@eetr/eetr-auth-client 0.3.1 → 0.5.2

package/dist/api.d.ts

@@ -1,31 +1,160 @@
 import type { TokenResponse, UserInfoResponse, TokenValidationResponse } from "./types.js";
 export declare class OAuthError extends Error {
     readonly code: string;
-    constructor(code: string, message: string);
+    /** HTTP status of the failed response, when the error came from one. */
+    readonly status?: number | undefined;
+    /** The server's `error_description`, when present. */
+    readonly description?: string | undefined;
+    constructor(code: string, message: string, 
+    /** HTTP status of the failed response, when the error came from one. */
+    status?: number | undefined, 
+    /** The server's `error_description`, when present. */
+    description?: string | undefined);
+    /**
+     * True when the access token was valid but lacked a required scope (HTTP 403
+     * `insufficient_scope`) — e.g. calling `/userinfo` with a token that was not
+     * granted `openid`. Re-authorize requesting the missing scope rather than
+     * treating the token as invalid.
+     */
+    get isInsufficientScope(): boolean;
 }
 export type GrantType = "authorization_code" | "client_credentials" | "refresh_token";
+export interface AuthorizationUrlParams {
+    clientId: string;
+    redirectUri: string;
+    /** PKCE S256 challenge (required by this server). */
+    codeChallenge: string;
+    /** Space-delimited scope string. Merged with `scopes` if both are given. */
+    scope?: string;
+    /**
+     * Scopes as an array (e.g. `[OIDCScope.OpenId, OIDCScope.Profile]`). Merged
+     * with `scope`, de-duplicated. Prefer this with the `OIDCScope` constants so
+     * `openid` can't be dropped by a typo.
+     */
+    scopes?: readonly string[];
+    state?: string;
+    /** OIDC nonce, bound into the issued id_token for replay protection. */
+    nonce?: string;
+    /**
+     * RFC 8707 resource indicator: the protected-resource URL the token is for. The server
+     * binds the access token's `aud` to this value (instead of the client_id). Pass the same
+     * value to {@link exchangeToken}.
+     */
+    resource?: string;
+}
+/**
+ * Build an authorization-request URL for the authorization_code + PKCE flow.
+ * Includes the OIDC `nonce` and RFC 8707 `resource` when provided.
+ */
+export declare function buildAuthorizationUrl(authorizationEndpoint: string, params: AuthorizationUrlParams): string;
 export interface ExchangeTokenParams {
     grantType: GrantType;
     clientId: string;
     clientSecret?: string;
+    /** Space-delimited scope string. Merged with `scopes` if both are given. */
     scope?: string;
+    /** Scopes as an array (e.g. with the `OIDCScope` constants). Merged with `scope`. */
+    scopes?: readonly string[];
     code?: string;
     redirectUri?: string;
     codeVerifier?: string;
     refreshToken?: string;
+    /**
+     * RFC 8707 resource indicator. When provided it must match the value sent to
+     * {@link buildAuthorizationUrl} (the server rejects a mismatch with `invalid_target`).
+     */
+    resource?: string;
 }
 export interface ExchangeTokenConfig {
     tokenEndpoint: string;
 }
 export declare function exchangeToken(params: ExchangeTokenParams, config: ExchangeTokenConfig): Promise<TokenResponse>;
+export interface ExchangeApiKeyParams {
+    /** The full credential, `eak_<keyId>_<secret>`. */
+    apiKey: string;
+    /**
+     * Space-delimited subset of the key's scopes. Omit for all of them. Scopes outside
+     * the key's set are rejected, never granted.
+     */
+    scope?: string;
+    /** Scopes as an array. Merged with `scope`. */
+    scopes?: readonly string[];
+    /** RFC 8707 resource indicator; becomes the token's audience. */
+    resource?: string;
+}
+export interface ExchangeApiKeyConfig {
+    /** Usually `${issuer}/api/token/api-key`. */
+    apiKeyEndpoint: string;
+}
+/**
+ * Exchange a long-lived API key for a short-lived access token.
+ *
+ * Intended for CI/CD and other machine callers: one durable secret in the environment
+ * instead of a client_id + client_secret pair, and no client_credentials round trip
+ * before every request.
+ *
+ * The returned token carries the user the key is bound to as its `sub`. There is no
+ * `refresh_token` — the API key is itself the long-lived credential.
+ */
