@idp.global/sdk 19.2.1 → 19.4.0

package/dist_ts_relyingparty/classes.rpmodels.d.ts

@@ -1,9 +1,11 @@
 import * as plugins from './plugins.js';
+import type { TRelyingPartyBearerClientKind } from './interfaces.js';
 /**
- * One browser session of a relying party. The persisted field names, their
- * types and the index declarations are the ones nevermind.finance has stored
- * under `SessionDoc` since before this module existed, so its collection is
- * read and written unchanged.
+ * One browser session of a relying party. The persisted field names and their
+ * types are the ones nevermind.finance has stored under `SessionDoc` since
+ * before this module existed, so its collection is read and written
+ * unchanged; its indexes are those and the `expiresAt` index the sweep of
+ * ended sessions reads.
  */
 export declare class RelyingPartySessionDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartySessionDoc, RelyingPartySessionDoc> {
     id: string;
@@ -13,6 +15,7 @@ export declare class RelyingPartySessionDoc extends plugins.nosqldb.SmartDataDbD
     userId: string;
     createdAt: number;
     lastSeenAt: number;
+    /** a revocation lowers it to `revokedAt` when that is earlier, so the sweep finds every ended session by it */
     expiresAt: number;
     /** absent while the session is valid */
     revokedAt?: number;
@@ -33,7 +36,8 @@ export declare class RelyingPartySessionDoc extends plugins.nosqldb.SmartDataDbD
  * against, the binding to the browser that started it, the sealed PKCE
  * verifier and the return path. Consumed exactly once by a conditional update.
  * Field names and indexes are the ones nevermind.finance stores under
- * `LoginAttemptDoc`.
+ * `LoginAttemptDoc`; the `bearer…` fields exist only on the attempt of a
+ * bearer login, whose binding token is never issued.
  */
 export declare class RelyingPartyLoginAttemptDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyLoginAttemptDoc, RelyingPartyLoginAttemptDoc> {
     id: string;
@@ -53,10 +57,57 @@ export declare class RelyingPartyLoginAttemptDoc extends plugins.nosqldb.SmartDa
     consumedAt?: number | null;
     /** the session the callback created; finalize releases the return path against it */
     createdSessionId?: string | null;
+    /** how the bearer client of this login receives its outcome; absent on a cookie login */
+    bearerClientKind?: TRelyingPartyBearerClientKind;
+    /** the return target the bearer client named, exactly */
+    bearerReturnTarget?: string;
+    /** the bearer client's S256 code challenge; its hand-off is claimed with the matching verifier */
+    bearerCodeChallenge?: string;
+    /** the bearer client's own `state`, handed back with the outcome */
+    bearerClientState?: string;
+}
+/**
+ * The single-use code a bearer login hands its client. Only the hash of the
+ * code is stored; the code is bound to the client's S256 challenge, lives at
+ * most a minute and is consumed by one conditional update.
+ */
+export declare class RelyingPartyBearerHandoffDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyBearerHandoffDoc, RelyingPartyBearerHandoffDoc> {
+    id: string;
+    /** sha256 of the code */
+    codeHash: string;
+    /** the session the login opened; the code is its only way out */
+    sessionId: string;
+    codeChallenge: string;
+    createdAt: number;
+    /** at most a minute after the callback; the sweep ends the session of a code nobody claimed by then */
+    expiresAt: number;
+    /** `null` until a claim consumes the code */
+    consumedAt: number | null;
+}
+/**
+ * One generation of a bearer session's tokens: an access token and the
+ * refresh token that replaces both. Only hashes are stored. Exactly one
+ * generation of a session is current (`rotatedAt` `null`); a rotated one is
+ * kept until the session expires, so its refresh token coming back is
+ * recognized as reuse.
+ */
+export declare class RelyingPartyBearerTokenDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyBearerTokenDoc, RelyingPartyBearerTokenDoc> {
+    id: string;
+    accessTokenHash: string;
+    refreshTokenHash: string;
+    sessionId: string;
+    createdAt: number;
+    accessTokenExpiresAt: number;
+    /** the session's end; the refresh token never outlives it, and the sweep removes the generation after it */
+    expiresAt: number;
+    /** `null` while this generation is current; when its refresh token was spent otherwise */
+    rotatedAt: number | null;
 }
 export declare const RELYING_PARTY_DEFAULT_COLLECTION_NAMES: {
     readonly sessions: 'IdpRelyingPartySession';
     readonly loginAttempts: 'IdpRelyingPartyLoginAttempt';
+    readonly bearerHandoffs: 'IdpRelyingPartyBearerHandoff';
+    readonly bearerTokens: 'IdpRelyingPartyBearerToken';
 };
 export interface IRelyingPartyModelsOptions {
     /**
@@ -73,17 +124,29 @@ export interface IRelyingPartyModelsOptions {
     collectionNames?: {
         sessions?: string;
         loginAttempts?: string;
+        bearerHandoffs?: string;
+        bearerTokens?: string;
     };
 }
-export interface IRelyingPartyModels {
+/** The models bearer hand-off mode stores its codes and tokens in. */
+export interface IRelyingPartyBearerModels {
+    readonly BearerHandoff: typeof RelyingPartyBearerHandoffDoc;
+    readonly BearerToken: typeof RelyingPartyBearerTokenDoc;
+}
+/**
+ * The models of the session layer. The bearer models are needed only when
+ * `RelyingPartySessions` runs with `bearer`; `createRelyingPartyModels`
+ * always binds them.
+ */
+export interface IRelyingPartyModels extends Partial<IRelyingPartyBearerModels> {
     readonly Session: typeof RelyingPartySessionDoc;
     readonly LoginAttempt: typeof RelyingPartyLoginAttemptDoc;
 }
 /**
- * Binds the two relying-party models to one database. Each call declares its
+ * Binds the relying-party models to one database. Each call declares its
  * own model classes, so several databases — and several applications in one
  * process — never share a binding. A deferred `db` is resolved on every use,
  * the way `@Collection(() => db)` resolves it; a use before it answers a
  * `SmartdataDb` throws `RelyingPartyDatabaseUnavailableError`.
  */
-export declare const createRelyingPartyModels: (optionsArg: IRelyingPartyModelsOptions) => IRelyingPartyModels;
+export declare const createRelyingPartyModels: (optionsArg: IRelyingPartyModelsOptions) => IRelyingPartyModels & IRelyingPartyBearerModels;

package/dist_ts_relyingparty/classes.rpmodels.js

@@ -35,10 +35,11 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 import * as plugins from './plugins.js';
 import { RelyingPartyDatabaseUnavailableError } from './classes.errors.js';
 /**
- * One browser session of a relying party. The persisted field names, their
- * types and the index declarations are the ones nevermind.finance has stored
- * under `SessionDoc` since before this module existed, so its collection is
- * read and written unchanged.
+ * One browser session of a relying party. The persisted field names and their
+ * types are the ones nevermind.finance has stored under `SessionDoc` since
+ * before this module existed, so its collection is read and written
+ * unchanged; its indexes are those and the `expiresAt` index the sweep of
+ * ended sessions reads.
