@idp.global/sdk 19.2.1 → 19.4.0

package/dist_ts_relyingparty/helpers.bearer.js

@@ -0,0 +1,199 @@
+import { RELYING_PARTY_BEARER_MESSAGE_TYPE, } from './contract.bearer.js';
+import { sha256, timingSafeEqualString } from './helpers.crypto.js';
+import { sanitizeReturnPath } from './helpers.returnpath.js';
+export { RELYING_PARTY_BEARER_MESSAGE_TYPE };
+export const RELYING_PARTY_BEARER_CLIENT_KINDS = Object.freeze([
+    'web',
+    'loopback',
+    'custom_scheme',
+    'popup',
+]);
+/** A return target is a location the application configured, not a place to park data. */
+const MAX_RETURN_TARGET_LENGTH = 2_048;
+/** BASE64URL of a SHA-256 digest, without padding (RFC 7636 §4.2). */
+const PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/u;
+/** RFC 7636 §4.1: 43 to 128 unreserved characters. */
+const PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/u;
+const CLIENT_STATE = /^[A-Za-z0-9._~-]{1,256}$/u;
+const LOOPBACK_HOSTS = ['127.0.0.1', '[::1]'];
+/** A private-use scheme is a reverse domain name: it has a dot, and no web scheme has one (RFC 8252 §7.1). */
+const CUSTOM_SCHEME = /^[a-z][a-z0-9+-]*(\.[a-z0-9+-]+)+:$/u;
+export const isBearerClientKind = (valueArg) => typeof valueArg === 'string' && RELYING_PARTY_BEARER_CLIENT_KINDS.includes(valueArg);
+export const isPkceChallenge = (valueArg) => typeof valueArg === 'string' && PKCE_CHALLENGE.test(valueArg);
+export const isPkceVerifier = (valueArg) => typeof valueArg === 'string' && PKCE_VERIFIER.test(valueArg);
+export const isBearerClientState = (valueArg) => typeof valueArg === 'string' && CLIENT_STATE.test(valueArg);
+/** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
+export const pkceChallengeOf = (verifierArg) => sha256(verifierArg);
+/** Whether a verifier answers a challenge under S256, compared in constant time. */
+export const verifyPkceChallenge = (verifierArg, challengeArg) => isPkceVerifier(verifierArg) && challengeArg.length > 0 && timingSafeEqualString(pkceChallengeOf(verifierArg), challengeArg);
+const parseUrl = (valueArg) => {
+    try {
+        return new URL(valueArg);
+    }
+    catch {
+        return null;
+    }
+};
+/** A URL as given, in its canonical form, with nothing that a delivery would have to merge into. */
+const plainUrl = (valueArg) => {
+    if (typeof valueArg !== 'string' || valueArg.length === 0 || valueArg.length > MAX_RETURN_TARGET_LENGTH) {
+        return null;
+    }
+    const parsed = parseUrl(valueArg);
+    if (!parsed
+        || parsed.href !== valueArg
+        || parsed.username !== ''
+        || parsed.password !== ''
+        || parsed.search !== ''
+        || parsed.hash !== '') {
+        return null;
+    }
+    return parsed;
+};
+const configuredTarget = (kindArg, entryArg, publicOriginArg, loginPathPrefixArg) => {
+    // targets are compared exactly; an entry that reads like a wildcard is a mistake, said at once
+    if (typeof entryArg === 'string' && entryArg.includes('*')) {
+        return false;
+    }
+    if (kindArg === 'web') {
+        return typeof entryArg === 'string'
+            && !entryArg.includes('?')
+            && !entryArg.includes('#')
+            && sanitizeReturnPath(entryArg, publicOriginArg, loginPathPrefixArg) === entryArg;
+    }
+    if (kindArg === 'popup') {
+        const parsed = typeof entryArg === 'string' ? parseUrl(entryArg) : null;
+        return parsed !== null
+            && (parsed.protocol === 'https:' || parsed.protocol === 'http:')
+            && parsed.origin === entryArg;
+    }
+    const parsed = plainUrl(entryArg);
+    if (!parsed) {
+        return false;
+    }
+    if (kindArg === 'loopback') {
+        return parsed.protocol === 'http:' && LOOPBACK_HOSTS.includes(parsed.hostname) && parsed.port === '';
+    }
+    return CUSTOM_SCHEME.test(parsed.protocol);
+};
+/**
+ * The return targets of a deployment, checked once: every entry has to be
+ * the exact canonical form a client can name, or the configuration is
+ * refused. A target with a query or a fragment is refused too, because the
+ * delivery adds its own query, and so is one with a `*`: nothing is a wildcard.
+ */
+export const normalizeBearerReturnTargets = (targetsArg, publicOriginArg, loginPathPrefixArg) => {
+    if (!targetsArg || typeof targetsArg !== 'object') {
+        throw new Error('bearer.returnTargets must name the return targets per client kind');
+    }
+    for (const key of Object.keys(targetsArg)) {
+        if (!isBearerClientKind(key)) {
+            throw new Error(`bearer.returnTargets.${key} is no client kind; the kinds are ${RELYING_PARTY_BEARER_CLIENT_KINDS.join(', ')}`);
+        }
+    }
+    const normalized = {};
+    let any = false;
+    for (const kind of RELYING_PARTY_BEARER_CLIENT_KINDS) {
+        const entries = targetsArg[kind] ?? [];
+        if (!Array.isArray(entries)) {
+            throw new Error(`bearer.returnTargets.${kind} must be a list`);
+        }
+        for (const entry of entries) {
+            if (!configuredTarget(kind, entry, publicOriginArg, loginPathPrefixArg)) {
+                throw new Error(`bearer.returnTargets.${kind} has an entry that is not an exact ${kind} target: ${JSON.stringify(entry)}`);
+            }
+        }
+        normalized[kind] = Object.freeze([...entries]);
+        any ||= entries.length > 0;
+    }
+    if (!any) {
+        throw new Error('bearer.returnTargets names no return target');
+    }
+    return Object.freeze(normalized);
+};
+/**
+ * Whether a client may name this return target: an entry of its kind,
+ * exactly. A loopback target names its own port, which is the only part
+ * that is not compared; it has to be given in canonical form.