+export declare function exchangeApiKey(params: ExchangeApiKeyParams, config: ExchangeApiKeyConfig): Promise<TokenResponse>;
 export interface IntrospectTokenParams {
     token: string;
     scopes?: string[];
     environmentName: string;
+    /**
+     * Optional audience binding. When set to the calling resource server's own
+     * client_id, the token is only reported valid if it was issued to that client —
+     * preventing a token minted for a sibling client in the same environment from
+     * being accepted here. Omit to keep the previous (audience-agnostic) behavior.
+     */
+    clientId?: string;
 }
 export interface IntrospectTokenConfig {
     introspectionEndpoint: string;
 }
 export declare function introspectToken(params: IntrospectTokenParams, config: IntrospectTokenConfig): Promise<TokenValidationResponse>;
+export interface RegisterClientParams {
+    /** Human-readable name shown on the consent screen. */
+    clientName?: string;
+    /**
+     * Required. Exact-match https URLs; http is allowed only on a loopback host
+     * (`localhost`, any 127.0.0.0/8 address, or `[::1]`). At `/authorize` the loopback host is
+     * matched interchangeably — scheme, port, path, and query still have to match exactly.
+     */
+    redirectUris: string[];
+    /** Defaults server-side to `none` (public/PKCE). Use a confidential method for a secret. */
+    tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post";
+    /** Defaults server-side to `["authorization_code", "refresh_token"]`. */
+    grantTypes?: string[];
+    /** Defaults server-side to `["code"]`. */
+    responseTypes?: string[];
+    /** Space-delimited scope string. Merged with `scopes` if both are given. */
+    scope?: string;
+    /** Scopes as an array (e.g. with the `OIDCScope` constants). Merged with `scope`. */
+    scopes?: readonly string[];
+}
+export interface RegisterClientConfig {
+    /** The `registration_endpoint` from discovery metadata. */
+    registrationEndpoint: string;
+}
+/** RFC 7591 client registration response. `client_secret` is present only for confidential clients. */
+export interface RegisterClientResponse {
+    client_id: string;
+    client_id_issued_at: number;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
+    token_endpoint_auth_method: string;
+    scope?: string;
+    client_secret?: string;
+    client_secret_expires_at?: number;
+}
+/**
+ * Dynamically register an OAuth client (RFC 7591) at the server's `registration_endpoint`.
+ * Public clients (`tokenEndpointAuthMethod: "none"`, the default) get no secret and use PKCE.
+ * Throws {@link OAuthError} on a non-2xx response (e.g. `invalid_redirect_uri`,
+ * `invalid_client_metadata`, or `too_many_requests` when rate-limited).
+ */
+export declare function registerClient(params: RegisterClientParams, config: RegisterClientConfig): Promise<RegisterClientResponse>;
 export declare function getUserInfo(accessToken: string, userInfoEndpoint: string): Promise<UserInfoResponse>;
 //# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE3F,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAEtF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CA2BxB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAWlC;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAY3B"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAG3F,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAAE,MAAM;IAE5B,wEAAwE;aACxD,MAAM,CAAC,EAAE,MAAM;IAC/B,sDAAsD;aACtC,WAAW,CAAC,EAAE,MAAM;gBALpB,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;IACf,wEAAwE;IACxD,MAAM,CAAC,EAAE,MAAM,YAAA;IAC/B,sDAAsD;IACtC,WAAW,CAAC,EAAE,MAAM,YAAA;IAMtC;;;;;OAKG;IACH,IAAI,mBAAmB,IAAI,OAAO,CAEjC;CACF;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAEtF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,qBAAqB,EAAE,MAAM,EAC7B,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAaR;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAED,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAYlC;AAED,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4FAA4F;IAC5F,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAChF,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,uGAAuG;AACvG,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,0BAA0B,EAAE,MAAM,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA2BjC;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAuB3B"}

