@idp.global/sdk 19.3.0 → 19.4.0

package/dist_ts_browser/classes.relyingpartybearerclient.js

@@ -0,0 +1,591 @@
+import { RELYING_PARTY_BEARER_MESSAGE_TYPE, } from '../dist_ts_relyingparty/contract.bearer.js';
+export { RELYING_PARTY_BEARER_MESSAGE_TYPE };
+export class RelyingPartyBearerClientError extends Error {
+    code;
+    status;
+    /** the `error` the relying party answered (`TRelyingPartyBearerErrorCode`) */
+    answerError;
+    /** the `error` a delivery carried (`TRelyingPartyBearerDeliveryError`) */
+    deliveryError;
+    constructor(code, detailsArg = {}) {
+        super(code, detailsArg.cause !== undefined ? { cause: detailsArg.cause } : undefined);
+        this.code = code;
+        this.name = 'RelyingPartyBearerClientError';
+        if (detailsArg.status !== undefined)
+            this.status = detailsArg.status;
+        if (detailsArg.answerError !== undefined)
+            this.answerError = detailsArg.answerError;
+        if (detailsArg.deliveryError !== undefined)
+            this.deliveryError = detailsArg.deliveryError;
+    }
+}
+const DEFAULT_LOGIN_PATH_PREFIX = '/auth/';
+const DEFAULT_REFRESH_SKEW_MS = 60_000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+/** Every tab of the origin waits on the lock while a section runs: two minutes at most. */
+const MAX_REQUEST_TIMEOUT_MS = 120_000;
+/** The life of a login attempt at the relying party (`LOGIN_ATTEMPT_MAX_AGE_SECONDS`). */
+const DEFAULT_POPUP_TIMEOUT_MS = 10 * 60 * 1_000;
+const DEFAULT_POPUP_FEATURES = 'popup,width=480,height=720';
+const POPUP_CLOSED_POLL_MS = 500;
+/** A popup posts and closes at once; its message can arrive after the opener sees it closed. */
+const POPUP_CLOSED_GRACE_MS = 1_000;
+/** 32 random bytes: a 43-character verifier and state (RFC 7636 §4.1). */
+const RANDOM_BYTES = 32;
+const DELIVERY_PARAMS = ['code', 'error', 'state'];
+const base64Url = (bytesArg) => {
+    let binary = '';
+    for (const byte of bytesArg)
+        binary += String.fromCharCode(byte);
+    return globalThis.btoa(binary).replace(/\+/gu, '-').replace(/\//gu, '_').replace(/=+$/u, '');
+};
+const randomBase64Url = () => base64Url(globalThis.crypto.getRandomValues(new Uint8Array(RANDOM_BYTES)));
+/** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
+const pkceChallengeOf = async (verifierArg) => base64Url(new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifierArg))));
+const isRecord = (valueArg) => typeof valueArg === 'object' && valueArg !== null && !Array.isArray(valueArg);
+const isText = (valueArg) => typeof valueArg === 'string' && valueArg.length > 0;
+const isTime = (valueArg) => typeof valueArg === 'number' && Number.isFinite(valueArg);
+/** Throws `request_failed` once a section's deadline has fired: nothing is sent or written past it. */
+const inTime = (signalArg) => {
+    if (signalArg.aborted) {
+        throw new RelyingPartyBearerClientError('request_failed');
+    }
+};
+/** The one value of a parameter, or `undefined` when it is absent or repeated. */
+const singleParam = (paramsArg, nameArg) => {
+    const values = paramsArg.getAll(nameArg);
+    return values.length === 1 ? values[0] : undefined;
+};
+/** A token answer exactly as the bearer contract says, or `null`. */
+const tokenAnswerOf = (answerArg) => {
+    if (!isRecord(answerArg)
+        || answerArg.tokenType !== 'Bearer'
+        || !isText(answerArg.accessToken)
+        || !isText(answerArg.refreshToken)
+        || !isTime(answerArg.accessTokenExpiresAt)
+        || !isTime(answerArg.expiresIn)
+        || answerArg.expiresIn <= 0
+        || !isTime(answerArg.refreshTokenExpiresAt)
+        || !isRecord(answerArg.session)
+        || !isText(answerArg.session.sessionId)
+        || !isText(answerArg.session.principalId)
+        || !isTime(answerArg.session.expiresAt)) {
+        return null;
+    }
+    return {
+        tokenType: 'Bearer',
+        accessToken: answerArg.accessToken,
+        accessTokenExpiresAt: answerArg.accessTokenExpiresAt,
+        expiresIn: answerArg.expiresIn,
+        refreshToken: answerArg.refreshToken,
+        refreshTokenExpiresAt: answerArg.refreshTokenExpiresAt,
+        session: {
+            sessionId: answerArg.session.sessionId,
+            principalId: answerArg.session.principalId,
+            expiresAt: answerArg.session.expiresAt,
+        },
+    };
+};
+/**
+ * The browser side of bearer hand-off (`@idp.global/sdk/relyingparty`
+ * `bearer`): it starts a `web` or `popup` login with PKCE and a state,
+ * receives the delivery, claims the code once and keeps the token pair in
+ * the application's storage. Every refresh, logout and store of a claimed
+ * pair holds one Web Lock, so the tabs of an origin rotate the pair one at a
+ * time: inside the lock the pair is read from storage again, a pair another
+ * tab rotated is used as it is, and a rotated pair is stored before the lock
+ * is released and before its access token is handed out. Each claim and
+ * each section that holds the lock ends by `requestTimeoutMs`, so a hanging
+ * request or write never holds the other tabs. A login replaces the stored
+ * pair and ends that pair's session. Rotation is strict at the relying
+ * party: a refresh token spent once ends the session when it comes back, so
+ * nothing here retries a claim or a refresh.
+ *
+ * It needs the Web Locks API and Web Crypto, both of them only in a secure
+ * context, and has no fallback for either.
