@idp.global/sdk 19.5.0 → 19.6.0

package/changelog.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 2026-11-11 - 19.6.0
+
+### Features
+
+- a lost refresh answer no longer signs the person out: `bearer.refreshReuseGraceSeconds` (relyingparty)
+  - A spent bearer refresh token that comes back within the window of its rotation (60 seconds by default, 0 turns it off, at most 300; the constructor refuses anything else), while its successor was never presented, revokes that successor and answers a new pair; the `bearer_refresh_reissued` event reports it. Presented means the successor's access token authenticated a request or its refresh token was sent to `bearer/refresh`; the first presentation is recorded on the token generation (`firstUsedAt`), and a rotation names its successor (`successorId`). Only hashes are stored, so the lost pair is replaced, never repeated.
+  - Once the successor was presented, after the window (counted from the rotation, however often the retry's answer is lost too), and for the second of two retries at once, the spent token is reuse and ends the session as before (`refresh_token_reused`). Generations stored before this release carry neither field and are handled as before.
+  - `bearer/logout` (`endBearerSession`) judges a spent refresh token as the refresh does: one that would be a lost answer there ends the session as a `logout`, so signing out after a lost refresh answer reports no `bearer_credential_reused` and no `refresh_token_reused`.
+  - The browser client needs no change: after a lost refresh its next refresh with the stored pair recovers within the window. A relying party that wants the strict rotation of 19.5.0 sets `refreshReuseGraceSeconds: 0`.
+  - `TRelyingPartyEventName` gains `bearer_refresh_reissued`; a consumer that switches over it exhaustively adds the case.
+  - The first request with each new access token now writes once to record its presentation.
+- a cookie policy for framed applications: `cookiePolicy: { sameSite, partitioned }` (relyingparty)
+  - `sameSite` is `'Lax'` (the default, unchanged) or `'None'`; `partitioned: true` adds the CHIPS `Partitioned` attribute and is valid only with `'None'`. One policy goes on the session and the intent cookie, on every `Set-Cookie` that sets or clears them: the login start, the opened session, `openSession`, `clearSessionCookie` and `clearIntentCookie`.
+  - The constructor refuses `partitioned` without `sameSite: 'None'`, `sameSite: 'None'` on an http `publicOrigin` (a `SameSite=None` cookie must be `Secure`), any other value, and `cookiePolicy` in bearer-only mode. `sessions.cookiePolicy` answers the resolved policy.
+  - `serializeCookie` takes `partitioned` and throws when it is given without `secure`.
+- typed provider errors: `OidcProviderError` with `code` and `oauthError` (relyingparty)
+  - An application classifies a failure of the provider half without importing openid-client. `code` (`TOidcProviderErrorCode`, listed in `OIDC_PROVIDER_ERROR_CODES`) is `token_exchange_refused`, `login_mismatch`, `invalid_response`, `provider_unreachable` or `refresh_refused`; `oauthError` is the provider's own OAuth error code when it sent one, such as `invalid_grant`, kept only when it is a short token and never with its description.
+  - `OidcCompletionError`, `OidcRefreshRefusedError` and `OidcAuthorityUnavailableError` now extend `OidcProviderError`; their names, `stage`, `reason` and constructors stay, and `OidcCompletionError` takes the code as an optional third argument (without it, the code is read from the cause). `IdpOidcProvider` maps openid-client's failures to the codes, and the provider double of `/relyingparty/testing` answers with the codes idp.global's would.
+  - `IdpOidcProvider.completeAuthorization` refuses a callback whose one `state` is not the login's (`login_mismatch`) before it asks the provider. A refresh whose answer fails openid-client's checks is now `OidcAuthorityUnavailableError` with the reason `invalid_response` instead of `unavailable`; both fail closed as before.
+
+### Fixes
+
+- a swept session takes its bearer rows with it, and `endSessionsOfPrincipal` leaves expired sessions alone (relyingparty)
+  - The session sweep now deletes a session's bearer hand-offs and token generations by `sessionId` before the session row. Before, a session revoked early was swept an hour after its revocation while its generations stayed until an hour after its original expiry, with no row left that named the principal, so `eraseSessionsOfPrincipal` could not reach them. A sweep that fails between the two leaves the session row, and the next sweep finishes it.
+  - The bearer hand-off and bearer token models declare a `sessionId` index, which the sweep and `eraseSessionsOfPrincipal` read; it is built on first use like the `expiresAt` index. On the test suite's engine a token write cost 3.68 instead of 3.22 ms in memory and 9.38 instead of 9.23 ms on file storage, and a delete by session took 5 instead of 54 ms (4,000 rows, memory) and 16 instead of 88 ms (600 rows, file).
+  - `endSessionsOfPrincipal` reads only sessions that have not expired: an expired one is over already and is no longer revoked, handed back to the provider or counted. `eraseSessionsOfPrincipal` still ends it.
+- ID tokens are verified against idp.global's signing keys (relyingparty)
+  - Before, `IdpOidcProvider` accepted the ID token of a code exchange or a refresh on the trust of the TLS connection to the token endpoint alone and never checked its signature. Discovery now turns on openid-client's `enableNonRepudiationChecks`, so every ID token of both grants is checked against the issuer's `jwks_uri` (RS256), fetched through the provider's own transport (`trustedCaPem` or `fetch` included) and cached by openid-client.
+  - A code exchange whose ID token is signed by a key outside the JWKS fails as `OidcCompletionError` at the `token_exchange` stage, and a refresh as `OidcAuthorityUnavailableError`, which ends nothing and fails closed. The first login after a start fetches the JWKS once more.
+
+### Maintenance
+
+- release tooling: `@git.zone/tsrepo` ^1.1.1 → ^2.1.0 (2.0.0 makes `@push.rocks/smartmongo` an optional peer of its tapbundle; the sdk's tests do not call `createSmartmongo()`), `@types/node` 26.6.5 → 26.6.6 and pnpm 12.14.0 → 12.17.0; the re-resolved tooling (`@push.rocks/smartfile` 13.2.4 with `@push.rocks/smartcrypto` 3.1.0) no longer installs `node-forge`; `brace-expansion` 2.1.2 → 2.1.7 (through `minimatch` 9.0.9 in the production closure) clears its high advisories.
+
 ## 2026-10-26 - 19.5.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '19.5.0',
+    version: '19.6.0',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_relyingparty/classes.idpoidcprovider.d.ts

@@ -56,22 +56,80 @@ export interface IOidcRefreshedTokens {
     /** epoch milliseconds; `0` when the token response named no lifetime */
     accessTokenExpiresAt: number;
 }
+/**
+ * What failed when the provider was asked, as an application tells the cases
+ * apart; never why access was refused, which only an authority answer says.
+ */
+export type TOidcProviderErrorCode = 
+/**
+ * The provider refused the login: an OAuth error in the callback, for the
+ * code at the token endpoint, or for its token at UserInfo. `oauthError`
+ * names it, such as `invalid_grant` for a code that was used or expired.
+ */
+'token_exchange_refused'
+/**
+ * The callback or its ID token is not this login's: a `state` that is not
+ * the login's, or an ID token claim that does not match it (the nonce, and
+ * likewise the issuer, the audience or the authorized party).