package/dist/api.js

@@ -1,10 +1,50 @@
+import { resolveScopeParam } from "./scopes.js";
 export class OAuthError extends Error {
     code;
-    constructor(code, message) {
+    status;
+    description;
+    constructor(code, message, 
+    /** HTTP status of the failed response, when the error came from one. */
+    status, 
+    /** The server's `error_description`, when present. */
+    description) {
         super(message);
         this.code = code;
+        this.status = status;
+        this.description = description;
         this.name = "OAuthError";
     }
+    /**
+     * True when the access token was valid but lacked a required scope (HTTP 403
+     * `insufficient_scope`) — e.g. calling `/userinfo` with a token that was not
+     * granted `openid`. Re-authorize requesting the missing scope rather than
+     * treating the token as invalid.
+     */
+    get isInsufficientScope() {
+        return this.code === "insufficient_scope";
+    }
+}
+/**
+ * Build an authorization-request URL for the authorization_code + PKCE flow.
+ * Includes the OIDC `nonce` and RFC 8707 `resource` when provided.
+ */
+export function buildAuthorizationUrl(authorizationEndpoint, params) {
+    const url = new URL(authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", params.clientId);
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("code_challenge", params.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    const scope = resolveScopeParam(params.scope, params.scopes);
+    if (scope)
+        url.searchParams.set("scope", scope);
+    if (params.state)
+        url.searchParams.set("state", params.state);
+    if (params.nonce)
+        url.searchParams.set("nonce", params.nonce);
+    if (params.resource)
+        url.searchParams.set("resource", params.resource);
+    return url.toString();
 }
 export async function exchangeToken(params, config) {
     const body = new URLSearchParams();
@@ -12,8 +52,9 @@ export async function exchangeToken(params, config) {
     body.set("client_id", params.clientId);
     if (params.clientSecret)
         body.set("client_secret", params.clientSecret);
-    if (params.scope)
-        body.set("scope", params.scope);
+    const scope = resolveScopeParam(params.scope, params.scopes);
+    if (scope)
+        body.set("scope", scope);
     if (params.code)
         body.set("code", params.code);
     if (params.redirectUri)
@@ -22,6 +63,8 @@ export async function exchangeToken(params, config) {
         body.set("code_verifier", params.codeVerifier);
     if (params.refreshToken)
         body.set("refresh_token", params.refreshToken);
+    if (params.resource)
+        body.set("resource", params.resource);
     const res = await fetch(config.tokenEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -33,6 +76,39 @@ export async function exchangeToken(params, config) {
     }
     return data;
 }
+/**
+ * Exchange a long-lived API key for a short-lived access token.
+ *
+ * Intended for CI/CD and other machine callers: one durable secret in the environment
+ * instead of a client_id + client_secret pair, and no client_credentials round trip
+ * before every request.
+ *
+ * The returned token carries the user the key is bound to as its `sub`. There is no
+ * `refresh_token` — the API key is itself the long-lived credential.
+ */
+export async function exchangeApiKey(params, config) {
+    const body = new URLSearchParams();
+    const scope = resolveScopeParam(params.scope, params.scopes);
+    if (scope)
+        body.set("scope", scope);
+    if (params.resource)
