@idp.global/sdk 19.4.0 → 19.5.0

package/dist_ts_relyingparty/contract.bearer.d.ts

@@ -36,6 +36,43 @@ export interface IRelyingPartyBearerMessage {
  * of the application's own refusal (`RelyingPartyRefusal.code`).
  */
 export type TRelyingPartyBearerDeliveryError = 'access_denied' | 'authentication_failed' | (string & {});
+/** Whether a value is a well-formed PKCE code verifier (RFC 7636 §4.1). */
+export declare const isPkceVerifier: (valueArg: unknown) => valueArg is string;
+/**
+ * The query of `GET <prefix>bearer/login`, by its parameter names on the
+ * wire. The routes check every parameter as untrusted input.
+ */
+export interface IRelyingPartyBearerLoginQuery {
+    client_kind: TRelyingPartyBearerClientKind;
+    /** one of the configured return targets of the kind, exactly; a loopback target with the client's port */
+    return_target: string;
+    /** BASE64URL(SHA-256(code verifier)), 43 characters */
+    code_challenge: string;
+    /** only `S256` is accepted */
+    code_challenge_method: 'S256';
+    /** the client's own correlation value, 1 to 256 characters of `A-Z a-z 0-9 . _ ~ -`, handed back with the outcome */
+    state?: string;
+}
+/** The JSON body of `POST <prefix>bearer/claim`. */
+export interface IRelyingPartyBearerClaimRequest {
+    /** the hand-off code, claimed once */
+    code: string;
+    /** the verifier of the challenge the code is bound to (`isPkceVerifier`) */
+    codeVerifier: string;
+}
+/** The JSON body of `POST <prefix>bearer/refresh`. */
+export interface IRelyingPartyBearerRefreshRequest {
+    /** the current refresh token; this call spends it */
+    refreshToken: string;
+}
+/**
+ * The JSON body of `POST <prefix>bearer/logout`. The session is named by
+ * `Authorization: Bearer <accessToken>`, or by `refreshToken` once that access
+ * token has expired.
+ */
+export interface IRelyingPartyBearerLogoutRequest {
+    refreshToken?: string;
+}
 /** The session a bearer answer names. */
 export interface IRelyingPartyBearerSessionInfo {
     sessionId: string;

package/dist_ts_relyingparty/contract.bearer.js

@@ -6,4 +6,8 @@
  */
 /** The `type` of every message a popup delivery posts. */
 export const RELYING_PARTY_BEARER_MESSAGE_TYPE = 'idp.global/relyingparty:bearer-handoff';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udHJhY3QuYmVhcmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NvbnRyYWN0LmJlYXJlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7R0FLRztBQUVILDBEQUEwRDtBQUMxRCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyx3Q0FBd0MsQ0FBQyJ9
+/** RFC 7636 §4.1: a code verifier is 43 to 128 characters of `A-Z a-z 0-9 . _ ~ -`. */
+const PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/u;
+/** Whether a value is a well-formed PKCE code verifier (RFC 7636 §4.1). */
+export const isPkceVerifier = (valueArg) => typeof valueArg === 'string' && PKCE_VERIFIER.test(valueArg);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udHJhY3QuYmVhcmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NvbnRyYWN0LmJlYXJlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7R0FLRztBQUVILDBEQUEwRDtBQUMxRCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyx3Q0FBd0MsQ0FBQztBQW1DMUYsdUZBQXVGO0FBQ3ZGLE1BQU0sYUFBYSxHQUFHLDRCQUE0QixDQUFDO0FBRW5ELDJFQUEyRTtBQUMzRSxNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQ3RFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxhQUFhLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDIn0=

package/dist_ts_relyingparty/helpers.bearer.d.ts

@@ -1,10 +1,9 @@
-import { RELYING_PARTY_BEARER_MESSAGE_TYPE, type IRelyingPartyBearerMessage, type TRelyingPartyBearerClientKind } from './contract.bearer.js';
+import { isPkceVerifier, RELYING_PARTY_BEARER_MESSAGE_TYPE, type IRelyingPartyBearerMessage, type TRelyingPartyBearerClientKind } from './contract.bearer.js';
 import type { IRelyingPartyBearerDelivery, IRelyingPartyBearerReturnTargets } from './interfaces.js';
-export { RELYING_PARTY_BEARER_MESSAGE_TYPE };
+export { isPkceVerifier, RELYING_PARTY_BEARER_MESSAGE_TYPE };
 export declare const RELYING_PARTY_BEARER_CLIENT_KINDS: readonly TRelyingPartyBearerClientKind[];
 export declare const isBearerClientKind: (valueArg: unknown) => valueArg is TRelyingPartyBearerClientKind;
 export declare const isPkceChallenge: (valueArg: unknown) => valueArg is string;
-export declare const isPkceVerifier: (valueArg: unknown) => valueArg is string;
 export declare const isBearerClientState: (valueArg: unknown) => valueArg is string;
 /** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
 export declare const pkceChallengeOf: (verifierArg: string) => string;