  */
 let RelyingPartySessionDoc = (() => {
     let _classSuper = plugins.nosqldb.SmartDataDbDoc;
@@ -89,7 +90,7 @@ let RelyingPartySessionDoc = (() => {
             _userId_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
             _createdAt_decorators = [plugins.nosqldb.svDb()];
             _lastSeenAt_decorators = [plugins.nosqldb.svDb()];
-            _expiresAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
             _revokedAt_decorators = [plugins.nosqldb.svDb()];
             _idpSubject_decorators = [plugins.nosqldb.svDb()];
             _loginAttemptId_decorators = [plugins.nosqldb.svDb()];
@@ -119,6 +120,7 @@ let RelyingPartySessionDoc = (() => {
         userId = (__runInitializers(this, _tokenHash_extraInitializers), __runInitializers(this, _userId_initializers, ''));
         createdAt = (__runInitializers(this, _userId_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
         lastSeenAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _lastSeenAt_initializers, 0));
+        /** a revocation lowers it to `revokedAt` when that is earlier, so the sweep finds every ended session by it */
         expiresAt = (__runInitializers(this, _lastSeenAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
         /** absent while the session is valid */
         revokedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _revokedAt_initializers, void 0));
@@ -145,7 +147,8 @@ export { RelyingPartySessionDoc };
  * against, the binding to the browser that started it, the sealed PKCE
  * verifier and the return path. Consumed exactly once by a conditional update.
  * Field names and indexes are the ones nevermind.finance stores under
- * `LoginAttemptDoc`.
+ * `LoginAttemptDoc`; the `bearer…` fields exist only on the attempt of a
+ * bearer login, whose binding token is never issued.
  */
 let RelyingPartyLoginAttemptDoc = (() => {
     let _classSuper = plugins.nosqldb.SmartDataDbDoc;
@@ -182,6 +185,18 @@ let RelyingPartyLoginAttemptDoc = (() => {
     let _createdSessionId_decorators;
     let _createdSessionId_initializers = [];
     let _createdSessionId_extraInitializers = [];
+    let _bearerClientKind_decorators;
+    let _bearerClientKind_initializers = [];
+    let _bearerClientKind_extraInitializers = [];
+    let _bearerReturnTarget_decorators;
+    let _bearerReturnTarget_initializers = [];
+    let _bearerReturnTarget_extraInitializers = [];
+    let _bearerCodeChallenge_decorators;
+    let _bearerCodeChallenge_initializers = [];
+    let _bearerCodeChallenge_extraInitializers = [];
+    let _bearerClientState_decorators;
+    let _bearerClientState_initializers = [];
+    let _bearerClientState_extraInitializers = [];
     return class RelyingPartyLoginAttemptDoc extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
@@ -196,6 +211,10 @@ let RelyingPartyLoginAttemptDoc = (() => {
             _expiresAt_decorators = [plugins.nosqldb.svDb()];
             _consumedAt_decorators = [plugins.nosqldb.svDb()];
             _createdSessionId_decorators = [plugins.nosqldb.svDb()];
+            _bearerClientKind_decorators = [plugins.nosqldb.svDb()];
+            _bearerReturnTarget_decorators = [plugins.nosqldb.svDb()];
+            _bearerCodeChallenge_decorators = [plugins.nosqldb.svDb()];
+            _bearerClientState_decorators = [plugins.nosqldb.svDb()];
             __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
             __esDecorate(null, null, _stateHash_decorators, { kind: "field", name: "stateHash", static: false, private: false, access: { has: obj => "stateHash" in obj, get: obj => obj.stateHash, set: (obj, value) => { obj.stateHash = value; } }, metadata: _metadata }, _stateHash_initializers, _stateHash_extraInitializers);
             __esDecorate(null, null, _bindingTokenHash_decorators, { kind: "field", name: "bindingTokenHash", static: false, private: false, access: { has: obj => "bindingTokenHash" in obj, get: obj => obj.bindingTokenHash, set: (obj, value) => { obj.bindingTokenHash = value; } }, metadata: _metadata }, _bindingTokenHash_initializers, _bindingTokenHash_extraInitializers);
@@ -207,6 +226,10 @@ let RelyingPartyLoginAttemptDoc = (() => {
             __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
             __esDecorate(null, null, _consumedAt_decorators, { kind: "field", name: "consumedAt", static: false, private: false, access: { has: obj => "consumedAt" in obj, get: obj => obj.consumedAt, set: (obj, value) => { obj.consumedAt = value; } }, metadata: _metadata }, _consumedAt_initializers, _consumedAt_extraInitializers);
             __esDecorate(null, null, _createdSessionId_decorators, { kind: "field", name: "createdSessionId", static: false, private: false, access: { has: obj => "createdSessionId" in obj, get: obj => obj.createdSessionId, set: (obj, value) => { obj.createdSessionId = value; } }, metadata: _metadata }, _createdSessionId_initializers, _createdSessionId_extraInitializers);
+            __esDecorate(null, null, _bearerClientKind_decorators, { kind: "field", name: "bearerClientKind", static: false, private: false, access: { has: obj => "bearerClientKind" in obj, get: obj => obj.bearerClientKind, set: (obj, value) => { obj.bearerClientKind = value; } }, metadata: _metadata }, _bearerClientKind_initializers, _bearerClientKind_extraInitializers);
+            __esDecorate(null, null, _bearerReturnTarget_decorators, { kind: "field", name: "bearerReturnTarget", static: false, private: false, access: { has: obj => "bearerReturnTarget" in obj, get: obj => obj.bearerReturnTarget, set: (obj, value) => { obj.bearerReturnTarget = value; } }, metadata: _metadata }, _bearerReturnTarget_initializers, _bearerReturnTarget_extraInitializers);
+            __esDecorate(null, null, _bearerCodeChallenge_decorators, { kind: "field", name: "bearerCodeChallenge", static: false, private: false, access: { has: obj => "bearerCodeChallenge" in obj, get: obj => obj.bearerCodeChallenge, set: (obj, value) => { obj.bearerCodeChallenge = value; } }, metadata: _metadata }, _bearerCodeChallenge_initializers, _bearerCodeChallenge_extraInitializers);
+            __esDecorate(null, null, _bearerClientState_decorators, { kind: "field", name: "bearerClientState", static: false, private: false, access: { has: obj => "bearerClientState" in obj, get: obj => obj.bearerClientState, set: (obj, value) => { obj.bearerClientState = value; } }, metadata: _metadata }, _bearerClientState_initializers, _bearerClientState_extraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         id = __runInitializers(this, _id_initializers, '');
@@ -226,19 +249,165 @@ let RelyingPartyLoginAttemptDoc = (() => {
         consumedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _consumedAt_initializers, void 0));
         /** the session the callback created; finalize releases the return path against it */
         createdSessionId = (__runInitializers(this, _consumedAt_extraInitializers), __runInitializers(this, _createdSessionId_initializers, void 0));
+        /** how the bearer client of this login receives its outcome; absent on a cookie login */
+        bearerClientKind = (__runInitializers(this, _createdSessionId_extraInitializers), __runInitializers(this, _bearerClientKind_initializers, void 0));
+        /** the return target the bearer client named, exactly */
+        bearerReturnTarget = (__runInitializers(this, _bearerClientKind_extraInitializers), __runInitializers(this, _bearerReturnTarget_initializers, void 0));
+        /** the bearer client's S256 code challenge; its hand-off is claimed with the matching verifier */
+        bearerCodeChallenge = (__runInitializers(this, _bearerReturnTarget_extraInitializers), __runInitializers(this, _bearerCodeChallenge_initializers, void 0));
+        /** the bearer client's own `state`, handed back with the outcome */
+        bearerClientState = (__runInitializers(this, _bearerCodeChallenge_extraInitializers), __runInitializers(this, _bearerClientState_initializers, void 0));
         constructor() {
             super(...arguments);
-            __runInitializers(this, _createdSessionId_extraInitializers);
+            __runInitializers(this, _bearerClientState_extraInitializers);
         }
     };
 })();
 export { RelyingPartyLoginAttemptDoc };
+/**
+ * The single-use code a bearer login hands its client. Only the hash of the
+ * code is stored; the code is bound to the client's S256 challenge, lives at
+ * most a minute and is consumed by one conditional update.
+ */
+let RelyingPartyBearerHandoffDoc = (() => {
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
+    let _id_decorators;
+    let _id_initializers = [];
+    let _id_extraInitializers = [];
+    let _codeHash_decorators;
+    let _codeHash_initializers = [];
+    let _codeHash_extraInitializers = [];
+    let _sessionId_decorators;
+    let _sessionId_initializers = [];
+    let _sessionId_extraInitializers = [];
+    let _codeChallenge_decorators;
+    let _codeChallenge_initializers = [];
+    let _codeChallenge_extraInitializers = [];
+    let _createdAt_decorators;
+    let _createdAt_initializers = [];
+    let _createdAt_extraInitializers = [];
+    let _expiresAt_decorators;
+    let _expiresAt_initializers = [];
+    let _expiresAt_extraInitializers = [];
+    let _consumedAt_decorators;
+    let _consumedAt_initializers = [];
+    let _consumedAt_extraInitializers = [];
+    return class RelyingPartyBearerHandoffDoc extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _id_decorators = [plugins.nosqldb.unI()];
+            _codeHash_decorators = [plugins.nosqldb.unI()];
+            _sessionId_decorators = [plugins.nosqldb.svDb()];
+            _codeChallenge_decorators = [plugins.nosqldb.svDb()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
+            _consumedAt_decorators = [plugins.nosqldb.svDb()];
+            __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
+            __esDecorate(null, null, _codeHash_decorators, { kind: "field", name: "codeHash", static: false, private: false, access: { has: obj => "codeHash" in obj, get: obj => obj.codeHash, set: (obj, value) => { obj.codeHash = value; } }, metadata: _metadata }, _codeHash_initializers, _codeHash_extraInitializers);
+            __esDecorate(null, null, _sessionId_decorators, { kind: "field", name: "sessionId", static: false, private: false, access: { has: obj => "sessionId" in obj, get: obj => obj.sessionId, set: (obj, value) => { obj.sessionId = value; } }, metadata: _metadata }, _sessionId_initializers, _sessionId_extraInitializers);
+            __esDecorate(null, null, _codeChallenge_decorators, { kind: "field", name: "codeChallenge", static: false, private: false, access: { has: obj => "codeChallenge" in obj, get: obj => obj.codeChallenge, set: (obj, value) => { obj.codeChallenge = value; } }, metadata: _metadata }, _codeChallenge_initializers, _codeChallenge_extraInitializers);
+            __esDecorate(null, null, _createdAt_decorators, { kind: "field", name: "createdAt", static: false, private: false, access: { has: obj => "createdAt" in obj, get: obj => obj.createdAt, set: (obj, value) => { obj.createdAt = value; } }, metadata: _metadata }, _createdAt_initializers, _createdAt_extraInitializers);
+            __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
+            __esDecorate(null, null, _consumedAt_decorators, { kind: "field", name: "consumedAt", static: false, private: false, access: { has: obj => "consumedAt" in obj, get: obj => obj.consumedAt, set: (obj, value) => { obj.consumedAt = value; } }, metadata: _metadata }, _consumedAt_initializers, _consumedAt_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        id = __runInitializers(this, _id_initializers, '');
+        /** sha256 of the code */
+        codeHash = (__runInitializers(this, _id_extraInitializers), __runInitializers(this, _codeHash_initializers, ''));
+        /** the session the login opened; the code is its only way out */
+        sessionId = (__runInitializers(this, _codeHash_extraInitializers), __runInitializers(this, _sessionId_initializers, ''));
+        codeChallenge = (__runInitializers(this, _sessionId_extraInitializers), __runInitializers(this, _codeChallenge_initializers, ''));
+        createdAt = (__runInitializers(this, _codeChallenge_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
+        /** at most a minute after the callback; the sweep ends the session of a code nobody claimed by then */
+        expiresAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
+        /** `null` until a claim consumes the code */
+        consumedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _consumedAt_initializers, null));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _consumedAt_extraInitializers);
+        }
+    };
+})();
+export { RelyingPartyBearerHandoffDoc };
+/**
+ * One generation of a bearer session's tokens: an access token and the
+ * refresh token that replaces both. Only hashes are stored. Exactly one
+ * generation of a session is current (`rotatedAt` `null`); a rotated one is
+ * kept until the session expires, so its refresh token coming back is
+ * recognized as reuse.
+ */
+let RelyingPartyBearerTokenDoc = (() => {
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
+    let _id_decorators;
+    let _id_initializers = [];
+    let _id_extraInitializers = [];
+    let _accessTokenHash_decorators;
+    let _accessTokenHash_initializers = [];
+    let _accessTokenHash_extraInitializers = [];
+    let _refreshTokenHash_decorators;
+    let _refreshTokenHash_initializers = [];
+    let _refreshTokenHash_extraInitializers = [];
+    let _sessionId_decorators;
+    let _sessionId_initializers = [];
+    let _sessionId_extraInitializers = [];
+    let _createdAt_decorators;
+    let _createdAt_initializers = [];
+    let _createdAt_extraInitializers = [];
+    let _accessTokenExpiresAt_decorators;
+    let _accessTokenExpiresAt_initializers = [];
+    let _accessTokenExpiresAt_extraInitializers = [];
+    let _expiresAt_decorators;
+    let _expiresAt_initializers = [];
+    let _expiresAt_extraInitializers = [];
+    let _rotatedAt_decorators;
+    let _rotatedAt_initializers = [];
+    let _rotatedAt_extraInitializers = [];
+    return class RelyingPartyBearerTokenDoc extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _id_decorators = [plugins.nosqldb.unI()];
+            _accessTokenHash_decorators = [plugins.nosqldb.unI()];
+            _refreshTokenHash_decorators = [plugins.nosqldb.unI()];
+            _sessionId_decorators = [plugins.nosqldb.svDb()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _accessTokenExpiresAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
+            _rotatedAt_decorators = [plugins.nosqldb.svDb()];
+            __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
+            __esDecorate(null, null, _accessTokenHash_decorators, { kind: "field", name: "accessTokenHash", static: false, private: false, access: { has: obj => "accessTokenHash" in obj, get: obj => obj.accessTokenHash, set: (obj, value) => { obj.accessTokenHash = value; } }, metadata: _metadata }, _accessTokenHash_initializers, _accessTokenHash_extraInitializers);
+            __esDecorate(null, null, _refreshTokenHash_decorators, { kind: "field", name: "refreshTokenHash", static: false, private: false, access: { has: obj => "refreshTokenHash" in obj, get: obj => obj.refreshTokenHash, set: (obj, value) => { obj.refreshTokenHash = value; } }, metadata: _metadata }, _refreshTokenHash_initializers, _refreshTokenHash_extraInitializers);
+            __esDecorate(null, null, _sessionId_decorators, { kind: "field", name: "sessionId", static: false, private: false, access: { has: obj => "sessionId" in obj, get: obj => obj.sessionId, set: (obj, value) => { obj.sessionId = value; } }, metadata: _metadata }, _sessionId_initializers, _sessionId_extraInitializers);
+            __esDecorate(null, null, _createdAt_decorators, { kind: "field", name: "createdAt", static: false, private: false, access: { has: obj => "createdAt" in obj, get: obj => obj.createdAt, set: (obj, value) => { obj.createdAt = value; } }, metadata: _metadata }, _createdAt_initializers, _createdAt_extraInitializers);
+            __esDecorate(null, null, _accessTokenExpiresAt_decorators, { kind: "field", name: "accessTokenExpiresAt", static: false, private: false, access: { has: obj => "accessTokenExpiresAt" in obj, get: obj => obj.accessTokenExpiresAt, set: (obj, value) => { obj.accessTokenExpiresAt = value; } }, metadata: _metadata }, _accessTokenExpiresAt_initializers, _accessTokenExpiresAt_extraInitializers);
+            __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
+            __esDecorate(null, null, _rotatedAt_decorators, { kind: "field", name: "rotatedAt", static: false, private: false, access: { has: obj => "rotatedAt" in obj, get: obj => obj.rotatedAt, set: (obj, value) => { obj.rotatedAt = value; } }, metadata: _metadata }, _rotatedAt_initializers, _rotatedAt_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        id = __runInitializers(this, _id_initializers, '');
+        accessTokenHash = (__runInitializers(this, _id_extraInitializers), __runInitializers(this, _accessTokenHash_initializers, ''));
+        refreshTokenHash = (__runInitializers(this, _accessTokenHash_extraInitializers), __runInitializers(this, _refreshTokenHash_initializers, ''));
+        sessionId = (__runInitializers(this, _refreshTokenHash_extraInitializers), __runInitializers(this, _sessionId_initializers, ''));
+        createdAt = (__runInitializers(this, _sessionId_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
+        accessTokenExpiresAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _accessTokenExpiresAt_initializers, 0));
+        /** the session's end; the refresh token never outlives it, and the sweep removes the generation after it */
+        expiresAt = (__runInitializers(this, _accessTokenExpiresAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
+        /** `null` while this generation is current; when its refresh token was spent otherwise */
+        rotatedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _rotatedAt_initializers, null));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _rotatedAt_extraInitializers);
+        }
+    };
+})();
+export { RelyingPartyBearerTokenDoc };
 export const RELYING_PARTY_DEFAULT_COLLECTION_NAMES = {
     sessions: 'IdpRelyingPartySession',
     loginAttempts: 'IdpRelyingPartyLoginAttempt',
+    bearerHandoffs: 'IdpRelyingPartyBearerHandoff',
+    bearerTokens: 'IdpRelyingPartyBearerToken',
 };
 /**
- * Binds the two relying-party models to one database. Each call declares its
+ * Binds the relying-party models to one database. Each call declares its
  * own model classes, so several databases — and several applications in one
  * process — never share a binding. A deferred `db` is resolved on every use,
  * the way `@Collection(() => db)` resolves it; a use before it answers a
@@ -268,6 +437,10 @@ export const createRelyingPartyModels = (optionsArg) => {
     const sessions = optionsArg.collectionNames?.sessions ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.sessions;
     const loginAttempts = optionsArg.collectionNames?.loginAttempts
         ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.loginAttempts;
+    const bearerHandoffs = optionsArg.collectionNames?.bearerHandoffs
+        ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.bearerHandoffs;
+    const bearerTokens = optionsArg.collectionNames?.bearerTokens
+        ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.bearerTokens;
     let BoundSessionDoc = (() => {
         let _classDecorators = [plugins.nosqldb.Collection(resolveDb, { collectionName: sessions })];
         let _classDescriptor;
@@ -304,6 +477,47 @@ export const createRelyingPartyModels = (optionsArg) => {
         };
         return BoundLoginAttemptDoc = _classThis;
     })();
-    return { Session: BoundSessionDoc, LoginAttempt: BoundLoginAttemptDoc };
+    let BoundBearerHandoffDoc = (() => {
+        let _classDecorators = [plugins.nosqldb.Collection(resolveDb, { collectionName: bearerHandoffs })];
+        let _classDescriptor;
+        let _classExtraInitializers = [];
+        let _classThis;
+        let _classSuper = RelyingPartyBearerHandoffDoc;
+        var BoundBearerHandoffDoc = class extends _classSuper {
+            static { _classThis = this; }
+            static {
+                const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+                __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+                BoundBearerHandoffDoc = _classThis = _classDescriptor.value;
+                if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+                __runInitializers(_classThis, _classExtraInitializers);
+            }
+        };
+        return BoundBearerHandoffDoc = _classThis;
+    })();
+    let BoundBearerTokenDoc = (() => {
+        let _classDecorators = [plugins.nosqldb.Collection(resolveDb, { collectionName: bearerTokens })];
+        let _classDescriptor;
+        let _classExtraInitializers = [];
+        let _classThis;
+        let _classSuper = RelyingPartyBearerTokenDoc;
+        var BoundBearerTokenDoc = class extends _classSuper {
+            static { _classThis = this; }
+            static {
+                const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+                __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+                BoundBearerTokenDoc = _classThis = _classDescriptor.value;
+                if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+                __runInitializers(_classThis, _classExtraInitializers);
+            }
+        };
+        return BoundBearerTokenDoc = _classThis;
+    })();
+    return {
+        Session: BoundSessionDoc,
+        LoginAttempt: BoundLoginAttemptDoc,
+        BearerHandoff: BoundBearerHandoffDoc,
+        BearerToken: BoundBearerTokenDoc,
+    };
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ycG1vZGVscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLnJwbW9kZWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsb0NBQW9DLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUzRTs7Ozs7R0FLRztJQUNVLHNCQUFzQjtzQkFBUyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBQTdELHNCQUF1QixTQUFRLFdBQThFOzs7OEJBQ3ZILE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO3FDQUlyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtrQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7cUNBR3ZCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTswQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NkNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzhDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtnREFJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBNUN2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFJdkIsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFjO1lBSzlCLG9LQUFPLE1BQU0sNkJBQU4sTUFBTSx1RkFBYztZQUczQiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFHN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFhO1lBRzlCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFJMUIsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFVO1lBSTNCLDRMQUFPLGNBQWMsNkJBQWQsY0FBYyx1R0FBVTtZQUkvQixxTUFBTyxpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBVTtZQUdsQyx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBVTtZQUluQyw4TUFBTyxvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBVTtZQUlyQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBVTs7O1FBN0MxQixFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2QixtRUFBbUU7UUFFNUQsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsOERBQThEO1FBR3ZELE1BQU0seUdBQVcsRUFBRSxHQUFDO1FBR3BCLFNBQVMseUdBQVcsQ0FBQyxHQUFDO1FBR3RCLFVBQVUsNkdBQVcsQ0FBQyxHQUFDO1FBR3ZCLFNBQVMsNkdBQVcsQ0FBQyxHQUFDO1FBRTdCLHdDQUF3QztRQUVqQyxTQUFTLHFIQUFVO1FBRTFCLG1HQUFtRztRQUU1RixVQUFVLHNIQUFVO1FBRTNCLHNFQUFzRTtRQUUvRCxjQUFjLDJIQUFVO1FBRS9CLG1GQUFtRjtRQUU1RSxpQkFBaUIsa0lBQVU7UUFHM0Isa0JBQWtCLHNJQUFVO1FBRW5DLHFHQUFxRztRQUU5RixvQkFBb0IseUlBQVU7UUFFckMsaUdBQWlHO1FBRTFGLGdCQUFnQix1SUFBVTs7Ozs7OztTQS9DdEIsc0JBQXNCO0FBa0RuQzs7Ozs7O0dBTUc7SUFDVSwyQkFBMkI7c0JBQVMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O2lCQUFsRSwyQkFBNEIsU0FBUSxXQUF3Rjs7OzhCQUN0SSxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7NENBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzhDQUdyQixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtpQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7c0NBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3dDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTs0Q0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7WUFuQ3ZCLHdKQUFPLEVBQUUsNkJBQUYsRUFBRSwrRUFBYztZQUl2Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWM7WUFJOUIsa01BQU8sZ0JBQWdCLDZCQUFoQixnQkFBZ0IsMkdBQWM7WUFHckMsd01BQU8sa0JBQWtCLDZCQUFsQixrQkFBa0IsK0dBQWM7WUFHdkMsaUtBQU8sS0FBSyw2QkFBTCxLQUFLLHFGQUFjO1lBSTFCLGdMQUFPLFVBQVUsNkJBQVYsVUFBVSwrRkFBZTtZQUloQyxzTEFBTyxZQUFZLDZCQUFaLFlBQVksbUdBQVU7WUFHN0IsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBRzdCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3QixnTEFBTyxVQUFVLDZCQUFWLFVBQVUsK0ZBQWlCO1lBSWxDLGtNQUFPLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFpQjs7O1FBcENqQyxFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2Qiw0RUFBNEU7UUFFckUsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsMkZBQTJGO1FBRXBGLGdCQUFnQixtSEFBVyxFQUFFLEdBQUM7UUFHOUIsa0JBQWtCLDRIQUFXLEVBQUUsR0FBQztRQUdoQyxLQUFLLGlIQUFXLEVBQUUsR0FBQztRQUUxQiw4Q0FBOEM7UUFFdkMsVUFBVSx5R0FBVyxHQUFHLEdBQUM7UUFFaEMsaUlBQWlJO1FBRTFILFlBQVkseUhBQVU7UUFHdEIsU0FBUywrR0FBVyxDQUFDLEdBQUM7UUFHdEIsU0FBUyw0R0FBVyxDQUFDLEdBQUM7UUFFN0IsZ0dBQWdHO1FBRXpGLFVBQVUsc0hBQWlCO1FBRWxDLHFGQUFxRjtRQUU5RSxnQkFBZ0IsNkhBQWlCOzs7Ozs7O1NBdEM3QiwyQkFBMkI7QUF5Q3hDLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHO0lBQ3BELFFBQVEsRUFBRSx3QkFBd0I7SUFDbEMsYUFBYSxFQUFFLDZCQUE2QjtDQUNwQyxDQUFDO0FBeUJYOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsVUFBc0MsRUFBdUIsRUFBRTtJQUN0RyxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsRUFBRSxDQUFDO0lBQy9CLElBQUksQ0FBQyxDQUFDLFFBQVEsWUFBWSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3pGLE1BQU0sSUFBSSxLQUFLLENBQUMsMEdBQTBHLENBQUMsQ0FBQztJQUM5SCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsR0FBZ0MsRUFBRTtRQUNsRCxJQUFJLFFBQVEsWUFBWSxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3BELE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFDRCxJQUFJLFFBQWlCLENBQUM7UUFDdEIsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLFFBQVEsRUFBRSxDQUFDO1FBQ3hCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLG9DQUFvQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxJQUFJLENBQUMsQ0FBQyxRQUFRLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxvQ0FBb0MsRUFBRSxDQUFDO1FBQ25ELENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDLENBQUM7SUFDRixNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsZUFBZSxFQUFFLFFBQVEsSUFBSSxzQ0FBc0MsQ0FBQyxRQUFRLENBQUM7SUFDekcsTUFBTSxhQUFhLEdBQUcsVUFBVSxDQUFDLGVBQWUsRUFBRSxhQUFhO1dBQzFELHNDQUFzQyxDQUFDLGFBQWEsQ0FBQztRQUdwRCxlQUFlO2dDQURwQixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsUUFBUSxFQUFFLENBQUM7Ozs7MEJBQ3RDLHNCQUFzQjttQ0FBOUIsU0FBUSxXQUFzQjs7OztnQkFBcEQsNktBQXVEOzs7Z0JBQWpELHVEQUFlOzs7OztRQUdmLG9CQUFvQjtnQ0FEekIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxDQUFDOzs7OzBCQUN0QywyQkFBMkI7d0NBQW5DLFNBQVEsV0FBMkI7Ozs7Z0JBQTlELDZLQUFpRTs7O2dCQUEzRCx1REFBb0I7Ozs7O0lBRTFCLE9BQU8sRUFBRSxPQUFPLEVBQUUsZUFBZSxFQUFFLFlBQVksRUFBRSxvQkFBb0IsRUFBRSxDQUFDO0FBQzFFLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ycG1vZGVscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLnJwbW9kZWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsb0NBQW9DLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUczRTs7Ozs7O0dBTUc7SUFDVSxzQkFBc0I7c0JBQVMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O2lCQUE3RCxzQkFBdUIsU0FBUSxXQUE4RTs7OzhCQUN2SCxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7a0NBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQ3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO3FDQUd2QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtzQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEVBQ3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFO3FDQUl2QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtzQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7MENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzZDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTs4Q0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7Z0RBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzRDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtZQTlDdkIsd0pBQU8sRUFBRSw2QkFBRixFQUFFLCtFQUFjO1lBSXZCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYztZQUs5QixvS0FBTyxNQUFNLDZCQUFOLE1BQU0sdUZBQWM7WUFHM0IsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBRzdCLGdMQUFPLFVBQVUsNkJBQVYsVUFBVSwrRkFBYTtZQUs5Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFJN0IsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFVO1lBSTFCLGdMQUFPLFVBQVUsNkJBQVYsVUFBVSwrRkFBVTtZQUkzQiw0TEFBTyxjQUFjLDZCQUFkLGNBQWMsdUdBQVU7WUFJL0IscU1BQU8saUJBQWlCLDZCQUFqQixpQkFBaUIsNkdBQVU7WUFHbEMsd01BQU8sa0JBQWtCLDZCQUFsQixrQkFBa0IsK0dBQVU7WUFJbkMsOE1BQU8sb0JBQW9CLDZCQUFwQixvQkFBb0IsbUhBQVU7WUFJckMsa01BQU8sZ0JBQWdCLDZCQUFoQixnQkFBZ0IsMkdBQVU7OztRQS9DMUIsRUFBRSw2Q0FBVyxFQUFFLEVBQUM7UUFFdkIsbUVBQW1FO1FBRTVELFNBQVMscUdBQVcsRUFBRSxHQUFDO1FBRTlCLDhEQUE4RDtRQUd2RCxNQUFNLHlHQUFXLEVBQUUsR0FBQztRQUdwQixTQUFTLHlHQUFXLENBQUMsR0FBQztRQUd0QixVQUFVLDZHQUFXLENBQUMsR0FBQztRQUU5QiwrR0FBK0c7UUFHeEcsU0FBUyw2R0FBVyxDQUFDLEdBQUM7UUFFN0Isd0NBQXdDO1FBRWpDLFNBQVMscUhBQVU7UUFFMUIsbUdBQW1HO1FBRTVGLFVBQVUsc0hBQVU7UUFFM0Isc0VBQXNFO1FBRS9ELGNBQWMsMkhBQVU7UUFFL0IsbUZBQW1GO1FBRTVFLGlCQUFpQixrSUFBVTtRQUczQixrQkFBa0Isc0lBQVU7UUFFbkMscUdBQXFHO1FBRTlGLG9CQUFvQix5SUFBVTtRQUVyQyxpR0FBaUc7UUFFMUYsZ0JBQWdCLHVJQUFVOzs7Ozs7O1NBakR0QixzQkFBc0I7QUFvRG5DOzs7Ozs7O0dBT0c7SUFDVSwyQkFBMkI7c0JBQVMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O2lCQUFsRSwyQkFBNEIsU0FBUSxXQUF3Rjs7OzhCQUN0SSxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7NENBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzhDQUdyQixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtpQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7c0NBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3dDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTs0Q0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzhDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTsrQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NkNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBbkR2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFJdkIsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFjO1lBSTlCLGtNQUFPLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFjO1lBR3JDLHdNQUFPLGtCQUFrQiw2QkFBbEIsa0JBQWtCLCtHQUFjO1lBR3ZDLGlLQUFPLEtBQUssNkJBQUwsS0FBSyxxRkFBYztZQUkxQixnTEFBTyxVQUFVLDZCQUFWLFVBQVUsK0ZBQWU7WUFJaEMsc0xBQU8sWUFBWSw2QkFBWixZQUFZLG1HQUFVO1lBRzdCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUc3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFJN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFpQjtZQUlsQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBaUI7WUFJeEMsa01BQU8sZ0JBQWdCLDZCQUFoQixnQkFBZ0IsMkdBQWlDO1lBSXhELHdNQUFPLGtCQUFrQiw2QkFBbEIsa0JBQWtCLCtHQUFVO1lBSW5DLDJNQUFPLG1CQUFtQiw2QkFBbkIsbUJBQW1CLGlIQUFVO1lBSXBDLHFNQUFPLGlCQUFpQiw2QkFBakIsaUJBQWlCLDZHQUFVOzs7UUFwRDNCLEVBQUUsNkNBQVcsRUFBRSxFQUFDO1FBRXZCLDRFQUE0RTtRQUVyRSxTQUFTLHFHQUFXLEVBQUUsR0FBQztRQUU5QiwyRkFBMkY7UUFFcEYsZ0JBQWdCLG1IQUFXLEVBQUUsR0FBQztRQUc5QixrQkFBa0IsNEhBQVcsRUFBRSxHQUFDO1FBR2hDLEtBQUssaUhBQVcsRUFBRSxHQUFDO1FBRTFCLDhDQUE4QztRQUV2QyxVQUFVLHlHQUFXLEdBQUcsR0FBQztRQUVoQyxpSUFBaUk7UUFFMUgsWUFBWSx5SEFBVTtRQUd0QixTQUFTLCtHQUFXLENBQUMsR0FBQztRQUd0QixTQUFTLDRHQUFXLENBQUMsR0FBQztRQUU3QixnR0FBZ0c7UUFFekYsVUFBVSxzSEFBaUI7UUFFbEMscUZBQXFGO1FBRTlFLGdCQUFnQiw2SEFBaUI7UUFFeEMseUZBQXlGO1FBRWxGLGdCQUFnQixtSUFBaUM7UUFFeEQseURBQXlEO1FBRWxELGtCQUFrQixxSUFBVTtRQUVuQyxrR0FBa0c7UUFFM0YsbUJBQW1CLHdJQUFVO1FBRXBDLG9FQUFvRTtRQUU3RCxpQkFBaUIsdUlBQVU7Ozs7Ozs7U0F0RHZCLDJCQUEyQjtBQXlEeEM7Ozs7R0FJRztJQUNVLDRCQUE0QjtzQkFBUyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBQW5FLDRCQUE2QixTQUFRLFdBQTBGOzs7OEJBQ3pJLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO29DQUlyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7eUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3FDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7c0NBSXZCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBdEJ2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFJdkIsMEtBQU8sUUFBUSw2QkFBUixRQUFRLDJGQUFjO1lBSTdCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYztZQUc5Qix5TEFBTyxhQUFhLDZCQUFiLGFBQWEscUdBQWM7WUFHbEMsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBSzdCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3QixnTEFBTyxVQUFVLDZCQUFWLFVBQVUsK0ZBQXVCOzs7UUF2QmpDLEVBQUUsNkNBQVcsRUFBRSxFQUFDO1FBRXZCLHlCQUF5QjtRQUVsQixRQUFRLG9HQUFXLEVBQUUsR0FBQztRQUU3QixpRUFBaUU7UUFFMUQsU0FBUywyR0FBVyxFQUFFLEdBQUM7UUFHdkIsYUFBYSxnSEFBVyxFQUFFLEdBQUM7UUFHM0IsU0FBUyxnSEFBVyxDQUFDLEdBQUM7UUFFN0IsdUdBQXVHO1FBR2hHLFNBQVMsNEdBQVcsQ0FBQyxHQUFDO1FBRTdCLDZDQUE2QztRQUV0QyxVQUFVLDZHQUFrQixJQUFJLEdBQUM7Ozs7Ozs7U0F6QjdCLDRCQUE0QjtBQTRCekM7Ozs7OztHQU1HO0lBQ1UsMEJBQTBCO3NCQUFTLE9BQU8sQ0FBQyxPQUFPLENBQUMsY0FBYzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztpQkFBakUsMEJBQTJCLFNBQVEsV0FBc0Y7Ozs4QkFDbkksT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7MkNBR3JCLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzRDQUdyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FHckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO2dEQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7cUNBSXZCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBdkJ2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFHdkIsK0xBQU8sZUFBZSw2QkFBZixlQUFlLHlHQUFjO1lBR3BDLGtNQUFPLGdCQUFnQiw2QkFBaEIsZ0JBQWdCLDJHQUFjO1lBR3JDLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYztZQUc5Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFHN0IsOE1BQU8sb0JBQW9CLDZCQUFwQixvQkFBb0IsbUhBQWE7WUFLeEMsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFhO1lBSTdCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBdUI7OztRQXhCaEMsRUFBRSw2Q0FBVyxFQUFFLEVBQUM7UUFHaEIsZUFBZSwyR0FBVyxFQUFFLEdBQUM7UUFHN0IsZ0JBQWdCLHlIQUFXLEVBQUUsR0FBQztRQUc5QixTQUFTLG1IQUFXLEVBQUUsR0FBQztRQUd2QixTQUFTLDRHQUFXLENBQUMsR0FBQztRQUd0QixvQkFBb0IsdUhBQVcsQ0FBQyxHQUFDO1FBRXhDLDRHQUE0RztRQUdyRyxTQUFTLHVIQUFXLENBQUMsR0FBQztRQUU3QiwwRkFBMEY7UUFFbkYsU0FBUyw0R0FBa0IsSUFBSSxHQUFDOzs7Ozs7O1NBMUI1QiwwQkFBMEI7QUE2QnZDLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHO0lBQ3BELFFBQVEsRUFBRSx3QkFBd0I7SUFDbEMsYUFBYSxFQUFFLDZCQUE2QjtJQUM1QyxjQUFjLEVBQUUsOEJBQThCO0lBQzlDLFlBQVksRUFBRSw0QkFBNEI7Q0FDbEMsQ0FBQztBQXNDWDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUN0QyxVQUFzQyxFQUNXLEVBQUU7SUFDbkQsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLEVBQUUsQ0FBQztJQUMvQixJQUFJLENBQUMsQ0FBQyxRQUFRLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN6RixNQUFNLElBQUksS0FBSyxDQUFDLDBHQUEwRyxDQUFDLENBQUM7SUFDOUgsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLEdBQWdDLEVBQUU7UUFDbEQsSUFBSSxRQUFRLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNwRCxPQUFPLFFBQVEsQ0FBQztRQUNsQixDQUFDO1FBQ0QsSUFBSSxRQUFpQixDQUFDO1FBQ3RCLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxRQUFRLEVBQUUsQ0FBQztRQUN4QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLENBQUMsUUFBUSxZQUFZLE9BQU8sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLElBQUksb0NBQW9DLEVBQUUsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGVBQWUsRUFBRSxRQUFRLElBQUksc0NBQXNDLENBQUMsUUFBUSxDQUFDO0lBQ3pHLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxlQUFlLEVBQUUsYUFBYTtXQUMxRCxzQ0FBc0MsQ0FBQyxhQUFhLENBQUM7SUFDMUQsTUFBTSxjQUFjLEdBQUcsVUFBVSxDQUFDLGVBQWUsRUFBRSxjQUFjO1dBQzVELHNDQUFzQyxDQUFDLGNBQWMsQ0FBQztJQUMzRCxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsZUFBZSxFQUFFLFlBQVk7V0FDeEQsc0NBQXNDLENBQUMsWUFBWSxDQUFDO1FBR25ELGVBQWU7Z0NBRHBCLE9BQU8sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFNBQVMsRUFBRSxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsQ0FBQzs7OzswQkFDdEMsc0JBQXNCO21DQUE5QixTQUFRLFdBQXNCOzs7O2dCQUFwRCw2S0FBdUQ7OztnQkFBakQsdURBQWU7Ozs7O1FBR2Ysb0JBQW9CO2dDQUR6QixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLENBQUM7Ozs7MEJBQ3RDLDJCQUEyQjt3Q0FBbkMsU0FBUSxXQUEyQjs7OztnQkFBOUQsNktBQWlFOzs7Z0JBQTNELHVEQUFvQjs7Ozs7UUFHcEIscUJBQXFCO2dDQUQxQixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLENBQUM7Ozs7MEJBQ3RDLDRCQUE0Qjt5Q0FBcEMsU0FBUSxXQUE0Qjs7OztnQkFBaEUsNktBQW1FOzs7Z0JBQTdELHVEQUFxQjs7Ozs7UUFHckIsbUJBQW1CO2dDQUR4QixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLENBQUM7Ozs7MEJBQ3RDLDBCQUEwQjt1Q0FBbEMsU0FBUSxXQUEwQjs7OztnQkFBNUQsNktBQStEOzs7Z0JBQXpELHVEQUFtQjs7Ozs7SUFFekIsT0FBTztRQUNMLE9BQU8sRUFBRSxlQUFlO1FBQ3hCLFlBQVksRUFBRSxvQkFBb0I7UUFDbEMsYUFBYSxFQUFFLHFCQUFxQjtRQUNwQyxXQUFXLEVBQUUsbUJBQW1CO0tBQ2pDLENBQUM7QUFDSixDQUFDLENBQUMifQ==

package/dist_ts_relyingparty/contract.bearer.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The wire contract of the bearer hand-off routes: what a bearer client sends
+ * and what it is answered. This module imports nothing, so the browser client
+ * (`@idp.global/sdk/browser`) shares it with the routes without reaching any
+ * server code; keep it that way.
+ */
+/** The `type` of every message a popup delivery posts. */
+export declare const RELYING_PARTY_BEARER_MESSAGE_TYPE = "idp.global/relyingparty:bearer-handoff";
+/**
+ * How a bearer client receives the outcome of its login:
+ *
+ * - `web`: a redirect to a same-origin path of the application
+ * - `loopback`: a redirect to `http://127.0.0.1:<port>/…` or `http://[::1]:<port>/…`, any port (RFC 8252)
+ * - `custom_scheme`: a redirect to a registered private-use URI scheme such as `com.example.app:/signed-in` (RFC 8252)
+ * - `popup`: a page that posts the outcome to `window.opener` at exactly one registered origin
+ */
+export type TRelyingPartyBearerClientKind = 'web' | 'loopback' | 'custom_scheme' | 'popup';
+/**
+ * What the popup page of a `popup` delivery posts to `window.opener`. The
+ * receiver accepts it only when `event.origin` is the relying party's public
+ * origin, `event.source` is the popup it opened, `type` is
+ * `RELYING_PARTY_BEARER_MESSAGE_TYPE` and `state` is its own.
+ */
+export interface IRelyingPartyBearerMessage {
+    type: string;
+    /** the hand-off code; absent when the login failed */
+    code?: string;
+    /** why the login failed (`TRelyingPartyBearerDeliveryError`); absent when it succeeded */
+    error?: string;
+    state?: string;
+}
+/**
+ * Why a bearer login delivered no code, as the `error` of its redirect or
+ * popup message: `access_denied` when the provider came back without one,
+ * `authentication_failed` when the login could not be completed, or the code
+ * of the application's own refusal (`RelyingPartyRefusal.code`).
+ */
+export type TRelyingPartyBearerDeliveryError = 'access_denied' | 'authentication_failed' | (string & {});
+/** The session a bearer answer names. */
+export interface IRelyingPartyBearerSessionInfo {
+    sessionId: string;
+    principalId: string;
+    /** epoch milliseconds: the end of the session, which no refresh extends */
+    expiresAt: number;
+}
+/** What `POST <prefix>bearer/claim` and `POST <prefix>bearer/refresh` answer with status 200. */
+export interface IRelyingPartyBearerTokenAnswer {
+    tokenType: 'Bearer';
+    accessToken: string;
+    /** epoch milliseconds on the relying party's clock */
+    accessTokenExpiresAt: number;
+    /** seconds the access token lives from the answer, for a client whose clock differs */
+    expiresIn: number;
+    /** spent by the next refresh; it never comes back after that */
+    refreshToken: string;
+    /** epoch milliseconds: the end of the session */
+    refreshTokenExpiresAt: number;
+    session: IRelyingPartyBearerSessionInfo;
+}
+/** What `GET <prefix>bearer/session` answers with status 200; `null` for any token that is not live. */
+export interface IRelyingPartyBearerSessionAnswer {
+    session: IRelyingPartyBearerSessionInfo | null;
+}
+/** What `POST <prefix>bearer/logout` answers with status 200; `true` only when this call ended a live session. */
+export interface IRelyingPartyBearerLogoutAnswer {
+    endedLiveSession: boolean;
+}
+/**
+ * The `error` of a failed bearer route, answered as `{ error }`:
+ *
+ * - `invalid_bearer_request` (400): a login start or claim with a missing or malformed parameter
+ * - `return_target_not_allowed` (400): a login start naming a return target not configured for its kind
+ * - `invalid_bearer_handoff` (400): a claim with a code that is unknown, expired, already claimed or of the wrong verifier
+ * - `invalid_bearer_grant` (400): a refresh token that is unknown, spent, expired or of a session that is over
+ * - `authority_unavailable` (503): a refresh that could not reach the provider; nothing was spent, retry it
+ * - `authentication_unavailable` (503): any other failure on the relying party's side
+ * - `forbidden` (403): a CORS preflight from an origin that is no popup return target
+ */
+export type TRelyingPartyBearerErrorCode = 'invalid_bearer_request' | 'return_target_not_allowed' | 'invalid_bearer_handoff' | 'invalid_bearer_grant' | 'authority_unavailable' | 'authentication_unavailable' | 'forbidden';
+export interface IRelyingPartyBearerErrorAnswer {
+    error: TRelyingPartyBearerErrorCode;
+}

package/dist_ts_relyingparty/contract.bearer.js

@@ -0,0 +1,9 @@
+/**
+ * The wire contract of the bearer hand-off routes: what a bearer client sends
+ * and what it is answered. This module imports nothing, so the browser client
+ * (`@idp.global/sdk/browser`) shares it with the routes without reaching any
+ * server code; keep it that way.
+ */
+/** The `type` of every message a popup delivery posts. */
+export const RELYING_PARTY_BEARER_MESSAGE_TYPE = 'idp.global/relyingparty:bearer-handoff';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udHJhY3QuYmVhcmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NvbnRyYWN0LmJlYXJlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7R0FLRztBQUVILDBEQUEwRDtBQUMxRCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyx3Q0FBd0MsQ0FBQyJ9

package/dist_ts_relyingparty/helpers.bearer.d.ts

@@ -0,0 +1,48 @@
+import { RELYING_PARTY_BEARER_MESSAGE_TYPE, type IRelyingPartyBearerMessage, type TRelyingPartyBearerClientKind } from './contract.bearer.js';
+import type { IRelyingPartyBearerDelivery, IRelyingPartyBearerReturnTargets } from './interfaces.js';
+export { RELYING_PARTY_BEARER_MESSAGE_TYPE };
+export declare const RELYING_PARTY_BEARER_CLIENT_KINDS: readonly TRelyingPartyBearerClientKind[];
+export declare const isBearerClientKind: (valueArg: unknown) => valueArg is TRelyingPartyBearerClientKind;
+export declare const isPkceChallenge: (valueArg: unknown) => valueArg is string;
+export declare const isPkceVerifier: (valueArg: unknown) => valueArg is string;
+export declare const isBearerClientState: (valueArg: unknown) => valueArg is string;
+/** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
+export declare const pkceChallengeOf: (verifierArg: string) => string;
+/** Whether a verifier answers a challenge under S256, compared in constant time. */
+export declare const verifyPkceChallenge: (verifierArg: unknown, challengeArg: string) => boolean;
+/**
+ * The return targets of a deployment, checked once: every entry has to be
+ * the exact canonical form a client can name, or the configuration is
+ * refused. A target with a query or a fragment is refused too, because the
+ * delivery adds its own query, and so is one with a `*`: nothing is a wildcard.
+ */
+export declare const normalizeBearerReturnTargets: (targetsArg: IRelyingPartyBearerReturnTargets, publicOriginArg: string, loginPathPrefixArg: string) => Readonly<Required<IRelyingPartyBearerReturnTargets>>;
+/**
+ * Whether a client may name this return target: an entry of its kind,
+ * exactly. A loopback target names its own port, which is the only part
+ * that is not compared; it has to be given in canonical form.
+ */
+export declare const isBearerReturnTargetAllowed: (targetsArg: Readonly<Required<IRelyingPartyBearerReturnTargets>>, kindArg: TRelyingPartyBearerClientKind, candidateArg: unknown) => boolean;
+/** The token of an `Authorization: Bearer <token>` header, or `null`. */
+export declare const parseBearerAuthorization: (headerArg: string | null | undefined) => string | null;
+/** What a delivery hands the client: the code, or why there is none. */
+export type TRelyingPartyBearerOutcome = {
+    code: string;
+} | {
+    error: string;
+};
+/** The location a redirect delivery sends the client to, with the outcome and its `state` in the query. */
+export declare const bearerDeliveryLocation: (deliveryArg: IRelyingPartyBearerDelivery, outcomeArg: TRelyingPartyBearerOutcome, publicOriginArg: string) => string;
+/** The message a popup delivery posts. */
+export declare const bearerDeliveryMessage: (deliveryArg: IRelyingPartyBearerDelivery, outcomeArg: TRelyingPartyBearerOutcome) => IRelyingPartyBearerMessage;
+/** The id of the element a popup page keeps its delivery in. */
+export declare const RELYING_PARTY_BEARER_POPUP_DATA_ID = "idp-rp-bearer-delivery";
+/**
+ * The page of a popup delivery. Its one script, allowed by nonce alone,
+ * posts the message to `window.opener` with the registered origin as the
+ * target origin — never `*` — so a browser hands it to nobody else, and
+ * closes the window. The delivery is data in a JSON block, never script.
+ */
+export declare const bearerPopupPage: (deliveryArg: IRelyingPartyBearerDelivery, outcomeArg: TRelyingPartyBearerOutcome, nonceArg: string) => string;
+/** The policy of a popup page: its nonce script and nothing else. */
+export declare const bearerPopupContentSecurityPolicy: (nonceArg: string) => string;