+        body.set("resource", params.resource);
+    const res = await fetch(config.apiKeyEndpoint, {
+        method: "POST",
+        headers: {
+            // Sent as a bearer credential rather than in the body so the key stays out of
+            // anything that logs request bodies.
+            Authorization: `Bearer ${params.apiKey}`,
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    const data = (await res.json());
+    if (!res.ok) {
+        throw new OAuthError(data.error ?? "server_error", data.error_description ?? `API key exchange failed: ${res.status}`, res.status, data.error_description);
+    }
+    return data;
+}
 export async function introspectToken(params, config) {
     const res = await fetch(config.introspectionEndpoint, {
         method: "POST",
@@ -41,17 +117,57 @@ export async function introspectToken(params, config) {
             token: params.token,
             scopes: params.scopes ?? [],
             environmentName: params.environmentName,
+            ...(params.clientId ? { clientId: params.clientId } : {}),
         }),
     });
     return res.json();
 }
+/**
+ * Dynamically register an OAuth client (RFC 7591) at the server's `registration_endpoint`.
+ * Public clients (`tokenEndpointAuthMethod: "none"`, the default) get no secret and use PKCE.
+ * Throws {@link OAuthError} on a non-2xx response (e.g. `invalid_redirect_uri`,
+ * `invalid_client_metadata`, or `too_many_requests` when rate-limited).
+ */
+export async function registerClient(params, config) {
+    const requestBody = { redirect_uris: params.redirectUris };
+    if (params.clientName)
+        requestBody.client_name = params.clientName;
+    if (params.tokenEndpointAuthMethod)
+        requestBody.token_endpoint_auth_method = params.tokenEndpointAuthMethod;
+    if (params.grantTypes)
+        requestBody.grant_types = params.grantTypes;
+    if (params.responseTypes)
+        requestBody.response_types = params.responseTypes;
+    const scope = resolveScopeParam(params.scope, params.scopes);
+    if (scope)
+        requestBody.scope = scope;
+    const res = await fetch(config.registrationEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(requestBody),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new OAuthError(data.error ?? "server_error", data.error_description ?? `Client registration failed: ${res.status}`, res.status, data.error_description);
+    }
+    return data;
+}
 export async function getUserInfo(accessToken, userInfoEndpoint) {
     const res = await fetch(userInfoEndpoint, {
         headers: { Authorization: `Bearer ${accessToken}` },
     });
     if (!res.ok) {
         const data = (await res.json().catch(() => ({})));
-        throw new OAuthError(data.error ?? "invalid_token", `UserInfo request failed: ${res.status}`);
+        // A 403 means the token is valid but missing a required scope (`openid`).
+        // Surface it as `insufficient_scope` so callers can re-authorize with the
+        // right scopes instead of discarding the token as invalid. A 401 (or a
+        // non-JSON body) stays `invalid_token`.
+        const code = data.error ?? (res.status === 403 ? "insufficient_scope" : "invalid_token");
+        const message = data.error_description ??
+            (code === "insufficient_scope"
+                ? "UserInfo requires the openid scope on the access token."
+                : `UserInfo request failed: ${res.status}`);
+        throw new OAuthError(code, message, res.status, data.error_description);
     }
     return res.json();
 }

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAEjB;IADlB,YACkB,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAQ;QAI5B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAmBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,MAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,WAAW;QAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAExE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,IAAI,CAAC,KAAK,IAAI,cAAc,EAC5B,IAAI,CAAC,iBAAiB,IAAI,0BAA0B,GAAG,CAAC,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B,EAC7B,MAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;KACH,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,EAAsC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,gBAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,MAAM,IAAI,UAAU,CAClB,IAAI,CAAC,KAAK,IAAI,eAAe,EAC7B,4BAA4B,GAAG,CAAC,MAAM,EAAE,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA+B,CAAC;AACjD,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,OAAO,UAAW,SAAQ,KAAK;IAEjB;IAGA;IAEA;IANlB,YACkB,IAAY,EAC5B,OAAe;IACf,wEAAwE;IACxD,MAAe;IAC/B,sDAAsD;IACtC,WAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,SAAI,GAAJ,IAAI,CAAQ;QAGZ,WAAM,GAAN,MAAM,CAAS;QAEf,gBAAW,GAAX,WAAW,CAAS;QAGpC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACH,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC;IAC5C,CAAC;CACF;AA4BD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,qBAA6B,EAC7B,MAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAyBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B,EAC3B,MAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,WAAW;QAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,IAAI,CAAC,KAAK,IAAI,cAAc,EAC5B,IAAI,CAAC,iBAAiB,IAAI,0BAA0B,GAAG,CAAC,MAAM,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA4B,EAC5B,MAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,8EAA8E;YAC9E,qCAAqC;YACrC,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;YACxC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,IAAI,CAAC,KAAK,IAAI,cAAc,EAC5B,IAAI,CAAC,iBAAiB,IAAI,4BAA4B,GAAG,CAAC,MAAM,EAAE,EAClE,GAAG,CAAC,MAAM,EACV,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B,EAC7B,MAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;KACH,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,EAAsC,CAAC;AACxD,CAAC;AAyCD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA4B,EAC5B,MAA4B;IAE5B,MAAM,WAAW,GAA4B,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACpF,IAAI,MAAM,CAAC,UAAU;QAAE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;IACnE,IAAI,MAAM,CAAC,uBAAuB;QAAE,WAAW,CAAC,0BAA0B,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAC5G,IAAI,MAAM,CAAC,UAAU;QAAE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC;IACnE,IAAI,MAAM,CAAC,aAAa;QAAE,WAAW,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;IAC5E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK;QAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC;IAErC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,oBAAoB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAG/C,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,IAAI,CAAC,KAAK,IAAI,cAAc,EAC5B,IAAI,CAAC,iBAAiB,IAAI,+BAA+B,GAAG,CAAC,MAAM,EAAE,EACrE,GAAG,CAAC,MAAM,EACV,IAAI,CAAC,iBAAiB,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,gBAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAG/C,CAAC;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,wCAAwC;QACxC,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC9E,MAAM,OAAO,GACX,IAAI,CAAC,iBAAiB;YACtB,CAAC,IAAI,KAAK,oBAAoB;gBAC5B,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA+B,CAAC;AACjD,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,15 @@
-export type { TokenResponse, UserInfoResponse, OIDCDiscovery, OAuthServerMetadata, AuthClientConfig, JWTPayload, TokenValidationResponse, } from "./types.js";
+export type { TokenResponse, UserInfoResponse, UserProfile, OIDCDiscovery, OAuthServerMetadata, AuthClientConfig, JWTPayload, IDTokenClaims, TokenValidationResponse, } from "./types.js";
+export { OIDCScope, STANDARD_OIDC_SCOPES, resolveScopeParam, } from "./scopes.js";
+export type { OIDCScopeValue } from "./scopes.js";
+export { toUserProfile } from "./profile.js";
 export { fetchOIDCDiscovery, fetchOAuthMetadata } from "./discovery.js";
-export { OAuthError, exchangeToken, introspectToken, getUserInfo, } from "./api.js";
-export type { GrantType, ExchangeTokenParams, ExchangeTokenConfig, IntrospectTokenParams, IntrospectTokenConfig, } from "./api.js";
+export { OAuthError, exchangeToken, introspectToken, getUserInfo, buildAuthorizationUrl, registerClient, exchangeApiKey, } from "./api.js";
+export type { GrantType, ExchangeTokenParams, ExchangeTokenConfig, IntrospectTokenParams, IntrospectTokenConfig, AuthorizationUrlParams, RegisterClientParams, RegisterClientConfig, RegisterClientResponse, ExchangeApiKeyParams, ExchangeApiKeyConfig, } from "./api.js";
 export { TokenManager } from "./tokens.js";
-export { validateJwt, decodeJwtPayload } from "./jwt.js";
-export type { ValidateJwtOptions } from "./jwt.js";
-export { getAdminUser, createAdminUser, updateAdminUser, deleteAdminUser, } from "./admin.js";
-export type { AdminUserRecord, AdminClientConfig, CreateUserParams, UpdateUserParams, } from "./admin.js";
+export { validateJwt, validateIdToken, decodeJwtPayload } from "./jwt.js";
+export type { ValidateJwtOptions, ValidateIdTokenOptions } from "./jwt.js";
+export { getAdminUser, createAdminUser, updateAdminUser, deleteAdminUser, listUserConsents, revokeUserConsent, listClientApiKeys, createClientApiKey, revokeClientApiKey, } from "./admin.js";
+export type { AdminUserRecord, AdminClientConfig, AdminConsentRecord, RevokeConsentResult, CreateUserParams, UpdateUserParams, ApiKeyRecord, CreateApiKeyParams, CreateApiKeyResult, } from "./admin.js";
 export { listPasskeys, renamePasskey, removePasskey } from "./passkeys.js";
 export type { PasskeySummary, UserClientConfig } from "./passkeys.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,SAAS,EACT,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC3E,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,SAAS,EACT,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC1E,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE3E,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC3E,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,7 +1,9 @@
+export { OIDCScope, STANDARD_OIDC_SCOPES, resolveScopeParam, } from "./scopes.js";
+export { toUserProfile } from "./profile.js";
 export { fetchOIDCDiscovery, fetchOAuthMetadata } from "./discovery.js";
-export { OAuthError, exchangeToken, introspectToken, getUserInfo, } from "./api.js";
+export { OAuthError, exchangeToken, introspectToken, getUserInfo, buildAuthorizationUrl, registerClient, exchangeApiKey, } from "./api.js";
 export { TokenManager } from "./tokens.js";
-export { validateJwt, decodeJwtPayload } from "./jwt.js";
-export { getAdminUser, createAdminUser, updateAdminUser, deleteAdminUser, } from "./admin.js";
+export { validateJwt, validateIdToken, decodeJwtPayload } from "./jwt.js";
+export { getAdminUser, createAdminUser, updateAdminUser, deleteAdminUser, listUserConsents, revokeUserConsent, listClientApiKeys, createClientApiKey, revokeClientApiKey, } from "./admin.js";
 export { listPasskeys, renamePasskey, removePasskey } from "./passkeys.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AASlB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGzD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAExE,OAAO,EACL,UAAU,EACV,aAAa,EACb,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,cAAc,GACf,MAAM,UAAU,CAAC;AAelB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAG1E,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAapB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/jwt.d.ts

@@ -1,9 +1,19 @@
-import type { JWTPayload } from "./types.js";
+import type { IDTokenClaims, JWTPayload } from "./types.js";
 export interface ValidateJwtOptions {
     audience?: string | string[];
     issuer?: string;
     clockTolerance?: number;
 }
+export interface ValidateIdTokenOptions extends ValidateJwtOptions {
+    /** When set, the id_token's `nonce` claim must match this value (OIDC replay defense). */
+    nonce?: string;
+}
 export declare function validateJwt(token: string, jwksUri: string, options?: ValidateJwtOptions): Promise<JWTPayload>;
+/**
+ * Verify an OIDC id_token: checks the RS256 signature against the JWKS plus
+ * `iss`/`aud`/`exp` (via {@link validateJwt}), and — when `options.nonce` is
+ * supplied — that the token's `nonce` claim matches, defending against replay.
+ */
+export declare function validateIdToken(token: string, jwksUri: string, options?: ValidateIdTokenOptions): Promise<IDTokenClaims>;
 export declare function decodeJwtPayload(token: string): JWTPayload;
 //# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAQ1D"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAWD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAQ1D"}

package/dist/jwt.js

@@ -15,6 +15,19 @@ export async function validateJwt(token, jwksUri, options = {}) {
     });
     return payload;
 }
+/**
+ * Verify an OIDC id_token: checks the RS256 signature against the JWKS plus
+ * `iss`/`aud`/`exp` (via {@link validateJwt}), and — when `options.nonce` is
+ * supplied — that the token's `nonce` claim matches, defending against replay.
+ */
+export async function validateIdToken(token, jwksUri, options = {}) {
+    const { nonce, ...jwtOptions } = options;
+    const payload = (await validateJwt(token, jwksUri, jwtOptions));
+    if (nonce !== undefined && payload.nonce !== nonce) {
+        throw new Error("id_token nonce mismatch");
+    }
+    return payload;
+}
 export function decodeJwtPayload(token) {
     const parts = token.split(".");
     if (parts.length !== 3) {

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AASrD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,OAAe,EACf,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,OAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;AACxC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAcrD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,OAAe,EACf,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,OAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,OAAe,EACf,UAAkC,EAAE;IAEpC,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAkB,CAAC;IACjF,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;AACxC,CAAC"}

package/dist/profile.d.ts

@@ -0,0 +1,14 @@
+import type { IDTokenClaims, UserInfoResponse, UserProfile } from "./types.js";
+/**
+ * Merge `/userinfo` claims (and optionally id_token claims) into a normalized,
+ * camelCased {@link UserProfile}. UserInfo values take precedence over id_token
+ * values — UserInfo is the authoritative, freshest source — and the id_token
+ * fills any gap for claims `/userinfo` did not return.
+ *
+ * Fields stay optional because the server only returns claims the access token's
+ * scopes allow (`profile` → name/preferredUsername/picture, `email` →
+ * email/emailVerified), so a profile built from an `openid`-only token carries
+ * just `sub`.
+ */
+export declare function toUserProfile(userInfo: UserInfoResponse, idTokenClaims?: IDTokenClaims): UserProfile;
+//# sourceMappingURL=profile.d.ts.map

package/dist/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,gBAAgB,EAC1B,aAAa,CAAC,EAAE,aAAa,GAC5B,WAAW,CAcb"}

package/dist/profile.js

@@ -0,0 +1,23 @@
+/**
+ * Merge `/userinfo` claims (and optionally id_token claims) into a normalized,
+ * camelCased {@link UserProfile}. UserInfo values take precedence over id_token
+ * values — UserInfo is the authoritative, freshest source — and the id_token
+ * fills any gap for claims `/userinfo` did not return.
+ *
+ * Fields stay optional because the server only returns claims the access token's
+ * scopes allow (`profile` → name/preferredUsername/picture, `email` →
+ * email/emailVerified), so a profile built from an `openid`-only token carries
+ * just `sub`.
+ */
+export function toUserProfile(userInfo, idTokenClaims) {
+    const prefer = (primary, fallback) => primary !== undefined ? primary : fallback;
+    return {
+        sub: userInfo.sub ?? idTokenClaims?.sub ?? "",
+        name: prefer(userInfo.name, idTokenClaims?.name),
+        preferredUsername: prefer(userInfo.preferred_username, idTokenClaims?.preferred_username),
+        picture: prefer(userInfo.picture, idTokenClaims?.picture),
+        email: prefer(userInfo.email, idTokenClaims?.email),
+        emailVerified: prefer(userInfo.email_verified, idTokenClaims?.email_verified),
+    };
+}
+//# sourceMappingURL=profile.js.map

package/dist/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA0B,EAC1B,aAA6B;IAE7B,MAAM,MAAM,GAAG,CAAI,OAAsB,EAAE,QAAuB,EAAiB,EAAE,CACnF,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7C,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,EAAE;QAC7C,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC;QAChD,iBAAiB,EAAE,MAAM,CACvB,QAAQ,CAAC,kBAAkB,EAC3B,aAAa,EAAE,kBAAkB,CAClC;QACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC;QACnD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,aAAa,EAAE,cAAc,CAAC;KAC9E,CAAC;AACJ,CAAC"}

package/dist/scopes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Standard OpenID Connect scopes recognized by the eetr-auth server. These are seeded
+ * on install; an admin still grants them to each client. Use them when building an
+ * authorization request or token exchange so a typo can't silently drop `openid` (which
+ * would make `/userinfo` return 403 insufficient_scope).
+ */
+export declare const OIDCScope: {
+    /** Required to mint an id_token and to call the `/userinfo` endpoint. */
+    readonly OpenId: "openid";
+    /** Gates the `name` / `preferred_username` / `picture` claims. */
+    readonly Profile: "profile";
+    /** Gates the `email` / `email_verified` claims. */
+    readonly Email: "email";
+};
+export type OIDCScopeValue = (typeof OIDCScope)[keyof typeof OIDCScope];
+/** The standard OIDC scopes, in canonical order: `openid profile email`. */
+export declare const STANDARD_OIDC_SCOPES: readonly OIDCScopeValue[];
+/**
+ * Merge a free-form `scope` string and/or a `scopes` array into a single
+ * space-delimited scope string, trimmed, de-duplicated, and order-preserving
+ * (the `scope` string first, then `scopes`). Returns `undefined` when neither
+ * yields any scope, so callers can omit the parameter entirely.
+ */
+export declare function resolveScopeParam(scope?: string, scopes?: readonly string[]): string | undefined;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../src/scopes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,SAAS;IACpB,yEAAyE;;IAEzE,kEAAkE;;IAElE,mDAAmD;;CAE3C,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAExE,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAIzD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,GAAG,SAAS,CAapB"}

package/dist/scopes.js

@@ -0,0 +1,43 @@
+/**
+ * Standard OpenID Connect scopes recognized by the eetr-auth server. These are seeded
+ * on install; an admin still grants them to each client. Use them when building an
+ * authorization request or token exchange so a typo can't silently drop `openid` (which
+ * would make `/userinfo` return 403 insufficient_scope).
+ */
+export const OIDCScope = {
+    /** Required to mint an id_token and to call the `/userinfo` endpoint. */
+    OpenId: "openid",
+    /** Gates the `name` / `preferred_username` / `picture` claims. */
+    Profile: "profile",
+    /** Gates the `email` / `email_verified` claims. */
+    Email: "email",
+};
+/** The standard OIDC scopes, in canonical order: `openid profile email`. */
+export const STANDARD_OIDC_SCOPES = [
+    OIDCScope.OpenId,
+    OIDCScope.Profile,
+    OIDCScope.Email,
+];
+/**
+ * Merge a free-form `scope` string and/or a `scopes` array into a single
+ * space-delimited scope string, trimmed, de-duplicated, and order-preserving
+ * (the `scope` string first, then `scopes`). Returns `undefined` when neither
+ * yields any scope, so callers can omit the parameter entirely.
+ */
+export function resolveScopeParam(scope, scopes) {
+    const out = [];
+    const seen = new Set();
+    const add = (value) => {
+        const trimmed = value.trim();
+        if (trimmed && !seen.has(trimmed)) {
+            seen.add(trimmed);
+            out.push(trimmed);
+        }
+    };
+    if (scope)
+        scope.split(/\s+/).forEach(add);
+    if (scopes)
+        scopes.forEach(add);
+    return out.length > 0 ? out.join(" ") : undefined;
+}
+//# sourceMappingURL=scopes.js.map

package/dist/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../src/scopes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,yEAAyE;IACzE,MAAM,EAAE,QAAQ;IAChB,kEAAkE;IAClE,OAAO,EAAE,SAAS;IAClB,mDAAmD;IACnD,KAAK,EAAE,OAAO;CACN,CAAC;AAIX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAA8B;IAC7D,SAAS,CAAC,MAAM;IAChB,SAAS,CAAC,OAAO;IACjB,SAAS,CAAC,KAAK;CAChB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAc,EACd,MAA0B;IAE1B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,KAAK;QAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC"}