQyxjQUFjO1lBQzFDLFVBQVUsRUFBRSxXQUFXLENBQUMsVUFBVTtTQUNuQyxDQUFDO0lBQ0osQ0FBQztJQUVELDZGQUE2RjtJQUN0RixhQUFhLENBQUMsWUFBb0I7UUFDdkMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUMzQyxNQUFNLE1BQU0sR0FBRyxHQUFHLFlBQVksR0FBRyxDQUFDO1FBQ2xDLEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ3JDLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO2dCQUMzQixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMxQixDQUFDO1FBQ0gsQ0FBQztRQUNELEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ3hDLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO2dCQUMzQixJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMzQixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFTyxTQUFTLENBQUMsTUFBYztRQUM5QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN0QyxPQUFPLEtBQUssSUFBSSxLQUFLLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDcEUsQ0FBQztJQUVPLEtBQUssQ0FBQyxXQUFXLENBQ3ZCLE1BQWMsRUFDZCxVQUFzRjtRQUV0RixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQyxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ1osT0FBTyxPQUFPLENBQUM7UUFDakIsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLFVBQVUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDcEUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDOUIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDcEMsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVPLEtBQUssQ0FBQyxlQUFlLENBQzNCLE1BQWMsRUFDZCxVQUFzRjtRQUV0RixNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsVUFBVSxDQUFDLGNBQWMsRUFBRSxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdEcsSUFBSSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN4RSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ25CLE1BQU0sVUFBVSxHQUFHLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUNwQyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDeEcsTUFBTSxPQUFPLEdBQUcsTUFBTSxNQUFNLENBQUMsS0FBSyxDQUFDO1lBQ25DLElBQUksTUFBTSxDQUFDLFFBQVEsR0FBRyxVQUFVLElBQUksT0FBTyxDQUFDLHFCQUFxQixLQUFLLElBQUksRUFBRSxDQUFDO2dCQUMzRSxNQUFNLElBQUksbUJBQW1CLENBQUMsdUJBQXVCLENBQUMsQ0FBQztZQUN6RCxDQUFDO1lBQ0QsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDdEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sSUFBSSxLQUFLLEtBQUssU0FBUyxDQUFDO1FBQ3BELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLE1BQU0sS0FBSyxHQUErQjtZQUN4QyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFVBQVU7WUFDdkMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsb0JBQW9CLENBQUMsQ0FBQyxDQUFDLHVCQUF1QixFQUFFLENBQUM7WUFDcEcsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLO1lBQ25CLGNBQWMsRUFBRSxNQUFNLENBQUMsU0FBUztZQUNoQyxVQUFVLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRTtZQUN2QixTQUFTLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDO1lBQzdFLDREQUE0RDtZQUM1RCxRQUFRLEVBQUUsQ0FBQyxNQUFNLElBQUksUUFBUSxFQUFFLE9BQU8sS0FBSyxVQUFVLElBQUksUUFBUSxDQUFDLFFBQVE7U0FDM0UsQ0FBQztRQUNGLElBQUksTUFBTSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDMUMsc0VBQXNFO1lBQ3RFLHlEQUF5RDtZQUN6RCxLQUFLLENBQUMsU0FBUyxHQUFHLENBQUMsQ0FBQztZQUNwQixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCw0RUFBNEU7UUFDNUUsaUVBQWlFO1FBQ2pFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNCLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUMvQixJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDYixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFTyxLQUFLLENBQUMsVUFBVSxDQUN0QixRQUF3QixFQUN4QixpQkFBeUI7UUFFekIsSUFBSSxDQUFDO1lBQ0gsT0FBTyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsc0JBQXNCLENBQUM7Z0JBQ2pELFdBQVcsRUFBRSxRQUFRLENBQUMsV0FBVztnQkFDakMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO2dCQUN6QixjQUFjLEVBQUUsaUJBQWlCO2FBQ2xDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksNkJBQTZCLEVBQUUsQ0FBQztnQkFDbkQsTUFBTSxJQUFJLG1CQUFtQixDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLGFBQWEsQ0FBQyxZQUFvQixFQUFFLGNBQXNCLEVBQUUsV0FBbUI7UUFDckYsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDckQsSUFBSSxJQUFJLElBQUksR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLEdBQUcsb0NBQW9DLEVBQUUsQ0FBQztZQUN4RSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxLQUFLLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLElBQUksSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDeEQsSUFBSSxHQUFHLEdBQUcsTUFBTSxDQUFDLFNBQVMsSUFBSSxvQ0FBb0MsRUFBRSxDQUFDO2dCQUNuRSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzFDLENBQUM7UUFDSCxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQW1CO1lBQzdCLFNBQVMsRUFBRSxHQUFHO1lBQ2QsUUFBUSxFQUFFLEVBQUUsSUFBSSxDQUFDLFNBQVM7WUFDMUIsS0FBSyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsWUFBWSxFQUFFLGNBQWMsRUFBRSxFQUFFLG1CQUFtQixFQUFFLFdBQVcsRUFBRSxDQUFDO1NBQzFHLENBQUM7UUFDRixJQUFJLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNoRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsc0VBQXNFO0lBQzlELEtBQUs7UUFDWCxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN6QyxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3ZDLElBQUksS0FBSyxDQUFDLFNBQVMsSUFBSSxHQUFHLEVBQUUsQ0FBQztnQkFDM0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDMUIsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN6QyxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxDQUFDLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7UUFDdEUsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDckMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDL0IsTUFBTTtZQUNSLENBQUM7WUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/classes.errors.d.ts

@@ -1,5 +1,15 @@
 import type { TLoginCallbackStage } from './interfaces.js';
-export type TRelyingPartyErrorCode = 'login_method_unavailable' | 'invalid_login_callback' | 'missing_login_intent' | 'invalid_or_replayed_login' | 'invalid_login_finalize';
+export type TRelyingPartyErrorCode = 'login_method_unavailable' | 'invalid_login_callback' | 'missing_login_intent' | 'invalid_or_replayed_login' | 'invalid_login_finalize'
+/** a bearer login start the relying party cannot accept: a missing or malformed parameter */
+ | 'invalid_bearer_request'
+/** a bearer client named a return target that is not configured for its kind, exactly */
+ | 'return_target_not_allowed'
+/** a hand-off code that is unknown, expired, already claimed, or claimed with the wrong verifier */
+ | 'invalid_bearer_handoff'
+/** a refresh token that is unknown, rotated, expired, or of a session that is over */
+ | 'invalid_bearer_grant'
+/** a `sessionsOfPrincipal` cursor that no page of it answered */
+ | 'invalid_sessions_cursor';
 /** A request the login flow refuses; the code is safe to answer, the browser learns nothing more. */
 export declare class RelyingPartyError extends Error {
     readonly code: TRelyingPartyErrorCode;

package/dist_ts_relyingparty/classes.errors.js

@@ -4,6 +4,11 @@ const RELYING_PARTY_ERROR_STATUS = {
     missing_login_intent: 400,
     invalid_or_replayed_login: 400,
     invalid_login_finalize: 400,
+    invalid_bearer_request: 400,
+    return_target_not_allowed: 400,
+    invalid_bearer_handoff: 400,
+    invalid_bearer_grant: 400,
+    invalid_sessions_cursor: 400,
 };
 /** A request the login flow refuses; the code is safe to answer, the browser learns nothing more. */
 export class RelyingPartyError extends Error {