package/dist_ts_relyingparty/helpers.bearer.js

@@ -1,7 +1,8 @@
-import { RELYING_PARTY_BEARER_MESSAGE_TYPE, } from './contract.bearer.js';
+import { isPkceVerifier, RELYING_PARTY_BEARER_MESSAGE_TYPE, } from './contract.bearer.js';
 import { sha256, timingSafeEqualString } from './helpers.crypto.js';
 import { sanitizeReturnPath } from './helpers.returnpath.js';
-export { RELYING_PARTY_BEARER_MESSAGE_TYPE };
+// the verifier check lives in the import-free contract, which the browser client shares
+export { isPkceVerifier, RELYING_PARTY_BEARER_MESSAGE_TYPE };
 export const RELYING_PARTY_BEARER_CLIENT_KINDS = Object.freeze([
     'web',
     'loopback',
@@ -12,15 +13,12 @@ export const RELYING_PARTY_BEARER_CLIENT_KINDS = Object.freeze([
 const MAX_RETURN_TARGET_LENGTH = 2_048;
 /** BASE64URL of a SHA-256 digest, without padding (RFC 7636 §4.2). */
 const PKCE_CHALLENGE = /^[A-Za-z0-9_-]{43}$/u;
-/** RFC 7636 §4.1: 43 to 128 unreserved characters. */
-const PKCE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/u;
 const CLIENT_STATE = /^[A-Za-z0-9._~-]{1,256}$/u;
 const LOOPBACK_HOSTS = ['127.0.0.1', '[::1]'];
 /** A private-use scheme is a reverse domain name: it has a dot, and no web scheme has one (RFC 8252 §7.1). */
 const CUSTOM_SCHEME = /^[a-z][a-z0-9+-]*(\.[a-z0-9+-]+)+:$/u;
 export const isBearerClientKind = (valueArg) => typeof valueArg === 'string' && RELYING_PARTY_BEARER_CLIENT_KINDS.includes(valueArg);
 export const isPkceChallenge = (valueArg) => typeof valueArg === 'string' && PKCE_CHALLENGE.test(valueArg);
-export const isPkceVerifier = (valueArg) => typeof valueArg === 'string' && PKCE_VERIFIER.test(valueArg);
 export const isBearerClientState = (valueArg) => typeof valueArg === 'string' && CLIENT_STATE.test(valueArg);
 /** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
 export const pkceChallengeOf = (verifierArg) => sha256(verifierArg);
@@ -196,4 +194,4 @@ export const bearerPopupPage = (deliveryArg, outcomeArg, nonceArg) => {
 };
 /** The policy of a popup page: its nonce script and nothing else. */
 export const bearerPopupContentSecurityPolicy = (nonceArg) => `default-src 'none'; script-src 'nonce-${nonceArg}'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5iZWFyZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaGVscGVycy5iZWFyZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUNMLGlDQUFpQyxHQUdsQyxNQUFNLHNCQUFzQixDQUFDO0FBQzlCLE9BQU8sRUFBRSxNQUFNLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNwRSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUc3RCxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsQ0FBQztBQUU3QyxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBNkMsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RyxLQUFLO0lBQ0wsVUFBVTtJQUNWLGVBQWU7SUFDZixPQUFPO0NBQ1IsQ0FBQyxDQUFDO0FBRUgsMEZBQTBGO0FBQzFGLE1BQU0sd0JBQXdCLEdBQUcsS0FBSyxDQUFDO0FBQ3ZDLHNFQUFzRTtBQUN0RSxNQUFNLGNBQWMsR0FBRyxzQkFBc0IsQ0FBQztBQUM5QyxzREFBc0Q7QUFDdEQsTUFBTSxhQUFhLEdBQUcsNEJBQTRCLENBQUM7QUFDbkQsTUFBTSxZQUFZLEdBQUcsMkJBQTJCLENBQUM7QUFDakQsTUFBTSxjQUFjLEdBQXNCLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQ2pFLDhHQUE4RztBQUM5RyxNQUFNLGFBQWEsR0FBRyxzQ0FBc0MsQ0FBQztBQUU3RCxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFFBQWlCLEVBQTZDLEVBQUUsQ0FDakcsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFLLGlDQUF1RCxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUU5RyxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQ3ZFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRWhFLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDdEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFL0QsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQzNFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRTlELDZFQUE2RTtBQUM3RSxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxXQUFtQixFQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFcEYsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsV0FBb0IsRUFBRSxZQUFvQixFQUFXLEVBQUUsQ0FDekYsY0FBYyxDQUFDLFdBQVcsQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztBQUU5SCxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWdCLEVBQWMsRUFBRTtJQUNoRCxJQUFJLENBQUM7UUFDSCxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixvR0FBb0c7QUFDcEcsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFjLEVBQUU7SUFDakQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyx3QkFBd0IsRUFBRSxDQUFDO1FBQ3hHLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUNFLENBQUMsTUFBTTtXQUNKLE1BQU0sQ0FBQyxJQUFJLEtBQUssUUFBUTtXQUN4QixNQUFNLENBQUMsUUFBUSxLQUFLLEVBQUU7V0FDdEIsTUFBTSxDQUFDLFFBQVEsS0FBSyxFQUFFO1dBQ3RCLE1BQU0sQ0FBQyxNQUFNLEtBQUssRUFBRTtXQUNwQixNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFDckIsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FDdkIsT0FBc0MsRUFDdEMsUUFBaUIsRUFDakIsZUFBdUIsRUFDdkIsa0JBQTBCLEVBQ2pCLEVBQUU7SUFDWCwrRkFBK0Y7SUFDL0YsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ3RCLE9BQU8sT0FBTyxRQUFRLEtBQUssUUFBUTtlQUM5QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2VBQ3ZCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7ZUFDdkIsa0JBQWtCLENBQUMsUUFBUSxFQUFFLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxLQUFLLFFBQVEsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDeEIsTUFBTSxNQUFNLEdBQUcsT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN4RSxPQUFPLE1BQU0sS0FBSyxJQUFJO2VBQ2pCLENBQUMsTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxPQUFPLENBQUM7ZUFDN0QsTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUM7SUFDbEMsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUMzQixPQUFPLE1BQU0sQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssRUFBRSxDQUFDO0lBQ3ZHLENBQUM7SUFDRCxPQUFPLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FDMUMsVUFBNEMsRUFDNUMsZUFBdUIsRUFDdkIsa0JBQTBCLEVBQzRCLEVBQUU7SUFDeEQsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNsRCxNQUFNLElBQUksS0FBSyxDQUFDLG1FQUFtRSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLEdBQUcscUNBQXFDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEksQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBRyxFQUE4RCxDQUFDO0lBQ2xGLElBQUksR0FBRyxHQUFHLEtBQUssQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLGlDQUFpQyxFQUFFLENBQUM7UUFDckQsTUFBTSxPQUFPLEdBQVksVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLElBQUksaUJBQWlCLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxlQUFlLEVBQUUsa0JBQWtCLENBQUMsRUFBRSxDQUFDO2dCQUN4RSxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixJQUFJLHNDQUFzQyxJQUFJLFlBQVksSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDN0gsQ0FBQztRQUNILENBQUM7UUFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFhLENBQUMsQ0FBQztRQUMzRCxHQUFHLEtBQUssT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUNELElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUN6QyxVQUFnRSxFQUNoRSxPQUFzQyxFQUN0QyxZQUFxQixFQUNaLEVBQUU7SUFDWCxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLHdCQUF3QixFQUFFLENBQUM7UUFDcEgsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3BDLElBQUksT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzNCLE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3RDLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzlHLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxVQUFVLE1BQU0sQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sb0JBQW9CLEdBQUcsb0NBQW9DLENBQUM7QUFFbEUseUVBQXlFO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsU0FBb0MsRUFBaUIsRUFBRTtJQUM5RixJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLENBQUMsTUFBTSxHQUFHLHdCQUF3QixFQUFFLENBQUM7UUFDakYsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUM7QUFDbEUsQ0FBQyxDQUFDO0FBS0YsMkdBQTJHO0FBQzNHLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQ3BDLFdBQXdDLEVBQ3hDLFVBQXNDLEVBQ3RDLGVBQXVCLEVBQ2YsRUFBRTtJQUNWLE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxVQUFVLEtBQUssS0FBSztRQUMvQyxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxlQUFlLENBQUM7UUFDcEQsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN0QyxJQUFJLE1BQU0sSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUN6QixRQUFRLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3JELENBQUM7U0FBTSxDQUFDO1FBQ04sUUFBUSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BDLFFBQVEsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQztBQUN2QixDQUFDLENBQUM7QUFFRiwwQ0FBMEM7QUFDMUMsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FDbkMsV0FBd0MsRUFDeEMsVUFBc0MsRUFDVixFQUFFLENBQUMsQ0FBQztJQUNoQyxJQUFJLEVBQUUsaUNBQWlDO0lBQ3ZDLEdBQUcsVUFBVTtJQUNiLEdBQUcsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Q0FDekUsQ0FBQyxDQUFDO0FBRUgscUZBQXFGO0FBQ3JGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFLENBQzlDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDO0tBQ3JCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO0tBQzlCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFFcEMsZ0VBQWdFO0FBQ2hFLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLHdCQUF3QixDQUFDO0FBRTNFOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQzdCLFdBQXdDLEVBQ3hDLFVBQXNDLEVBQ3RDLFFBQWdCLEVBQ1IsRUFBRTtJQUNWLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsWUFBWSxFQUFFLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVILE1BQU0sTUFBTSxHQUFHO1FBQ2Isc0RBQXNELGtDQUFrQyxrQkFBa0I7UUFDMUcsc0JBQXNCO1FBQ3RCLHVFQUF1RTtRQUN2RSxtQkFBbUI7UUFDbkIsR0FBRztLQUNKLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2IsT0FBTztRQUNMLGlCQUFpQjtRQUNqQixpRkFBaUY7UUFDakYsdUNBQXVDLGtDQUFrQyxLQUFLLElBQUksV0FBVztRQUM3RixrQkFBa0IsUUFBUSxPQUFPLE1BQU0sYUFBYTtRQUNwRCw0REFBNEQ7UUFDNUQsZ0JBQWdCO0tBQ2pCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYscUVBQXFFO0FBQ3JFLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQUMsUUFBZ0IsRUFBVSxFQUFFLENBQzNFLHlDQUF5QyxRQUFRLGdFQUFnRSxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5iZWFyZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvaGVscGVycy5iZWFyZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUNMLGNBQWMsRUFDZCxpQ0FBaUMsR0FHbEMsTUFBTSxzQkFBc0IsQ0FBQztBQUM5QixPQUFPLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFHN0Qsd0ZBQXdGO0FBQ3hGLE9BQU8sRUFBRSxjQUFjLEVBQUUsaUNBQWlDLEVBQUUsQ0FBQztBQUU3RCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBNkMsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RyxLQUFLO0lBQ0wsVUFBVTtJQUNWLGVBQWU7SUFDZixPQUFPO0NBQ1IsQ0FBQyxDQUFDO0FBRUgsMEZBQTBGO0FBQzFGLE1BQU0sd0JBQXdCLEdBQUcsS0FBSyxDQUFDO0FBQ3ZDLHNFQUFzRTtBQUN0RSxNQUFNLGNBQWMsR0FBRyxzQkFBc0IsQ0FBQztBQUM5QyxNQUFNLFlBQVksR0FBRywyQkFBMkIsQ0FBQztBQUNqRCxNQUFNLGNBQWMsR0FBc0IsQ0FBQyxXQUFXLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDakUsOEdBQThHO0FBQzlHLE1BQU0sYUFBYSxHQUFHLHNDQUFzQyxDQUFDO0FBRTdELE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBaUIsRUFBNkMsRUFBRSxDQUNqRyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUssaUNBQXVELENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRTlHLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDdkUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFaEUsTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQzNFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRTlELDZFQUE2RTtBQUM3RSxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxXQUFtQixFQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7QUFFcEYsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLENBQUMsV0FBb0IsRUFBRSxZQUFvQixFQUFXLEVBQUUsQ0FDekYsY0FBYyxDQUFDLFdBQVcsQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztBQUU5SCxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWdCLEVBQWMsRUFBRTtJQUNoRCxJQUFJLENBQUM7UUFDSCxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixvR0FBb0c7QUFDcEcsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFjLEVBQUU7SUFDakQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyx3QkFBd0IsRUFBRSxDQUFDO1FBQ3hHLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUNFLENBQUMsTUFBTTtXQUNKLE1BQU0sQ0FBQyxJQUFJLEtBQUssUUFBUTtXQUN4QixNQUFNLENBQUMsUUFBUSxLQUFLLEVBQUU7V0FDdEIsTUFBTSxDQUFDLFFBQVEsS0FBSyxFQUFFO1dBQ3RCLE1BQU0sQ0FBQyxNQUFNLEtBQUssRUFBRTtXQUNwQixNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFDckIsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FDdkIsT0FBc0MsRUFDdEMsUUFBaUIsRUFDakIsZUFBdUIsRUFDdkIsa0JBQTBCLEVBQ2pCLEVBQUU7SUFDWCwrRkFBK0Y7SUFDL0YsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ3RCLE9BQU8sT0FBTyxRQUFRLEtBQUssUUFBUTtlQUM5QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2VBQ3ZCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7ZUFDdkIsa0JBQWtCLENBQUMsUUFBUSxFQUFFLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxLQUFLLFFBQVEsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDeEIsTUFBTSxNQUFNLEdBQUcsT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztRQUN4RSxPQUFPLE1BQU0sS0FBSyxJQUFJO2VBQ2pCLENBQUMsTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxPQUFPLENBQUM7ZUFDN0QsTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUM7SUFDbEMsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUMzQixPQUFPLE1BQU0sQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLEtBQUssRUFBRSxDQUFDO0lBQ3ZHLENBQUM7SUFDRCxPQUFPLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FDMUMsVUFBNEMsRUFDNUMsZUFBdUIsRUFDdkIsa0JBQTBCLEVBQzRCLEVBQUU7SUFDeEQsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNsRCxNQUFNLElBQUksS0FBSyxDQUFDLG1FQUFtRSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLEdBQUcscUNBQXFDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEksQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLFVBQVUsR0FBRyxFQUE4RCxDQUFDO0lBQ2xGLElBQUksR0FBRyxHQUFHLEtBQUssQ0FBQztJQUNoQixLQUFLLE1BQU0sSUFBSSxJQUFJLGlDQUFpQyxFQUFFLENBQUM7UUFDckQsTUFBTSxPQUFPLEdBQVksVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLElBQUksaUJBQWlCLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxlQUFlLEVBQUUsa0JBQWtCLENBQUMsRUFBRSxDQUFDO2dCQUN4RSxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixJQUFJLHNDQUFzQyxJQUFJLFlBQVksSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDN0gsQ0FBQztRQUNILENBQUM7UUFDRCxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFhLENBQUMsQ0FBQztRQUMzRCxHQUFHLEtBQUssT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUNELElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNULE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUN6QyxVQUFnRSxFQUNoRSxPQUFzQyxFQUN0QyxZQUFxQixFQUNaLEVBQUU7SUFDWCxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLHdCQUF3QixFQUFFLENBQUM7UUFDcEgsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3BDLElBQUksT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQzNCLE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3RDLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzlHLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDLFFBQVEsQ0FBQyxVQUFVLE1BQU0sQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sb0JBQW9CLEdBQUcsb0NBQW9DLENBQUM7QUFFbEUseUVBQXlFO0FBQ3pFLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsU0FBb0MsRUFBaUIsRUFBRTtJQUM5RixJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLENBQUMsTUFBTSxHQUFHLHdCQUF3QixFQUFFLENBQUM7UUFDakYsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUM7QUFDbEUsQ0FBQyxDQUFDO0FBS0YsMkdBQTJHO0FBQzNHLE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQ3BDLFdBQXdDLEVBQ3hDLFVBQXNDLEVBQ3RDLGVBQXVCLEVBQ2YsRUFBRTtJQUNWLE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxVQUFVLEtBQUssS0FBSztRQUMvQyxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLFlBQVksRUFBRSxlQUFlLENBQUM7UUFDcEQsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN0QyxJQUFJLE1BQU0sSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUN6QixRQUFRLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3JELENBQUM7U0FBTSxDQUFDO1FBQ04sUUFBUSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BDLFFBQVEsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLElBQUksQ0FBQztBQUN2QixDQUFDLENBQUM7QUFFRiwwQ0FBMEM7QUFDMUMsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FDbkMsV0FBd0MsRUFDeEMsVUFBc0MsRUFDVixFQUFFLENBQUMsQ0FBQztJQUNoQyxJQUFJLEVBQUUsaUNBQWlDO0lBQ3ZDLEdBQUcsVUFBVTtJQUNiLEdBQUcsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsV0FBVyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Q0FDekUsQ0FBQyxDQUFDO0FBRUgscUZBQXFGO0FBQ3JGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFLENBQzlDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDO0tBQ3JCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDO0tBQ3pCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDO0tBQzlCLE9BQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFFcEMsZ0VBQWdFO0FBQ2hFLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLHdCQUF3QixDQUFDO0FBRTNFOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQzdCLFdBQXdDLEVBQ3hDLFVBQXNDLEVBQ3RDLFFBQWdCLEVBQ1IsRUFBRTtJQUNWLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsWUFBWSxFQUFFLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVILE1BQU0sTUFBTSxHQUFHO1FBQ2Isc0RBQXNELGtDQUFrQyxrQkFBa0I7UUFDMUcsc0JBQXNCO1FBQ3RCLHVFQUF1RTtRQUN2RSxtQkFBbUI7UUFDbkIsR0FBRztLQUNKLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2IsT0FBTztRQUNMLGlCQUFpQjtRQUNqQixpRkFBaUY7UUFDakYsdUNBQXVDLGtDQUFrQyxLQUFLLElBQUksV0FBVztRQUM3RixrQkFBa0IsUUFBUSxPQUFPLE1BQU0sYUFBYTtRQUNwRCw0REFBNEQ7UUFDNUQsZ0JBQWdCO0tBQ2pCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYscUVBQXFFO0FBQ3JFLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQUMsUUFBZ0IsRUFBVSxFQUFFLENBQzNFLHlDQUF5QyxRQUFRLGdFQUFnRSxDQUFDIn0=