+ */
+export const isBearerReturnTargetAllowed = (targetsArg, kindArg, candidateArg) => {
+    if (typeof candidateArg !== 'string' || candidateArg.length === 0 || candidateArg.length > MAX_RETURN_TARGET_LENGTH) {
+        return false;
+    }
+    const entries = targetsArg[kindArg];
+    if (kindArg !== 'loopback') {
+        return entries.includes(candidateArg);
+    }
+    const parsed = plainUrl(candidateArg);
+    if (!parsed || parsed.protocol !== 'http:' || !LOOPBACK_HOSTS.includes(parsed.hostname) || parsed.port === '') {
+        return false;
+    }
+    return entries.includes(`http://${parsed.hostname}${parsed.pathname}`);
+};
+/** RFC 6750 §2.1: the scheme is matched case-insensitively, the token is a b64token. */
+const AUTHORIZATION_BEARER = /^bearer +([A-Za-z0-9._~+/-]+=*)$/iu;
+/** The token of an `Authorization: Bearer <token>` header, or `null`. */
+export const parseBearerAuthorization = (headerArg) => {
+    if (typeof headerArg !== 'string' || headerArg.length > MAX_RETURN_TARGET_LENGTH) {
+        return null;
+    }
+    return AUTHORIZATION_BEARER.exec(headerArg.trim())?.[1] ?? null;
+};
+/** The location a redirect delivery sends the client to, with the outcome and its `state` in the query. */
+export const bearerDeliveryLocation = (deliveryArg, outcomeArg, publicOriginArg) => {
+    const location = deliveryArg.clientKind === 'web'
+        ? new URL(deliveryArg.returnTarget, publicOriginArg)
+        : new URL(deliveryArg.returnTarget);
+    if ('code' in outcomeArg) {
+        location.searchParams.set('code', outcomeArg.code);
+    }
+    else {
+        location.searchParams.set('error', outcomeArg.error);
+    }
+    if (deliveryArg.state !== undefined) {
+        location.searchParams.set('state', deliveryArg.state);
+    }
+    return location.href;
+};
+/** The message a popup delivery posts. */
+export const bearerDeliveryMessage = (deliveryArg, outcomeArg) => ({
+    type: RELYING_PARTY_BEARER_MESSAGE_TYPE,
+    ...outcomeArg,
+    ...(deliveryArg.state !== undefined ? { state: deliveryArg.state } : {}),
+});
+/** JSON that stays inert inside an HTML element, whatever the strings in it hold. */
+const inertJson = (valueArg) => JSON.stringify(valueArg)
+    .replace(/</gu, '\\u003c')
+    .replace(/>/gu, '\\u003e')
+    .replace(/&/gu, '\\u0026')
+    .replace(/\u2028/gu, '\\u2028')
+    .replace(/\u2029/gu, '\\u2029');
+/** The id of the element a popup page keeps its delivery in. */
+export const RELYING_PARTY_BEARER_POPUP_DATA_ID = 'idp-rp-bearer-delivery';
+/**
+ * The page of a popup delivery. Its one script, allowed by nonce alone,
+ * posts the message to `window.opener` with the registered origin as the
+ * target origin — never `*` — so a browser hands it to nobody else, and
+ * closes the window. The delivery is data in a JSON block, never script.
+ */
+export const bearerPopupPage = (deliveryArg, outcomeArg, nonceArg) => {
+    const data = inertJson({ targetOrigin: deliveryArg.returnTarget, message: bearerDeliveryMessage(deliveryArg, outcomeArg) });
+    const script = [
+        `var delivery = JSON.parse(document.getElementById('${RELYING_PARTY_BEARER_POPUP_DATA_ID}').textContent);`,
+        'if (window.opener) {',
+        '  window.opener.postMessage(delivery.message, delivery.targetOrigin);',
+        '  window.close();',
+        '}',
+    ].join('\n');
+    return [
+        '<!doctype html>',
+        '<html lang="en"><head><meta charset="utf-8"><title>Sign-in</title></head><body>',
+        `<script type="application/json" id="${RELYING_PARTY_BEARER_POPUP_DATA_ID}">${data}</script>`,
+        `<script nonce="${nonceArg}">\n${script}\n</script>`,
+        '<p>The sign-in is complete. You can close this window.</p>',
+        '</body></html>',
+    ].join('\n');
+};
+/** The policy of a popup page: its nonce script and nothing else. */
+export const bearerPopupContentSecurityPolicy = (nonceArg) => `default-src 'none'; script-src 'nonce-${nonceArg}'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5iZWFyZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaGVscGVycy5iZWFyZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUNMLGlDQUFpQyxHQUdsQyxNQUFNLHNCQUFzQixDQUFDO0FBQzlCLE9BQU8sRUFBRSxNQUFNLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNwRSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUc3RCxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsQ0FBQztBQUU3QyxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBNkMsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RyxLQUFLO0lBQ0wsVUFBVTtJQUNWLGVBQWU7SUFDZixPQUFPO0NBQ1IsQ0FBQyxDQUFDO0FBRUgsMEZBQTBGO0FBQzFGLE1BQU0sd0JBQXdCLEdBQUcsS0FBSyxDQUFDO0FBQ3ZDLHNFQUFzRTtBQUN0RSxNQUFNLGNBQWMsR0FBRyxzQkFBc0IsQ0FBQztBQUM5QyxzREFBc0Q7QUFDdEQsTUFBTSxhQUFhLEdBQUcsNEJBQTRCLENBQUM7QUFDbkQsTUFBTSxZQUFZLEdBQUcsMkJBQTJCLENBQUM7QUFDakQsTUFBTSxjQUFjLEdBQXNCLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQ2pFLDhHQUE4RztBQUM5RyxNQUFNLGFBQWEsR0FBRyxzQ0FBc0MsQ0FBQztBQUU3RCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQWlCLEVBQTZDLEVBQUUsQ0FDakcsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFLLGlDQUF1RCxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUU5RyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQ3ZFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRWhFLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDdEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFL0QsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQzNFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRTlELDZFQUE2RTtBQUM3RSxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxXQUFtQixFQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFcEYsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsV0FBb0IsRUFBRSxZQUFvQixFQUFXLEVBQUUsQ0FDekYsY0FBYyxDQUFDLFdBQVcsQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztBQUU5SCxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWdCLEVBQWMsRUFBRTtJQUNoRCxJQUFJLENBQUM7UUFDSCxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixvR0FBb0c7QUFDcEcsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFjLEVBQUU7SUFDakQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyx3QkFBd0IsRUFBRSxDQUFDO1FBQ3hHLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUNFLENBQUMsTUFBTTtXQUNKLE1BQU0sQ0FBQyxJQUFJLEtBQUssUUFBUTtXQUN4QixNQUFNLENBQUMsUUFBUSxLQUFLLEVBQUU7V0FDdEIsTUFBTSxDQUFDLFFBQVEsS0FBSyxFQUFFO1dBQ3RCLE1BQU0sQ0FBQyxNQUFNLEtBQUssRUFBRTtXQUNwQixNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFDckIsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FDdkIsT0FBc0MsRUFDdEMsUUFBaUIsRUFDakIsZUFBdUIsRUFDdkIsa0JBQTBCLEVBQ2pCLEVBQUU7SUFDWCwrRkFBK0Y7SUFDL0YsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ3RCLE9BQU8sT0FBTyxRQUFRLEtBQUssUUFBUTtlQUM5QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2VBQ3ZCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7ZUFDdkIsa0JBQWtCLENBQUMsUUFBUSxFQUFFLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxLQUFLLFFBQVEsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDeEIsTUFBTSxNQUFNLEdBQUcsT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN4RSxPQUFPLE1BQU0sS0FBSyxJQUFJO2VBQ2pCLENBQUMsTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxPQUFPLENBQUM7ZUFDN0QsTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUM7SUFDbEMsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUMzQixPQUFPLE1BQU0sQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssRUFBRSxDQUFDO0lBQ3ZHLENBQUM7SUFDRCxPQUFPLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FDMUMsVUFBNEMsRUFDNUMsZUFBdUIsRUFDdkIsa0JBQTBCLEVBQzRCLEVBQUU7SUFDeEQsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNsRCxNQUFNLElBQUksS0FBSyxDQUFDLG1FQUFtRSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLEdBQUcscUNBQXFDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEksQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBRyxFQUE4RCxDQUFDO0lBQ2xGLElBQUksR0FBRyxHQUFHLEtBQUssQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLGlDQUFpQyxFQUFFLENBQUM7UUFDckQsTUFBTSxPQUFPLEdBQVksVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLElBQUksaUJBQWlCLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxlQUFlLEVBQUUsa0JBQWtCLENBQUMsRUFBRSxDQUFDO2dCQUN4RSxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixJQUFJLHNDQUFzQyxJQUFJLFlBQVksSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDN0gsQ0FBQztRQUNILENBQUM7UUFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFhLENBQUMsQ0FBQztRQUMzRCxHQUFHLEtBQUssT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUNELElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUN6QyxVQUFnRSxFQUNoRSxPQUFzQyxFQUN0QyxZQUFxQixFQUNaLEVBQUU7SUFDWCxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLHdCQUF3QixFQUFFLENBQUM7UUFDcEgsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3BDLElBQUksT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzNCLE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3RDLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzlHLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxVQUFVLE1BQU0sQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sb0JBQW9CLEdBQUcsb0NBQW9DLENBQUM7QUFFbEUseUVBQXlFO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsU0FBb0MsRUFBaUIsRUFBRTtJQUM5RixJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLENBQUMsTUFBTSxHQUFHLHdCQUF3QixFQUFFLENBQUM7UUFDakYsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUM7QUFDbEUsQ0FBQyxDQUFDO0FBS0YsMkdBQTJHO0FBQzNHLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQ3BDLFdBQXdDLEVBQ3hDLFVBQXNDLEVBQ3RDLGVBQXVCLEVBQ2YsRUFBRTtJQUNWLE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxVQUFVLEtBQUssS0FBSztRQUMvQyxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxlQUFlLENBQUM7UUFDcEQsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN0QyxJQUFJLE1BQU0sSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUN6QixRQUFRLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3JELENBQUM7U0FBTSxDQUFDO1FBQ04sUUFBUSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BDLFFBQVEsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQztBQUN2QixDQUFDLENBQUM7QUFFRiwwQ0FBMEM7QUFDMUMsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FDbkMsV0FBd0MsRUFDeEMsVUFBc0MsRUFDVixFQUFFLENBQUMsQ0FBQztJQUNoQyxJQUFJLEVBQUUsaUNBQWlDO0lBQ3ZDLEdBQUcsVUFBVTtJQUNiLEdBQUcsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Q0FDekUsQ0FBQyxDQUFDO0FBRUgscUZBQXFGO0FBQ3JGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFLENBQzlDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDO0tBQ3JCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO0tBQzlCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFFcEMsZ0VBQWdFO0FBQ2hFLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLHdCQUF3QixDQUFDO0FBRTNFOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQzdCLFdBQXdDLEVBQ3hDLFVBQXNDLEVBQ3RDLFFBQWdCLEVBQ1IsRUFBRTtJQUNWLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsWUFBWSxFQUFFLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVILE1BQU0sTUFBTSxHQUFHO1FBQ2Isc0RBQXNELGtDQUFrQyxrQkFBa0I7UUFDMUcsc0JBQXNCO1FBQ3RCLHVFQUF1RTtRQUN2RSxtQkFBbUI7UUFDbkIsR0FBRztLQUNKLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2IsT0FBTztRQUNMLGlCQUFpQjtRQUNqQixpRkFBaUY7UUFDakYsdUNBQXVDLGtDQUFrQyxLQUFLLElBQUksV0FBVztRQUM3RixrQkFBa0IsUUFBUSxPQUFPLE1BQU0sYUFBYTtRQUNwRCw0REFBNEQ7UUFDNUQsZ0JBQWdCO0tBQ2pCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYscUVBQXFFO0FBQ3JFLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQUMsUUFBZ0IsRUFBVSxFQUFFLENBQzNFLHlDQUF5QyxRQUFRLGdFQUFnRSxDQUFDIn0=

package/dist_ts_relyingparty/index.d.ts

@@ -3,6 +3,7 @@ export * from './classes.errors.js';
 export * from './helpers.cookies.js';
 export * from './helpers.crypto.js';
 export * from './helpers.returnpath.js';
+export * from './helpers.bearer.js';
 export * from './classes.secretbox.js';
 export * from './classes.idpoidcprovider.js';
 export * from './classes.rpmodels.js';

package/dist_ts_relyingparty/index.js

@@ -3,6 +3,7 @@ export * from './classes.errors.js';
 export * from './helpers.cookies.js';
 export * from './helpers.crypto.js';
 export * from './helpers.returnpath.js';
+export * from './helpers.bearer.js';
 export * from './classes.secretbox.js';
 export * from './classes.idpoidcprovider.js';
 export * from './classes.rpmodels.js';
@@ -11,4 +12,4 @@ export * from './classes.authorityobserver.js';
 export * from './classes.relyingpartyroutes.js';
 export * from './classes.actorscope.js';
 export * from './classes.socketbinding.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLGlDQUFpQyxDQUFDO0FBQ2hELGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyw0QkFBNEIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxtQ0FBbUMsQ0FBQztBQUNsRCxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMsaUNBQWlDLENBQUM7QUFDaEQsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDRCQUE0QixDQUFDIn0=

package/dist_ts_relyingparty/interfaces.d.ts

@@ -1,4 +1,6 @@
 import type { IOidcCompletion, TOidcCompletionFailureStage, TOidcPrompt, TOidcTokenHint } from './classes.idpoidcprovider.js';
+import type { TRelyingPartyBearerClientKind } from './contract.bearer.js';
+export type { IRelyingPartyBearerErrorAnswer, IRelyingPartyBearerLogoutAnswer, IRelyingPartyBearerMessage, IRelyingPartyBearerSessionAnswer, IRelyingPartyBearerSessionInfo, IRelyingPartyBearerTokenAnswer, TRelyingPartyBearerClientKind, TRelyingPartyBearerDeliveryError, TRelyingPartyBearerErrorCode, } from './contract.bearer.js';
 /** A session as the application reads it; no token and no sealed value is part of it. */
 export interface IRelyingPartySession {
     id: string;
@@ -30,6 +32,19 @@ export interface IRelyingPartySessionOpening {
     csrfToken: string;
     sessionCookie: string;
 }
+/** What `sessionsOfPrincipal` reads: how many sessions, and after which page. */
+export interface IRelyingPartySessionsPageOptions {
+    /** 1 to `RELYING_PARTY_MAX_SESSIONS_PAGE_LIMIT`; `RELYING_PARTY_DEFAULT_SESSIONS_PAGE_LIMIT` when absent */
+    limit?: number;
+    /** the `nextCursor` of the page before; absent for the first page */
+    cursor?: string;
+}
+/** One page of a principal's live sessions, newest first. */
+export interface IRelyingPartySessionsPage {
+    sessions: IRelyingPartySession[];
+    /** opaque; reads the next page as `cursor`. Absent on the last page. */
+    nextCursor?: string;
+}
 /**
  * What `startLogin` carries besides the return path. `intent` is the
  * application's own text — the invitation a login accepts, the account it
@@ -54,20 +69,111 @@ export interface IRelyingPartyLoginStart {
     authorizationUrl: URL;
     intentCookie: string;
 }
+/**
+ * The exact return targets a bearer client may name, per client kind. A kind
+ * without targets is not offered. Matching is by equality, never by prefix
+ * or pattern; a loopback target matches on any port.
+ */
+export interface IRelyingPartyBearerReturnTargets {
+    /** same-origin paths such as `/signed-in`, without query or fragment */
+    web?: readonly string[];
+    /** `http://127.0.0.1/<path>` or `http://[::1]/<path>` without a port; the client names its own port */
+    loopback?: readonly string[];
+    /** whole URIs of a private-use scheme with a dot in it, such as `com.example.app:/signed-in`, without query or fragment */
+    custom_scheme?: readonly string[];
+    /** bare origins such as `https://workspace.example`; the popup posts to exactly the one its client named */
+    popup?: readonly string[];
+}
+/**
+ * Bearer hand-off mode: the application's own clients sign in through this
+ * relying party and receive its own access and refresh tokens instead of a
+ * cookie.
+ */
+export interface IRelyingPartyBearerOptions {
+    returnTargets: IRelyingPartyBearerReturnTargets;
+    /** how long an access token lives, in seconds; 900 by default, never past its session */
+    accessTokenMaxAgeSeconds?: number;
+}
+/** What a bearer client sends to start its login. Every field is checked as untrusted input. */
+export interface IRelyingPartyBearerLoginRequest {
+    clientKind: TRelyingPartyBearerClientKind;
+    /** one of the configured return targets of the kind, exactly; a loopback target with the client's port */
+    returnTarget: string;
+    /** BASE64URL(SHA-256(code verifier)), 43 characters */
+    codeChallenge: string;
+    /** only `S256` is accepted */
+    codeChallengeMethod: 'S256';
+    /** the client's own correlation value, 1 to 256 characters of `A-Z a-z 0-9 . _ ~ -`, handed back with the outcome */
+    state?: string;
+}
+/** The redirect that starts a bearer login. It sets no cookie. */
+export interface IRelyingPartyBearerLoginStart {
+    authorizationUrl: URL;
+}
+/** Where the outcome of a bearer login goes, as its client named it at the start. */
+export interface IRelyingPartyBearerDelivery {
+    clientKind: TRelyingPartyBearerClientKind;
+    returnTarget: string;
+    /** the client's `state`, when it gave one */
+    state?: string;
+}
+/**
+ * A bearer login that came back from the provider: its session is open, and
+ * its single-use code is what the client claims the tokens with. The code is
+ * no token; only its hash is stored.
+ */
+export interface IRelyingPartyBearerHandoff {
+    session: IRelyingPartySession;
+    delivery: IRelyingPartyBearerDelivery;
+    code: string;
+    /** epoch milliseconds, at most `BEARER_HANDOFF_MAX_AGE_SECONDS` after the callback */
+    expiresAt: number;
+}
+/**
+ * The relying party's own tokens of a bearer session. The refresh token
+ * rotates on every use; a rotated one coming back ends the session.
+ */
+export interface IRelyingPartyBearerTokens {
+    session: IRelyingPartySession;
+    /** epoch milliseconds on the relying party's clock; a client with another clock counts from it */
+    issuedAt: number;
+    accessToken: string;
+    /** epoch milliseconds */
+    accessTokenExpiresAt: number;
+    refreshToken: string;
+    /** epoch milliseconds: the end of the session, which no refresh extends */
+    refreshTokenExpiresAt: number;
+}
 /** A provider access token usable right now, with the subject it belongs to. */
 export interface IProviderToken {
     accessToken: string;
     subject: string;
     /** epoch milliseconds; `0` when the provider named no lifetime */
     expiresAt: number;
+    /**
+     * `true` only on the answer to `rejectedAccessToken`, and only when a
+     * rotation that this call started issued the token.
+     */
+    rotatedAfterRejection?: boolean;
 }
 /** What an authority observer needs from the session owner. `RelyingPartySessions` implements it. */
 export interface IAuthorityTokenSource {
     /**
      * The access token of a login session, rotated first when it is due. The
      * session must belong to `expectedPrincipalIdArg`. Throws `AuthorityTokenError`.
+     *
+     * `rejectedAccessToken` is a token idp.global answered inactive for. The
+     * source must rotate the session's token then, whatever is stored, and set
+     * `rotatedAfterRejection` only when a rotation that this call started issued
+     * the token. A refused refresh ends the session and throws
+     * `authority_login_required`. A rotation that started before the call, one
+     * another replica holds, or a session without a refresh token marks
+     * nothing. A source that never rotates or never marks its answer can never
+     * refuse: the observer answers `authority_unavailable` (fail-closed).
      */
-    liveProviderToken(sessionIdArg: string, expectedPrincipalIdArg: string): Promise<IProviderToken>;
+    liveProviderToken(sessionIdArg: string, expectedPrincipalIdArg: string, optionsArg?: {
+        rejectedAccessToken?: string;
+    }): Promise<IProviderToken>;
 }
 /**
  * The application's side of a provider login: who the verified subject is
@@ -112,8 +218,22 @@ export type TRelyingPartySessionEndReason =
 /** its access token is dead and there is nothing to rotate it with */
  | 'access_token_unusable'
 /** a rotation found it revoked by someone else */
- | 'revoked_elsewhere';
+ | 'revoked_elsewhere'
+/** its bearer hand-off code expired before a client claimed it */
+ | 'handoff_unclaimed'
+/** its bearer hand-off code was claimed with a verifier that does not match its challenge */
+ | 'handoff_verifier_mismatch'
+/** its bearer hand-off code came back after it was claimed */
+ | 'handoff_code_reused'
+/** a bearer refresh token that was already rotated came back: the whole family ends */
+ | 'refresh_token_reused';
 export type TRelyingPartyEventName = 'idp_token_refresh_failed' | 'idp_token_store_failed' | 'idp_session_ended' | 'oidc_sealed_token_unreadable' | 'oidc_token_revocation_failed' | 'oidc_token_revocation_timed_out' | 'login_attempt_sweep_failed'
+/** expired bearer hand-offs and token generations could not be swept */
+ | 'bearer_sweep_failed'
+/** sessions an hour past their end could not be swept */
+ | 'session_sweep_failed'
+/** a bearer hand-off code or refresh token came back after its use; `reason` names which, the session ended */
+ | 'bearer_credential_reused'
 /** an application hook threw; the step it belonged to ran on regardless */
  | 'hook_failed'
 /** a session whose opening failed could not be revoked; its provider tokens went back anyway */

package/dist_ts_relyingparty/testing.d.ts

@@ -1,4 +1,5 @@
 import { type IOidcAuthorizationOptions, type IOidcCompletion, type IOidcCompletionOptions, type IOidcOrganizationClaim, type IOidcOrganizationObservation, type IOidcProvider, type IOidcRefreshedTokens, type TOidcTokenHint } from './classes.idpoidcprovider.js';
+import type { IRelyingPartyBearerMessage } from './interfaces.js';
 /**
  * `@idp.global/sdk/relyingparty/testing`: an in-process idp.global for the
  * tests of an application built on `RelyingPartySessions`. It is a test
@@ -114,3 +115,24 @@ export declare class RelyingPartyProviderDouble implements IOidcProvider {
     private issue;
     private isLive;
 }
+/** A PKCE pair as a bearer client makes one: the verifier it keeps and the S256 challenge it sends. */
+export declare const createBearerPkcePair: () => {
+    verifier: string;
+    challenge: string;
+};
+/** What a bearer delivery handed its client. */
+export interface IBearerDeliveryRead {
+    /** a redirect: its location without the query; a popup page: the origin it posts to */
+    target: string;
+    /** the popup page's message as it would be posted; absent for a redirect */
+    message?: IRelyingPartyBearerMessage;
+    code?: string;
+    error?: string;
+    state?: string;
+}
+/**
+ * Reads the answer of a bearer login's callback the way its client would:
+ * the `code`, `error` and `state` of a redirect's location, or the message
+ * and target origin of a popup page. Anything else throws.
+ */
+export declare const readBearerDelivery: (responseArg: Response) => Promise<IBearerDeliveryRead>;

package/dist_ts_relyingparty/testing.js

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import { OidcAuthorityUnavailableError, OidcCompletionError, OidcRefreshRefusedError, } from './classes.idpoidcprovider.js';
+import { pkceChallengeOf, RELYING_PARTY_BEARER_POPUP_DATA_ID } from './helpers.bearer.js';
 const randomToken = () => plugins.crypto.randomBytes(18).toString('base64url');
 /** What `IdpOidcProvider` fails with when a step needs the discovery that has not succeeded. */
 const notDiscovered = () => new Error('The identity provider is not initialized');
@@ -263,4 +264,44 @@ export class RelyingPartyProviderDouble {
         return !tokenArg.revoked && (tokenArg.expiresAt === 0 || tokenArg.expiresAt > this.#now());
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdGluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS90ZXN0aW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBQ3hDLE9BQU8sRUFDTCw2QkFBNkIsRUFDN0IsbUJBQW1CLEVBQ25CLHVCQUF1QixHQVN4QixNQUFNLDhCQUE4QixDQUFDO0FBZ0R0QyxNQUFNLFdBQVcsR0FBRyxHQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFdkYsZ0dBQWdHO0FBQ2hHLE1BQU0sYUFBYSxHQUFHLEdBQVUsRUFBRSxDQUFDLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7QUFFekY7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLE9BQU8sMEJBQTBCO0lBQ3JCLHFCQUFxQixDQUFTO0lBQzlCLE1BQU0sQ0FBUztJQUN4QiwwQkFBMEIsQ0FBUztJQUUxQixjQUFjLEdBQWdDLEVBQUUsQ0FBQztJQUNqRCxXQUFXLEdBQThDLEVBQUUsQ0FBQztJQUM1RCxXQUFXLEdBQW1ELEVBQUUsQ0FBQztJQUNqRSxjQUFjLEdBQTRFLEVBQUUsQ0FBQztJQUM3RixTQUFTLEdBQWEsRUFBRSxDQUFDO0lBQ3pDLGlEQUFpRDtJQUMxQyxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBRXZCOzs7Ozs7O09BT0c7SUFDSSxnQkFBZ0IsQ0FBUztJQUNoQyxtR0FBbUc7SUFDNUYsaUJBQWlCLENBQVM7SUFDakMsbUhBQW1IO0lBQzVHLG9CQUFvQixDQUFTO0lBQ3BDLDRDQUE0QztJQUNyQyxjQUFjLENBQVM7SUFDOUIsc0VBQXNFO0lBQy9ELGlCQUFpQixDQUFTO0lBQ2pDLG9GQUFvRjtJQUM3RSxZQUFZLENBQW1HO0lBQ3RILDZFQUE2RTtJQUN0RSxTQUFTLENBQThDO0lBRXJELElBQUksQ0FBZTtJQUNuQixTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQWtDLENBQUM7SUFDdEQsTUFBTSxHQUFHLElBQUksR0FBRyxFQUF1QixDQUFDO0lBQ3hDLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBd0IsQ0FBQztJQUNuRCxLQUFLLENBQVU7SUFDZixpR0FBaUc7SUFDakcsV0FBVyxHQUFHLElBQUksQ0FBQztJQUNuQixZQUFZLEdBQUcsS0FBSyxDQUFDO0lBRXJCLFlBQVksVUFBVSxHQUEyQixFQUFFO1FBQ2pELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUN0RSxJQUFJLENBQUMsMEJBQTBCLEdBQUcsVUFBVSxDQUFDLDBCQUEwQixJQUFJLEtBQUssQ0FBQztRQUNqRixJQUFJLENBQUMscUJBQXFCLEdBQUcsVUFBVSxDQUFDLHFCQUFxQixJQUFJLEVBQUUsQ0FBQztRQUNwRSxJQUFJLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQscUJBQXFCO0lBRXJCLDREQUE0RDtJQUNyRCxVQUFVLENBQUMsVUFBa0M7UUFDbEQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRTtZQUNyQyxHQUFHLFVBQVU7WUFDYixhQUFhLEVBQUUsQ0FBQyxVQUFVLENBQUMsYUFBYSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLEtBQUssRUFBRSxDQUFDLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztTQUNqSCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sT0FBTyxDQUFDLFVBQWtCO1FBQy9CLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELDRGQUE0RjtJQUNyRixZQUFZLENBQUMsVUFBMkM7UUFDN0QsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNuQyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzlCLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxPQUFPLFVBQVUsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUNqRixJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNqQyxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxPQUFPLG9CQUFvQixDQUFDLENBQUM7UUFDekYsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLEdBQUcsT0FBTyxDQUFDO0lBQ3ZCLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksb0JBQW9CLENBQUMsVUFBa0IsRUFBRSxpQkFBeUIsRUFBRSxRQUF5QjtRQUNsRyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2hELE1BQU0sYUFBYSxHQUFHLENBQUMsT0FBTyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssaUJBQWlCLENBQUMsQ0FBQztRQUM1RyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQ2IsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLGFBQWEsRUFBRSxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssaUJBQWlCLENBQUMsQ0FBQztZQUMzRixhQUFhLENBQUMsSUFBSSxDQUFDO2dCQUNqQixFQUFFLEVBQUUsaUJBQWlCO2dCQUNyQixJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksSUFBSSxpQkFBaUI7Z0JBQ3RDLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxJQUFJLGlCQUFpQjtnQkFDdEMsS0FBSyxFQUFFLENBQUMsR0FBRyxRQUFRLENBQUM7YUFDckIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE9BQU8sQ0FBQyxhQUFhLEdBQUcsYUFBYSxDQUFDO0lBQ3hDLENBQUM7SUFFRCwwR0FBMEc7SUFDbkcsV0FBVyxDQUFDLFVBQWtCO1FBQ25DLEtBQUssTUFBTSxLQUFLLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzFDLElBQUksS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztnQkFDakMsS0FBSyxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDdkIsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQscUdBQXFHO0lBQzlGLGNBQWMsQ0FBQyxtQkFBd0IsRUFBRSxjQUE0QjtRQUMxRSxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN6QyxRQUFRLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsbUJBQW1CLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN0RixRQUFRLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsbUJBQW1CLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN4RixPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRUQsMEJBQTBCO0lBRW5CLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUM7UUFDdEIsSUFBSSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDdEIsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxXQUFXLEdBQUcsS0FBSyxDQUFDO1lBQ3pCLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDO1FBQzlCLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztRQUN4QixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksQ0FBQztJQUMzQixDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQXFDO1FBQ3RFLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdEIsTUFBTSxhQUFhLEVBQUUsQ0FBQztRQUN4QixDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNoQixNQUFNLElBQUksS0FBSyxDQUFDLHVGQUF1RixDQUFDLENBQUM7UUFDM0csQ0FBQztRQUNELElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxHQUFHLE9BQU8sR0FBRyxXQUFXLEVBQUUsQ0FBQztRQUNyQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDakcsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3JELEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM5QyxHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2hELEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDaEQsSUFBSSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDdEIsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0Qsc0ZBQXNGO1FBQ3RGLEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNuQyxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFFTSxLQUFLLENBQUMscUJBQXFCLENBQUMsVUFBa0M7UUFDbkUsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksbUJBQW1CLENBQUMsZ0JBQWdCLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNuRSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNyQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN6QixJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxLQUFLLEtBQUssVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2pELE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxnQkFBZ0IsRUFBRSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDLENBQUM7UUFDOUYsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLEtBQUssS0FBSyxVQUFVLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDdEMsTUFBTSxJQUFJLG1CQUFtQixDQUFDLGtCQUFrQixFQUFFLElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztRQUNqRixDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDeEUsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMzQixNQUFNLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztRQUMvQixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDcEQsTUFBTSxNQUFNLEdBQUcsV0FBVyxFQUFFLENBQUM7UUFDN0IsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM1RCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzlELE9BQU87WUFDTCxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87WUFDeEIsV0FBVyxFQUFFLE1BQU0sQ0FBQyxLQUFLO1lBQ3pCLFlBQVksRUFBRSxPQUFPLENBQUMsS0FBSztZQUMzQixvQkFBb0IsRUFBRSxNQUFNLENBQUMsU0FBUztZQUN0QyxHQUFHLENBQUMsT0FBTyxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2hFLGFBQWEsRUFBRSxPQUFPLENBQUMsYUFBYSxJQUFJLElBQUk7WUFDNUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNsRixhQUFhLEVBQUUsQ0FBQyxPQUFPLENBQUMsYUFBYSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLEtBQUssRUFBRSxDQUFDLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztTQUM5RyxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQUMsUUFBZ0IsRUFBRSxPQUF1QjtRQUNoRSxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sYUFBYSxFQUFFLENBQUM7UUFDeEIsQ0FBQztRQUNELElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUMxRCxJQUFJLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQzNCLE1BQU0sSUFBSSxDQUFDLGlCQUFpQixDQUFDO1FBQy9CLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN6QyxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsS0FBSyxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDdkIsQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsc0JBQXNCLENBQUMsVUFJbkM7UUFDQyxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxhQUFhLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDNUMsTUFBTSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUMsRUFBRSxHQUFHLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDN0MsSUFBSSxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksQ0FBQyxvQkFBb0IsQ0FBQztRQUNsQyxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sUUFBUSxHQUFpQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDMUYsSUFBSSxDQUFDLEtBQUssSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDckcsT0FBTyxRQUFRLENBQUM7UUFDbEIsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLFVBQVUsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNuSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsT0FBTyxRQUFRLENBQUM7UUFDbEIsQ0FBQztRQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDM0YsQ0FBQztJQUVNLEtBQUssQ0FBQyxhQUFhLENBQUMsZUFBdUI7UUFDaEQsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDMUUsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ3hDLElBQUksSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQztRQUM1QixDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLEtBQUssSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDeEQsTUFBTSxJQUFJLHVCQUF1QixDQUFDLElBQUksS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2YsdURBQXVEO1lBQ3ZELEtBQUssTUFBTSxLQUFLLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO29CQUNsQyxLQUFLLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztnQkFDdkIsQ0FBQztZQUNILENBQUM7WUFDRCxNQUFNLElBQUksdUJBQXVCLENBQUMsSUFBSSxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsS0FBSyxDQUFDLElBQUksR0FBRyxJQUFJLENBQUM7UUFDbEIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakUsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkUsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUM1RyxDQUFDO0lBRUQsc0JBQXNCO0lBRWQsY0FBYyxDQUFDLFVBQWtCO1FBQ3ZDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQy9DLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDMUUsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxLQUFLLENBQUMsT0FBNkIsRUFBRSxVQUFrQixFQUFFLFNBQWlCO1FBQ2hGLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxXQUFXLEVBQUUsQ0FBQztRQUNyRSxNQUFNLFNBQVMsR0FBRyxPQUFPLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQywwQkFBMEIsR0FBRyxDQUFDO1lBQzNFLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLEdBQUcsSUFBSSxDQUFDLDBCQUEwQixHQUFHLEtBQUs7WUFDdkQsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNOLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQzNILE9BQU8sRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUM7SUFDOUIsQ0FBQztJQUVPLE1BQU0sQ0FBQyxRQUFzQjtRQUNuQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztDQUNGIn0=
+// ---- bearer clients ----
+/** A PKCE pair as a bearer client makes one: the verifier it keeps and the S256 challenge it sends. */
+export const createBearerPkcePair = () => {
+    const verifier = plugins.crypto.randomBytes(32).toString('base64url');
+    return { verifier, challenge: pkceChallengeOf(verifier) };
+};
+const POPUP_DATA = new RegExp(`<script type="application/json" id="${RELYING_PARTY_BEARER_POPUP_DATA_ID}">([^<]*)</script>`, 'u');
+/**
+ * Reads the answer of a bearer login's callback the way its client would:
+ * the `code`, `error` and `state` of a redirect's location, or the message
+ * and target origin of a popup page. Anything else throws.
+ */
+export const readBearerDelivery = async (responseArg) => {
+    const location = responseArg.headers.get('location');
+    if (responseArg.status === 302 && location) {
+        const url = new URL(location);
+        const read = { target: '' };
+        for (const name of ['code', 'error', 'state']) {
+            const value = url.searchParams.get(name);
+            if (value !== null) {
+                read[name] = value;
+            }
+        }
+        url.search = '';
+        read.target = url.href;
+        return read;
+    }
+    const data = responseArg.status === 200 ? POPUP_DATA.exec(await responseArg.text())?.[1] : undefined;
+    if (data === undefined) {
+        throw new Error(`readBearerDelivery: a response with status ${responseArg.status} is no bearer delivery`);
+    }
+    const delivery = JSON.parse(data);
+    return {
+        target: delivery.targetOrigin,
+        message: delivery.message,
+        ...(delivery.message.code !== undefined ? { code: delivery.message.code } : {}),
+        ...(delivery.message.error !== undefined ? { error: delivery.message.error } : {}),
+        ...(delivery.message.state !== undefined ? { state: delivery.message.state } : {}),
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdGluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS90ZXN0aW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBQ3hDLE9BQU8sRUFDTCw2QkFBNkIsRUFDN0IsbUJBQW1CLEVBQ25CLHVCQUF1QixHQVN4QixNQUFNLDhCQUE4QixDQUFDO0FBQ3RDLE9BQU8sRUFBRSxlQUFlLEVBQUUsa0NBQWtDLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQWlEMUYsTUFBTSxXQUFXLEdBQUcsR0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBRXZGLGdHQUFnRztBQUNoRyxNQUFNLGFBQWEsR0FBRyxHQUFVLEVBQUUsQ0FBQyxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0FBRXpGOzs7Ozs7Ozs7OztHQVdHO0FBQ0gsTUFBTSxPQUFPLDBCQUEwQjtJQUNyQixxQkFBcUIsQ0FBUztJQUM5QixNQUFNLENBQVM7SUFDeEIsMEJBQTBCLENBQVM7SUFFMUIsY0FBYyxHQUFnQyxFQUFFLENBQUM7SUFDakQsV0FBVyxHQUE4QyxFQUFFLENBQUM7SUFDNUQsV0FBVyxHQUFtRCxFQUFFLENBQUM7SUFDakUsY0FBYyxHQUE0RSxFQUFFLENBQUM7SUFDN0YsU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUN6QyxpREFBaUQ7SUFDMUMsV0FBVyxHQUFHLENBQUMsQ0FBQztJQUV2Qjs7Ozs7OztPQU9HO0lBQ0ksZ0JBQWdCLENBQVM7SUFDaEMsbUdBQW1HO0lBQzVGLGlCQUFpQixDQUFTO0lBQ2pDLG1IQUFtSDtJQUM1RyxvQkFBb0IsQ0FBUztJQUNwQyw0Q0FBNEM7SUFDckMsY0FBYyxDQUFTO0lBQzlCLHNFQUFzRTtJQUMvRCxpQkFBaUIsQ0FBUztJQUNqQyxvRkFBb0Y7SUFDN0UsWUFBWSxDQUFtRztJQUN0SCw2RUFBNkU7SUFDdEUsU0FBUyxDQUE4QztJQUVyRCxJQUFJLENBQWU7SUFDbkIsU0FBUyxHQUFHLElBQUksR0FBRyxFQUFrQyxDQUFDO0lBQ3RELE1BQU0sR0FBRyxJQUFJLEdBQUcsRUFBdUIsQ0FBQztJQUN4QyxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQXdCLENBQUM7SUFDbkQsS0FBSyxDQUFVO0lBQ2YsaUdBQWlHO0lBQ2pHLFdBQVcsR0FBRyxJQUFJLENBQUM7SUFDbkIsWUFBWSxHQUFHLEtBQUssQ0FBQztJQUVyQixZQUFZLFVBQVUsR0FBMkIsRUFBRTtRQUNqRCxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxNQUFNLElBQUksa0JBQWtCLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFDdEUsSUFBSSxDQUFDLDBCQUEwQixHQUFHLFVBQVUsQ0FBQywwQkFBMEIsSUFBSSxLQUFLLENBQUM7UUFDakYsSUFBSSxDQUFDLHFCQUFxQixHQUFHLFVBQVUsQ0FBQyxxQkFBcUIsSUFBSSxFQUFFLENBQUM7UUFDcEUsSUFBSSxDQUFDLElBQUksR0FBRyxVQUFVLENBQUMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVELHFCQUFxQjtJQUVyQiw0REFBNEQ7SUFDckQsVUFBVSxDQUFDLFVBQWtDO1FBQ2xELElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUU7WUFDckMsR0FBRyxVQUFVO1lBQ2IsYUFBYSxFQUFFLENBQUMsVUFBVSxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDakgsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLE9BQU8sQ0FBQyxVQUFrQjtRQUMvQixPQUFPLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCw0RkFBNEY7SUFDckYsWUFBWSxDQUFDLFVBQTJDO1FBQzdELElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbkMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM5QixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxVQUFVLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUM7UUFDakYsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDakMsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsT0FBTyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQztJQUN2QixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLG9CQUFvQixDQUFDLFVBQWtCLEVBQUUsaUJBQXlCLEVBQUUsUUFBeUI7UUFDbEcsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNoRCxNQUFNLGFBQWEsR0FBRyxDQUFDLE9BQU8sQ0FBQyxhQUFhLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLGlCQUFpQixDQUFDLENBQUM7UUFDNUcsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNiLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLGlCQUFpQixDQUFDLENBQUM7WUFDM0YsYUFBYSxDQUFDLElBQUksQ0FBQztnQkFDakIsRUFBRSxFQUFFLGlCQUFpQjtnQkFDckIsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLElBQUksaUJBQWlCO2dCQUN0QyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksSUFBSSxpQkFBaUI7Z0JBQ3RDLEtBQUssRUFBRSxDQUFDLEdBQUcsUUFBUSxDQUFDO2FBQ3JCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxPQUFPLENBQUMsYUFBYSxHQUFHLGFBQWEsQ0FBQztJQUN4QyxDQUFDO0lBRUQsMEdBQTBHO0lBQ25HLFdBQVcsQ0FBQyxVQUFrQjtRQUNuQyxLQUFLLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUMxQyxJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQ2pDLEtBQUssQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ3ZCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVELHFHQUFxRztJQUM5RixjQUFjLENBQUMsbUJBQXdCLEVBQUUsY0FBNEI7UUFDMUUsTUFBTSxRQUFRLEdBQUcsSUFBSSxHQUFHLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDekMsUUFBUSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDdEYsUUFBUSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLG1CQUFtQixDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDeEYsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUVELDBCQUEwQjtJQUVuQixLQUFLLENBQUMsSUFBSTtRQUNmLElBQUksQ0FBQyxXQUFXLElBQUksQ0FBQyxDQUFDO1FBQ3RCLElBQUksSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3RCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsV0FBVyxHQUFHLEtBQUssQ0FBQztZQUN6QixNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUM5QixDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUM7UUFDeEIsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUM7SUFDM0IsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFxQztRQUN0RSxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sYUFBYSxFQUFFLENBQUM7UUFDeEIsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDaEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1RkFBdUYsQ0FBQyxDQUFDO1FBQzNHLENBQUM7UUFDRCxJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUM1QyxNQUFNLElBQUksR0FBRyxPQUFPLEdBQUcsV0FBVyxFQUFFLENBQUM7UUFDckMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ2pHLE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLGtCQUFrQixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNyRCxHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDOUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNoRCxHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2hELElBQUksVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3RCLEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUNELHNGQUFzRjtRQUN0RixHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDbkMsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQWtDO1FBQ25FLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLG1CQUFtQixDQUFDLGdCQUFnQixFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHLFVBQVUsQ0FBQyxXQUFXLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbkUsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDckMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDekIsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsS0FBSyxLQUFLLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNqRCxNQUFNLElBQUksbUJBQW1CLENBQUMsZ0JBQWdCLEVBQUUsSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQyxDQUFDO1FBQzlGLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxLQUFLLEtBQUssVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3RDLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLElBQUksSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFDL0IsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3BELE1BQU0sTUFBTSxHQUFHLFdBQVcsRUFBRSxDQUFDO1FBQzdCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM5RCxPQUFPO1lBQ0wsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO1lBQ3hCLFdBQVcsRUFBRSxNQUFNLENBQUMsS0FBSztZQUN6QixZQUFZLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDM0Isb0JBQW9CLEVBQUUsTUFBTSxDQUFDLFNBQVM7WUFDdEMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxhQUFhLEVBQUUsT0FBTyxDQUFDLGFBQWEsSUFBSSxJQUFJO1lBQzVDLEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEYsYUFBYSxFQUFFLENBQUMsT0FBTyxDQUFDLGFBQWEsSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7U0FDOUcsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQWdCLEVBQUUsT0FBdUI7UUFDaEUsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN0QixNQUFNLGFBQWEsRUFBRSxDQUFDO1FBQ3hCLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDMUQsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMzQixNQUFNLElBQUksQ0FBQyxpQkFBaUIsQ0FBQztRQUMvQixDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDekMsSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUNWLEtBQUssQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1FBQ3ZCLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLHNCQUFzQixDQUFDLFVBSW5DO1FBQ0MsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDMUUsQ0FBQztRQUNELElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDLEVBQUUsR0FBRyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLElBQUksSUFBSSxDQUFDLG9CQUFvQixFQUFFLENBQUM7WUFDOUIsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUM7UUFDbEMsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN2RCxNQUFNLFFBQVEsR0FBaUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQzFGLElBQUksQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3JHLE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFDRCxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsYUFBYSxFQUFFLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsS0FBSyxVQUFVLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDbkksSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDO0lBQzNGLENBQUM7SUFFTSxLQUFLLENBQUMsYUFBYSxDQUFDLGVBQXVCO1FBQ2hELElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGFBQWEsRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNyQyxNQUFNLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUN4QyxJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksQ0FBQyxjQUFjLENBQUM7UUFDNUIsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2hELElBQUksQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3hELE1BQU0sSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLEtBQUssQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNmLHVEQUF1RDtZQUN2RCxLQUFLLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztnQkFDMUMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztvQkFDbEMsS0FBSyxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7Z0JBQ3ZCLENBQUM7WUFDSCxDQUFDO1lBQ0QsTUFBTSxJQUFJLHVCQUF1QixDQUFDLElBQUksS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELEtBQUssQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO1FBQ2xCLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2pFLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ25FLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxZQUFZLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxvQkFBb0IsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDNUcsQ0FBQztJQUVELHNCQUFzQjtJQUVkLGNBQWMsQ0FBQyxVQUFrQjtRQUN2QyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMvQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRU8sS0FBSyxDQUFDLE9BQTZCLEVBQUUsVUFBa0IsRUFBRSxTQUFpQjtRQUNoRixNQUFNLEtBQUssR0FBRyxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsV0FBVyxFQUFFLENBQUM7UUFDckUsTUFBTSxTQUFTLEdBQUcsT0FBTyxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsMEJBQTBCLEdBQUcsQ0FBQztZQUMzRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQywwQkFBMEIsR0FBRyxLQUFLO1lBQ3ZELENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUMzSCxPQUFPLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQzlCLENBQUM7SUFFTyxNQUFNLENBQUMsUUFBc0I7UUFDbkMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7Q0FDRjtBQUVELDJCQUEyQjtBQUUzQix1R0FBdUc7QUFDdkcsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsR0FBNEMsRUFBRTtJQUNoRixNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDdEUsT0FBTyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsZUFBZSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7QUFDNUQsQ0FBQyxDQUFDO0FBYUYsTUFBTSxVQUFVLEdBQUcsSUFBSSxNQUFNLENBQzNCLHVDQUF1QyxrQ0FBa0Msb0JBQW9CLEVBQzdGLEdBQUcsQ0FDSixDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLEtBQUssRUFBRSxXQUFxQixFQUFnQyxFQUFFO0lBQzlGLE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3JELElBQUksV0FBVyxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksUUFBUSxFQUFFLENBQUM7UUFDM0MsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDOUIsTUFBTSxJQUFJLEdBQXdCLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDO1FBQ2pELEtBQUssTUFBTSxJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBVSxFQUFFLENBQUM7WUFDdkQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDekMsSUFBSSxLQUFLLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQ25CLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUM7WUFDckIsQ0FBQztRQUNILENBQUM7UUFDRCxHQUFHLENBQUMsTUFBTSxHQUFHLEVBQUUsQ0FBQztRQUNoQixJQUFJLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUM7UUFDdkIsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLE1BQU0sS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxXQUFXLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDckcsSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsV0FBVyxDQUFDLE1BQU0sd0JBQXdCLENBQUMsQ0FBQztJQUM1RyxDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQWtFLENBQUM7SUFDbkcsT0FBTztRQUNMLE1BQU0sRUFBRSxRQUFRLENBQUMsWUFBWTtRQUM3QixPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU87UUFDekIsR0FBRyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9FLEdBQUcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRixHQUFHLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7S0FDbkYsQ0FBQztBQUNKLENBQUMsQ0FBQyJ9

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@idp.global/sdk",
-  "version": "19.2.1",
+  "version": "19.4.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
   "exports": {
     ".": "./dist_ts/index.js",
     "./browser": "./dist_ts_browser/index.js",
+    "./browser/bearer": "./dist_ts_browser/classes.relyingpartybearerclient.js",
     "./server": "./dist_ts_server/index.js",
     "./relyingparty": "./dist_ts_relyingparty/index.js",
     "./relyingparty/testing": "./dist_ts_relyingparty/testing.js"
@@ -18,10 +19,10 @@
   "dependencies": {
     "@api.global/typedrequest": "^8.2.0",
     "@api.global/typedrequest-interfaces": "^7.1.0",
-    "@api.global/typedsocket": "^8.7.0",
+    "@api.global/typedsocket": "^8.10.1",
     "@idp.global/interfaces": "^30.0.0",
     "@push.rocks/smartjson": "^6.0.1",
-    "@push.rocks/smartjwt": "^2.7.0",
+    "@push.rocks/smartjwt": "^3.0.0",
     "@push.rocks/smartpromise": "^4.2.4",
     "@push.rocks/smartrx": "^3.0.12",
     "@push.rocks/smartserve": "^6.2.2",
@@ -35,13 +36,10 @@
   },
   "devDependencies": {
     "@api.global/typedserver": "^11.4.0",
-    "@git.zone/tsbuild": "^6.0.2",
-    "@git.zone/tsdoc": "^3.0.2",
-    "@git.zone/tsrun": "^3.0.3",
-    "@git.zone/tstest": "^7.2.1",
+    "@git.zone/tsrepo": "^1.1.1",
     "@lossless.org/client": "^2.0.0",
     "@lossless.org/nosqldb": "10.5.0",
-    "@types/node": "26.6.4"
+    "@types/node": "26.6.5"
   },
   "files": [
     "ts/**/*",
@@ -73,8 +71,8 @@
     "last 1 Chrome versions"
   ],
   "scripts": {
-    "test": "pnpm run build && tstest test/ --verbose --logfile --timeout 60",
-    "build": "tsbuild tsfolders --web",
-    "buildDocs": "tsdoc"
+    "test": "pnpm run build && tsrepo test test/ --verbose --logfile --timeout 60",
+    "build": "tsrepo build tsfolders --web",
+    "buildDocs": "tsrepo docs"
   }
 }