@@ -66,4 +71,4 @@ export class RelyingPartyDatabaseUnavailableError extends Error {
         this.name = 'RelyingPartyDatabaseUnavailableError';
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5lcnJvcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBU0EsTUFBTSwwQkFBMEIsR0FBcUQ7SUFDbkYsd0JBQXdCLEVBQUUsR0FBRztJQUM3QixzQkFBc0IsRUFBRSxHQUFHO0lBQzNCLG9CQUFvQixFQUFFLEdBQUc7SUFDekIseUJBQXlCLEVBQUUsR0FBRztJQUM5QixzQkFBc0IsRUFBRSxHQUFHO0NBQzVCLENBQUM7QUFFRixxR0FBcUc7QUFDckcsTUFBTSxPQUFPLGlCQUFrQixTQUFRLEtBQUs7SUFHZCxJQUFJO0lBRmhCLE1BQU0sQ0FBUztJQUUvQixZQUE0QixJQUE0QjtRQUN0RCxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7b0JBRGMsSUFBSTtRQUU5QixJQUFJLENBQUMsSUFBSSxHQUFHLG1CQUFtQixDQUFDO1FBQ2hDLElBQUksQ0FBQyxNQUFNLEdBQUcsMEJBQTBCLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDakQsQ0FBQztDQUNGO0FBRUQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxPQUFPLG1CQUFvQixTQUFRLEtBQUs7SUFJMUIsSUFBSTtJQUNKLE1BQU07SUFKUixRQUFRLENBQVU7SUFFbEMsWUFDa0IsSUFBWSxFQUNaLE1BQWMsRUFDOUIsVUFBVSxHQUEwQixFQUFFO1FBRXRDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFKSSxJQUFJO3NCQUNKLE1BQU07UUFJdEIsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztRQUNsQyxJQUFJLFVBQVUsQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDdEMsSUFBSSxDQUFDLFFBQVEsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3RDLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFFRCxxR0FBcUc7QUFDckcsTUFBTSxPQUFPLGtCQUFtQixTQUFRLEtBQUs7SUFFekIsS0FBSztJQUR2QixZQUNrQixLQUEwQixFQUMxQyxRQUFpQjtRQUVqQixLQUFLLENBQUMsMkNBQTJDLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztxQkFIeEQsS0FBSztRQUlyQixJQUFJLENBQUMsSUFBSSxHQUFHLG9CQUFvQixDQUFDO0lBQ25DLENBQUM7Q0FDRjtBQVFELE1BQU0sT0FBTyxtQkFBb0IsU0FBUSxLQUFLO0lBR2hCLElBQUk7SUFGaEIsTUFBTSxDQUFTO0lBRS9CLFlBQTRCLElBQThCLEVBQUUsUUFBa0I7UUFDNUUsS0FBSyxDQUFDLElBQUksRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO29CQURQLElBQUk7UUFFOUIsSUFBSSxDQUFDLElBQUksR0FBRyxxQkFBcUIsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksS0FBSywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7SUFDaEUsQ0FBQztDQUNGO0FBRUQsZ0ZBQWdGO0FBQ2hGLE1BQU0sT0FBTyxvQ0FBcUMsU0FBUSxLQUFLO0lBQzdELFlBQVksUUFBa0I7UUFDNUIsS0FBSyxDQUFDLGlFQUFpRSxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDOUYsSUFBSSxDQUFDLElBQUksR0FBRyxzQ0FBc0MsQ0FBQztJQUNyRCxDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5lcnJvcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5lcnJvcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBbUJBLE1BQU0sMEJBQTBCLEdBQXFEO0lBQ25GLHdCQUF3QixFQUFFLEdBQUc7SUFDN0Isc0JBQXNCLEVBQUUsR0FBRztJQUMzQixvQkFBb0IsRUFBRSxHQUFHO0lBQ3pCLHlCQUF5QixFQUFFLEdBQUc7SUFDOUIsc0JBQXNCLEVBQUUsR0FBRztJQUMzQixzQkFBc0IsRUFBRSxHQUFHO0lBQzNCLHlCQUF5QixFQUFFLEdBQUc7SUFDOUIsc0JBQXNCLEVBQUUsR0FBRztJQUMzQixvQkFBb0IsRUFBRSxHQUFHO0lBQ3pCLHVCQUF1QixFQUFFLEdBQUc7Q0FDN0IsQ0FBQztBQUVGLHFHQUFxRztBQUNyRyxNQUFNLE9BQU8saUJBQWtCLFNBQVEsS0FBSztJQUdkLElBQUk7SUFGaEIsTUFBTSxDQUFTO0lBRS9CLFlBQTRCLElBQTRCO1FBQ3RELEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFEYyxJQUFJO1FBRTlCLElBQUksQ0FBQyxJQUFJLEdBQUcsbUJBQW1CLENBQUM7UUFDaEMsSUFBSSxDQUFDLE1BQU0sR0FBRywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRCxDQUFDO0NBQ0Y7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLE9BQU8sbUJBQW9CLFNBQVEsS0FBSztJQUkxQixJQUFJO0lBQ0osTUFBTTtJQUpSLFFBQVEsQ0FBVTtJQUVsQyxZQUNrQixJQUFZLEVBQ1osTUFBYyxFQUM5QixVQUFVLEdBQTBCLEVBQUU7UUFFdEMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO29CQUpJLElBQUk7c0JBQ0osTUFBTTtRQUl0QixJQUFJLENBQUMsSUFBSSxHQUFHLHFCQUFxQixDQUFDO1FBQ2xDLElBQUksVUFBVSxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0QyxJQUFJLENBQUMsUUFBUSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUM7UUFDdEMsQ0FBQztJQUNILENBQUM7Q0FDRjtBQUVELHFHQUFxRztBQUNyRyxNQUFNLE9BQU8sa0JBQW1CLFNBQVEsS0FBSztJQUV6QixLQUFLO0lBRHZCLFlBQ2tCLEtBQTBCLEVBQzFDLFFBQWlCO1FBRWpCLEtBQUssQ0FBQywyQ0FBMkMsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO3FCQUh4RCxLQUFLO1FBSXJCLElBQUksQ0FBQyxJQUFJLEdBQUcsb0JBQW9CLENBQUM7SUFDbkMsQ0FBQztDQUNGO0FBUUQsTUFBTSxPQUFPLG1CQUFvQixTQUFRLEtBQUs7SUFHaEIsSUFBSTtJQUZoQixNQUFNLENBQVM7SUFFL0IsWUFBNEIsSUFBOEIsRUFBRSxRQUFrQjtRQUM1RSxLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7b0JBRFAsSUFBSTtRQUU5QixJQUFJLENBQUMsSUFBSSxHQUFHLHFCQUFxQixDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxLQUFLLDBCQUEwQixDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztJQUNoRSxDQUFDO0NBQ0Y7QUFFRCxnRkFBZ0Y7QUFDaEYsTUFBTSxPQUFPLG9DQUFxQyxTQUFRLEtBQUs7SUFDN0QsWUFBWSxRQUFrQjtRQUM1QixLQUFLLENBQUMsaUVBQWlFLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUM5RixJQUFJLENBQUMsSUFBSSxHQUFHLHNDQUFzQyxDQUFDO0lBQ3JELENBQUM7Q0FDRiJ9

package/dist_ts_relyingparty/classes.relyingpartyroutes.d.ts

@@ -40,7 +40,7 @@ export interface IRelyingPartyRoutesOptions<TPrincipal extends object | undefine
         session: IRelyingPartySession;
         endedLiveSession: boolean;
     }): Promise<void>;
-    /** the largest logout body read, in bytes; a longer one is cancelled as soon as it passes the limit */
+    /** the largest logout, claim or refresh body read, in bytes; a longer one is cancelled as soon as it passes the limit */
     maxBodyBytes?: number;
     /**
      * diagnostics of a failed start or callback; the default writes one JSON
@@ -49,6 +49,10 @@ export interface IRelyingPartyRoutesOptions<TPrincipal extends object | undefine
      */
     onRouteEvent?(eventArg: {
         event: 'auth_login_start_failed' | 'auth_callback_failed' | 'auth_callback_declined' | 'auth_callback_refused'
+        /** a bearer login start named something the relying party does not accept; `code` says what */
+         | 'auth_bearer_start_refused'
+        /** a bearer claim, refresh, session or logout failed for a reason other than its credential */
+         | 'auth_bearer_failed'
         /** an application hook of the routes threw; the step it belonged to is complete */
          | 'hook_failed';
         hook?: 'onLogout';
@@ -72,6 +76,30 @@ export interface IRelyingPartyRoutesOptions<TPrincipal extends object | undefine
  * - `POST logout` ends the session; it needs this origin and the CSRF token,
  *   and `onLogout` runs before it answers
  *
+ * With bearer mode on (`RelyingPartySessions` `bearer`), the routes of the
+ * application's own clients join them; none of them reads or sets a cookie:
+ *
+ * - `GET bearer/login?client_kind=…&return_target=…&code_challenge=…&code_challenge_method=S256[&state=…]`
+ *   redirects to the provider
+ * - `GET callback` answers a bearer login's callback by delivering the
+ *   hand-off code — or the `error` — to the return target: a redirect with
+ *   `code` (or `error`) and `state` in the query, or for a popup a page that
+ *   posts them to its opener at the registered origin
+ * - `POST bearer/claim` `{ code, codeVerifier }` and `POST bearer/refresh`
+ *   `{ refreshToken }` answer the tokens
+ * - `GET bearer/session` answers the session of `Authorization: Bearer <access token>`
+ * - `POST bearer/logout` ends the session of the `Authorization` access token
+ *   or of the body's `{ refreshToken }`
+ *
+ * The four API routes answer CORS requests from the popup return targets'
+ * origins, exactly, and no others; they never allow credentials.