package/dist_ts_relyingparty/interfaces.d.ts

@@ -1,6 +1,6 @@
 import type { IOidcCompletion, TOidcCompletionFailureStage, TOidcPrompt, TOidcTokenHint } from './classes.idpoidcprovider.js';
 import type { TRelyingPartyBearerClientKind } from './contract.bearer.js';
-export type { IRelyingPartyBearerErrorAnswer, IRelyingPartyBearerLogoutAnswer, IRelyingPartyBearerMessage, IRelyingPartyBearerSessionAnswer, IRelyingPartyBearerSessionInfo, IRelyingPartyBearerTokenAnswer, TRelyingPartyBearerClientKind, TRelyingPartyBearerDeliveryError, TRelyingPartyBearerErrorCode, } from './contract.bearer.js';
+export type { IRelyingPartyBearerClaimRequest, IRelyingPartyBearerErrorAnswer, IRelyingPartyBearerLoginQuery, IRelyingPartyBearerLogoutAnswer, IRelyingPartyBearerLogoutRequest, IRelyingPartyBearerMessage, IRelyingPartyBearerRefreshRequest, IRelyingPartyBearerSessionAnswer, IRelyingPartyBearerSessionInfo, IRelyingPartyBearerTokenAnswer, TRelyingPartyBearerClientKind, TRelyingPartyBearerDeliveryError, TRelyingPartyBearerErrorCode, } from './contract.bearer.js';
 /** A session as the application reads it; no token and no sealed value is part of it. */
 export interface IRelyingPartySession {
     id: string;
@@ -129,6 +129,35 @@ export interface IRelyingPartyBearerHandoff {
     /** epoch milliseconds, at most `BEARER_HANDOFF_MAX_AGE_SECONDS` after the callback */
     expiresAt: number;
 }
+/**
+ * A bearer session the application opened for a device it paired
+ * (`openBearerHandoff`): the session, which has no provider login of its own
+ * (`idpSubject` and `loginAttemptId` are absent), and the single-use code the
+ * device claims at `bearer/claim` with the verifier of its challenge. The
+ * code is no token; only its hash is stored.
+ */
+export interface IRelyingPartyBearerHandoffOpening {
+    session: IRelyingPartySession;
+    code: string;
+    /** epoch milliseconds, at most `BEARER_HANDOFF_MAX_AGE_SECONDS` after the opening and never past the session */
+    expiresAt: number;
+}
+/**
+ * What `eraseSessionsOfPrincipal` removed of one principal: the sessions it
+ * ended first, and the rows it deleted.
+ */
+export interface IRelyingPartySessionsErasure {
+    /** sessions not revoked yet (an expired one too) that it ended, each with `onSessionEnded` and its provider tokens handed back */
+    endedSessions: number;
+    /** session rows, live or ended */
+    deletedSessions: number;
+    /** the sign-in transactions the provider sessions came out of */
+    deletedLoginAttempts: number;
+    /** bearer hand-offs, claimed or not */
+    deletedBearerHandoffs: number;
+    /** bearer token generations, current or rotated */
+    deletedBearerTokens: number;
+}
 /**
  * The relying party's own tokens of a bearer session. The refresh token
  * rotates on every use; a rotated one coming back ends the session.
@@ -254,21 +283,31 @@ export interface IRelyingPartyHooks {
      * A provider login opened a session, linked to its attempt. Runs before the
      * login answers; a throw fails the login: the session is revoked, the
      * provider tokens are handed back and the original error is rethrown.
+     * `delivery` is where a bearer login's outcome goes (its client kind, return
+     * target and the client's `state`); a cookie login has none.
      */
     onProviderSessionOpened?(eventArg: {
         session: IRelyingPartySession;
+        delivery?: IRelyingPartyBearerDelivery;
     }): Promise<void>;
     /**
      * A session ended, or a caller tried to end one that was already over
      * (`revokedHere: false`). Close its live connections when `revokedHere`,
      * drop cached authority either way. Must not wait. A throw (or a rejected
      * promise) is reported as a `hook_failed` event and never stops the end:
-     * the provider tokens go back regardless.
+     * the provider tokens go back regardless. An end that revoked the session
+     * here names its principal (`principalId`); one that found it over already
+     * does not.
      */
     onSessionEnded?(eventArg: {
         sessionId: string;
         reason: TRelyingPartySessionEndReason;
-        revokedHere: boolean;
+        revokedHere: true;
+        principalId: string;
+    } | {
+        sessionId: string;
+        reason: TRelyingPartySessionEndReason;
+        revokedHere: false;
     }): void;
     /**
      * Structured diagnostics; the default writes one JSON line to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "19.4.0",
+  "version": "19.5.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",

package/readme.md

@@ -152,7 +152,7 @@ await idp.logout();
 | `getTransferTokenAndSwitchToLocation()` | Request a transfer token and navigate to the same configured target with `transfertoken` attached. |
 | `processTransferToken()` | Consume a `transfertoken` from the current URL and refresh local auth state. |
 | `logout()` | Revoke and clear the current login flow. |
-| `RelyingPartyBearerClient` | The bearer hand-off client of a relying party's own `web` and `popup` logins: PKCE start URL, the redirect and popup receivers, claim, refresh single-flight across tabs through Web Locks, and logout, with the token pair in an application storage adapter (`IRelyingPartyBearerTokenStorage`). See [Bearer Hand-off](#bearer-hand-off). |
+| `RelyingPartyBearerClient` | The bearer hand-off client of a relying party's own `web` and `popup` logins: PKCE start URL, the redirect and popup receivers, claim, refresh single-flight across tabs through Web Locks, and logout, with the token pair in an application storage adapter (`IRelyingPartyBearerTokenStorage`). `createPkce()` and `claimCode(pkce, code)` claim a code delivered another way, such as a device pairing, without a window. See [Bearer Hand-off](#bearer-hand-off). |
 
 ### Typed Request Shortcuts
 
@@ -614,6 +614,13 @@ What it does:
 Nothing runs on a timer, and no token, cookie or sealed value ever reaches a
 log line or an error message.
 
+`onSessionEnded` names the session, the reason and whether this call revoked
+it (`revokedHere`); when it did, it also names the session's principal
+(`principalId`), and when the session was over already it does not.
+`onProviderSessionOpened` receives the session and, for a bearer login, its
+`delivery`: the client kind, the return target and the client's `state`. A
+cookie login has no `delivery`.
+
 Application hooks never stand in the way of that cleanup. A throwing (or
 rejecting) `onSessionEnded` or `onEvent` is reported as a `hook_failed` event —
 `onEvent`'s own failure on `console.error` — and the provider tokens go back
@@ -648,9 +655,46 @@ example after a local password check.
 
 Nothing runs on a timer. A login start first removes up to 100 login attempts
 and up to 100 sessions that ended more than an hour ago, and a bearer login
-start also its bearer hand-offs and token generations; `openSession` removes
-the sessions only. Removing an ended session fires no end hook and calls no
-provider.
+start also its bearer hand-offs and token generations; `openBearerHandoff`
+removes the bearer state and the sessions, `openSession` the sessions only.
+Removing an ended session fires no end hook and calls no provider.
+
+**Deleting an account.** The sweeps above run only when a session is created,
+so an ended session can stay stored for long on a quiet service.
+`eraseSessionsOfPrincipal(principalId)` removes everything of one principal at
+once: an application calls it when it deletes the account, after its own
+erasers and before its user record, so a failure can be retried.
+
+```ts
+await accountData.eraseAll(userId); // the application's own records
+const erasure = await sessions.eraseSessionsOfPrincipal(userId);
+await users.delete(userId);
+```
+
+- It ends every session of the principal that is not revoked yet, an expired
+  one too, as `endSession` does: its tokens stop working at once,
+  `onSessionEnded` fires (reason `logout`, with `principalId`), and its
+  provider tokens go back to idp.global, which a deleted row could no longer
+  do.
+- Then it deletes every session row of the principal, live or ended, and with
+  each the login attempt a provider session came out of and, in bearer mode,
+  its hand-offs (claimed or not) and its token generations. The session row
+  goes last: it is the only link from the principal to the others, so an
+  erase that fails half way leaves a retry everything it needs.
+- It answers what it removed (`IRelyingPartySessionsErasure`: `endedSessions`,
+  `deletedSessions`, `deletedLoginAttempts`, `deletedBearerHandoffs`,
+  `deletedBearerTokens`); a second call finds nothing.
+- A session opened by a login already past `admit` when the erase runs is not
+  covered. It keeps the principal id until it expires and a later sweep
+  removes it. A second `eraseSessionsOfPrincipal(principalId)`, run after the
+  user record is deleted, removes it. A token generation issued by a refresh
+  already under way is not covered either; it outlives its session row as
+  described below.
+- A token generation, and for at most a minute a hand-off, outlives the row
+  of its session when that session was revoked and swept before its expiry.
+  It holds only hashes, the session id and times, the bearer sweep removes it
+  an hour after the session would have expired, and the erase cannot
+  attribute it to the principal any more.
 
 **Building before the database connects.** `db` may be a function that answers
 the database once it exists. It is called on every use of a model, the way
@@ -843,8 +887,10 @@ Tokens and their ends:
   bearer login sweeps it (`handoff_unclaimed`). Each answers 400
   `invalid_bearer_handoff`; reuse is also reported as a
   `bearer_credential_reused` event.
-- A bearer session is a provider login like a cookie session: `onSessionEnded`,
-  `endSessionsOfPrincipal` and `AuthorityObserver` apply as they are. A refresh
+- A bearer login is a provider login like a cookie session: `onSessionEnded`,
+  `endSessionsOfPrincipal` and `AuthorityObserver` apply as they are. (A
+  session opened by pairing a device has no provider login of its own; see
+  "Pairing a device" below.) A refresh
   rotates the provider token when it is due and ends the session when
   idp.global has ended the login (`invalid_bearer_grant`); an unreachable
   provider answers 503 `authority_unavailable` and spends nothing. Until then
@@ -877,8 +923,13 @@ The client side:
 The HTTP answers are exported as types (`IRelyingPartyBearerTokenAnswer`,
 `IRelyingPartyBearerSessionAnswer`, `IRelyingPartyBearerLogoutAnswer`,
 `IRelyingPartyBearerErrorAnswer` with `TRelyingPartyBearerErrorCode`, and the
-popup's `IRelyingPartyBearerMessage`). They come from a module that imports
-nothing, so `@idp.global/sdk/browser` shares them with the server.
+popup's `IRelyingPartyBearerMessage`), and so are the requests:
+`IRelyingPartyBearerLoginQuery` (the `bearer/login` query by its parameter
+names), `IRelyingPartyBearerClaimRequest` (`{ code, codeVerifier }`),
+`IRelyingPartyBearerRefreshRequest` (`{ refreshToken }`) and
+`IRelyingPartyBearerLogoutRequest` (`{ refreshToken? }`). They come from a
+module that imports nothing, so `@idp.global/sdk/browser` and
+`@idp.global/sdk/browser/bearer` share them with the server.
 
 **The browser client.** `RelyingPartyBearerClient` from `@idp.global/sdk/browser`
 is that client side for `web` and `popup` logins. The application owns where the
@@ -929,6 +980,16 @@ await client.logout();
   `previous_session_not_revoked` with `previousSessionError`. In the last case
   that session lives on at the relying party until it expires. A failed claim
   leaves the stored pair and its session as they were.
+- `createPkce()` makes a verifier and its S256 challenge from 32 random bytes,
+  and `claimCode(pkce, code)` claims a code bound to that challenge which
+  reached the client another way than its own login, such as a device pairing
+  ("Pairing a device" below). It is received like a login: one
+  claim, never retried, under `requestTimeoutMs`, and the pair replaces the
+  stored one under the lock (`IRelyingPartyBearerLoginResult`). A pair is
+  claimed with once: a second call with it, after a failed claim as well, is
+  `already_received` and sends nothing. A pair that is not one (a malformed
+  verifier, a challenge that is not its S256) or a code that is not text
+  throws before anything is sent. Neither needs a window.
 - `openPopupLogin(login, { timeoutMs?, signal?, windowFeatures? })` calls
   `window.open` before it returns, so a browser lets it through within the
   click. It takes only a message from the relying party's exact origin, from
@@ -981,6 +1042,87 @@ await client.logout();
 - The client needs the Web Locks API and Web Crypto, which a browser offers
   only in a secure context, and has no fallback for either. Every request is
   sent without credentials, cache or redirects.
+- It runs in a Manifest V3 extension's service worker. That was checked in
+  Chromium 149: a module service worker imported `@idp.global/sdk/browser/bearer`
+  and ran `createPkce`, `claimCode` against the bearer routes and a rotation
+  through `accessToken()`, with the lock held at each write. Other browsers'
+  extension workers were not checked. The extension needs a host permission
+  for the relying party's origin: the routes answer CORS for popup origins
+  only, so without one the browser's preflight is refused and the claim fails
+  with `request_failed` before it is sent.
+
+**Pairing a device.** A person who is signed in can sign a second device of
+theirs in without a login on it, such as a TV or a browser extension. The
+device makes a PKCE pair and shows the application its challenge, for example
+together with a short code that the person confirms in a session where they
+are signed in. The application's server then opens the device's session from
+the session that confirmed:
+
+```ts
+// the device polls; the person has confirmed the pairing in one of their sessions
+const { code, expiresAt } = await sessions.openBearerHandoff({
+  openerSessionId: pairing.confirmedInSessionId, // written by the confirm handler, never taken from the device
+  codeChallenge: pairing.codeChallenge, // the device's S256 challenge
+  maxAgeSeconds: 8 * 60 * 60, // optional: 1 to sessionMaxAgeSeconds, which is the default
+});
+// answer the poll with `code`; the device claims it at POST /auth/bearer/claim with its verifier
+```
+
+```ts
+// the device, with the browser client (a native client claims at bearer/claim itself)
+const pkce = await client.createPkce();
+await showPairingRequest(pkce.codeChallenge);
+const result = await client.claimCode(pkce, await pollForCode());
+```
+
+- **The opener.** `openerSessionId` must name a live provider login: not ended
+  and not expired, with an active principal and a provider login of its own
+  (`idpSubject`). A session from `openSession` or from `openBearerHandoff`
+  does not qualify, so a paired device cannot pair another one. Any other
+  opener throws `RelyingPartyError('invalid_handoff_opener')` (400). A
+  challenge that is not one throws `invalid_bearer_request`, and a
+  `maxAgeSeconds` outside 1 to `sessionMaxAgeSeconds` throws a `RangeError`.
+  Nothing is stored for any of these. Without `bearer` the call throws
+  `login_method_unavailable`; in bearer-only mode it works, with a bearer login
+  as the opener. The check reads this relying party's state of the opener;
+  observe authority with the opener first to ask idp.global itself.
+- **The pairing record.** It keeps the id of the session that confirmed,
+  written by the confirm handler and never taken from the device. That opener
+  must still be live when the poll delivers the code. Open one hand-off per
+  confirmed pairing, in the poll that delivers it; then the code is never
+  stored, and only the public challenge sits in the record. Only server code
+  opens a hand-off, and no route does. Guard the confirmation against a code
+  the person did not start themselves (RFC 8628 §5.4).
+- **The code** is a bearer login's code: one claim within
+  `BEARER_HANDOFF_MAX_AGE_SECONDS` (60) and never past the session, bound to
+  the challenge, stored only as a hash. A claimed code that comes back, a wrong
+  verifier or a code nobody claims ends the session.
+- **The session** acts as the opener's principal and has no `idpSubject` or
+  `loginAttemptId`. It lives `maxAgeSeconds` from the opening, the same rule as
+  every session, and no refresh extends it. It refreshes without asking the
+  provider. Its expiry, `endSession`, `endSessionsOfPrincipal`, the device's
+  `bearer/logout` and the reuse of its code or refresh token end it; an
+  inactive principal resolves it to nothing.
+- **What does not reach it.** It holds no provider token, so an idp.global
+  logout or a change of the person's memberships never reaches it, and
+  `AuthorityObserver.observe` refuses it (`authority_login_required`) without
+  ending it. So the application:
+  - grants a paired session (`session.idpSubject` absent) no idp.global
+    organization authority and does not observe it. An application that ends
+    sessions on `authority_login_required` must not observe paired sessions at
+    all;
+  - sees idp.global end a login only as `onSessionEnded` with the reason
+    `refresh_token_refused` for one of the person's provider sessions. It may
+    answer that by ending the person's paired sessions: `endSession` for those
+    `sessionsOfPrincipal` lists without `idpSubject`, or
+    `endSessionsOfPrincipal` to end every session of the person. The hook
+    names the principal of a session it revoked (`principalId`), so the
+    application needs no table of sessions and principals of its own;
+  - ends paired sessions itself when the person signs out everywhere, and
+    erases them with every other session when the account goes
+    (`eraseSessionsOfPrincipal`, see "Deleting an account");
+  - chooses `sessionMaxAgeSeconds`, or `maxAgeSeconds` per pairing, knowing
+    that a paired device lives that long without a check at idp.global.
 
 **Bearer-only mode.** An application whose every client is a bearer client turns
 the cookie login off with `cookieSessions: false`. No route then reads or sets a
@@ -1004,7 +1146,8 @@ const sessions = new RelyingPartySessions({
 `null`, like every path the routes do not serve. `startLogin`,
 `completeLogin`, `abandonLogin`, `finalizeLogin`, `openSession`,
 `clearSessionCookie` and `clearIntentCookie` throw `login_method_unavailable`,
-and `resolveCookieSession` answers `null`. A callback that belongs to no bearer
+and `resolveCookieSession` answers `null`. `openBearerHandoff` works, with a
+bearer login as the opener. A callback that belongs to no bearer
 login redirects to `failureLocation` when the provider sent an `error`, and
 otherwise answers 400 `authentication_failed`. `RelyingPartySocketBinding`
 registers a browser by its cookie session, so it binds no connection in this
@@ -1088,7 +1231,7 @@ const delivery = await readBearerDelivery(await fetch(callback, { redirect: 'man
 | --- | --- |
 | `IdpOidcProvider` | Discovery, PKCE authorization URL, code exchange with UserInfo, refresh, revocation and organization introspection for idp.global. Implements `IOidcProvider`. `trustedCaPem` or `fetch` for an issuer under a private CA. |
 | `createRelyingPartyModels()` | Binds the session, login-attempt, bearer hand-off and bearer token models to one `SmartdataDb`, or to a function asked for it on every use, optionally under existing collection names. |
-| `RelyingPartySessions<TPrincipal>` | Login start (with an application intent and a prompt)/complete/abandon/finalize, `openSession` (with a shorter lifetime), `resolveCookieSession`, `revalidateSession`, `revalidateLiveSession`, `isSessionLive`, `validateCsrf`, `logout`/`endSession`, `endSessionsOfPrincipal`, `sessionsOfPrincipal` (paged), `liveProviderToken` (with `rejectedAccessToken`). Principals give `isActive` or `resolve` (`IRelyingPartyPrincipals`, `IRelyingPartyPrincipalResolver<TPrincipal>`); with `resolve`, live sessions carry `principal`. With `bearer`: `startBearerLogin`, `bearerDeliveryOf`, `completeBearerLogin`, `abandonBearerLogin`, `claimBearerHandoff`, `refreshBearerTokens`, `resolveBearerAccessToken`, `resolveBearerSession`, `endBearerSession`; `cookieSessions: false` (`IRelyingPartyBearerOnlySessionsOptions`) runs bearer hand-off alone, without cookies or a CSRF key. |
+| `RelyingPartySessions<TPrincipal>` | Login start (with an application intent and a prompt)/complete/abandon/finalize, `openSession` (with a shorter lifetime), `resolveCookieSession`, `revalidateSession`, `revalidateLiveSession`, `isSessionLive`, `validateCsrf`, `logout`/`endSession`, `endSessionsOfPrincipal`, `eraseSessionsOfPrincipal` (deleting an account), `sessionsOfPrincipal` (paged), `liveProviderToken` (with `rejectedAccessToken`). Principals give `isActive` or `resolve` (`IRelyingPartyPrincipals`, `IRelyingPartyPrincipalResolver<TPrincipal>`); with `resolve`, live sessions carry `principal`. With `bearer`: `startBearerLogin`, `bearerDeliveryOf`, `completeBearerLogin`, `abandonBearerLogin`, `openBearerHandoff` (pairing a device from a live provider login), `claimBearerHandoff`, `refreshBearerTokens`, `resolveBearerAccessToken`, `resolveBearerSession`, `endBearerSession`; `cookieSessions: false` (`IRelyingPartyBearerOnlySessionsOptions`) runs bearer hand-off alone, without cookies or a CSRF key. |
 | `AuthorityObserver`, `AUTHORITY_FORCED_REFRESH_INTERVAL_MS` | Live organization authority with opt-in positive and negative reuse. An inactive answer rotates the session's token, at most once per interval, before it refuses. |
 | `RelyingPartyRoutes` | `handle(ctx)` for `/auth/login`, `/auth/callback`, `/auth/finalize`, `/auth/session` and `/auth/logout`; `null` for anything else. Takes a typedserver route context. `onLogout` is awaited after a CSRF-checked logout ended the session. In bearer mode also `/auth/bearer/login`, `/auth/bearer/claim`, `/auth/bearer/refresh`, `/auth/bearer/session` and `/auth/bearer/logout`, with CORS for the popup origins only; in bearer-only mode `/auth/login`, `/auth/finalize`, `/auth/session` and `/auth/logout` answer `null`. |
 | `createActorScope()` | AsyncLocalStorage actor context with a TypedRouter request scope. |
@@ -1096,6 +1239,9 @@ const delivery = await readBearerDelivery(await fetch(callback, { redirect: 'man
 | `SecretBox`, `deriveCsrfToken()`, `decodeSecretKey()`, `parseCookies()`, `serializeCookie()`, `sanitizeReturnPath()` | The primitives underneath. |
 | `pkceChallengeOf()`, `verifyPkceChallenge()`, `parseBearerAuthorization()`, `isBearerReturnTargetAllowed()`, `RELYING_PARTY_BEARER_MESSAGE_TYPE`, `BEARER_HANDOFF_MAX_AGE_SECONDS` | The bearer primitives: S256, the `Authorization` header, the return-target match and the popup message type. |
 | `IRelyingPartyBearerTokenAnswer`, `IRelyingPartyBearerSessionAnswer`, `IRelyingPartyBearerLogoutAnswer`, `IRelyingPartyBearerErrorAnswer`, `TRelyingPartyBearerErrorCode`, `IRelyingPartyBearerMessage` | The HTTP answers of the bearer routes and the popup message, shared with `@idp.global/sdk/browser`. |
+| `IRelyingPartyBearerLoginQuery`, `IRelyingPartyBearerClaimRequest`, `IRelyingPartyBearerRefreshRequest`, `IRelyingPartyBearerLogoutRequest` | The requests of the bearer routes: the `bearer/login` query and the JSON bodies, shared with `@idp.global/sdk/browser`. |
+| `IRelyingPartyBearerHandoffOpening` | What `openBearerHandoff` answers: the paired session, its code and when the code expires. |
+| `IRelyingPartySessionsErasure` | What `eraseSessionsOfPrincipal` answers: how many sessions it ended, and how many sessions, login attempts, bearer hand-offs and token generations it deleted. |
 | `RelyingPartyError`, `RelyingPartyRefusal`, `LoginCallbackError`, `AuthorityTokenError`, `AuthorityRefusedError`, `RelyingPartyDatabaseUnavailableError` | Errors with stable codes; none carries token material. A `RelyingPartyRefusal` may name the application's `location` for the browser. |
 | `RelyingPartyProviderDouble` (`/relyingparty/testing`) | An in-process idp.global for an application's tests: personas, live organization roles, single-use codes, rotating and reuse-detecting refresh tokens, recorded calls and injectable failures. `createBearerPkcePair()` and `readBearerDelivery()` for bearer clients. |
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '19.4.0',
+  version: '19.5.0',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }