@eetr/eetr-auth-client 0.3.1 → 0.5.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 eetr-ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,350 @@
+# @eetr/eetr-auth-client
+
+TypeScript client library for the [eetr-auth](https://github.com/eetr-ai/eetr-auth) OAuth 2.1 / OIDC server.
+
+It wraps the server's token, introspection, UserInfo, admin, and passkey-management
+endpoints, plus helpers for OIDC discovery and JWT verification. Everything is
+`fetch`-based and ships with full type definitions.
+
+## Installation
+
+```bash
+npm install @eetr/eetr-auth-client
+```
+
+```bash
+pnpm add @eetr/eetr-auth-client
+# or
+yarn add @eetr/eetr-auth-client
+```
+
+**Requirements:** Node.js 18+ (the library relies on the global `fetch`; `decodeJwtPayload`
+also uses Node's `Buffer`). `jose` is a runtime dependency used for JWT verification.
+
+The package is ESM-only (`"type": "module"`) and exports both JavaScript and `.d.ts` types.
+
+## Quick start
+
+```ts
+import {
+  fetchOIDCDiscovery,
+  exchangeToken,
+  validateJwt,
+  getUserInfo,
+} from "@eetr/eetr-auth-client";
+
+const ISSUER = "https://auth.example.com";
+
+// 1. Discover endpoints
+const discovery = await fetchOIDCDiscovery(ISSUER);
+
+// 2. Exchange an authorization code for tokens (PKCE)
+const tokens = await exchangeToken(
+  {
+    grantType: "authorization_code",
+    clientId: "my-client",
+    code: authorizationCode,
+    redirectUri: "https://app.example.com/callback",
+    codeVerifier,
+  },
+  { tokenEndpoint: discovery.token_endpoint }
+);
+
+// 3. Verify the access/ID token against the server's JWKS
+const payload = await validateJwt(tokens.access_token, discovery.jwks_uri, {
+  issuer: ISSUER,
+  audience: "my-client",
+});
+
+// 4. Fetch the user's profile
+const user = await getUserInfo(tokens.access_token, discovery.userinfo_endpoint);
+```
+
+## API reference
+
+### Discovery
+
+```ts
+fetchOIDCDiscovery(issuerUrl: string): Promise<OIDCDiscovery>
+fetchOAuthMetadata(issuerUrl: string): Promise<OAuthServerMetadata>
+```
+
+Fetch the server's `/.well-known/openid-configuration` or
+`/.well-known/oauth-authorization-server` metadata. Use the returned
+`token_endpoint`, `jwks_uri`, `userinfo_endpoint`, etc. to configure the rest of
+the client rather than hard-coding paths.
+
+### Authorization URL
+
+```ts
+buildAuthorizationUrl(authorizationEndpoint: string, params: AuthorizationUrlParams): string
+```
+
+Builds the authorization-request URL for the `authorization_code` + PKCE flow.
+`code_challenge` is required (the server only accepts `S256`). Pass `nonce` to
+request an OIDC `nonce` that the server binds into the issued `id_token`, then
+verify it on the returned token with [`validateIdToken`](#jwt-verification).
+
+```ts
+const url = buildAuthorizationUrl(discovery.authorization_endpoint, {
+  clientId: "my-client",
+  redirectUri: "https://app.example.com/callback",
+  codeChallenge,            // base64url SHA-256 of your PKCE verifier
+  scope: "openid profile email",
+  state,
+  nonce,
+});
+```
+
+Prefer the `OIDCScope` constants and the `scopes` array so a typo can't silently
+drop `openid` (which would make `/userinfo` return `403 insufficient_scope`). `scope`
+and `scopes` are merged and de-duplicated, so either or both work:
+
+```ts
+import { OIDCScope, STANDARD_OIDC_SCOPES } from "@eetr/eetr-auth-client";
+
+const url = buildAuthorizationUrl(discovery.authorization_endpoint, {
+  clientId: "my-client",
+  redirectUri: "https://app.example.com/callback",
+  codeChallenge,
+  scopes: [OIDCScope.OpenId, OIDCScope.Profile, OIDCScope.Email], // or STANDARD_OIDC_SCOPES
+  state,
+  nonce,
+});
+```
+
+> The client must be **granted** these scopes by an admin, and `openid`/`profile`/`email`
+> are seeded on the server. Requesting a scope the client wasn't granted fails with
+> `invalid_scope`.
+
+### Token exchange
+
+```ts
+exchangeToken(params: ExchangeTokenParams, config: ExchangeTokenConfig): Promise<TokenResponse>
+```
+
+Performs an OAuth token request. `grantType` is one of `"authorization_code"`,
+`"client_credentials"`, or `"refresh_token"`; supply the fields relevant to the grant.
+When the `openid` scope was granted on an `authorization_code` exchange, the
+`TokenResponse` also includes a signed `id_token`.
+
+```ts
+// Client credentials (machine-to-machine)
+const tokens = await exchangeToken(
+  {
+    grantType: "client_credentials",
+    clientId: "service-a",
+    clientSecret: process.env.CLIENT_SECRET,
+    scope: "admin",
+  },
+  { tokenEndpoint: discovery.token_endpoint }
+);
+```
+
+On a non-2xx response it throws an [`OAuthError`](#error-handling) carrying the
+server's `error` code and `error_description`.
+
+### TokenManager
+
+A small helper that caches an access token and transparently refreshes it (using a
+30-second expiry skew) when a refresh token is available.
+
+```ts
+import { TokenManager } from "@eetr/eetr-auth-client";
+
+const manager = new TokenManager({
+  issuerUrl: ISSUER,
+  clientId: "my-client",
+  clientSecret: process.env.CLIENT_SECRET, // optional for public clients
+  tokenEndpoint: discovery.token_endpoint,
+});
+
+manager.setTokens(tokens);        // seed from an initial exchange
+const accessToken = await manager.getAccessToken(); // refreshes if expired
+```
+
+`getAccessToken()` throws an `OAuthError` with code `no_token` if there is no valid
+token and no refresh token to fall back on.
+
+### JWT verification
+
+```ts
+validateJwt(token: string, jwksUri: string, options?: ValidateJwtOptions): Promise<JWTPayload>
+validateIdToken(token: string, jwksUri: string, options?: ValidateIdTokenOptions): Promise<IDTokenClaims>
+decodeJwtPayload(token: string): JWTPayload
+```
+
+`validateJwt` verifies the signature against the server's JWKS (remote keys are
+cached per `jwksUri`) and validates `issuer`/`audience`/expiry (`clockTolerance`
+defaults to 5 seconds). `decodeJwtPayload` decodes the payload **without** verifying
+the signature — use it only for inspecting claims you have already verified.
+
+```ts
+const payload = await validateJwt(accessToken, discovery.jwks_uri, {
+  issuer: ISSUER,
+  audience: "my-client",
+  clockTolerance: 10,
+});
+```
+
+`validateIdToken` verifies an OIDC `id_token` the same way and, when you pass the
+`nonce` you sent to the authorization endpoint, additionally checks the token's
+`nonce` claim — throwing `id_token nonce mismatch` on a mismatch. It returns the
+typed `IDTokenClaims` (`sub`, `auth_time`, `nonce`, `at_hash`, plus scope-gated
+`name`/`preferred_username`/`picture`/`email`/`email_verified`).
+
+```ts
+const claims = await validateIdToken(tokens.id_token!, discovery.jwks_uri, {
+  issuer: ISSUER,
+  audience: "my-client",
+  nonce, // the value passed to buildAuthorizationUrl
+});
+```
+
+### Token introspection
+
+```ts
+introspectToken(params: IntrospectTokenParams, config: IntrospectTokenConfig): Promise<TokenValidationResponse>
+```
+
+Asks the server whether a token is active within a given environment. The endpoint
+is published as `token_introspection_endpoint` in the OAuth metadata (defaults to
+`${ISSUER}/api/token/validate`).
+
+```ts
+const metadata = await fetchOAuthMetadata(ISSUER);
+
+const result = await introspectToken(
+  { token: accessToken, scopes: ["read"], environmentName: "production" },
+  { introspectionEndpoint: metadata.token_introspection_endpoint! }
+);
+// → { valid, active, client_id, expires_at }
+```
+
+### UserInfo
+
+```ts
+getUserInfo(accessToken: string, userInfoEndpoint: string): Promise<UserInfoResponse>
+```
+
+Returns the OIDC UserInfo claims for the bearer token. The endpoint **requires the
+`openid` scope**; only `sub` is always present, and the remaining claims are gated by
+scope (`profile` → `name`/`preferred_username`/`picture`, `email` →
+`email`/`email_verified`).
+
+On failure it throws an [`OAuthError`](#error-handling). A token that is valid but
+lacks `openid` yields a `403`, surfaced as `code === "insufficient_scope"` (use
+`err.isInsufficientScope`) so you can re-authorize with the right scopes rather than
+discarding the token:
+
+```ts
+try {
+  const info = await getUserInfo(accessToken, discovery.userinfo_endpoint);
+} catch (err) {
+  if (err instanceof OAuthError && err.isInsufficientScope) {
+    // token is fine but missing `openid` — restart the dance requesting it
+  }
+}
+```
+
+#### Normalized profile
+
+```ts
+toUserProfile(userInfo: UserInfoResponse, idTokenClaims?: IDTokenClaims): UserProfile
+```
+
+Merges the UserInfo response (and optionally the decoded `id_token` claims) into a
+single camelCased `UserProfile` (`sub`, `name`, `preferredUsername`, `picture`,
+`email`, `emailVerified`). UserInfo wins; the id_token fills any gap.
+
+```ts
+const info = await getUserInfo(tokens.access_token, discovery.userinfo_endpoint);
+const profile = toUserProfile(info, decodeJwtPayload(tokens.id_token!));
+// → { sub, name?, preferredUsername?, picture?, email?, emailVerified? }
+```
+
+### Admin API
+
+User management against the server's admin API. Requires an access token from a
+client configured as an **admin API client** on the server.
+
+```ts
+import {
+  getAdminUser,
+  createAdminUser,
+  updateAdminUser,
+  deleteAdminUser,
+} from "@eetr/eetr-auth-client";
+
+const config = { baseUrl: ISSUER, accessToken }; // AdminClientConfig
+
+const created = await createAdminUser(
+  { username: "alice", password: "•••", email: "alice@example.com" },
+  config
+);
+
+await updateAdminUser("alice", { name: "Alice B." }, config);
+const user = await getAdminUser("alice", config); // by username or UUID
+await deleteAdminUser(created.id, config);
+```
+
+All admin calls throw `OAuthError` on non-2xx responses.
+
+### Passkey management
+
+List, rename, and remove a user's passkeys. The access token must belong to the
+user whose passkeys are being managed.
+
+```ts
+import { listPasskeys, renamePasskey, removePasskey } from "@eetr/eetr-auth-client";
+
+const config = { baseUrl: ISSUER, accessToken }; // UserClientConfig
+
+const passkeys = await listPasskeys(config);
+await renamePasskey(passkeys[0].id, "Work laptop", config);
+await removePasskey(passkeys[0].id, config);
+```
+
+> Only passkey *management* is available here. Creating or authenticating with a
+> passkey is a WebAuthn ceremony that requires a browser and cannot be driven from a
+> server-side client. `removePasskey` deletes the server-side record only — it does
+> not remove the credential from the device/authenticator.
+
+## Error handling
+
+API helpers throw `OAuthError` (a subclass of `Error`) on non-2xx responses, exposing
+the server's machine-readable `code` alongside the message:
+
+```ts
+import { OAuthError } from "@eetr/eetr-auth-client";
+
+try {
+  await exchangeToken(params, config);
+} catch (err) {
+  if (err instanceof OAuthError) {
+    console.error(err.code, err.message); // e.g. "invalid_grant"
+  }
+}
+```
+
+`OAuthError` also exposes the HTTP `status` and the server's `description`
+(`error_description`) when available, plus an `isInsufficientScope` convenience for
+the `/userinfo` 403 case (token valid but missing `openid`).
+
+The discovery helpers throw a plain `Error` with the HTTP status on failure.
+
+## Types
+
+The package exports TypeScript types for every request and response shape, including
+`TokenResponse`, `UserInfoResponse`, `UserProfile`, `IDTokenClaims`, `OIDCDiscovery`,
+`OAuthServerMetadata`, `AuthClientConfig`, `JWTPayload`, `TokenValidationResponse`,
+`GrantType`, `ExchangeTokenParams`/`Config`, `AuthorizationUrlParams`,
+`IntrospectTokenParams`/`Config`, `OIDCScopeValue`, `ValidateJwtOptions`,
+`ValidateIdTokenOptions`, `AdminUserRecord`, `AdminClientConfig`, `CreateUserParams`,
+`UpdateUserParams`, `PasskeySummary`, and `UserClientConfig`. It also exports the
+`OIDCScope` / `STANDARD_OIDC_SCOPES` constants, the `resolveScopeParam` helper, and
+the `toUserProfile` profile normalizer.
+
+## License
+
+See the [eetr-auth repository](https://github.com/eetr-ai/eetr-auth).

package/dist/admin.d.ts

@@ -18,6 +18,54 @@ export interface CreateUserParams {
     name?: string | null;
     email?: string | null;
 }
+export interface AdminConsentRecord {
+    /** The client's public client_id. */
+    clientId: string;
+    clientName: string | null;
+    /** The scope names this user has consented to for that client. */
+    scopes: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface RevokeConsentResult {
+    ok: boolean;
+    /** Access tokens force-expired as part of the revocation. */
+    accessTokensExpired: number;
+    /** Unused authorization codes dropped as part of the revocation. */
+    codesDeleted: number;
+}
+export interface ApiKeyRecord {
+    /** Public handle — the middle segment of the credential. Safe to display and log. */
+    keyId: string;
+    name: string | null;
+    /** The bound user. Becomes the `sub` of every token this key mints. */
+    userId: string;
+    username: string;
+    createdBy: string;
+    createdAt: string;
+    /** null = never expires. */
+    expiresAt: string | null;
+    /** Non-null once revoked; the record is kept so the audit trail still resolves. */
+    revokedAt: string | null;
+    lastUsedAt: string | null;
+}
+export interface CreateApiKeyParams {
+    /** Internal user UUID or username to bind the key to. Required. */
+    userId: string;
+    /** Human-readable label, e.g. the pipeline that uses it. */
+    name?: string | null;
+    /** ISO timestamp. Omit for a key that never expires. */
+    expiresAt?: string | null;
+    /**
+     * Subset of the client's granted scopes. Omit for all of them. The subset is a
+     * snapshot: the key does not pick up scopes granted to the client later.
+     */
+    scopes?: readonly string[];
+}
+export interface CreateApiKeyResult extends ApiKeyRecord {
+    /** The full credential. Returned only here — it cannot be recovered afterwards. */
+    apiKey: string;
+}
 export interface UpdateUserParams {
     username?: string;
     password?: string;
@@ -41,4 +89,38 @@ export declare function updateAdminUser(idOrUsername: string, updates: UpdateUse
  * UUID or the username.
  */
 export declare function deleteAdminUser(idOrUsername: string, config: AdminClientConfig): Promise<void>;
+/**
+ * List the applications a user has authorized, with the scopes consented to for each.
+ * `idOrUsername` accepts either the internal UUID or the username.
+ */
+export declare function listUserConsents(idOrUsername: string, config: AdminClientConfig): Promise<AdminConsentRecord[]>;
+/**
+ * Withdraw a user's consent for one client, addressed by its public `client_id`.
+ *
+ * This also revokes that user's refresh tokens, access tokens, and unused authorization
+ * codes for the client, so access stops immediately rather than at token expiry.
+ */
+export declare function revokeUserConsent(idOrUsername: string, clientId: string, config: AdminClientConfig): Promise<RevokeConsentResult>;
+/**
+ * List every API key issued for a client, including revoked and expired ones.
+ *
+ * The secret is never returned — it is shown only once, when the key is created.
+ */
+export declare function listClientApiKeys(clientId: string, config: AdminClientConfig): Promise<ApiKeyRecord[]>;
+/**
+ * Issue an API key for a client, bound to a user.
+ *
+ * The full credential comes back in `apiKey` and is not recoverable afterwards — store
+ * it at the call site or hand it straight to the operator.
+ */
+export declare function createClientApiKey(clientId: string, params: CreateApiKeyParams, config: AdminClientConfig): Promise<CreateApiKeyResult>;
+/**
+ * Revoke an API key, addressed by its public handle.
+ *
+ * Takes effect on the next exchange; access tokens already minted live out their
+ * remaining TTL. Idempotent — retrying keeps the original revocation timestamp.
+ */
+export declare function revokeClientApiKey(clientId: string, keyId: string, config: AdminClientConfig): Promise<{
+    ok: boolean;
+}>;
 //# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAqBD;;GAEG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAQf"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kEAAkE;IAClE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,6DAA6D;IAC7D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mFAAmF;IACnF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA+BD;;GAEG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAS/B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAW9B;AAGD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,YAAY,EAAE,CAAC,CASzB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAS1B"}

package/dist/admin.js

@@ -6,6 +6,14 @@ function adminUsersUrl(baseUrl, idOrUsername) {
     }
     return `${trimmed}/api/admin/users/${encodeURIComponent(idOrUsername)}`;
 }
+function adminUserConsentsUrl(baseUrl, idOrUsername) {
+    return `${adminUsersUrl(baseUrl, idOrUsername)}/consents`;
+}
+function adminClientApiKeysUrl(baseUrl, clientId, keyId) {
+    const trimmed = baseUrl.replace(/\/+$/, "");
+    const base = `${trimmed}/api/admin/clients/${encodeURIComponent(clientId)}/api-keys`;
+    return keyId === undefined ? base : `${base}/${encodeURIComponent(keyId)}`;
+}
 async function parseError(res) {
     const data = (await res.json().catch(() => ({})));
     return new OAuthError(data.error ?? "server_error", data.error_description ?? `Admin API request failed: ${res.status}`);
@@ -67,4 +75,92 @@ export async function deleteAdminUser(idOrUsername, config) {
         throw await parseError(res);
     }
 }
+/**
+ * List the applications a user has authorized, with the scopes consented to for each.
+ * `idOrUsername` accepts either the internal UUID or the username.
+ */
+export async function listUserConsents(idOrUsername, config) {
+    const res = await fetch(adminUserConsentsUrl(config.baseUrl, idOrUsername), {
+        headers: { Authorization: `Bearer ${config.accessToken}` },
+    });
+    if (!res.ok) {
+        throw await parseError(res);
+    }
+    const data = (await res.json());
+    return data.consents;
+}
+/**
+ * Withdraw a user's consent for one client, addressed by its public `client_id`.
+ *
+ * This also revokes that user's refresh tokens, access tokens, and unused authorization
+ * codes for the client, so access stops immediately rather than at token expiry.
+ */
+export async function revokeUserConsent(idOrUsername, clientId, config) {
+    const url = new URL(adminUserConsentsUrl(config.baseUrl, idOrUsername));
+    url.searchParams.set("client_id", clientId);
+    const res = await fetch(url.toString(), {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${config.accessToken}` },
+    });
+    if (!res.ok) {
+        throw await parseError(res);
+    }
+    return res.json();
+}
+/**
+ * List every API key issued for a client, including revoked and expired ones.
+ *
+ * The secret is never returned — it is shown only once, when the key is created.
+ */
+export async function listClientApiKeys(clientId, config) {
+    const res = await fetch(adminClientApiKeysUrl(config.baseUrl, clientId), {
+        headers: { Authorization: `Bearer ${config.accessToken}` },
+    });
+    if (!res.ok) {
+        throw await parseError(res);
+    }
+    const data = (await res.json());
+    return data.apiKeys;
+}
+/**
+ * Issue an API key for a client, bound to a user.
+ *
+ * The full credential comes back in `apiKey` and is not recoverable afterwards — store
+ * it at the call site or hand it straight to the operator.
+ */
+export async function createClientApiKey(clientId, params, config) {
+    const res = await fetch(adminClientApiKeysUrl(config.baseUrl, clientId), {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${config.accessToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            userId: params.userId,
+            ...(params.name !== undefined ? { name: params.name } : {}),
+            ...(params.expiresAt !== undefined ? { expiresAt: params.expiresAt } : {}),
+            ...(params.scopes !== undefined ? { scopes: [...params.scopes] } : {}),
+        }),
+    });
+    if (!res.ok) {
+        throw await parseError(res);
+    }
+    return res.json();
+}
+/**
+ * Revoke an API key, addressed by its public handle.
+ *
+ * Takes effect on the next exchange; access tokens already minted live out their
+ * remaining TTL. Idempotent — retrying keeps the original revocation timestamp.
+ */
+export async function revokeClientApiKey(clientId, keyId, config) {
+    const res = await fetch(adminClientApiKeysUrl(config.baseUrl, clientId, keyId), {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${config.accessToken}` },
+    });
+    if (!res.ok) {
+        throw await parseError(res);
+    }
+    return res.json();
+}
 //# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAkCtC,SAAS,aAAa,CAAC,OAAe,EAAE,YAAqB;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,OAAO,kBAAkB,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,OAAO,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAG/C,CAAC;IACF,OAAO,IAAI,UAAU,CACnB,IAAI,CAAC,KAAK,IAAI,cAAc,EAC5B,IAAI,CAAC,iBAAiB,IAAI,6BAA6B,GAAG,CAAC,MAAM,EAAE,CACpE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QACnE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAwB,EACxB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,OAAyB,EACzB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QACnE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAuFtC,SAAS,aAAa,CAAC,OAAe,EAAE,YAAqB;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,GAAG,OAAO,kBAAkB,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,OAAO,oBAAoB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,YAAoB;IACjE,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,QAAgB,EAAE,KAAc;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,OAAO,sBAAsB,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC;IACrF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAG/C,CAAC;IACF,OAAO,IAAI,UAAU,CACnB,IAAI,CAAC,KAAK,IAAI,cAAc,EAC5B,IAAI,CAAC,iBAAiB,IAAI,6BAA6B,GAAG,CAAC,MAAM,EAAE,CACpE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QACnE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAwB,EACxB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,OAAyB,EACzB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QACnE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;QAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuC,CAAC;IACtE,OAAO,IAAI,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAoB,EACpB,QAAgB,EAChB,MAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;QACtC,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAkC,CAAC;AACpD,CAAC;AAGD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgC,CAAC;IAC/D,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAA0B,EAC1B,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,KAAa,EACb,MAAyB;IAEzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE;QAC9E,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;AAChD,CAAC"}