+ *
+ * In bearer-only mode (`RelyingPartySessions` `cookieSessions: false`) only
+ * the bearer routes and the callback answer, and no answer sets a cookie: a
+ * callback that is no bearer login fails without clearing an intent cookie
+ * that was never set, and `login`, `finalize`, `session` and `logout` answer
+ * `null`.
+ *
  * `handle()` answers `null` for every other request, so the application
  * chains its own routes (a local password login) around it. Cookies are only
  * ever set here: a `/typedrequest` answer cannot carry `Set-Cookie`.
@@ -79,13 +107,18 @@ export interface IRelyingPartyRoutesOptions<TPrincipal extends object | undefine
 export declare class RelyingPartyRoutes<TPrincipal extends object | undefined = undefined> {
     #private;
     constructor(optionsArg: IRelyingPartyRoutesOptions<TPrincipal>);
-    /** The paths the routes answer, for registering them one by one. */
+    /** The paths the routes answer, for registering them one by one; the `bearer…` paths answer only in bearer mode. */
     get paths(): {
         login: string;
         callback: string;
         finalize: string;
         session: string;
         logout: string;
+        bearerLogin: string;
+        bearerClaim: string;
+        bearerRefresh: string;
+        bearerSession: string;
+        bearerLogout: string;
     };
     readonly handle: (contextArg: IRelyingPartyHttpContext) => Promise<Response | null>;
     private login;
@@ -96,6 +129,45 @@ export declare class RelyingPartyRoutes<TPrincipal extends object | undefined =
      */
     private refusalLocationOf;
     private callback;
+    /**
+     * A callback of no bearer login in bearer-only mode: no attempt of this
+     * relying party can be completed with it, and no cookie is cleared because
+     * none was ever set.
+     */
+    private callbackOfNoBearerLogin;
+    /** A callback that failed for a reason other than a refusal: reported when it is the relying party's fault. */
+    private callbackFailure;
+    private callbackFailureStatus;
+    private handleBearer;
+    /**
+     * The CORS answer for a request from a popup return target's origin, which
+     * is matched exactly; `null` for every other origin, which gets none.
+     * Credentials are never allowed: bearer mode carries no cookie.
+     */
+    private bearerCorsHeaders;
+    private bearerLogin;
+    /**
+     * The callback of a bearer login, delivered to its return target whatever
+     * the outcome: the hand-off code, `access_denied` when the provider came
+     * back without one, the code of an application refusal (its `location` is
+     * a page of the cookie flow and not followed), or `authentication_failed`.
+     */
+    private bearerCallback;
+    /**
+     * A redirect to the return target with the outcome in its query, or for a
+     * popup the page that posts it to the opener. Neither sends a referrer, and
+     * the popup page runs its one nonce script and nothing else.
+     */
+    private deliverBearerOutcome;
+    /**
+     * Runs one bearer API step and answers its JSON. A refused credential
+     * answers its code with 400; an unreachable provider answers
+     * `authority_unavailable` with 503 and spends nothing; any other failure is
+     * reported and answers `authentication_unavailable`.
+     */
+    private bearerApi;
+    private bearerTokenAnswer;
+    private bearerSessionAnswer;
     private logout;
     private sessionAnswer;
     /**