+ */
+ | 'login_mismatch'
+/**
+ * The provider answered outside its contract: an ID token whose signature
+ * does not verify against the JWKS or that has expired, no subject, another
+ * subject at UserInfo, or a body that is no OAuth answer.
+ */
+ | 'invalid_response'
+/** The provider could not be asked: no answer in time, a transport failure, a 5xx, or no discovery yet. */
+ | 'provider_unreachable'
+/** The refresh grant answered `invalid_grant`: the refresh family is revoked, expired or was reused. */
+ | 'refresh_refused';
+export declare const OIDC_PROVIDER_ERROR_CODES: readonly TOidcProviderErrorCode[];
+/**
+ * Every failure of the provider this module throws: its `code` says which
+ * case it is, `oauthError` the provider's own OAuth error code where it sent
+ * one (a short token, never its description). An application classifies a
+ * failure by these and never by openid-client's classes; `cause` keeps the
+ * original for a debugger, not for a log line.
+ */
+export declare class OidcProviderError extends Error {
+    readonly code: TOidcProviderErrorCode;
+    readonly oauthError?: string;
+    constructor(messageArg: string, detailArg: {
+        code: TOidcProviderErrorCode;
+        oauthError?: string;
+    }, causeArg?: unknown);
+}
 /** Why an observation or a refresh could not be made; never why access was refused. */
 export type TOidcAuthorityFailure = 'unavailable' | 'invalid_response';
-/** The provider could not be asked, or did not answer in its own contract. The caller fails closed on it. */
-export declare class OidcAuthorityUnavailableError extends Error {
+/**
+ * The provider could not be asked, or did not answer in its own contract. The
+ * caller fails closed on it. `code` is `provider_unreachable` or
+ * `invalid_response`, after `reason`.
+ */
+export declare class OidcAuthorityUnavailableError extends OidcProviderError {
     readonly reason: TOidcAuthorityFailure;
     constructor(reason: TOidcAuthorityFailure, causeArg?: unknown);
 }
-/** The provider refused the refresh with `invalid_grant`: the refresh family is revoked, expired or was reused. */
-export declare class OidcRefreshRefusedError extends Error {
+/**
+ * The provider refused the refresh with `invalid_grant`: the refresh family is
+ * revoked, expired or was reused. `code` is `refresh_refused`.
+ */
+export declare class OidcRefreshRefusedError extends OidcProviderError {
     constructor(causeArg?: unknown);
 }
 export type TOidcTokenHint = 'access_token' | 'refresh_token';
 export type TOidcCompletionFailureStage = 'token_exchange' | 'token_validation' | 'userinfo';
-export declare class OidcCompletionError extends Error {
+/**
+ * A login the provider half could not complete. `stage` says where it
+ * stopped, `code` what it was; without a `detailArg` the code is read from
+ * the cause, an openid-client failure.
+ */
+export declare class OidcCompletionError extends OidcProviderError {
     readonly stage: TOidcCompletionFailureStage;
-    constructor(stage: TOidcCompletionFailureStage, causeArg: unknown);
+    constructor(stage: TOidcCompletionFailureStage, causeArg: unknown, detailArg?: {
+        code: TOidcProviderErrorCode;
+        oauthError?: string;
+    });
 }
 /**
  * What the session layer needs from the provider. `IdpOidcProvider` is the
@@ -115,7 +173,7 @@ export interface IIdpOidcProviderOptions {
     /** the registered callback, on the application's public origin */
     redirectUri: URL;
     scopes?: string;
-    /** deadline of discovery, token, UserInfo, refresh and revocation requests */
+    /** deadline of discovery, token, JWKS, UserInfo, refresh and revocation requests */
     requestTimeoutSeconds?: number;
     /** deadline of one introspection; the introspection client's default applies when absent */
     introspectionTimeoutMs?: number;
@@ -129,7 +187,7 @@ export interface IIdpOidcProviderOptions {
     trustedCaPem?: string | readonly string[];
     /**
      * Advanced: the fetch that carries every request of this provider —
-     * discovery, token, UserInfo, refresh, revocation and introspection.
+     * discovery, token, JWKS, UserInfo, refresh, revocation and introspection.
      * It owns the transport's trust decisions; https-only still holds. Not
      * combined with `trustedCaPem`.
      */
@@ -144,9 +202,9 @@ export declare const readOrganizationClaims: (valueArg: unknown) => IOidcOrganiz
 /**
  * The relying-party side of the authorization code flow with S256 PKCE on
  * `openid-client`, in the profile idp.global supports: code responses, S256
- * challenges, RS256 ID tokens and `client_secret_basic` for a confidential
- * client. Live organization authority is observed with the sdk's
- * `OidcIntrospectionClient`.
+ * challenges, RS256 ID tokens whose signature is verified against the
+ * issuer's JWKS, and `client_secret_basic` for a confidential client. Live
+ * organization authority is observed with the sdk's `OidcIntrospectionClient`.
  */
 export declare class IdpOidcProvider implements IOidcProvider {
     #private;

package/dist_ts_relyingparty/classes.idpoidcprovider.js

@@ -2,26 +2,123 @@ import * as plugins from './plugins.js';
 import { OidcIntrospectionClient, OidcIntrospectionError, } from '../dist_ts_server/classes.oidc-introspection-client.js';
 import { createTrustedCaFetch } from '../dist_ts_server/helpers.trusted-ca-fetch.js';
 export const OIDC_PROMPTS = ['none', 'login', 'consent'];
-/** The provider could not be asked, or did not answer in its own contract. The caller fails closed on it. */
-export class OidcAuthorityUnavailableError extends Error {
+export const OIDC_PROVIDER_ERROR_CODES = [
+    'token_exchange_refused',
+    'login_mismatch',
+    'invalid_response',
+    'provider_unreachable',
+    'refresh_refused',
+];
+/** An OAuth error code is a short token; anything else a provider sends there is dropped, never kept. */
+const OAUTH_ERROR_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/;
+const oauthErrorOf = (valueArg) => typeof valueArg === 'string' && OAUTH_ERROR_PATTERN.test(valueArg) ? valueArg : undefined;
+/** The OAuth error and HTTP status of an openid-client failure that is the provider's own answer; `null` for any other failure. */
+const providerAnswerOf = (errorArg) => {
+    const openidClient = plugins.openidClient;
+    if (errorArg instanceof openidClient.ResponseBodyError) {
+        return { oauthError: oauthErrorOf(errorArg.error), status: errorArg.status };
+    }
+    if (errorArg instanceof openidClient.AuthorizationResponseError) {
+        return { oauthError: oauthErrorOf(errorArg.error) };
+    }
+    if (errorArg instanceof openidClient.WWWAuthenticateChallengeError) {
+        return { oauthError: oauthErrorOf(errorArg.cause[0]?.parameters.error), status: errorArg.status };
+    }
+    return null;
+};
+/** openid-client's codes (`ClientError.code`) for a provider that did not answer in time or within HTTP's own contract. */
+const UNREACHABLE_CLIENT_ERROR_CODES = ['OAUTH_TIMEOUT', 'OAUTH_ABORT', 'OAUTH_RESPONSE_IS_NOT_CONFORM'];
+/** openid-client's code for a JWT claim that is not the expected one: the nonce, the issuer, the audience or the authorized party. */
+const JWT_CLAIM_COMPARISON_CODE = 'OAUTH_JWT_CLAIM_COMPARISON_FAILED';
+/**
+ * The class of an openid-client failure of the code exchange or of UserInfo.
+ * The provider's own OAuth error answer is a refusal, or unreachable on a 5xx;
+ * a claim that does not match is not this login's; every other failure of
+ * openid-client's checks is an invalid response; and anything else (a
+ * transport failure is fetch's `TypeError`) is an unreachable provider.
+ */
+const classifyCompletionFailure = (errorArg) => {
+    if (errorArg instanceof OidcProviderError) {
+        return { code: errorArg.code, oauthError: errorArg.oauthError };
+    }
+    const answer = providerAnswerOf(errorArg);
+    if (answer) {
+        const code = answer.status !== undefined && answer.status >= 500
+            ? 'provider_unreachable'
+            : 'token_exchange_refused';
+        return { code, oauthError: answer.oauthError };
+    }
+    if (errorArg instanceof plugins.openidClient.ClientError) {
+        if (errorArg.code === JWT_CLAIM_COMPARISON_CODE) {
+            return { code: 'login_mismatch' };
+        }
+        return { code: errorArg.code !== undefined && UNREACHABLE_CLIENT_ERROR_CODES.includes(errorArg.code) ? 'provider_unreachable' : 'invalid_response' };
+    }
+    return { code: 'provider_unreachable' };
+};
+/** Why a refresh could not be made: openid-client's checks failed on the answer, or the provider could not be asked. */
+const refreshFailureReasonOf = (errorArg) => errorArg instanceof plugins.openidClient.ClientError
+    && !(errorArg.code !== undefined && UNREACHABLE_CLIENT_ERROR_CODES.includes(errorArg.code))
+    ? 'invalid_response'
+    : 'unavailable';
+/**
+ * Every failure of the provider this module throws: its `code` says which
+ * case it is, `oauthError` the provider's own OAuth error code where it sent
+ * one (a short token, never its description). An application classifies a
+ * failure by these and never by openid-client's classes; `cause` keeps the
+ * original for a debugger, not for a log line.
+ */
+export class OidcProviderError extends Error {
+    code;
+    oauthError;
+    constructor(messageArg, detailArg, causeArg) {
+        super(messageArg, { cause: causeArg });
+        this.name = 'OidcProviderError';
+        if (!OIDC_PROVIDER_ERROR_CODES.includes(detailArg?.code)) {
+            throw new TypeError('OidcProviderError needs one of OIDC_PROVIDER_ERROR_CODES');
+        }
+        this.code = detailArg.code;
+        const oauthError = oauthErrorOf(detailArg.oauthError);
+        if (oauthError !== undefined) {
+            this.oauthError = oauthError;
+        }
+    }
+}
+/**
+ * The provider could not be asked, or did not answer in its own contract. The
+ * caller fails closed on it. `code` is `provider_unreachable` or
+ * `invalid_response`, after `reason`.
+ */
+export class OidcAuthorityUnavailableError extends OidcProviderError {
     reason;
     constructor(reason, causeArg) {
-        super('The identity provider could not be observed', { cause: causeArg });
+        super('The identity provider could not be observed', {
+            code: reason === 'invalid_response' ? 'invalid_response' : 'provider_unreachable',
+            oauthError: providerAnswerOf(causeArg)?.oauthError,
+        }, causeArg);
         this.reason = reason;
         this.name = 'OidcAuthorityUnavailableError';
     }
 }
-/** The provider refused the refresh with `invalid_grant`: the refresh family is revoked, expired or was reused. */
-export class OidcRefreshRefusedError extends Error {
+/**
+ * The provider refused the refresh with `invalid_grant`: the refresh family is
+ * revoked, expired or was reused. `code` is `refresh_refused`.
+ */
+export class OidcRefreshRefusedError extends OidcProviderError {
     constructor(causeArg) {
-        super('The identity provider refused the refresh', { cause: causeArg });
+        super('The identity provider refused the refresh', { code: 'refresh_refused', oauthError: 'invalid_grant' }, causeArg);
         this.name = 'OidcRefreshRefusedError';
     }
 }
-export class OidcCompletionError extends Error {
+/**
+ * A login the provider half could not complete. `stage` says where it
+ * stopped, `code` what it was; without a `detailArg` the code is read from
+ * the cause, an openid-client failure.
+ */
+export class OidcCompletionError extends OidcProviderError {
     stage;
-    constructor(stage, causeArg) {
-        super('OIDC completion failed', { cause: causeArg });
+    constructor(stage, causeArg, detailArg) {
+        super('OIDC completion failed', detailArg ?? classifyCompletionFailure(causeArg), causeArg);
         this.stage = stage;
         this.name = 'OidcCompletionError';
     }
@@ -68,9 +165,9 @@ export const readOrganizationClaims = (valueArg) => {
 /**
  * The relying-party side of the authorization code flow with S256 PKCE on
  * `openid-client`, in the profile idp.global supports: code responses, S256
- * challenges, RS256 ID tokens and `client_secret_basic` for a confidential
- * client. Live organization authority is observed with the sdk's
- * `OidcIntrospectionClient`.
+ * challenges, RS256 ID tokens whose signature is verified against the
+ * issuer's JWKS, and `client_secret_basic` for a confidential client. Live
+ * organization authority is observed with the sdk's `OidcIntrospectionClient`.
  */
 export class IdpOidcProvider {
     requestTimeoutSeconds;
@@ -114,13 +211,18 @@ export class IdpOidcProvider {
         }
         const options = this.#options;
         // the timeout and the fetch given to discovery apply to discovery itself
-        // and stay on the resolved configuration for every later request
+        // and stay on the resolved configuration for every later request.
+        // `enableNonRepudiationChecks` verifies the signature of every ID token the
+        // code grant and the refresh grant answer against the issuer's JWKS
+        // (`jwks_uri`, fetched through the same fetch), so an ID token is never
+        // accepted on the trust of the TLS connection alone
         const configuration = await plugins.openidClient.discovery(options.issuer, options.clientId, {
             client_secret: options.clientSecret,
             token_endpoint_auth_method: 'client_secret_basic',
             id_token_signed_response_alg: 'RS256',
         }, plugins.openidClient.ClientSecretBasic(options.clientSecret), {
             timeout: this.requestTimeoutSeconds,
+            execute: [plugins.openidClient.enableNonRepudiationChecks],
             ...(this.#fetch ? { [plugins.openidClient.customFetch]: this.#fetch } : {}),
         });
         const metadata = configuration.serverMetadata();
@@ -164,6 +266,11 @@ export class IdpOidcProvider {
         });
     }
     async completeAuthorization(optionsArg) {
+        // the one state of the callback is the login's, or nothing is exchanged
+        const states = optionsArg.callbackUrl.searchParams.getAll('state');
+        if (states.length !== 1 || states[0] !== optionsArg.state) {
+            throw new OidcCompletionError('token_exchange', new Error('The callback state is not the state of this login'), { code: 'login_mismatch' });
+        }
         let tokens;
         try {
             tokens = await plugins.openidClient.authorizationCodeGrant(this.configuration, optionsArg.callbackUrl, {
@@ -185,7 +292,7 @@ export class IdpOidcProvider {
             subject = claims.sub;
         }
         catch (error) {
-            throw new OidcCompletionError('token_validation', error);
+            throw new OidcCompletionError('token_validation', error, { code: 'invalid_response' });
         }
         // UserInfo is the current view of profile and organization claims; the ID
         // token proves the login. Both are read, and the subjects must agree.
@@ -197,7 +304,7 @@ export class IdpOidcProvider {
             throw new OidcCompletionError('userinfo', error);
         }
         if (userInfo.sub !== subject) {
-            throw new OidcCompletionError('token_validation', new Error('The UserInfo subject does not match the ID token'));
+            throw new OidcCompletionError('token_validation', new Error('The UserInfo subject does not match the ID token'), { code: 'invalid_response' });
         }
         return {
             subject,
@@ -263,7 +370,10 @@ export class IdpOidcProvider {
             if (error instanceof plugins.openidClient.ResponseBodyError && error.error === 'invalid_grant') {
                 throw new OidcRefreshRefusedError(error);
             }
-            throw new OidcAuthorityUnavailableError('unavailable', error);
+            // everything else fails closed: another OAuth error (`invalid_client` for a
+            // deactivated app) or a transport failure is unreachable, an answer that
+            // fails openid-client's checks (an ID token that does not verify) is invalid
+            throw new OidcAuthorityUnavailableError(refreshFailureReasonOf(error), error);
         }
         return {
             accessToken: tokens.access_token,
@@ -272,4 +382,4 @@ export class IdpOidcProvider {
         };
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixzQkFBc0IsR0FDdkIsTUFBTSxtREFBbUQsQ0FBQztBQUMzRCxPQUFPLEVBQUUsb0JBQW9CLEVBQW1CLE1BQU0sMENBQTBDLENBQUM7QUFLakcsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUEyQixDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFpRWpGLDZHQUE2RztBQUM3RyxNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQUVwQyxNQUFNO0lBRHhCLFlBQ2tCLE1BQTZCLEVBQzdDLFFBQWtCO1FBRWxCLEtBQUssQ0FBQyw2Q0FBNkMsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO3NCQUgxRCxNQUFNO1FBSXRCLElBQUksQ0FBQyxJQUFJLEdBQUcsK0JBQStCLENBQUM7SUFDOUMsQ0FBQztDQUNGO0FBRUQsbUhBQW1IO0FBQ25ILE1BQU0sT0FBTyx1QkFBd0IsU0FBUSxLQUFLO0lBQ2hELFlBQVksUUFBa0I7UUFDNUIsS0FBSyxDQUFDLDJDQUEyQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLElBQUksR0FBRyx5QkFBeUIsQ0FBQztJQUN4QyxDQUFDO0NBQ0Y7QUFNRCxNQUFNLE9BQU8sbUJBQW9CLFNBQVEsS0FBSztJQUUxQixLQUFLO0lBRHZCLFlBQ2tCLEtBQWtDLEVBQ2xELFFBQWlCO1FBRWpCLEtBQUssQ0FBQyx3QkFBd0IsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO3FCQUhyQyxLQUFLO1FBSXJCLElBQUksQ0FBQyxJQUFJLEdBQUcscUJBQXFCLENBQUM7SUFDcEMsQ0FBQztDQUNGO0FBK0JEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLDBDQUEwQyxDQUFDO0FBRWxGLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEVBQUUsQ0FBQztBQStCM0QsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQy9ELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFM0Ysb0dBQW9HO0FBQ3BHLE1BQU0sUUFBUSxHQUFHLENBQUMsWUFBZ0MsRUFBVSxFQUFFLENBQzVELE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLFlBQVksR0FBRyxDQUFDO0lBQ25GLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxLQUFLO0lBQy9DLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFUjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQ3BGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDN0IsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQTZCLEVBQUUsQ0FBQztJQUNuRCxLQUFLLE1BQU0sS0FBSyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzdCLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLEtBQWdDLENBQUM7UUFDbkQsTUFBTSxFQUFFLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QyxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzFCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDO1lBQzFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBcUIsRUFBRSxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsQ0FBQztZQUNyRixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ1AsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE9BQU8sYUFBYSxDQUFDO0FBQ3ZCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBQ1YscUJBQXFCLENBQVM7SUFDckMsUUFBUSxDQUEwQjtJQUMzQyxxRUFBcUU7SUFDNUQsTUFBTSxDQUFjO0lBQzdCLGNBQWMsQ0FBc0M7SUFDcEQsY0FBYyxDQUEyQjtJQUV6QyxZQUFZLFVBQW1DO1FBQzdDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxNQUFNLFlBQVksR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsQ0FBQyxXQUFXLFlBQVksR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyRixNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDbkYsQ0FBQztRQUNELElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3JGLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLHFCQUFxQixJQUFJLHdDQUF3QyxDQUFDO1FBQzdGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksT0FBTyxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxDQUFDLHFCQUFxQixHQUFHLE9BQU8sQ0FBQztRQUNyQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sVUFBVSxDQUFDLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDLFlBQVksS0FBSyxTQUFTO1lBQ2pELENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQy9DLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDO0lBQzdCLENBQUM7SUFFRCxJQUFZLGFBQWE7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQztJQUM3QixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDOUIseUVBQXlFO1FBQ3pFLGlFQUFpRTtRQUNqRSxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUN4RCxPQUFPLENBQUMsTUFBTSxFQUNkLE9BQU8sQ0FBQyxRQUFRLEVBQ2hCO1lBQ0UsYUFBYSxFQUFFLE9BQU8sQ0FBQyxZQUFZO1lBQ25DLDBCQUEwQixFQUFFLHFCQUFxQjtZQUNqRCw0QkFBNEIsRUFBRSxPQUFPO1NBQ3RDLEVBQ0QsT0FBTyxDQUFDLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQzVEO1lBQ0UsT0FBTyxFQUFFLElBQUksQ0FBQyxxQkFBcUI7WUFDbkMsR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVFLENBQ0YsQ0FBQztRQUNGLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsUUFBUSxDQUFDLHNCQUFzQixJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2RixNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsZ0NBQWdDLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUNFLFFBQVEsQ0FBQyxxQ0FBcUM7ZUFDM0MsQ0FBQyxRQUFRLENBQUMscUNBQXFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUNwRSxDQUFDO1lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQ3JHLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMscUJBQXFCLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDaEcsc0VBQXNFO1lBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLHVCQUF1QixDQUFDO1lBQ2hELE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU07WUFDN0IsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQzFCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNsQyxHQUFHLENBQUMsT0FBTyxDQUFDLHNCQUFzQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLGNBQWMsR0FBRyxhQUFhLENBQUM7SUFDdEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFxQztRQUN0RSxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsMEJBQTBCLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3JHLE9BQU8sT0FBTyxDQUFDLFlBQVksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFO1lBQ3BFLFlBQVksRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJO1lBQzVDLGFBQWEsRUFBRSxNQUFNO1lBQ3JCLEtBQUssRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSx1QkFBdUI7WUFDdEQsY0FBYyxFQUFFLGFBQWE7WUFDN0IscUJBQXFCLEVBQUUsTUFBTTtZQUM3QixLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDdkIsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQ3ZCLEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUM1RCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQWtDO1FBQ25FLElBQUksTUFBK0UsQ0FBQztRQUNwRixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsVUFBVSxDQUFDLFdBQVcsRUFBRTtnQkFDckcsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLFlBQVk7Z0JBQ3pDLGFBQWEsRUFBRSxVQUFVLENBQUMsS0FBSztnQkFDL0IsYUFBYSxFQUFFLFVBQVUsQ0FBQyxLQUFLO2dCQUMvQixlQUFlLEVBQUUsSUFBSTthQUN0QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBRUQsSUFBSSxPQUFlLENBQUM7UUFDcEIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQy9CLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUM7Z0JBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsT0FBTyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUM7UUFDdkIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksbUJBQW1CLENBQUMsa0JBQWtCLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUVELDBFQUEwRTtRQUMxRSxzRUFBc0U7UUFDdEUsSUFBSSxRQUF3RSxDQUFDO1FBQzdFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN4RyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksbUJBQW1CLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQyxDQUFDO1FBQ25ILENBQUM7UUFFRCxPQUFPO1lBQ0wsT0FBTztZQUNQLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7WUFDakQsS0FBSyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ3JDLGFBQWEsRUFBRSxRQUFRLENBQUMsY0FBYyxLQUFLLElBQUk7WUFDL0MsV0FBVyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksY0FBYyxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztZQUN6RixhQUFhLEVBQUUsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7U0FDOUUsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQWdCLEVBQUUsT0FBdUI7UUFDaEUsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLFFBQVEsRUFBRSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxVQUluQztRQUNDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDekIsNERBQTREO1lBQzVELDBEQUEwRDtZQUMxRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUMsQ0FBQztRQUNoSCxDQUFDO1FBQ0QsSUFBSSxRQUFvRSxDQUFDO1FBQ3pFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDO2dCQUM5QyxLQUFLLEVBQUUsVUFBVSxDQUFDLFdBQVc7Z0JBQzdCLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztnQkFDM0IsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO2FBQzFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksc0JBQXNCLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUFFLENBQUM7b0JBQ3JDLGlFQUFpRTtvQkFDakUsdUNBQXVDO29CQUN2QyxNQUFNLEtBQUssQ0FBQztnQkFDZCxDQUFDO2dCQUNELE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3JCLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3BELENBQUM7UUFDRCxPQUFPO1lBQ0wsTUFBTSxFQUFFLElBQUk7WUFDWixLQUFLLEVBQUUsUUFBUSxDQUFDLG9CQUFvQixDQUFDLEtBQUs7WUFDMUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxHQUFHLEdBQUcsS0FBSztTQUNoQyxDQUFDO0lBQ0osQ0FBQztJQUVELCtGQUErRjtJQUN4RixLQUFLLENBQUMsYUFBYSxDQUFDLGVBQXVCO1FBQ2hELElBQUksTUFBMEUsQ0FBQztRQUMvRSxJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsZUFBZSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQy9GLE1BQU0sSUFBSSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMzQyxDQUFDO1lBQ0QsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGFBQWEsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsT0FBTztZQUNMLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7U0FDbEQsQ0FBQztJQUNKLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixzQkFBc0IsR0FDdkIsTUFBTSxtREFBbUQsQ0FBQztBQUMzRCxPQUFPLEVBQUUsb0JBQW9CLEVBQW1CLE1BQU0sMENBQTBDLENBQUM7QUFLakcsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUEyQixDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7QUEwRmpGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFzQztJQUMxRSx3QkFBd0I7SUFDeEIsZ0JBQWdCO0lBQ2hCLGtCQUFrQjtJQUNsQixzQkFBc0I7SUFDdEIsaUJBQWlCO0NBQ2xCLENBQUM7QUFFRix5R0FBeUc7QUFDekcsTUFBTSxtQkFBbUIsR0FBRyx3QkFBd0IsQ0FBQztBQUVyRCxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDN0QsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLG1CQUFtQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFNUYsbUlBQW1JO0FBQ25JLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxRQUFpQixFQUFtRCxFQUFFO0lBQzlGLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUM7SUFDMUMsSUFBSSxRQUFRLFlBQVksWUFBWSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDdkQsT0FBTyxFQUFFLFVBQVUsRUFBRSxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDL0UsQ0FBQztJQUNELElBQUksUUFBUSxZQUFZLFlBQVksQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1FBQ2hFLE9BQU8sRUFBRSxVQUFVLEVBQUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLFFBQVEsWUFBWSxZQUFZLENBQUMsNkJBQTZCLEVBQUUsQ0FBQztRQUNuRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3BHLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQUVGLDJIQUEySDtBQUMzSCxNQUFNLDhCQUE4QixHQUFzQixDQUFDLGVBQWUsRUFBRSxhQUFhLEVBQUUsK0JBQStCLENBQUMsQ0FBQztBQUM1SCxzSUFBc0k7QUFDdEksTUFBTSx5QkFBeUIsR0FBRyxtQ0FBbUMsQ0FBQztBQUV0RTs7Ozs7O0dBTUc7QUFDSCxNQUFNLHlCQUF5QixHQUFHLENBQUMsUUFBaUIsRUFBeUQsRUFBRTtJQUM3RyxJQUFJLFFBQVEsWUFBWSxpQkFBaUIsRUFBRSxDQUFDO1FBQzFDLE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ2xFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMxQyxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ1gsTUFBTSxJQUFJLEdBQTJCLE1BQU0sQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxNQUFNLElBQUksR0FBRztZQUN0RixDQUFDLENBQUMsc0JBQXNCO1lBQ3hCLENBQUMsQ0FBQyx3QkFBd0IsQ0FBQztRQUM3QixPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDakQsQ0FBQztJQUNELElBQUksUUFBUSxZQUFZLE9BQU8sQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDekQsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLHlCQUF5QixFQUFFLENBQUM7WUFDaEQsT0FBTyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO1FBQ3BDLENBQUM7UUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLHNCQUFzQixDQUFDLENBQUMsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO0lBQ3ZKLENBQUM7SUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLENBQUM7QUFDMUMsQ0FBQyxDQUFDO0FBRUYsd0hBQXdIO0FBQ3hILE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUF5QixFQUFFLENBQzFFLFFBQVEsWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVc7T0FDL0MsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0YsQ0FBQyxDQUFDLGtCQUFrQjtJQUNwQixDQUFDLENBQUMsYUFBYSxDQUFDO0FBRXBCOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBQzFCLElBQUksQ0FBeUI7SUFDN0IsVUFBVSxDQUFVO0lBRXBDLFlBQ0UsVUFBa0IsRUFDbEIsU0FBZ0UsRUFDaEUsUUFBa0I7UUFFbEIsS0FBSyxDQUFDLFVBQVUsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxJQUFJLEdBQUcsbUJBQW1CLENBQUM7UUFDaEMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN6RCxNQUFNLElBQUksU0FBUyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQztRQUMzQixNQUFNLFVBQVUsR0FBRyxZQUFZLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3RELElBQUksVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzdCLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDO1FBQy9CLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFLRDs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLDZCQUE4QixTQUFRLGlCQUFpQjtJQUVoRCxNQUFNO0lBRHhCLFlBQ2tCLE1BQTZCLEVBQzdDLFFBQWtCO1FBRWxCLEtBQUssQ0FDSCw2Q0FBNkMsRUFDN0M7WUFDRSxJQUFJLEVBQUUsTUFBTSxLQUFLLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsc0JBQXNCO1lBQ2pGLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsRUFBRSxVQUFVO1NBQ25ELEVBQ0QsUUFBUSxDQUNULENBQUM7c0JBVmMsTUFBTTtRQVd0QixJQUFJLENBQUMsSUFBSSxHQUFHLCtCQUErQixDQUFDO0lBQzlDLENBQUM7Q0FDRjtBQUVEOzs7R0FHRztBQUNILE1BQU0sT0FBTyx1QkFBd0IsU0FBUSxpQkFBaUI7SUFDNUQsWUFBWSxRQUFrQjtRQUM1QixLQUFLLENBQUMsMkNBQTJDLEVBQUUsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3ZILElBQUksQ0FBQyxJQUFJLEdBQUcseUJBQXlCLENBQUM7SUFDeEMsQ0FBQztDQUNGO0FBTUQ7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxtQkFBb0IsU0FBUSxpQkFBaUI7SUFFdEMsS0FBSztJQUR2QixZQUNrQixLQUFrQyxFQUNsRCxRQUFpQixFQUNqQixTQUFpRTtRQUVqRSxLQUFLLENBQUMsd0JBQXdCLEVBQUUsU0FBUyxJQUFJLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO3FCQUo1RSxLQUFLO1FBS3JCLElBQUksQ0FBQyxJQUFJLEdBQUcscUJBQXFCLENBQUM7SUFDcEMsQ0FBQztDQUNGO0FBK0JEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLDBDQUEwQyxDQUFDO0FBRWxGLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEVBQUUsQ0FBQztBQStCM0QsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQy9ELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFM0Ysb0dBQW9HO0FBQ3BHLE1BQU0sUUFBUSxHQUFHLENBQUMsWUFBZ0MsRUFBVSxFQUFFLENBQzVELE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLFlBQVksR0FBRyxDQUFDO0lBQ25GLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxLQUFLO0lBQy9DLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFUjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQ3BGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDN0IsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQTZCLEVBQUUsQ0FBQztJQUNuRCxLQUFLLE1BQU0sS0FBSyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzdCLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLEtBQWdDLENBQUM7UUFDbkQsTUFBTSxFQUFFLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QyxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzFCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDO1lBQzFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBcUIsRUFBRSxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsQ0FBQztZQUNyRixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ1AsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE9BQU8sYUFBYSxDQUFDO0FBQ3ZCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBQ1YscUJBQXFCLENBQVM7SUFDckMsUUFBUSxDQUEwQjtJQUMzQyxxRUFBcUU7SUFDNUQsTUFBTSxDQUFjO0lBQzdCLGNBQWMsQ0FBc0M7SUFDcEQsY0FBYyxDQUEyQjtJQUV6QyxZQUFZLFVBQW1DO1FBQzdDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxNQUFNLFlBQVksR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsQ0FBQyxXQUFXLFlBQVksR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyRixNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDbkYsQ0FBQztRQUNELElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3JGLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLHFCQUFxQixJQUFJLHdDQUF3QyxDQUFDO1FBQzdGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksT0FBTyxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxDQUFDLHFCQUFxQixHQUFHLE9BQU8sQ0FBQztRQUNyQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sVUFBVSxDQUFDLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDLFlBQVksS0FBSyxTQUFTO1lBQ2pELENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQy9DLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDO0lBQzdCLENBQUM7SUFFRCxJQUFZLGFBQWE7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQztJQUM3QixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDOUIseUVBQXlFO1FBQ3pFLGtFQUFrRTtRQUNsRSw0RUFBNEU7UUFDNUUsb0VBQW9FO1FBQ3BFLHdFQUF3RTtRQUN4RSxvREFBb0Q7UUFDcEQsTUFBTSxhQUFhLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FDeEQsT0FBTyxDQUFDLE1BQU0sRUFDZCxPQUFPLENBQUMsUUFBUSxFQUNoQjtZQUNFLGFBQWEsRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNuQywwQkFBMEIsRUFBRSxxQkFBcUI7WUFDakQsNEJBQTRCLEVBQUUsT0FBTztTQUN0QyxFQUNELE9BQU8sQ0FBQyxZQUFZLENBQUMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUM1RDtZQUNFLE9BQU8sRUFBRSxJQUFJLENBQUMscUJBQXFCO1lBQ25DLE9BQU8sRUFBRSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsMEJBQTBCLENBQUM7WUFDMUQsR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVFLENBQ0YsQ0FBQztRQUNGLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsUUFBUSxDQUFDLHNCQUFzQixJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2RixNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsZ0NBQWdDLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUNFLFFBQVEsQ0FBQyxxQ0FBcUM7ZUFDM0MsQ0FBQyxRQUFRLENBQUMscUNBQXFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUNwRSxDQUFDO1lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQ3JHLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMscUJBQXFCLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDaEcsc0VBQXNFO1lBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLHVCQUF1QixDQUFDO1lBQ2hELE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU07WUFDN0IsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQzFCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNsQyxHQUFHLENBQUMsT0FBTyxDQUFDLHNCQUFzQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLGNBQWMsR0FBRyxhQUFhLENBQUM7SUFDdEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFxQztRQUN0RSxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsMEJBQTBCLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3JHLE9BQU8sT0FBTyxDQUFDLFlBQVksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFO1lBQ3BFLFlBQVksRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJO1lBQzVDLGFBQWEsRUFBRSxNQUFNO1lBQ3JCLEtBQUssRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSx1QkFBdUI7WUFDdEQsY0FBYyxFQUFFLGFBQWE7WUFDN0IscUJBQXFCLEVBQUUsTUFBTTtZQUM3QixLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDdkIsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQ3ZCLEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUM1RCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQWtDO1FBQ25FLHdFQUF3RTtRQUN4RSxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbkUsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsQ0FBQyxDQUFDLEtBQUssVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQzFELE1BQU0sSUFBSSxtQkFBbUIsQ0FDM0IsZ0JBQWdCLEVBQ2hCLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLEVBQzlELEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQzNCLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxNQUErRSxDQUFDO1FBQ3BGLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxVQUFVLENBQUMsV0FBVyxFQUFFO2dCQUNyRyxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsWUFBWTtnQkFDekMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxLQUFLO2dCQUMvQixhQUFhLEVBQUUsVUFBVSxDQUFDLEtBQUs7Z0JBQy9CLGVBQWUsRUFBRSxJQUFJO2FBQ3RCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLG1CQUFtQixDQUFDLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCxJQUFJLE9BQWUsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDL0IsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1lBQzNELENBQUM7WUFDRCxPQUFPLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQztRQUN2QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFFRCwwRUFBMEU7UUFDMUUsc0VBQXNFO1FBQ3RFLElBQUksUUFBd0UsQ0FBQztRQUM3RSxJQUFJLENBQUM7WUFDSCxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDeEcsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksbUJBQW1CLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxHQUFHLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDN0IsTUFBTSxJQUFJLG1CQUFtQixDQUMzQixrQkFBa0IsRUFDbEIsSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsRUFDN0QsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsQ0FDN0IsQ0FBQztRQUNKLENBQUM7UUFFRCxPQUFPO1lBQ0wsT0FBTztZQUNQLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7WUFDakQsS0FBSyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ3JDLGFBQWEsRUFBRSxRQUFRLENBQUMsY0FBYyxLQUFLLElBQUk7WUFDL0MsV0FBVyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksY0FBYyxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztZQUN6RixhQUFhLEVBQUUsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7U0FDOUUsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQWdCLEVBQUUsT0FBdUI7UUFDaEUsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLFFBQVEsRUFBRSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxVQUluQztRQUNDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDekIsNERBQTREO1lBQzVELDBEQUEwRDtZQUMxRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUMsQ0FBQztRQUNoSCxDQUFDO1FBQ0QsSUFBSSxRQUFvRSxDQUFDO1FBQ3pFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDO2dCQUM5QyxLQUFLLEVBQUUsVUFBVSxDQUFDLFdBQVc7Z0JBQzdCLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztnQkFDM0IsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO2FBQzFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksc0JBQXNCLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUFFLENBQUM7b0JBQ3JDLGlFQUFpRTtvQkFDakUsdUNBQXVDO29CQUN2QyxNQUFNLEtBQUssQ0FBQztnQkFDZCxDQUFDO2dCQUNELE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3JCLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3BELENBQUM7UUFDRCxPQUFPO1lBQ0wsTUFBTSxFQUFFLElBQUk7WUFDWixLQUFLLEVBQUUsUUFBUSxDQUFDLG9CQUFvQixDQUFDLEtBQUs7WUFDMUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxHQUFHLEdBQUcsS0FBSztTQUNoQyxDQUFDO0lBQ0osQ0FBQztJQUVELCtGQUErRjtJQUN4RixLQUFLLENBQUMsYUFBYSxDQUFDLGVBQXVCO1FBQ2hELElBQUksTUFBMEUsQ0FBQztRQUMvRSxJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsZUFBZSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQy9GLE1BQU0sSUFBSSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMzQyxDQUFDO1lBQ0QsNEVBQTRFO1lBQzVFLHlFQUF5RTtZQUN6RSw2RUFBNkU7WUFDN0UsTUFBTSxJQUFJLDZCQUE2QixDQUFDLHNCQUFzQixDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxPQUFPO1lBQ0wsV0FBVyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1lBQ2hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RSxvQkFBb0IsRUFBRSxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQztTQUNsRCxDQUFDO0lBQ0osQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/classes.relyingpartysessions.d.ts

@@ -1,6 +1,6 @@
 import { type IOidcProvider } from './classes.idpoidcprovider.js';
 import type { IRelyingPartyModels } from './classes.rpmodels.js';
-import type { IAuthorityTokenSource, IProviderToken, IRelyingPartyBearerDelivery, IRelyingPartyBearerHandoff, IRelyingPartyBearerHandoffOpening, IRelyingPartyBearerLoginRequest, IRelyingPartyBearerLoginStart, IRelyingPartyBearerOptions, IRelyingPartyBearerReturnTargets, IRelyingPartyBearerTokens, IRelyingPartyHooks, IRelyingPartyLiveSession, IRelyingPartyLoginOptions, IRelyingPartyLoginStart, IRelyingPartySession, IRelyingPartySessionOpening, IRelyingPartySessionsErasure, IRelyingPartySessionsPage, IRelyingPartySessionsPageOptions, IResolvedRelyingPartySession, TRelyingPartyPrincipals, TRelyingPartySessionEndReason } from './interfaces.js';
+import type { IAuthorityTokenSource, IProviderToken, IRelyingPartyBearerDelivery, IRelyingPartyBearerHandoff, IRelyingPartyBearerHandoffOpening, IRelyingPartyBearerLoginRequest, IRelyingPartyBearerLoginStart, IRelyingPartyBearerOptions, IRelyingPartyBearerReturnTargets, IRelyingPartyBearerTokens, IRelyingPartyCookiePolicy, IRelyingPartyHooks, IRelyingPartyLiveSession, IRelyingPartyLoginOptions, IRelyingPartyLoginStart, IRelyingPartySession, IRelyingPartySessionOpening, IRelyingPartySessionsErasure, IRelyingPartySessionsPage, IRelyingPartySessionsPageOptions, IResolvedRelyingPartySession, TRelyingPartyPrincipals, TRelyingPartySessionEndReason } from './interfaces.js';
 export declare const RELYING_PARTY_DEFAULT_SESSION_MAX_AGE_SECONDS: number;
 export declare const RELYING_PARTY_DEFAULT_LOGIN_PATH_PREFIX = "/auth/";
 /** The label the CSRF HMAC starts with unless the application names its own. */
@@ -17,6 +17,10 @@ export declare const RELYING_PARTY_MAX_SESSIONS_PAGE_LIMIT = 1000;
 export declare const BEARER_HANDOFF_MAX_AGE_SECONDS = 60;
 /** How long a bearer access token lives unless `bearer.accessTokenMaxAgeSeconds` says otherwise. */
 export declare const RELYING_PARTY_DEFAULT_BEARER_ACCESS_TOKEN_MAX_AGE_SECONDS: number;
+/** How long a spent refresh token may come back as a lost answer unless `bearer.refreshReuseGraceSeconds` says otherwise. */
+export declare const RELYING_PARTY_DEFAULT_REFRESH_REUSE_GRACE_SECONDS = 60;
+/** The longest `bearer.refreshReuseGraceSeconds`: a spent token that comes back later is always reuse. */
+export declare const RELYING_PARTY_MAX_REFRESH_REUSE_GRACE_SECONDS = 300;
 /**
  * How long ending a session waits for the provider to take its tokens back.
  * The local session is already revoked when that call runs.
@@ -62,6 +66,14 @@ export interface IRelyingPartySessionsOptions<TPrincipal extends object | undefi
         session?: string;
         intent?: string;
     };
+    /**
+     * How the session and intent cookies go across sites: `{ sameSite: 'Lax' }`
+     * by default. A page framed on another site needs `sameSite: 'None'` (an
+     * https `publicOrigin` only), with `partitioned: true` where the browser
+     * keeps third-party cookies per top-level site. The constructor refuses
+     * every other combination.
+     */
+    cookiePolicy?: IRelyingPartyCookiePolicy;
     /** the prefix of the login routes; a login never returns into it */
     loginPathPrefix?: string;
     /**
@@ -78,13 +90,14 @@ export interface IRelyingPartySessionsOptions<TPrincipal extends object | undefi
  * sign in through bearer hand-off and nothing else. The relying party never
  * reads or sets a cookie — not even the clearing intent cookie of a callback
  * that is no bearer login — so it has no CSRF token and takes no CSRF key:
- * `csrfKey`, `csrfLabel` and `cookieNames` are refused, not ignored. The
+ * `csrfKey`, `csrfLabel`, `cookieNames` and `cookiePolicy` are refused, not
+ * ignored. The
  * cookie steps (`openSession`, `startLogin`, `completeLogin`, `abandonLogin`,
  * `finalizeLogin`, `clearSessionCookie`, `clearIntentCookie`) throw
  * `RelyingPartyError('login_method_unavailable')` and `resolveCookieSession`
  * answers `null`.
  */
-export interface IRelyingPartyBearerOnlySessionsOptions<TPrincipal extends object | undefined = undefined> extends Omit<IRelyingPartySessionsOptions<TPrincipal>, 'provider' | 'csrfKey' | 'csrfLabel' | 'cookieNames' | 'cookieSessions' | 'bearer'> {
+export interface IRelyingPartyBearerOnlySessionsOptions<TPrincipal extends object | undefined = undefined> extends Omit<IRelyingPartySessionsOptions<TPrincipal>, 'provider' | 'csrfKey' | 'csrfLabel' | 'cookieNames' | 'cookiePolicy' | 'cookieSessions' | 'bearer'> {
     cookieSessions: false;
     /** every bearer session comes from a live provider login, directly or through a hand-off opened from one */
     provider: IOidcProvider;
@@ -92,6 +105,7 @@ export interface IRelyingPartyBearerOnlySessionsOptions<TPrincipal extends objec
     csrfKey?: never;
     csrfLabel?: never;
     cookieNames?: never;
+    cookiePolicy?: never;
 }
 /**
  * The relying-party session layer: provider logins through the authorization
@@ -120,6 +134,8 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     readonly secureCookies: boolean;
     readonly sessionCookieName: string;
     readonly intentCookieName: string;
+    /** how the session and intent cookies go across sites, as the constructor resolved `cookiePolicy` */
+    readonly cookiePolicy: Readonly<Required<IRelyingPartyCookiePolicy>>;
     readonly loginPathPrefix: string;
     readonly sessionMaxAgeSeconds: number;
     constructor(optionsArg: IRelyingPartySessionsOptions<TPrincipal> | IRelyingPartyBearerOnlySessionsOptions<TPrincipal>);
@@ -181,6 +197,7 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     /**
      * Ends every live session of a principal but `keepSessionId` (a password
      * change keeps the session that asked for it) and answers how many ended.
+     * A session that expired is over already and is neither ended nor counted.
      */
     endSessionsOfPrincipal(principalIdArg: string, optionsArg?: {
         keepSessionId?: string;
@@ -308,15 +325,45 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     /**
      * Rotates a bearer session's tokens: the refresh token is spent, a new
      * access and refresh token answer, and the old access token stops working.
-     * Rotation is strict — a client serializes its refreshes — because a
-     * refresh token that comes back after it was spent ends the whole session.
-     * The provider login of a bearer login is checked on the way: a login
-     * idp.global ended ends the session here (`invalid_bearer_grant`), an
+     * A client serializes its refreshes, because a refresh token that comes
+     * back after it was spent ends the whole session, with one exception for
+     * an answer that never reached the client: within
+     * `bearer.refreshReuseGraceSeconds` of its rotation (60 by default), a
+     * spent refresh token whose successor was never presented — neither its
+     * access token nor its refresh token — revokes that successor and answers a
+     * new pair (`bearer_refresh_reissued`). Only hashes are stored, so the lost
+     * pair is replaced, never repeated. Once the successor was presented, after
+     * the window, or for a second retry that loses the race to the first, it is
+     * reuse. The provider login of a bearer login is checked on the way: a
+     * login idp.global ended ends the session here (`invalid_bearer_grant`), an
      * unreachable provider fails with `AuthorityTokenError('authority_unavailable')`
      * and spends nothing. A session `openBearerHandoff` opened has no provider
      * login (no `idpSubject` is stored) and rotates without the provider.
      */
     refreshBearerTokens(refreshTokenArg: unknown): Promise<IRelyingPartyBearerTokens>;
+    /**
+     * The successor of a spent generation when its answer may have been lost:
+     * the rotation is at most `refreshReuseGraceMs` old, and the successor is
+     * still current and was never presented. `null` otherwise, which is reuse.
+     */
+    private lostSuccessorOf;
+    /**
+     * Issues a pair again for a spent generation whose answer was lost. The
+     * successor that answer carried is revoked first, by one conditional write
+     * that needs it current and unpresented: of two retries at once exactly one
+     * takes it, and the other is reuse, as is a successor presented in the
+     * meantime. Then the new generation is stored and the spent one names it,
+     * so a retry after this answer is lost too finds it within the same window
+     * (counted from the original rotation). A failure after the revocation
+     * leaves the session without a current generation; its retry is reuse.
+     */
+    private reissueLostRotation;
+    /**
+     * Records the first presentation of a current generation's access or refresh
+     * token, once. Answers whether the generation is still current: `false`
+     * when a lost answer of its predecessor revoked it just now.
+     */
+    private markBearerGenerationPresented;
     /**
      * The live session behind a bearer access token, or `null`: the token of the
      * session's current generation, not expired, its session live and its
@@ -328,7 +375,9 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     /**
      * Ends the session of a bearer token — a live access token or the current
      * refresh token — like `endSession`. A refresh token that was already spent
-     * is reuse and ends the session as such. Answers whether this call ended it.
+     * is reuse and ends the session as such, unless `refreshBearerTokens` would
+     * take it as a lost answer (`lostSuccessorOf`): then it is a logout like the
+     * current one. Answers whether this call ended it.
      */
     endBearerSession(tokenArg: unknown): Promise<boolean>;
     /**
@@ -377,6 +426,8 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
      */
     private openProviderLogin;
     private newSessionDoc;
+    /** The attributes every session and intent cookie is set and cleared with: one policy for all of them. */
+    private cookieAttributes;
     private csrfTokenOf;
     private opening;
     private snapshot;
@@ -396,7 +447,7 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
      * `BEARER_HANDOFF_MAX_AGE_SECONDS` at most and never past the session.
      */
     private storeBearerHandoff;
-    /** Stores the next token generation of a live session and answers its tokens; none of them is stored in the clear. */
+    /** Stores the next token generation of a live session and answers its tokens and its id; no token is stored in the clear. */
     private issueBearerTokens;
     /** A spent hand-off code or refresh token came back: whoever holds it, the session ends. */
     private bearerCredentialReused;
@@ -470,9 +521,13 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
      * page per login start and per session the application opens. An ended
      * session's expiry is its revocation at the latest, so the expiry index
      * finds expired and revoked sessions alike. Each of them ended already: the
-     * row goes without an end, a hook or a provider call. A row is deleted only
-     * while its expiry is still past the cutoff, so a row whose expiry moved
-     * after the page was read stays. A sweep that cannot run never blocks a
+     * row goes without an end, a hook or a provider call. Its children go
+     * first: in bearer mode its hand-offs and token generations, by their
+     * `sessionId` index, and only then the session row, which is the only link
+     * from a principal to them; a sweep that fails half way leaves the session
+     * row, and the next sweep finds it and deletes the rest. Expiry never moves
+     * later, so a session past the cutoff stays past it, and its row is deleted
+     * only while that still holds. A sweep that cannot run never blocks a
      * sign-in.
      */
     private sweepEndedSessions;