+ */
+export class RelyingPartyBearerClient {
+    origin;
+    #paths;
+    #storage;
+    #lockName;
+    #refreshSkewMs;
+    #requestTimeoutMs;
+    #locks;
+    #fetch;
+    #window;
+    #now;
+    /** the states of the logins received here; a login is received once */
+    #receivedStates = new Set();
+    constructor(optionsArg) {
+        const origin = optionsArg?.origin;
+        let parsedOrigin = null;
+        try {
+            parsedOrigin = typeof origin === 'string' ? new URL(origin) : null;
+        }
+        catch {
+            parsedOrigin = null;
+        }
+        if (!parsedOrigin || parsedOrigin.origin !== origin || !['https:', 'http:'].includes(parsedOrigin.protocol)) {
+            throw new Error('origin must be the relying party\'s exact origin, such as https://app.example');
+        }
+        const prefix = optionsArg.loginPathPrefix ?? DEFAULT_LOGIN_PATH_PREFIX;
+        if (typeof prefix !== 'string' || !/^\/(?:[A-Za-z0-9._~-]+\/)*$/u.test(prefix)) {
+            throw new Error('loginPathPrefix must be a path that starts and ends with /');
+        }
+        const storage = optionsArg.storage;
+        if (!storage || typeof storage.get !== 'function' || typeof storage.set !== 'function' || typeof storage.clear !== 'function') {
+            throw new Error('storage must have get, set and clear');
+        }
+        const locks = optionsArg.locks ?? globalThis.navigator?.locks;
+        if (!locks || typeof locks.request !== 'function') {
+            throw new Error('RelyingPartyBearerClient needs the Web Locks API (navigator.locks)');
+        }
+        if (typeof globalThis.crypto?.subtle?.digest !== 'function' || typeof globalThis.crypto.getRandomValues !== 'function') {
+            throw new Error('RelyingPartyBearerClient needs Web Crypto (crypto.subtle), which a browser offers only in a secure context');
+        }
+        const fetchFunction = optionsArg.fetch ?? globalThis.fetch?.bind(globalThis);
+        if (typeof fetchFunction !== 'function') {
+            throw new Error('RelyingPartyBearerClient needs fetch');
+        }
+        const refreshSkewMs = optionsArg.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+        if (!Number.isInteger(refreshSkewMs) || refreshSkewMs < 0) {
+            throw new Error('refreshSkewMs must be a whole number of milliseconds');
+        }
+        // only an absent deadline takes the default: any other value that is not one throws
+        const requestTimeoutMs = optionsArg.requestTimeoutMs === undefined ? DEFAULT_REQUEST_TIMEOUT_MS : optionsArg.requestTimeoutMs;
+        if (typeof requestTimeoutMs !== 'number'
+            || !Number.isFinite(requestTimeoutMs)
+            || requestTimeoutMs <= 0
+            || requestTimeoutMs > MAX_REQUEST_TIMEOUT_MS) {
+            throw new Error(`requestTimeoutMs must be more than 0 and at most ${MAX_REQUEST_TIMEOUT_MS} milliseconds`);
+        }
+        this.origin = origin;
+        this.#paths = {
+            login: `${origin}${prefix}bearer/login`,
+            claim: `${origin}${prefix}bearer/claim`,
+            refresh: `${origin}${prefix}bearer/refresh`,
+            logout: `${origin}${prefix}bearer/logout`,
+        };
+        this.#storage = storage;
+        this.#lockName = optionsArg.lockName ?? `idp.global/relyingparty:bearer-tokens ${origin}`;
+        this.#refreshSkewMs = refreshSkewMs;
+        this.#requestTimeoutMs = requestTimeoutMs;
+        this.#locks = locks;
+        this.#fetch = fetchFunction;
+        this.#window = optionsArg.window ?? globalThis.window;
+        this.#now = optionsArg.now ?? Date.now;
+    }
+    /**
+     * A new login: a fresh verifier, its S256 challenge and a state, each from
+     * 32 random bytes, and the URL that starts it. Make a popup login before
+     * the click that opens it: this is async, and a browser opens a popup only
+     * within the user's gesture.
+     */
+    async createLogin(optionsArg) {
+        const { clientKind, returnTarget } = optionsArg ?? {};
+        if (clientKind !== 'web' && clientKind !== 'popup') {
+            throw new Error('a browser signs in as a web or popup client');
+        }
+        if (!isText(returnTarget)) {
+            throw new Error('returnTarget must name the configured return target');
+        }
+        const codeVerifier = randomBase64Url();
+        const state = randomBase64Url();
+        const url = new URL(this.#paths.login);
+        url.searchParams.set('client_kind', clientKind);
+        url.searchParams.set('return_target', returnTarget);
+        url.searchParams.set('code_challenge', await pkceChallengeOf(codeVerifier));
+        url.searchParams.set('code_challenge_method', 'S256');
+        url.searchParams.set('state', state);
+        return { clientKind, returnTarget, state, codeVerifier, url: url.href };
+    }
+    /**
+     * Receives a `web` login on its return target page. The delivery leaves
+     * the address first, before anything is checked, so neither a reload nor
+     * the history holds the code. A delivery whose state is not the login's is
+     * refused unclaimed; a code is claimed once, and a failed claim is not
+     * retried. The claimed pair replaces the stored one, whose session is
+     * ended then (`IRelyingPartyBearerLoginResult`). Answers `null` on a page
+     * that holds no delivery.
+     */
+    async completeRedirectLogin(loginArg) {
+        const window = this.requireWindow();
+        const url = new URL(window.location.href);
+        if (!DELIVERY_PARAMS.some((nameArg) => url.searchParams.has(nameArg))) {
+            return null;
+        }
+        const delivered = url.searchParams;
+        const code = singleParam(delivered, 'code');
+        const error = singleParam(delivered, 'error');
+        const state = singleParam(delivered, 'state');
+        const kept = new URL(url.href);
+        for (const name of DELIVERY_PARAMS) {
+            kept.searchParams.delete(name);
+        }
+        window.history.replaceState(window.history.state, '', kept.pathname + kept.search + kept.hash);
+        if (!loginArg || loginArg.clientKind !== 'web' || state === undefined || state !== loginArg.state) {
+            throw new RelyingPartyBearerClientError('state_mismatch');
+        }
+        return this.receive(loginArg, code, error);
+    }
+    /**
+     * Opens a `popup` login and receives what its page posts: a message is
+     * taken only from the relying party's origin, from this very popup, of the
+     * bearer message type and with the login's state; any other is ignored.
+     * The popup opens before this returns, so call it in the click handler
+     * itself, with a login made beforehand. The claimed pair replaces the
+     * stored one like `completeRedirectLogin`'s.
+     */
+    openPopupLogin(loginArg, optionsArg = {}) {
+        let window;
+        try {
+            window = this.requireWindow();
+            if (!loginArg || loginArg.clientKind !== 'popup') {
+                throw new Error('openPopupLogin needs a popup login');
+            }
+            if (this.#receivedStates.has(loginArg.state)) {
+                throw new RelyingPartyBearerClientError('already_received');
+            }
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        let popup;
+        try {
+            popup = window.open(loginArg.url, '_blank', optionsArg.windowFeatures ?? DEFAULT_POPUP_FEATURES);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        if (!popup) {
+            return Promise.reject(new RelyingPartyBearerClientError('popup_blocked'));
+        }
+        return this.receivePopup(window, popup, loginArg, optionsArg);
+    }
+    /**
+     * An access token to send right now, or `null` when there is no session.
+     * One that is about to end is rotated first, by one tab for all of them.
+     */
+    async accessToken() {
+        const stored = await this.#storage.get();
+        if (!stored) {
+            return null;
+        }
+        if (this.isFresh(stored)) {
+            return stored.accessToken;
+        }
+        return (await this.rotate(stored.refreshToken, null))?.accessToken ?? null;
+    }
+    /**
+     * Rotates the pair now — after the relying party refused
+     * `rejectedAccessTokenArg`, say — unless another tab already did, and
+     * answers the pair to use: `null` once the session is over, which clears
+     * the storage. A relying party that cannot refresh right now
+     * (`authority_unavailable`) keeps the pair as it is; try again later.
+     */
+    async refresh(rejectedAccessTokenArg) {
+        const stored = await this.#storage.get();
+        if (!stored) {
+            return null;
+        }
+        return this.rotate(stored.refreshToken, rejectedAccessTokenArg ?? null);
+    }
+    /**
+     * Clears the storage and then ends the session at the relying party with
+     * the pair it held, and answers whether that ended a live session. When the
+     * relying party cannot be reached, refuses or gives no answer by
+     * `requestTimeoutMs`, the call throws `session_not_revoked` with that
+     * failure as its `cause`: this device is signed out, and the session may
+     * live on at the relying party until it expires, so tell the user they are
+     * signed out on this device only. A deadline that fires before the storage
+     * is cleared throws `request_failed`, and the pair stays.
+     */
+    async logout() {
+        let cleared = false;
+        const notRevoked = (errorArg) => new RelyingPartyBearerClientError('session_not_revoked', { cause: errorArg });
+        return this.#locks.request(this.#lockName, () => this.withDeadline(async (signalArg) => {
+            const current = await this.#storage.get();
+            if (!current) {
+                return false;
+            }
+            inTime(signalArg);
+            await this.#storage.clear({ signal: signalArg });
+            cleared = true;
+            try {
+                return await this.endSessionOf(current, signalArg);
+            }
+            catch (error) {
+                throw notRevoked(error);
+            }
+        }, () => {
+            // once the pair is cleared this device is signed out, whatever the request still does
+            const failure = new RelyingPartyBearerClientError('request_failed');
+            throw cleared ? notRevoked(failure) : failure;
+        }));
+    }
+    requireWindow() {
+        if (!this.#window) {
+            throw new Error('the login receivers of RelyingPartyBearerClient need a window');
+        }
+        return this.#window;
+    }
+    isFresh(storedArg) {
+        const lifetimeMs = storedArg.expiresIn * 1_000;
+        const skewMs = Math.min(this.#refreshSkewMs, lifetimeMs / 2);
+        return this.#now() < storedArg.receivedAt + lifetimeMs - skewMs;
+    }
+    /** Takes a delivery for its login, once, claims its code and stores the pair in place of the one before. */
+    async receive(loginArg, codeArg, errorArg) {
+        if (this.#receivedStates.has(loginArg.state)) {
+            throw new RelyingPartyBearerClientError('already_received');
+        }
+        this.#receivedStates.add(loginArg.state);
+        if (errorArg !== undefined) {
+            throw new RelyingPartyBearerClientError(isText(errorArg) && codeArg === undefined ? 'login_failed' : 'unexpected_answer', {
+                ...(isText(errorArg) ? { deliveryError: errorArg } : {}),
+            });
+        }
+        if (!isText(codeArg)) {
+            throw new RelyingPartyBearerClientError('unexpected_answer');
+        }
+        // the claim touches no stored pair, so it holds no lock, only its own deadline; a failed one leaves the stored pair as it was
+        const answer = tokenAnswerOf(await this.withDeadline((signalArg) => this.post(this.#paths.claim, { code: codeArg, codeVerifier: loginArg.codeVerifier }, {}, signalArg)));
+        if (!answer) {
+            throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+        }
+        return this.replacePair({ ...answer, receivedAt: this.#now() });
+    }
+    /**
+     * Stores a claimed pair in place of the stored one and then ends the
+     * session of that one with its tokens, held here, through the logout
+     * route. Both run under the lock a refresh holds, so no tab rotates the
+     * replaced pair meanwhile. A session that cannot be ended is the result's
+     * `previous_session_not_revoked`, neither thrown nor dropped: the new pair
+     * is stored by then.
+     */
+    replacePair(tokensArg) {
+        /** what the login answers if the deadline fires now: nothing before the pair is stored */
+        let atDeadline = null;
+        const notRevoked = (errorArg) => ({
+            tokens: tokensArg,
+            previousSession: 'previous_session_not_revoked',
+            previousSessionError: errorArg instanceof RelyingPartyBearerClientError
+                ? errorArg
+                : new RelyingPartyBearerClientError('unexpected_answer', { cause: errorArg }),
+        });
+        return this.#locks.request(this.#lockName, () => this.withDeadline(async (signalArg) => {
+            const previous = await this.#storage.get();
+            inTime(signalArg);
+            await this.#storage.set(tokensArg, { signal: signalArg });
+            if (!previous) {
+                return { tokens: tokensArg, previousSession: 'no_previous_session' };
+            }
+            if (previous.session.sessionId === tokensArg.session.sessionId) {
+                return { tokens: tokensArg, previousSession: 'same_session' };
+            }
+            atDeadline = notRevoked(new RelyingPartyBearerClientError('request_failed'));
+            try {
+                await this.endSessionOf(previous, signalArg);
+                return { tokens: tokensArg, previousSession: 'previous_session_ended' };
+            }
+            catch (error) {
+                return notRevoked(error);
+            }
+        }, () => {
+            // past its write the login stands; only the end of the previous session is cut short
+            if (!atDeadline) {
+                throw new RelyingPartyBearerClientError('request_failed');
+            }
+            return atDeadline;
+        }));
+    }
+    receivePopup(windowArg, popupArg, loginArg, optionsArg) {
+        return new Promise((resolve, reject) => {
+            const cleanups = [];
+            let settled = false;
+            const settle = (actionArg) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                for (const cleanup of cleanups) {
+                    cleanup();
+                }
+                actionArg();
+            };
+            const fail = (errorArg) => settle(() => reject(errorArg));
+            const onMessage = (eventArg) => {
+                const data = eventArg?.data;
+                if (eventArg?.origin !== this.origin
+                    || eventArg.source !== popupArg
+                    || !isRecord(data)
+                    || data.type !== RELYING_PARTY_BEARER_MESSAGE_TYPE
+                    || data.state !== loginArg.state) {
+                    return;
+                }
+                settle(() => {
+                    this.receive(loginArg, data.code, data.error).then(resolve, reject);
+                });
+            };
+            windowArg.addEventListener('message', onMessage);
+            cleanups.push(() => windowArg.removeEventListener('message', onMessage));
+            const timeout = setTimeout(() => fail(new RelyingPartyBearerClientError('popup_timeout')), optionsArg.timeoutMs ?? DEFAULT_POPUP_TIMEOUT_MS);
+            cleanups.push(() => clearTimeout(timeout));
+            let closedGrace;
+            const closedPoll = setInterval(() => {
+                if (popupArg.closed && closedGrace === undefined) {
+                    closedGrace = setTimeout(() => fail(new RelyingPartyBearerClientError('popup_closed')), POPUP_CLOSED_GRACE_MS);
+                }
+            }, POPUP_CLOSED_POLL_MS);
+            cleanups.push(() => {
+                clearInterval(closedPoll);
+                if (closedGrace !== undefined) {
+                    clearTimeout(closedGrace);
+                }
+            });
+            const signal = optionsArg.signal;
+            if (signal) {
+                if (signal.aborted) {
+                    fail(signal.reason);
+                    return;
+                }
+                const onAbort = () => fail(signal.reason);
+                signal.addEventListener('abort', onAbort, { once: true });
+                cleanups.push(() => signal.removeEventListener('abort', onAbort));
+            }
+        });
+    }
+    /**
+     * One rotation under the lock. The pair is read again inside it: one
+     * whose refresh token is no longer `seenRefreshTokenArg`, or whose access
+     * token is no longer `rejectedAccessTokenArg`, was rotated already and is
+     * used as it is. A rotated pair is stored before the lock is released. The
+     * whole section has one deadline: past it, the lock is released with
+     * `request_failed` and an answer that still arrives is dropped unstored.
+     */
+    rotate(seenRefreshTokenArg, rejectedAccessTokenArg) {
+        return this.#locks.request(this.#lockName, () => this.withDeadline(async (signalArg) => {
+            const current = await this.#storage.get();
+            if (!current) {
+                return null;
+            }
+            if (current.refreshToken !== seenRefreshTokenArg
+                || (rejectedAccessTokenArg !== null && current.accessToken !== rejectedAccessTokenArg)) {
+                return current;
+            }
+            let answer;
+            try {
+                answer = tokenAnswerOf(await this.post(this.#paths.refresh, { refreshToken: current.refreshToken }, {}, signalArg));
+            }
+            catch (error) {
+                if (error instanceof RelyingPartyBearerClientError && error.answerError === 'invalid_bearer_grant') {
+                    // the session is over: this pair opens nothing any more
+                    inTime(signalArg);
+                    await this.#storage.clear({ signal: signalArg });
+                    return null;
+                }
+                throw error;
+            }
+            if (!answer) {
+                throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+            }
+            const stored = { ...answer, receivedAt: this.#now() };
+            inTime(signalArg);
+            await this.#storage.set(stored, { signal: signalArg });
+            return stored;
+        }));
+    }
+    /** Ends the session of a pair through the logout route and answers whether that ended a live one. */
+    async endSessionOf(pairArg, signalArg) {
+        const answer = await this.post(this.#paths.logout, { refreshToken: pairArg.refreshToken }, { authorization: `Bearer ${pairArg.accessToken}` }, signalArg);
+        if (!isRecord(answer) || typeof answer.endedLiveSession !== 'boolean') {
+            throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+        }
+        return answer.endedLiveSession;
+    }
+    /**
+     * Runs one operation, a claim or a section that holds the lock, under
+     * `requestTimeoutMs`. When the deadline fires, the section's signal aborts
+     * its request and its storage write and keeps it from writing anything
+     * more (`inTime`), and the call answers `onDeadlineArg()` at once, so the
+     * lock is released whatever the request or the storage still does.
+     */
+    async withDeadline(sectionArg, onDeadlineArg = () => {
+        throw new RelyingPartyBearerClientError('request_failed');
+    }) {
+        const controller = new AbortController();
+        let timer;
+        const deadline = new Promise((resolve, reject) => {
+            timer = setTimeout(() => {
+                controller.abort(new RelyingPartyBearerClientError('request_failed'));
+                try {
+                    resolve(onDeadlineArg());
+                }
+                catch (error) {
+                    reject(error);
+                }
+            }, this.#requestTimeoutMs);
+        });
+        const section = sectionArg(controller.signal);
+        // past the deadline the section's own end, its aborted request among them, has nobody left to answer
+        section.catch(() => undefined);
+        try {
+            return await Promise.race([section, deadline]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * A bearer API call: JSON in, JSON out, no cookie, no cache, no redirect.
+     * With `signalArg` none is sent past the deadline and an answer that
+     * arrives after it counts as none.
+     */
+    async post(urlArg, bodyArg, headersArg = {}, signalArg) {
+        if (signalArg) {
+            inTime(signalArg);
+        }
+        let response;
+        try {
+            response = await this.#fetch(urlArg, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', ...headersArg },
+                body: JSON.stringify(bodyArg),
+                credentials: 'omit',
+                cache: 'no-store',
+                redirect: 'error',
+                referrerPolicy: 'no-referrer',
+                ...(signalArg ? { signal: signalArg } : {}),
+            });
+        }
+        catch (error) {
+            throw new RelyingPartyBearerClientError('request_failed', { cause: error });
+        }
+        let answer;
+        try {
+            answer = await response.json();
+        }
+        catch {
+            // the parse error is not kept: its message quotes the body
+            answer = undefined;
+            if (signalArg) {
+                inTime(signalArg);
+            }
+            if (response.status === 200) {
+                throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+            }
+        }
+        if (signalArg) {
+            inTime(signalArg);
+        }
+        if (response.status !== 200) {
+            throw new RelyingPartyBearerClientError('request_refused', {
+                status: response.status,
+                ...(isRecord(answer) && isText(answer.error) ? { answerError: answer.error } : {}),
+            });
+        }
+        return answer;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yZWx5aW5ncGFydHliZWFyZXJjbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19icm93c2VyL2NsYXNzZXMucmVseWluZ3BhcnR5YmVhcmVyY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFDTCxpQ0FBaUMsR0FHbEMsTUFBTSx1Q0FBdUMsQ0FBQztBQVkvQyxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsQ0FBQztBQXdKN0MsTUFBTSxPQUFPLDZCQUE4QixTQUFRLEtBQUs7SUFRcEMsSUFBSTtJQVBOLE1BQU0sQ0FBVTtJQUNoQyw4RUFBOEU7SUFDOUQsV0FBVyxDQUFVO0lBQ3JDLDBFQUEwRTtJQUMxRCxhQUFhLENBQVU7SUFFdkMsWUFDa0IsSUFBd0MsRUFDeEQsVUFBVSxHQUF1RixFQUFFO1FBRW5HLEtBQUssQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUM7b0JBSHRFLElBQUk7UUFJcEIsSUFBSSxDQUFDLElBQUksR0FBRywrQkFBK0IsQ0FBQztRQUM1QyxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssU0FBUztZQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQztRQUNyRSxJQUFJLFVBQVUsQ0FBQyxXQUFXLEtBQUssU0FBUztZQUFFLElBQUksQ0FBQyxXQUFXLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQztRQUNwRixJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssU0FBUztZQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsVUFBVSxDQUFDLGFBQWEsQ0FBQztJQUM1RixDQUFDO0NBQ0Y7QUFFRCxNQUFNLHlCQUF5QixHQUFHLFFBQVEsQ0FBQztBQUMzQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQztBQUN2QyxNQUFNLDBCQUEwQixHQUFHLE1BQU0sQ0FBQztBQUMxQywyRkFBMkY7QUFDM0YsTUFBTSxzQkFBc0IsR0FBRyxPQUFPLENBQUM7QUFDdkMsMEZBQTBGO0FBQzFGLE1BQU0sd0JBQXdCLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUM7QUFDakQsTUFBTSxzQkFBc0IsR0FBRyw0QkFBNEIsQ0FBQztBQUM1RCxNQUFNLG9CQUFvQixHQUFHLEdBQUcsQ0FBQztBQUNqQyxnR0FBZ0c7QUFDaEcsTUFBTSxxQkFBcUIsR0FBRyxLQUFLLENBQUM7QUFDcEMsMEVBQTBFO0FBQzFFLE1BQU0sWUFBWSxHQUFHLEVBQUUsQ0FBQztBQUN4QixNQUFNLGVBQWUsR0FBRyxDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFVLENBQUM7QUFFNUQsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFvQixFQUFVLEVBQUU7SUFDakQsSUFBSSxNQUFNLEdBQUcsRUFBRSxDQUFDO0lBQ2hCLEtBQUssTUFBTSxJQUFJLElBQUksUUFBUTtRQUFFLE1BQU0sSUFBSSxNQUFNLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2pFLE9BQU8sVUFBVSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUM7QUFFRixNQUFNLGVBQWUsR0FBRyxHQUFXLEVBQUUsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsSUFBSSxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRWpILDZFQUE2RTtBQUM3RSxNQUFNLGVBQWUsR0FBRyxLQUFLLEVBQUUsV0FBbUIsRUFBbUIsRUFBRSxDQUNyRSxTQUFTLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXJILE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUMxRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFaEYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO0FBRTlHLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRXBILHVHQUF1RztBQUN2RyxNQUFNLE1BQU0sR0FBRyxDQUFDLFNBQXNCLEVBQVEsRUFBRTtJQUM5QyxJQUFJLFNBQVMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUM1RCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sV0FBVyxHQUFHLENBQUMsU0FBMEIsRUFBRSxPQUFlLEVBQXNCLEVBQUU7SUFDdEYsTUFBTSxNQUFNLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN6QyxPQUFPLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRixxRUFBcUU7QUFDckUsTUFBTSxhQUFhLEdBQUcsQ0FBQyxTQUFrQixFQUF5QyxFQUFFO0lBQ2xGLElBQ0UsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ2pCLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUNoQyxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDO1dBQzlCLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7V0FDL0IsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ3ZDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUIsU0FBUyxDQUFDLFNBQVMsSUFBSSxDQUFDO1dBQ3hCLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQztXQUN4QyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDO1dBQzVCLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDO1dBQ3BDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1dBQ3RDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQ3ZDLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPO1FBQ0wsU0FBUyxFQUFFLFFBQVE7UUFDbkIsV0FBVyxFQUFFLFNBQVMsQ0FBQyxXQUFXO1FBQ2xDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxvQkFBb0I7UUFDcEQsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFTO1FBQzlCLFlBQVksRUFBRSxTQUFTLENBQUMsWUFBWTtRQUNwQyxxQkFBcUIsRUFBRSxTQUFTLENBQUMscUJBQXFCO1FBQ3RELE9BQU8sRUFBRTtZQUNQLFNBQVMsRUFBRSxTQUFTLENBQUMsT0FBTyxDQUFDLFNBQVM7WUFDdEMsV0FBVyxFQUFFLFNBQVMsQ0FBQyxPQUFPLENBQUMsV0FBVztZQUMxQyxTQUFTLEVBQUUsU0FBUyxDQUFDLE9BQU8sQ0FBQyxTQUFTO1NBQ3ZDO0tBQ0YsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQU0sT0FBTyx3QkFBd0I7SUFDbkIsTUFBTSxDQUFTO0lBQ3RCLE1BQU0sQ0FBb0U7SUFDMUUsUUFBUSxDQUFrQztJQUMxQyxTQUFTLENBQVM7SUFDbEIsY0FBYyxDQUFTO0lBQ3ZCLGlCQUFpQixDQUFTO0lBQzFCLE1BQU0sQ0FBYztJQUNwQixNQUFNLENBQTBCO0lBQ2hDLE9BQU8sQ0FBOEM7SUFDckQsSUFBSSxDQUFlO0lBQzVCLHVFQUF1RTtJQUM5RCxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUU3QyxZQUFZLFVBQTRDO1FBQ3RELE1BQU0sTUFBTSxHQUFHLFVBQVUsRUFBRSxNQUFNLENBQUM7UUFDbEMsSUFBSSxZQUFZLEdBQWUsSUFBSSxDQUFDO1FBQ3BDLElBQUksQ0FBQztZQUNILFlBQVksR0FBRyxPQUFPLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDckUsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLFlBQVksR0FBRyxJQUFJLENBQUM7UUFDdEIsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDNUcsTUFBTSxJQUFJLEtBQUssQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQ25HLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsZUFBZSxJQUFJLHlCQUF5QixDQUFDO1FBQ3ZFLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsOEJBQThCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDL0UsTUFBTSxJQUFJLEtBQUssQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDO1FBQ25DLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFVBQVUsSUFBSSxPQUFPLE9BQU8sQ0FBQyxHQUFHLEtBQUssVUFBVSxJQUFJLE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUM5SCxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxLQUFLLElBQUksVUFBVSxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUM7UUFDOUQsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDbEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7UUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxLQUFLLFVBQVUsSUFBSSxPQUFPLFVBQVUsQ0FBQyxNQUFNLENBQUMsZUFBZSxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ3ZILE1BQU0sSUFBSSxLQUFLLENBQUMsNEdBQTRHLENBQUMsQ0FBQztRQUNoSSxDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsVUFBVSxDQUFDLEtBQUssSUFBSSxVQUFVLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM3RSxJQUFJLE9BQU8sYUFBYSxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsVUFBVSxDQUFDLGFBQWEsSUFBSSx1QkFBdUIsQ0FBQztRQUMxRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsSUFBSSxhQUFhLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDMUQsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxvRkFBb0Y7UUFDcEYsTUFBTSxnQkFBZ0IsR0FBRyxVQUFVLENBQUMsZ0JBQWdCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDO1FBQzlILElBQ0UsT0FBTyxnQkFBZ0IsS0FBSyxRQUFRO2VBQ2pDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQztlQUNsQyxnQkFBZ0IsSUFBSSxDQUFDO2VBQ3JCLGdCQUFnQixHQUFHLHNCQUFzQixFQUM1QyxDQUFDO1lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxvREFBb0Qsc0JBQXNCLGVBQWUsQ0FBQyxDQUFDO1FBQzdHLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUNyQixJQUFJLENBQUMsTUFBTSxHQUFHO1lBQ1osS0FBSyxFQUFFLEdBQUcsTUFBTSxHQUFHLE1BQU0sY0FBYztZQUN2QyxLQUFLLEVBQUUsR0FBRyxNQUFNLEdBQUcsTUFBTSxjQUFjO1lBQ3ZDLE9BQU8sRUFBRSxHQUFHLE1BQU0sR0FBRyxNQUFNLGdCQUFnQjtZQUMzQyxNQUFNLEVBQUUsR0FBRyxNQUFNLEdBQUcsTUFBTSxlQUFlO1NBQzFDLENBQUM7UUFDRixJQUFJLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQztRQUN4QixJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxRQUFRLElBQUkseUNBQXlDLE1BQU0sRUFBRSxDQUFDO1FBQzFGLElBQUksQ0FBQyxjQUFjLEdBQUcsYUFBYSxDQUFDO1FBQ3BDLElBQUksQ0FBQyxpQkFBaUIsR0FBRyxnQkFBZ0IsQ0FBQztRQUMxQyxJQUFJLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQztRQUNwQixJQUFJLENBQUMsTUFBTSxHQUFHLGFBQWEsQ0FBQztRQUM1QixJQUFJLENBQUMsT0FBTyxHQUFHLFVBQVUsQ0FBQyxNQUFNLElBQUssVUFBMkQsQ0FBQyxNQUFNLENBQUM7UUFDeEcsSUFBSSxDQUFDLElBQUksR0FBRyxVQUFVLENBQUMsR0FBRyxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUM7SUFDekMsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxVQUd4QjtRQUNDLE1BQU0sRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLEdBQUcsVUFBVSxJQUFLLEVBQXdCLENBQUM7UUFDN0UsSUFBSSxVQUFVLEtBQUssS0FBSyxJQUFJLFVBQVUsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUNuRCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUMxQixNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLGVBQWUsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sS0FBSyxHQUFHLGVBQWUsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkMsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ2hELEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxZQUFZLENBQUMsQ0FBQztRQUNwRCxHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLGVBQWUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1FBQzVFLEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLHVCQUF1QixFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3RELEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNyQyxPQUFPLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDMUUsQ0FBQztJQUVEOzs7Ozs7OztPQVFHO0lBQ0ksS0FBSyxDQUFDLHFCQUFxQixDQUNoQyxRQUEyRDtRQUUzRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDcEMsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMxQyxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3RFLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLEdBQUcsQ0FBQyxZQUFZLENBQUM7UUFDbkMsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM1QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQzlDLE1BQU0sS0FBSyxHQUFHLFdBQVcsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDOUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQy9CLEtBQUssTUFBTSxJQUFJLElBQUksZUFBZSxFQUFFLENBQUM7WUFDbkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELE1BQU0sQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRSxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQy9GLElBQUksQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxLQUFLLElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLEtBQUssUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2xHLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM3QyxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNJLGNBQWMsQ0FDbkIsUUFBd0MsRUFDeEMsVUFBVSxHQUFvQyxFQUFFO1FBRWhELElBQUksTUFBdUMsQ0FBQztRQUM1QyxJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQzlCLElBQUksQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxPQUFPLEVBQUUsQ0FBQztnQkFDakQsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO1lBQ3hELENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUM3QyxNQUFNLElBQUksNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUM5RCxDQUFDO1FBQ0gsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0IsQ0FBQztRQUNELElBQUksS0FBc0MsQ0FBQztRQUMzQyxJQUFJLENBQUM7WUFDSCxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsY0FBYyxJQUFJLHNCQUFzQixDQUFDLENBQUM7UUFDbkcsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0IsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNYLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFdBQVc7UUFDdEIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQztRQUM1QixDQUFDO1FBQ0QsT0FBTyxDQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLElBQUksQ0FBQyxDQUFDLEVBQUUsV0FBVyxJQUFJLElBQUksQ0FBQztJQUM3RSxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxzQkFBK0I7UUFDbEQsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLHNCQUFzQixJQUFJLElBQUksQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSSxLQUFLLENBQUMsTUFBTTtRQUNqQixJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUM7UUFDcEIsTUFBTSxVQUFVLEdBQUcsQ0FBQyxRQUFpQixFQUFFLEVBQUUsQ0FBQyxJQUFJLDZCQUE2QixDQUFDLHFCQUFxQixFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDeEgsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxFQUFFO1lBQ3JGLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsT0FBTyxLQUFLLENBQUM7WUFDZixDQUFDO1lBQ0QsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztZQUNqRCxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ2YsSUFBSSxDQUFDO2dCQUNILE9BQU8sTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNyRCxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixNQUFNLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMxQixDQUFDO1FBQ0gsQ0FBQyxFQUFFLEdBQUcsRUFBRTtZQUNOLHNGQUFzRjtZQUN0RixNQUFNLE9BQU8sR0FBRyxJQUFJLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDcEUsTUFBTSxPQUFPLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQ2hELENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRU8sYUFBYTtRQUNuQixJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsK0RBQStELENBQUMsQ0FBQztRQUNuRixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDO0lBQ3RCLENBQUM7SUFFTyxPQUFPLENBQUMsU0FBMEM7UUFDeEQsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLFNBQVMsR0FBRyxLQUFLLENBQUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLFVBQVUsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUM3RCxPQUFPLElBQUksQ0FBQyxJQUFJLEVBQUUsR0FBRyxTQUFTLENBQUMsVUFBVSxHQUFHLFVBQVUsR0FBRyxNQUFNLENBQUM7SUFDbEUsQ0FBQztJQUVELDRHQUE0RztJQUNwRyxLQUFLLENBQUMsT0FBTyxDQUNuQixRQUF3QyxFQUN4QyxPQUFnQixFQUNoQixRQUFpQjtRQUVqQixJQUFJLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzdDLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDekMsSUFBSSxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDM0IsTUFBTSxJQUFJLDZCQUE2QixDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLG1CQUFtQixFQUFFO2dCQUN4SCxHQUFHLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLGFBQWEsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQ3pELENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELDhIQUE4SDtRQUM5SCxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FDakUsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxZQUFZLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hHLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNLLFdBQVcsQ0FBQyxTQUEwQztRQUM1RCwwRkFBMEY7UUFDMUYsSUFBSSxVQUFVLEdBQTBDLElBQUksQ0FBQztRQUM3RCxNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQWtDLEVBQUUsQ0FBQyxDQUFDO1lBQ3pFLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLGVBQWUsRUFBRSw4QkFBOEI7WUFDL0Msb0JBQW9CLEVBQUUsUUFBUSxZQUFZLDZCQUE2QjtnQkFDckUsQ0FBQyxDQUFDLFFBQVE7Z0JBQ1YsQ0FBQyxDQUFDLElBQUksNkJBQTZCLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUM7U0FDaEYsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQWlDLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtZQUNySCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDM0MsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFDMUQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNkLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLGVBQWUsRUFBRSxxQkFBcUIsRUFBRSxDQUFDO1lBQ3ZFLENBQUM7WUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQy9ELE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLGVBQWUsRUFBRSxjQUFjLEVBQUUsQ0FBQztZQUNoRSxDQUFDO1lBQ0QsVUFBVSxHQUFHLFVBQVUsQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztZQUM3RSxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQztnQkFDN0MsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLHdCQUF3QixFQUFFLENBQUM7WUFDMUUsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsT0FBTyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDM0IsQ0FBQztRQUNILENBQUMsRUFBRSxHQUFHLEVBQUU7WUFDTixxRkFBcUY7WUFDckYsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUNoQixNQUFNLElBQUksNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUM1RCxDQUFDO1lBQ0QsT0FBTyxVQUFVLENBQUM7UUFDcEIsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7SUFFTyxZQUFZLENBQ2xCLFNBQTBDLEVBQzFDLFFBQWtDLEVBQ2xDLFFBQXdDLEVBQ3hDLFVBQTJDO1FBRTNDLE9BQU8sSUFBSSxPQUFPLENBQWlDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JFLE1BQU0sUUFBUSxHQUFzQixFQUFFLENBQUM7WUFDdkMsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3BCLE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBcUIsRUFBRSxFQUFFO2dCQUN2QyxJQUFJLE9BQU8sRUFBRSxDQUFDO29CQUNaLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxPQUFPLEdBQUcsSUFBSSxDQUFDO2dCQUNmLEtBQUssTUFBTSxPQUFPLElBQUksUUFBUSxFQUFFLENBQUM7b0JBQy9CLE9BQU8sRUFBRSxDQUFDO2dCQUNaLENBQUM7Z0JBQ0QsU0FBUyxFQUFFLENBQUM7WUFDZCxDQUFDLENBQUM7WUFDRixNQUFNLElBQUksR0FBRyxDQUFDLFFBQWlCLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUVuRSxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQXlDLEVBQUUsRUFBRTtnQkFDOUQsTUFBTSxJQUFJLEdBQVksUUFBUSxFQUFFLElBQUksQ0FBQztnQkFDckMsSUFDRSxRQUFRLEVBQUUsTUFBTSxLQUFLLElBQUksQ0FBQyxNQUFNO3VCQUM3QixRQUFRLENBQUMsTUFBTSxLQUFLLFFBQVE7dUJBQzVCLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQzt1QkFDZixJQUFJLENBQUMsSUFBSSxLQUFLLGlDQUFpQzt1QkFDL0MsSUFBSSxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsS0FBSyxFQUNoQyxDQUFDO29CQUNELE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxNQUFNLENBQUMsR0FBRyxFQUFFO29CQUNWLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLENBQUMsQ0FBQyxDQUFDO1lBQ0wsQ0FBQyxDQUFDO1lBQ0YsU0FBUyxDQUFDLGdCQUFnQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNqRCxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUV6RSxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQ3hCLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGVBQWUsQ0FBQyxDQUFDLEVBQzlELFVBQVUsQ0FBQyxTQUFTLElBQUksd0JBQXdCLENBQ2pELENBQUM7WUFDRixRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQzNDLElBQUksV0FBc0QsQ0FBQztZQUMzRCxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsR0FBRyxFQUFFO2dCQUNsQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUNqRCxXQUFXLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsQ0FBQztnQkFDakgsQ0FBQztZQUNILENBQUMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO1lBQ3pCLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO2dCQUNqQixhQUFhLENBQUMsVUFBVSxDQUFDLENBQUM7Z0JBQzFCLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUM5QixZQUFZLENBQUMsV0FBVyxDQUFDLENBQUM7Z0JBQzVCLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUVILE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFDakMsSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDWCxJQUFJLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztvQkFDbkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztvQkFDcEIsT0FBTztnQkFDVCxDQUFDO2dCQUNELE1BQU0sT0FBTyxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQzFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQzFELFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQ3BFLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0ssTUFBTSxDQUNaLG1CQUEyQixFQUMzQixzQkFBcUM7UUFFckMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxFQUFFO1lBQ3JGLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBQ0QsSUFDRSxPQUFPLENBQUMsWUFBWSxLQUFLLG1CQUFtQjttQkFDekMsQ0FBQyxzQkFBc0IsS0FBSyxJQUFJLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxzQkFBc0IsQ0FBQyxFQUN0RixDQUFDO2dCQUNELE9BQU8sT0FBTyxDQUFDO1lBQ2pCLENBQUM7WUFDRCxJQUFJLE1BQTZDLENBQUM7WUFDbEQsSUFBSSxDQUFDO2dCQUNILE1BQU0sR0FBRyxhQUFhLENBQUMsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUN0SCxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixJQUFJLEtBQUssWUFBWSw2QkFBNkIsSUFBSSxLQUFLLENBQUMsV0FBVyxLQUFLLHNCQUFzQixFQUFFLENBQUM7b0JBQ25HLHdEQUF3RDtvQkFDeEQsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO29CQUNsQixNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7b0JBQ2pELE9BQU8sSUFBSSxDQUFDO2dCQUNkLENBQUM7Z0JBQ0QsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1lBQ0QsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNaLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2hGLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBb0MsRUFBRSxHQUFHLE1BQU0sRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDdkYsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFDdkQsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7SUFFRCxxR0FBcUc7SUFDN0YsS0FBSyxDQUFDLFlBQVksQ0FBQyxPQUF3QyxFQUFFLFNBQXNCO1FBQ3pGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FDNUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQ2xCLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsRUFDdEMsRUFBRSxhQUFhLEVBQUUsVUFBVSxPQUFPLENBQUMsV0FBVyxFQUFFLEVBQUUsRUFDbEQsU0FBUyxDQUNWLENBQUM7UUFDRixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLE9BQU8sTUFBTSxDQUFDLGdCQUFnQixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RFLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxPQUFRLE1BQXFELENBQUMsZ0JBQWdCLENBQUM7SUFDakYsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNLLEtBQUssQ0FBQyxZQUFZLENBQ3hCLFVBQWtELEVBQ2xELGFBQWEsR0FBWSxHQUFHLEVBQUU7UUFDNUIsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDNUQsQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUM7UUFDekMsSUFBSSxLQUFnRCxDQUFDO1FBQ3JELE1BQU0sUUFBUSxHQUFHLElBQUksT0FBTyxDQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ2xELEtBQUssR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFO2dCQUN0QixVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO2dCQUN0RSxJQUFJLENBQUM7b0JBQ0gsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUM7Z0JBQzNCLENBQUM7Z0JBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztvQkFDZixNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ2hCLENBQUM7WUFDSCxDQUFDLEVBQUUsSUFBSSxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDN0IsQ0FBQyxDQUFDLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlDLHFHQUFxRztRQUNyRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQy9CLElBQUksQ0FBQztZQUNILE9BQU8sTUFBTSxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDakQsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3RCLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLEtBQUssQ0FBQyxJQUFJLENBQ2hCLE1BQWMsRUFDZCxPQUErQixFQUMvQixVQUFVLEdBQTJCLEVBQUUsRUFDdkMsU0FBdUI7UUFFdkIsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNkLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNwQixDQUFDO1FBQ0QsSUFBSSxRQUFrQixDQUFDO1FBQ3ZCLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFO2dCQUNuQyxNQUFNLEVBQUUsTUFBTTtnQkFDZCxPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUUsR0FBRyxVQUFVLEVBQUU7Z0JBQzlELElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQztnQkFDN0IsV0FBVyxFQUFFLE1BQU07Z0JBQ25CLEtBQUssRUFBRSxVQUFVO2dCQUNqQixRQUFRLEVBQUUsT0FBTztnQkFDakIsY0FBYyxFQUFFLGFBQWE7Z0JBQzdCLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDNUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksNkJBQTZCLENBQUMsZ0JBQWdCLEVBQUUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUM5RSxDQUFDO1FBQ0QsSUFBSSxNQUFlLENBQUM7UUFDcEIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxHQUFHLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2pDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCwyREFBMkQ7WUFDM0QsTUFBTSxHQUFHLFNBQVMsQ0FBQztZQUNuQixJQUFJLFNBQVMsRUFBRSxDQUFDO2dCQUNkLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNwQixDQUFDO1lBQ0QsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDO2dCQUM1QixNQUFNLElBQUksNkJBQTZCLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUNoRixDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksU0FBUyxFQUFFLENBQUM7WUFDZCxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDcEIsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksNkJBQTZCLENBQUMsaUJBQWlCLEVBQUU7Z0JBQ3pELE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtnQkFDdkIsR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQzthQUNuRixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztDQUNGIn0=

package/dist_ts_browser/index.d.ts

@@ -1,3 +1,4 @@
 export * from './classes.idpclient.js';
 export * from './classes.idprequests.js';
 export * from './secret-delivery.js';
+export * from './classes.relyingpartybearerclient.js';

package/dist_ts_browser/index.js

@@ -1,4 +1,5 @@
 export * from './classes.idpclient.js';
 export * from './classes.idprequests.js';
 export * from './secret-delivery.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19icm93c2VyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHNCQUFzQixDQUFDIn0=
+export * from './classes.relyingpartybearerclient.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19icm93c2VyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsdUNBQXVDLENBQUMifQ==

package/dist_ts_browser/plugins.js

@@ -12,4 +12,4 @@ import * as smarttime from '@push.rocks/smarttime';
 import * as smarturl from '@push.rocks/smarturl';
 import * as webstore from '@push.rocks/webstore';
 export { smartjson, smartjwtWeb, smartpromise, smartrx, smarttime, smarturl, webstore };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2Jyb3dzZXIvcGx1Z2lucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssYUFBYSxNQUFNLHdCQUF3QixDQUFDO0FBRXhELE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQztBQUV6QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxzQkFBc0IsTUFBTSxxQ0FBcUMsQ0FBQztBQUM5RSxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBRXZELE9BQU8sRUFBRSxZQUFZLEVBQUUsc0JBQXNCLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFFN0QsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssV0FBVyxNQUFNLDBCQUEwQixDQUFDO0FBQ3hELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUVqRCxPQUFPLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2Jyb3dzZXIvcGx1Z2lucy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssYUFBYSxNQUFNLHdCQUF3QixDQUFDO0FBRXhELE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQztBQUV6QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxzQkFBc0IsTUFBTSxxQ0FBcUMsQ0FBQztBQUM5RSxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBRXZELE9BQU8sRUFBRSxZQUFZLEVBQUUsc0JBQXNCLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFFN0QsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssV0FBVyxNQUFNLDBCQUEwQixDQUFDO0FBQ3hELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUMvQyxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUVqRCxPQUFPLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLENBQUMifQ==