@felixgeelhaar/jira-sdk 0.2.0 → 1.0.0

package/dist/auth/index.cjs

@@ -0,0 +1,400 @@
+'use strict';
+
+var zod = require('zod');
+
+// src/auth/types.ts
+var ApiTokenAuthConfigSchema = zod.z.object({
+  email: zod.z.email({ error: "Invalid email address" }),
+  apiToken: zod.z.string().min(1, { error: "API token is required" })
+});
+var PatAuthConfigSchema = zod.z.object({
+  token: zod.z.string().min(1, "Personal access token is required")
+});
+var BasicAuthConfigSchema = zod.z.object({
+  username: zod.z.string().min(1, "Username is required"),
+  password: zod.z.string().min(1, "Password is required")
+});
+var OAuth2AuthConfigSchema = zod.z.object({
+  clientId: zod.z.string().min(1, "Client ID is required"),
+  clientSecret: zod.z.string().min(1, "Client secret is required"),
+  accessToken: zod.z.string().optional(),
+  refreshToken: zod.z.string().optional(),
+  tokenEndpoint: zod.z.url().optional(),
+  scopes: zod.z.array(zod.z.string()).optional(),
+  expiresAt: zod.z.number().int().optional()
+});
+var OAuth2TokenResponseSchema = zod.z.object({
+  access_token: zod.z.string(),
+  token_type: zod.z.string(),
+  expires_in: zod.z.number().int().optional(),
+  refresh_token: zod.z.string().optional(),
+  scope: zod.z.string().optional()
+});
+
+// src/utils/runtime.ts
+function captureStackTrace(target, constructor) {
+  const capture = Error.captureStackTrace;
+  capture?.(target, constructor);
+}
+
+// src/errors/base.error.ts
+var JiraSdkError = class extends Error {
+  /** HTTP status code if applicable */
+  statusCode;
+  /** Original cause of the error */
+  cause;
+  /** Additional context/metadata */
+  context;
+  constructor(message, options) {
+    super(message, options?.cause !== void 0 ? { cause: options.cause } : void 0);
+    this.name = this.constructor.name;
+    if (options?.cause !== void 0) {
+      this.cause = options.cause;
+    }
+    if (options?.statusCode !== void 0) {
+      this.statusCode = options.statusCode;
+    }
+    if (options?.context !== void 0) {
+      this.context = options.context;
+    }
+    captureStackTrace(this, this.constructor);
+  }
+  /**
+   * Returns a JSON representation of the error
+   */
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      context: this.context,
+      cause: this.cause?.message,
+      stack: this.stack
+    };
+  }
+};
+
+// src/errors/auth.error.ts
+var AuthError = class extends JiraSdkError {
+  code = "AUTH_ERROR";
+  constructor(message, context) {
+    super(message, { statusCode: 401, ...context !== void 0 && { context } });
+  }
+};
+var TokenRefreshError = class extends AuthError {
+  code = "TOKEN_REFRESH_ERROR";
+};
+var TokenExpiredError = class extends AuthError {
+  code = "TOKEN_EXPIRED_ERROR";
+  constructor(message = "Access token has expired", context) {
+    super(message, context);
+  }
+};
+var AuthConfigError = class extends AuthError {
+  code = "AUTH_CONFIG_ERROR";
+  validationErrors;
+  constructor(message, validationErrors) {
+    super(message, validationErrors !== void 0 ? { validationErrors } : void 0);
+    this.validationErrors = validationErrors;
+  }
+};
+
+// src/auth/api-token.ts
+var ApiTokenAuth = class {
+  type = "api-token";
+  email;
+  apiToken;
+  encodedCredentials;
+  constructor(config) {
+    const result = ApiTokenAuthConfigSchema.safeParse(config);
+    if (!result.success) {
+      throw new AuthConfigError("Invalid API token auth configuration", result.error.issues);
+    }
+    this.email = result.data.email;
+    this.apiToken = result.data.apiToken;
+    const credentials = `${this.email}:${this.apiToken}`;
+    this.encodedCredentials = this.encodeBase64(credentials);
+  }
+  /**
+   * Returns the Authorization header with Basic auth
+   */
+  getAuthHeaders() {
+    return {
+      Authorization: `Basic ${this.encodedCredentials}`
+    };
+  }
+  /**
+   * API token auth is always valid (no expiration)
+   */
+  isValid() {
+    return true;
+  }
+  /**
+   * Encode string to base64 (works in both browser and Node.js)
+   */
+  encodeBase64(str) {
+    if (typeof btoa === "function") {
+      return btoa(str);
+    } else if (typeof Buffer !== "undefined") {
+      return Buffer.from(str, "utf-8").toString("base64");
+    }
+    throw new Error("No base64 encoding method available");
+  }
+};
+function createApiTokenAuth(config) {
+  return new ApiTokenAuth(config);
+}
+
+// src/auth/pat.ts
+var PatAuth = class {
+  type = "pat";
+  token;
+  constructor(config) {
+    const result = PatAuthConfigSchema.safeParse(config);
+    if (!result.success) {
+      throw new AuthConfigError("Invalid PAT auth configuration", result.error.issues);
+    }
+    this.token = result.data.token;
+  }
+  /**
+   * Returns the Authorization header with Bearer token
+   */
+  getAuthHeaders() {
+    return {
+      Authorization: `Bearer ${this.token}`
+    };
+  }
+  /**
+   * PAT auth is always valid (no automatic expiration check)
+   */
+  isValid() {
+    return true;
+  }
+};
+function createPatAuth(config) {
+  return new PatAuth(config);
+}
+
+// src/auth/basic.ts
+var BasicAuth = class {
+  type = "basic";
+  encodedCredentials;
+  constructor(config) {
+    const result = BasicAuthConfigSchema.safeParse(config);
+    if (!result.success) {
+      throw new AuthConfigError("Invalid basic auth configuration", result.error.issues);
+    }
+    const { username, password } = result.data;
+    const credentials = `${username}:${password}`;
+    this.encodedCredentials = this.encodeBase64(credentials);
+  }
+  /**
+   * Returns the Authorization header with Basic auth
+   */
+  getAuthHeaders() {
+    return {
+      Authorization: `Basic ${this.encodedCredentials}`
+    };
+  }
+  /**
+   * Basic auth is always valid (no expiration)
+   */
+  isValid() {
+    return true;
+  }
+  /**
+   * Encode string to base64 (works in both browser and Node.js)
+   */
+  encodeBase64(str) {
+    if (typeof btoa === "function") {
+      return btoa(str);
+    } else if (typeof Buffer !== "undefined") {
+      return Buffer.from(str, "utf-8").toString("base64");
+    }
+    throw new Error("No base64 encoding method available");
+  }
+};
+function createBasicAuth(config) {
+  return new BasicAuth(config);
+}
+
+// src/auth/oauth2.ts
+var ATLASSIAN_TOKEN_ENDPOINT = "https://auth.atlassian.com/oauth/token";
+var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
+var OAuth2Auth = class {
+  type = "oauth2";
+  clientId;
+  clientSecret;
+  tokenEndpoint;
+  accessToken;
+  refreshToken;
+  expiresAt;
+  /**
+   * Promise for in-flight token refresh (prevents concurrent refreshes)
+   */
+  refreshPromise;
+  /**
+   * Callback invoked when tokens are refreshed
+   * Useful for persisting new tokens
+   */
+  onTokenRefresh;
+  constructor(config) {
+    const result = OAuth2AuthConfigSchema.safeParse(config);
+    if (!result.success) {
+      throw new AuthConfigError("Invalid OAuth2 auth configuration", result.error.issues);
+    }
+    const data = result.data;
+    this.clientId = data.clientId;
+    this.clientSecret = data.clientSecret;
+    this.tokenEndpoint = data.tokenEndpoint ?? ATLASSIAN_TOKEN_ENDPOINT;
+    this.accessToken = data.accessToken;
+    this.refreshToken = data.refreshToken;
+    this.expiresAt = data.expiresAt;
+  }
+  /**
+   * Returns the Authorization header with Bearer token
+   * Uses a mutex to prevent concurrent token refreshes
+   */
+  async getAuthHeaders() {
+    if (this.shouldRefreshToken()) {
+      if (!this.refreshPromise) {
+        this.refreshPromise = this.refresh().finally(() => {
+          this.refreshPromise = void 0;
+        });
+      }
+      await this.refreshPromise;
+    }
+    if (!this.accessToken) {
+      throw new TokenExpiredError("No access token available");
+    }
+    return {
+      Authorization: `Bearer ${this.accessToken}`
+    };
+  }
+  /**
+   * Check if the current token is valid
+   */
+  isValid() {
+    if (!this.accessToken) {
+      return false;
+    }
+    if (this.expiresAt && Date.now() >= this.expiresAt) {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Refresh the access token using the refresh token
+   */
+  async refresh() {
+    if (!this.refreshToken) {
+      throw new TokenRefreshError("No refresh token available");
+    }
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      refresh_token: this.refreshToken
+    });
+    try {
+      const response = await fetch(this.tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: body.toString()
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        throw new TokenRefreshError(
+          `Token refresh failed: ${response.status} ${response.statusText}`,
+          { responseBody: errorText }
+        );
+      }
+      const data = await response.json();
+      const parsed = OAuth2TokenResponseSchema.safeParse(data);
+      if (!parsed.success) {
+        throw new TokenRefreshError("Invalid token response from server", {
+          validationErrors: parsed.error.issues
+        });
+      }
+      const tokens = parsed.data;
+      this.accessToken = tokens.access_token;
+      if (tokens.refresh_token) {
+        this.refreshToken = tokens.refresh_token;
+      }
+      if (tokens.expires_in) {
+        this.expiresAt = Date.now() + tokens.expires_in * 1e3;
+      }
+      if (this.onTokenRefresh) {
+        await this.onTokenRefresh({
+          accessToken: this.accessToken,
+          refreshToken: this.refreshToken,
+          expiresAt: this.expiresAt
+        });
+      }
+    } catch (error) {
+      if (error instanceof TokenRefreshError) {
+        throw error;
+      }
+      throw new TokenRefreshError("Failed to refresh token", { cause: error });
+    }
+  }
+  /**
+   * Set a new access token
+   */
+  setAccessToken(token, expiresIn) {
+    this.accessToken = token;
+    if (expiresIn) {
+      this.expiresAt = Date.now() + expiresIn * 1e3;
+    }
+  }
+  /**
+   * Set a new refresh token
+   */
+  setRefreshToken(token) {
+    this.refreshToken = token;
+  }
+  /**
+   * Get current tokens (for persistence)
+   */
+  getTokens() {
+    return {
+      accessToken: this.accessToken,
+      refreshToken: this.refreshToken,
+      expiresAt: this.expiresAt
+    };
+  }
+  /**
+   * Check if we should proactively refresh the token
+   */
+  shouldRefreshToken() {
+    if (!this.accessToken) {
+      return true;
+    }
+    if (!this.expiresAt) {
+      return false;
+    }
+    return Date.now() >= this.expiresAt - TOKEN_EXPIRY_BUFFER_MS;
+  }
+};
+function createOAuth2Auth(config) {
+  return new OAuth2Auth(config);
+}
+
+exports.ApiTokenAuth = ApiTokenAuth;
+exports.ApiTokenAuthConfigSchema = ApiTokenAuthConfigSchema;
+exports.BasicAuth = BasicAuth;
+exports.BasicAuthConfigSchema = BasicAuthConfigSchema;
+exports.OAuth2Auth = OAuth2Auth;
+exports.OAuth2AuthConfigSchema = OAuth2AuthConfigSchema;
+exports.OAuth2TokenResponseSchema = OAuth2TokenResponseSchema;
+exports.PatAuth = PatAuth;
+exports.PatAuthConfigSchema = PatAuthConfigSchema;
+exports.createApiTokenAuth = createApiTokenAuth;
+exports.createBasicAuth = createBasicAuth;
+exports.createOAuth2Auth = createOAuth2Auth;
+exports.createPatAuth = createPatAuth;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/types.ts","../../src/utils/runtime.ts","../../src/errors/base.error.ts","../../src/errors/auth.error.ts","../../src/auth/api-token.ts","../../src/auth/pat.ts","../../src/auth/basic.ts","../../src/auth/oauth2.ts"],"names":["z"],"mappings":";;;;;AAoCO,IAAM,wBAAA,GAA2BA,MAAE,MAAA,CAAO;AAAA,EAC/C,OAAOA,KAAA,CAAE,KAAA,CAAM,EAAE,KAAA,EAAO,yBAAyB,CAAA;AAAA,EACjD,QAAA,EAAUA,MAAE,MAAA,EAAO,CAAE,IAAI,CAAA,EAAG,EAAE,KAAA,EAAO,uBAAA,EAAyB;AAChE,CAAC;AAOM,IAAM,mBAAA,GAAsBA,MAAE,MAAA,CAAO;AAAA,EAC1C,OAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,mCAAmC;AAC9D,CAAC;AAOM,IAAM,qBAAA,GAAwBA,MAAE,MAAA,CAAO;AAAA,EAC5C,UAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,sBAAsB,CAAA;AAAA,EAClD,UAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,sBAAsB;AACpD,CAAC;AAOM,IAAM,sBAAA,GAAyBA,MAAE,MAAA,CAAO;AAAA,EAC7C,UAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,uBAAuB,CAAA;AAAA,EACnD,cAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,GAAG,2BAA2B,CAAA;AAAA,EAC3D,WAAA,EAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,aAAA,EAAeA,KAAA,CAAE,GAAA,EAAI,CAAE,QAAA,EAAS;AAAA,EAChC,QAAQA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACrC,WAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA;AAC9B,CAAC;AAOM,IAAM,yBAAA,GAA4BA,MAAE,MAAA,CAAO;AAAA,EAChD,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,UAAA,EAAYA,MAAE,MAAA,EAAO;AAAA,EACrB,YAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA,EACtC,aAAA,EAAeA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACpB,CAAC;;;AClBM,SAAS,iBAAA,CAAkB,QAAgB,WAAA,EAA6B;AAC7E,EAAA,MAAM,UAAW,KAAA,CAA+D,iBAAA;AAChF,EAAA,OAAA,GAAU,QAAQ,WAAW,CAAA;AAC/B;;;AClEO,IAAe,YAAA,GAAf,cAAoC,KAAA,CAAM;AAAA;AAAA,EAKtC,UAAA;AAAA;AAAA,EAGA,KAAA;AAAA;AAAA,EAGA,OAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EAKA;AACA,IAAA,KAAA,CAAM,OAAA,EAAS,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AAClF,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAG7B,IAAA,IAAI,OAAA,EAAS,UAAU,MAAA,EAAW;AAChC,MAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AAAA,IACvB;AACA,IAAA,IAAI,OAAA,EAAS,eAAe,MAAA,EAAW;AACrC,MAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,UAAA;AAAA,IAC5B;AACA,IAAA,IAAI,OAAA,EAAS,YAAY,MAAA,EAAW;AAClC,MAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AAAA,IACzB;AAGA,IAAA,iBAAA,CAAkB,IAAA,EAAM,KAAK,WAAW,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,GAAkC;AAChC,IAAA,OAAO;AAAA,MACL,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO,KAAK,KAAA,EAAO,OAAA;AAAA,MACnB,OAAO,IAAA,CAAK;AAAA,KACd;AAAA,EACF;AACF,CAAA;;;ACpDO,IAAM,SAAA,GAAN,cAAwB,YAAA,CAAa;AAAA,EACjC,IAAA,GAAe,YAAA;AAAA,EAExB,WAAA,CAAY,SAAiB,OAAA,EAAmC;AAC9D,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,UAAA,EAAY,GAAA,EAAK,GAAI,YAAY,MAAA,IAAa,EAAE,OAAA,EAAQ,EAAI,CAAA;AAAA,EAC/E;AACF,CAAA;AAKO,IAAM,iBAAA,GAAN,cAAgC,SAAA,CAAU;AAAA,EAC7B,IAAA,GAAe,qBAAA;AACnC,CAAA;AAKO,IAAM,iBAAA,GAAN,cAAgC,SAAA,CAAU;AAAA,EAC7B,IAAA,GAAe,qBAAA;AAAA,EAEjC,WAAA,CAAY,OAAA,GAAU,0BAAA,EAA4B,OAAA,EAAmC;AACnF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAAA,EACxB;AACF,CAAA;AAKO,IAAM,eAAA,GAAN,cAA8B,SAAA,CAAU;AAAA,EAC3B,IAAA,GAAe,mBAAA;AAAA,EACxB,gBAAA;AAAA,EAET,WAAA,CAAY,SAAiB,gBAAA,EAAuC;AAClE,IAAA,KAAA,CAAM,SAAS,gBAAA,KAAqB,MAAA,GAAY,EAAE,gBAAA,KAAqB,MAAS,CAAA;AAChF,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAAA,EAC1B;AACF,CAAA;;;ACnBO,IAAM,eAAN,MAA2C;AAAA,EAChC,IAAA,GAAiB,WAAA;AAAA,EAChB,KAAA;AAAA,EACA,QAAA;AAAA,EACA,kBAAA;AAAA,EAEjB,YAAY,MAAA,EAA4B;AACtC,IAAA,MAAM,MAAA,GAAS,wBAAA,CAAyB,SAAA,CAAU,MAAM,CAAA;AACxD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,eAAA,CAAgB,sCAAA,EAAwC,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,IACvF;AAEA,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,IAAA,CAAK,KAAA;AACzB,IAAA,IAAA,CAAK,QAAA,GAAW,OAAO,IAAA,CAAK,QAAA;AAI5B,IAAA,MAAM,cAAc,CAAA,EAAG,IAAA,CAAK,KAAK,CAAA,CAAA,EAAI,KAAK,QAAQ,CAAA,CAAA;AAClD,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA,CAAK,YAAA,CAAa,WAAW,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,GAAyC;AACvC,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,kBAAkB,CAAA;AAAA,KACjD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAmB;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,aAAa,GAAA,EAAqB;AACxC,IAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAE9B,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB,CAAA,MAAA,IAAW,OAAO,MAAA,KAAW,WAAA,EAAa;AAExC,MAAA,OAAO,OAAO,IAAA,CAAK,GAAA,EAAK,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AACF;AAKO,SAAS,mBAAmB,MAAA,EAA0C;AAC3E,EAAA,OAAO,IAAI,aAAa,MAAM,CAAA;AAChC;;;AC1DO,IAAM,UAAN,MAAsC;AAAA,EAC3B,IAAA,GAAiB,KAAA;AAAA,EAChB,KAAA;AAAA,EAEjB,YAAY,MAAA,EAAuB;AACjC,IAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,SAAA,CAAU,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,eAAA,CAAgB,gCAAA,EAAkC,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,IACjF;AAEA,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,IAAA,CAAK,KAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,GAAyC;AACvC,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA;AAAA,KACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAmB;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAKO,SAAS,cAAc,MAAA,EAAgC;AAC5D,EAAA,OAAO,IAAI,QAAQ,MAAM,CAAA;AAC3B;;;ACpCO,IAAM,YAAN,MAAwC;AAAA,EAC7B,IAAA,GAAiB,OAAA;AAAA,EAChB,kBAAA;AAAA,EAEjB,YAAY,MAAA,EAAyB;AACnC,IAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,SAAA,CAAU,MAAM,CAAA;AACrD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,eAAA,CAAgB,kCAAA,EAAoC,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,IACnF;AAEA,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAS,GAAI,MAAA,CAAO,IAAA;AACtC,IAAA,MAAM,WAAA,GAAc,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAC3C,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA,CAAK,YAAA,CAAa,WAAW,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,GAAyC;AACvC,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,kBAAkB,CAAA;AAAA,KACjD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAmB;AACjB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,aAAa,GAAA,EAAqB;AACxC,IAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAE9B,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB,CAAA,MAAA,IAAW,OAAO,MAAA,KAAW,WAAA,EAAa;AAExC,MAAA,OAAO,OAAO,IAAA,CAAK,GAAA,EAAK,OAAO,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,IAAI,MAAM,qCAAqC,CAAA;AAAA,EACvD;AACF;AAKO,SAAS,gBAAgB,MAAA,EAAoC;AAClE,EAAA,OAAO,IAAI,UAAU,MAAM,CAAA;AAC7B;;;AC7DA,IAAM,wBAAA,GAA2B,wCAAA;AAMjC,IAAM,sBAAA,GAAyB,IAAI,EAAA,GAAK,GAAA;AAmBjC,IAAM,aAAN,MAAyC;AAAA,EAC9B,IAAA,GAAiB,QAAA;AAAA,EAChB,QAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EAET,WAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMD,cAAA;AAAA,EAMP,YAAY,MAAA,EAA0B;AACpC,IAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,SAAA,CAAU,MAAM,CAAA;AACtD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,eAAA,CAAgB,mCAAA,EAAqC,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,IACpF;AAEA,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AACpB,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AACrB,IAAA,IAAA,CAAK,eAAe,IAAA,CAAK,YAAA;AACzB,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,aAAA,IAAiB,wBAAA;AAC3C,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AACxB,IAAA,IAAA,CAAK,eAAe,IAAA,CAAK,YAAA;AACzB,IAAA,IAAA,CAAK,YAAY,IAAA,CAAK,SAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAA,GAAkD;AAEtD,IAAA,IAAI,IAAA,CAAK,oBAAmB,EAAG;AAG7B,MAAA,IAAI,CAAC,KAAK,cAAA,EAAgB;AACxB,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,OAAA,EAAQ,CAAE,QAAQ,MAAM;AACjD,UAAA,IAAA,CAAK,cAAA,GAAiB,MAAA;AAAA,QACxB,CAAC,CAAA;AAAA,MACH;AACA,MAAA,MAAM,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,MAAM,IAAI,kBAAkB,2BAA2B,CAAA;AAAA,IACzD;AAEA,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,WAAW,CAAA;AAAA,KAC3C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GAAmB;AACjB,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,IAAI,KAAK,SAAA,IAAa,IAAA,CAAK,GAAA,EAAI,IAAK,KAAK,SAAA,EAAW;AAClD,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,GAAyB;AAC7B,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,MAAM,IAAI,kBAAkB,4BAA4B,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,eAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,eAAe,IAAA,CAAK;AAAA,KACrB,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,QAC/C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,IAAA,EAAM,KAAK,QAAA;AAAS,OACrB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,sBAAA,EAAyB,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA;AAAA,UAC/D,EAAE,cAAc,SAAA;AAAU,SAC5B;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAgB,MAAM,QAAA,CAAS,IAAA,EAAK;AAC1C,MAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,SAAA,CAAU,IAAI,CAAA;AAEvD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,QAAA,MAAM,IAAI,kBAAkB,oCAAA,EAAsC;AAAA,UAChE,gBAAA,EAAkB,OAAO,KAAA,CAAM;AAAA,SAChC,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,SAAS,MAAA,CAAO,IAAA;AACtB,MAAA,IAAA,CAAK,cAAc,MAAA,CAAO,YAAA;AAE1B,MAAA,IAAI,OAAO,aAAA,EAAe;AACxB,QAAA,IAAA,CAAK,eAAe,MAAA,CAAO,aAAA;AAAA,MAC7B;AAEA,MAAA,IAAI,OAAO,UAAA,EAAY;AACrB,QAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAAA,MACpD;AAGA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,MAAM,KAAK,cAAA,CAAe;AAAA,UACxB,aAAa,IAAA,CAAK,WAAA;AAAA,UAClB,cAAc,IAAA,CAAK,YAAA;AAAA,UACnB,WAAW,IAAA,CAAK;AAAA,SACjB,CAAA;AAAA,MACH;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,iBAAA,EAAmB;AACtC,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,MAAM,IAAI,iBAAA,CAAkB,yBAAA,EAA2B,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,IACzE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CAAe,OAAe,SAAA,EAA0B;AACtD,IAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,KAAA,EAAqB;AACnC,IAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA,EAKA,SAAA,GAIE;AACA,IAAA,OAAO;AAAA,MACL,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,cAAc,IAAA,CAAK,YAAA;AAAA,MACnB,WAAW,IAAA,CAAK;AAAA,KAClB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAA,GAA8B;AACpC,IAAA,IAAI,CAAC,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,MAAA,OAAO,KAAA;AAAA,IACT;AAGA,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,IAAK,IAAA,CAAK,SAAA,GAAY,sBAAA;AAAA,EACxC;AACF;AAKO,SAAS,iBAAiB,MAAA,EAAsC;AACrE,EAAA,OAAO,IAAI,WAAW,MAAM,CAAA;AAC9B","file":"index.cjs","sourcesContent":["import { z } from 'zod';\n\n/**\n * Authentication provider interface\n * All auth providers must implement this interface\n */\nexport interface AuthProvider {\n  /**\n   * Returns the authentication headers to be added to requests\n   */\n  getAuthHeaders(): Promise<Record<string, string>> | Record<string, string>;\n\n  /**\n   * Returns the auth type identifier\n   */\n  readonly type: AuthType;\n\n  /**\n   * Optional: Check if the auth is still valid\n   */\n  isValid?(): Promise<boolean> | boolean;\n\n  /**\n   * Optional: Refresh the authentication (for OAuth2)\n   */\n  refresh?(): Promise<void>;\n}\n\n/**\n * Auth type enum\n */\nexport type AuthType = 'api-token' | 'pat' | 'basic' | 'oauth2' | 'none';\n\n/**\n * API Token auth configuration schema\n */\nexport const ApiTokenAuthConfigSchema = z.object({\n  email: z.email({ error: 'Invalid email address' }),\n  apiToken: z.string().min(1, { error: 'API token is required' }),\n});\n\nexport type ApiTokenAuthConfig = z.infer<typeof ApiTokenAuthConfigSchema>;\n\n/**\n * Personal Access Token (PAT) auth configuration schema\n */\nexport const PatAuthConfigSchema = z.object({\n  token: z.string().min(1, 'Personal access token is required'),\n});\n\nexport type PatAuthConfig = z.infer<typeof PatAuthConfigSchema>;\n\n/**\n * Basic auth configuration schema\n */\nexport const BasicAuthConfigSchema = z.object({\n  username: z.string().min(1, 'Username is required'),\n  password: z.string().min(1, 'Password is required'),\n});\n\nexport type BasicAuthConfig = z.infer<typeof BasicAuthConfigSchema>;\n\n/**\n * OAuth2 auth configuration schema\n */\nexport const OAuth2AuthConfigSchema = z.object({\n  clientId: z.string().min(1, 'Client ID is required'),\n  clientSecret: z.string().min(1, 'Client secret is required'),\n  accessToken: z.string().optional(),\n  refreshToken: z.string().optional(),\n  tokenEndpoint: z.url().optional(),\n  scopes: z.array(z.string()).optional(),\n  expiresAt: z.number().int().optional(),\n});\n\nexport type OAuth2AuthConfig = z.infer<typeof OAuth2AuthConfigSchema>;\n\n/**\n * OAuth2 token response schema\n */\nexport const OAuth2TokenResponseSchema = z.object({\n  access_token: z.string(),\n  token_type: z.string(),\n  expires_in: z.number().int().optional(),\n  refresh_token: z.string().optional(),\n  scope: z.string().optional(),\n});\n\nexport type OAuth2TokenResponse = z.infer<typeof OAuth2TokenResponseSchema>;\n\n/**\n * Union of all auth configs\n */\nexport type AuthConfig =\n  | { type: 'api-token'; config: ApiTokenAuthConfig }\n  | { type: 'pat'; config: PatAuthConfig }\n  | { type: 'basic'; config: BasicAuthConfig }\n  | { type: 'oauth2'; config: OAuth2AuthConfig }\n  | { type: 'none' };\n","/**\n * Feature detection for host globals that TypeScript's DOM/Node lib types\n * declare as always present, but which are genuinely absent in some runtimes\n * this SDK supports (browsers, Workers, Deno, edge functions).\n *\n * Reading them through a widened view of `globalThis` keeps the runtime guard —\n * removing it would crash outside Node — while letting the type system see that\n * the check is meaningful, so it no longer reports the guard as an unnecessary\n * condition.\n */\ninterface RuntimeGlobals {\n  process?: { env?: Record<string, string | undefined> };\n  console?: { warn?: (...args: unknown[]) => void };\n  crypto?: { randomUUID?: () => string };\n}\n\nfunction runtime(): RuntimeGlobals {\n  return globalThis;\n}\n\n/**\n * Read `process.env`, or an empty object where `process` is unavailable.\n */\nexport function processEnv(): Record<string, string | undefined> {\n  return runtime().process?.env ?? {};\n}\n\n/**\n * Read a single environment variable, or `undefined` where unavailable.\n */\nexport function readEnvVar(name: string): string | undefined {\n  return processEnv()[name];\n}\n\n/**\n * Emit a warning through `console.warn` where one exists, otherwise do nothing.\n */\nexport function warn(message: string): void {\n  runtime().console?.warn?.(message);\n}\n\n/**\n * Generate a UUID using `crypto.randomUUID` where available, falling back to a\n * timestamp-and-random identifier. The fallback is not cryptographically\n * random and is only used for request correlation IDs.\n */\nexport function randomId(): string {\n  const uuid = runtime().crypto?.randomUUID?.();\n  if (uuid !== undefined) {\n    return uuid;\n  }\n  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 11)}`;\n}\n\n/**\n * V8-only API used to trim the constructor frame from error stacks. Absent on\n * SpiderMonkey and JavaScriptCore.\n */\ntype CaptureStackTrace = (target: object, constructor?: unknown) => void;\n\n/**\n * Trim the constructor frame from an error's stack where the engine supports\n * it; a no-op elsewhere.\n *\n * `constructor` is typed `unknown` rather than `Function` so the signature does\n * not widen to \"any callable\" for callers. V8 expects a constructor function\n * there, and every call site passes `this.constructor`.\n */\nexport function captureStackTrace(target: object, constructor?: unknown): void {\n  const capture = (Error as unknown as { captureStackTrace?: CaptureStackTrace }).captureStackTrace;\n  capture?.(target, constructor);\n}\n","import { captureStackTrace } from '../utils/runtime.js';\n/**\n * Base error class for all SDK errors.\n * Provides consistent error structure with error codes and cause chaining.\n */\nexport abstract class JiraSdkError extends Error {\n  /** Unique error code for programmatic handling */\n  abstract readonly code: string;\n\n  /** HTTP status code if applicable */\n  readonly statusCode?: number;\n\n  /** Original cause of the error */\n  readonly cause?: Error;\n\n  /** Additional context/metadata */\n  readonly context?: Record<string, unknown>;\n\n  constructor(\n    message: string,\n    options?: {\n      cause?: Error | undefined;\n      statusCode?: number | undefined;\n      context?: Record<string, unknown> | undefined;\n    }\n  ) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = this.constructor.name;\n\n    // Only assign properties when values are defined (for exactOptionalPropertyTypes)\n    if (options?.cause !== undefined) {\n      this.cause = options.cause;\n    }\n    if (options?.statusCode !== undefined) {\n      this.statusCode = options.statusCode;\n    }\n    if (options?.context !== undefined) {\n      this.context = options.context;\n    }\n\n    // Maintains proper stack trace for where our error was thrown (V8 only)\n    captureStackTrace(this, this.constructor);\n  }\n\n  /**\n   * Returns a JSON representation of the error\n   */\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      code: this.code,\n      message: this.message,\n      statusCode: this.statusCode,\n      context: this.context,\n      cause: this.cause?.message,\n      stack: this.stack,\n    };\n  }\n}\n","import type { z } from 'zod';\nimport { JiraSdkError } from './base.error.js';\n\n/**\n * Error thrown when authentication fails or is misconfigured.\n */\nexport class AuthError extends JiraSdkError {\n  readonly code: string = 'AUTH_ERROR';\n\n  constructor(message: string, context?: Record<string, unknown>) {\n    super(message, { statusCode: 401, ...(context !== undefined && { context }) });\n  }\n}\n\n/**\n * Error thrown when OAuth2 token refresh fails.\n */\nexport class TokenRefreshError extends AuthError {\n  override readonly code: string = 'TOKEN_REFRESH_ERROR';\n}\n\n/**\n * Error thrown when OAuth2 token is expired.\n */\nexport class TokenExpiredError extends AuthError {\n  override readonly code: string = 'TOKEN_EXPIRED_ERROR';\n\n  constructor(message = 'Access token has expired', context?: Record<string, unknown>) {\n    super(message, context);\n  }\n}\n\n/**\n * Error thrown when auth configuration is invalid.\n */\nexport class AuthConfigError extends AuthError {\n  override readonly code: string = 'AUTH_CONFIG_ERROR';\n  readonly validationErrors: z.core.$ZodIssue[] | undefined;\n\n  constructor(message: string, validationErrors?: z.core.$ZodIssue[]) {\n    super(message, validationErrors !== undefined ? { validationErrors } : undefined);\n    this.validationErrors = validationErrors;\n  }\n}\n","import {\n  type AuthProvider,\n  type AuthType,\n  type ApiTokenAuthConfig,\n  ApiTokenAuthConfigSchema,\n} from './types.js';\nimport { AuthConfigError } from '../errors/auth.error.js';\n\n/**\n * API Token authentication provider for Atlassian Cloud\n *\n * Uses email + API token authentication which creates a Basic auth header.\n * This is the recommended auth method for Atlassian Cloud APIs.\n *\n * @see https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/\n *\n * @example\n * ```typescript\n * const auth = new ApiTokenAuth({\n *   email: 'user@example.com',\n *   apiToken: 'your-api-token'\n * });\n * ```\n */\nexport class ApiTokenAuth implements AuthProvider {\n  public readonly type: AuthType = 'api-token';\n  private readonly email: string;\n  private readonly apiToken: string;\n  private readonly encodedCredentials: string;\n\n  constructor(config: ApiTokenAuthConfig) {\n    const result = ApiTokenAuthConfigSchema.safeParse(config);\n    if (!result.success) {\n      throw new AuthConfigError('Invalid API token auth configuration', result.error.issues);\n    }\n\n    this.email = result.data.email;\n    this.apiToken = result.data.apiToken;\n\n    // Pre-compute the base64 encoded credentials\n    // In browser, use btoa; in Node.js, use Buffer\n    const credentials = `${this.email}:${this.apiToken}`;\n    this.encodedCredentials = this.encodeBase64(credentials);\n  }\n\n  /**\n   * Returns the Authorization header with Basic auth\n   */\n  getAuthHeaders(): Record<string, string> {\n    return {\n      Authorization: `Basic ${this.encodedCredentials}`,\n    };\n  }\n\n  /**\n   * API token auth is always valid (no expiration)\n   */\n  isValid(): boolean {\n    return true;\n  }\n\n  /**\n   * Encode string to base64 (works in both browser and Node.js)\n   */\n  private encodeBase64(str: string): string {\n    if (typeof btoa === 'function') {\n      // Browser environment\n      return btoa(str);\n    } else if (typeof Buffer !== 'undefined') {\n      // Node.js environment\n      return Buffer.from(str, 'utf-8').toString('base64');\n    }\n    throw new Error('No base64 encoding method available');\n  }\n}\n\n/**\n * Factory function to create API Token auth provider\n */\nexport function createApiTokenAuth(config: ApiTokenAuthConfig): ApiTokenAuth {\n  return new ApiTokenAuth(config);\n}\n","import {\n  type AuthProvider,\n  type AuthType,\n  type PatAuthConfig,\n  PatAuthConfigSchema,\n} from './types.js';\nimport { AuthConfigError } from '../errors/auth.error.js';\n\n/**\n * Personal Access Token (PAT) authentication provider\n *\n * Uses Bearer token authentication with a PAT.\n * Supported by Jira Server/Data Center and some Cloud APIs.\n *\n * @see https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html\n *\n * @example\n * ```typescript\n * const auth = new PatAuth({\n *   token: 'your-personal-access-token'\n * });\n * ```\n */\nexport class PatAuth implements AuthProvider {\n  public readonly type: AuthType = 'pat';\n  private readonly token: string;\n\n  constructor(config: PatAuthConfig) {\n    const result = PatAuthConfigSchema.safeParse(config);\n    if (!result.success) {\n      throw new AuthConfigError('Invalid PAT auth configuration', result.error.issues);\n    }\n\n    this.token = result.data.token;\n  }\n\n  /**\n   * Returns the Authorization header with Bearer token\n   */\n  getAuthHeaders(): Record<string, string> {\n    return {\n      Authorization: `Bearer ${this.token}`,\n    };\n  }\n\n  /**\n   * PAT auth is always valid (no automatic expiration check)\n   */\n  isValid(): boolean {\n    return true;\n  }\n}\n\n/**\n * Factory function to create PAT auth provider\n */\nexport function createPatAuth(config: PatAuthConfig): PatAuth {\n  return new PatAuth(config);\n}\n","import {\n  type AuthProvider,\n  type AuthType,\n  type BasicAuthConfig,\n  BasicAuthConfigSchema,\n} from './types.js';\nimport { AuthConfigError } from '../errors/auth.error.js';\n\n/**\n * Basic authentication provider\n *\n * Uses HTTP Basic authentication with username and password.\n * Primarily used with Jira Server/Data Center instances.\n *\n * @example\n * ```typescript\n * const auth = new BasicAuth({\n *   username: 'admin',\n *   password: 'password123'\n * });\n * ```\n */\nexport class BasicAuth implements AuthProvider {\n  public readonly type: AuthType = 'basic';\n  private readonly encodedCredentials: string;\n\n  constructor(config: BasicAuthConfig) {\n    const result = BasicAuthConfigSchema.safeParse(config);\n    if (!result.success) {\n      throw new AuthConfigError('Invalid basic auth configuration', result.error.issues);\n    }\n\n    const { username, password } = result.data;\n    const credentials = `${username}:${password}`;\n    this.encodedCredentials = this.encodeBase64(credentials);\n  }\n\n  /**\n   * Returns the Authorization header with Basic auth\n   */\n  getAuthHeaders(): Record<string, string> {\n    return {\n      Authorization: `Basic ${this.encodedCredentials}`,\n    };\n  }\n\n  /**\n   * Basic auth is always valid (no expiration)\n   */\n  isValid(): boolean {\n    return true;\n  }\n\n  /**\n   * Encode string to base64 (works in both browser and Node.js)\n   */\n  private encodeBase64(str: string): string {\n    if (typeof btoa === 'function') {\n      // Browser environment\n      return btoa(str);\n    } else if (typeof Buffer !== 'undefined') {\n      // Node.js environment\n      return Buffer.from(str, 'utf-8').toString('base64');\n    }\n    throw new Error('No base64 encoding method available');\n  }\n}\n\n/**\n * Factory function to create Basic auth provider\n */\nexport function createBasicAuth(config: BasicAuthConfig): BasicAuth {\n  return new BasicAuth(config);\n}\n","import {\n  type AuthProvider,\n  type AuthType,\n  type OAuth2AuthConfig,\n  OAuth2AuthConfigSchema,\n  OAuth2TokenResponseSchema,\n} from './types.js';\nimport { AuthConfigError, TokenRefreshError, TokenExpiredError } from '../errors/auth.error.js';\n\n/**\n * Default token endpoint for Atlassian Cloud OAuth2\n */\nconst ATLASSIAN_TOKEN_ENDPOINT = 'https://auth.atlassian.com/oauth/token';\n\n/**\n * Buffer time (in ms) before token expiration to trigger refresh\n * Default: 5 minutes\n */\nconst TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;\n\n/**\n * OAuth2 authentication provider\n *\n * Supports OAuth 2.0 with automatic token refresh for Atlassian Cloud.\n *\n * @see https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/\n *\n * @example\n * ```typescript\n * const auth = new OAuth2Auth({\n *   clientId: 'your-client-id',\n *   clientSecret: 'your-client-secret',\n *   accessToken: 'current-access-token',\n *   refreshToken: 'refresh-token',\n * });\n * ```\n */\nexport class OAuth2Auth implements AuthProvider {\n  public readonly type: AuthType = 'oauth2';\n  private readonly clientId: string;\n  private readonly clientSecret: string;\n  private readonly tokenEndpoint: string;\n\n  private accessToken: string | undefined;\n  private refreshToken: string | undefined;\n  private expiresAt: number | undefined;\n\n  /**\n   * Promise for in-flight token refresh (prevents concurrent refreshes)\n   */\n  private refreshPromise: Promise<void> | undefined;\n\n  /**\n   * Callback invoked when tokens are refreshed\n   * Useful for persisting new tokens\n   */\n  public onTokenRefresh?: (tokens: {\n    accessToken: string;\n    refreshToken: string | undefined;\n    expiresAt: number | undefined;\n  }) => void | Promise<void>;\n\n  constructor(config: OAuth2AuthConfig) {\n    const result = OAuth2AuthConfigSchema.safeParse(config);\n    if (!result.success) {\n      throw new AuthConfigError('Invalid OAuth2 auth configuration', result.error.issues);\n    }\n\n    const data = result.data;\n    this.clientId = data.clientId;\n    this.clientSecret = data.clientSecret;\n    this.tokenEndpoint = data.tokenEndpoint ?? ATLASSIAN_TOKEN_ENDPOINT;\n    this.accessToken = data.accessToken;\n    this.refreshToken = data.refreshToken;\n    this.expiresAt = data.expiresAt;\n  }\n\n  /**\n   * Returns the Authorization header with Bearer token\n   * Uses a mutex to prevent concurrent token refreshes\n   */\n  async getAuthHeaders(): Promise<Record<string, string>> {\n    // Check if we need to refresh the token\n    if (this.shouldRefreshToken()) {\n      // Use existing refresh promise if one is in flight (prevents concurrent refreshes)\n      // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- ??= can't be used with side effects\n      if (!this.refreshPromise) {\n        this.refreshPromise = this.refresh().finally(() => {\n          this.refreshPromise = undefined;\n        });\n      }\n      await this.refreshPromise;\n    }\n\n    if (!this.accessToken) {\n      throw new TokenExpiredError('No access token available');\n    }\n\n    return {\n      Authorization: `Bearer ${this.accessToken}`,\n    };\n  }\n\n  /**\n   * Check if the current token is valid\n   */\n  isValid(): boolean {\n    if (!this.accessToken) {\n      return false;\n    }\n\n    if (this.expiresAt && Date.now() >= this.expiresAt) {\n      return false;\n    }\n\n    return true;\n  }\n\n  /**\n   * Refresh the access token using the refresh token\n   */\n  async refresh(): Promise<void> {\n    if (!this.refreshToken) {\n      throw new TokenRefreshError('No refresh token available');\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      client_id: this.clientId,\n      client_secret: this.clientSecret,\n      refresh_token: this.refreshToken,\n    });\n\n    try {\n      const response = await fetch(this.tokenEndpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: body.toString(),\n      });\n\n      if (!response.ok) {\n        const errorText = await response.text();\n        throw new TokenRefreshError(\n          `Token refresh failed: ${response.status} ${response.statusText}`,\n          { responseBody: errorText }\n        );\n      }\n\n      const data: unknown = await response.json();\n      const parsed = OAuth2TokenResponseSchema.safeParse(data);\n\n      if (!parsed.success) {\n        throw new TokenRefreshError('Invalid token response from server', {\n          validationErrors: parsed.error.issues,\n        });\n      }\n\n      const tokens = parsed.data;\n      this.accessToken = tokens.access_token;\n\n      if (tokens.refresh_token) {\n        this.refreshToken = tokens.refresh_token;\n      }\n\n      if (tokens.expires_in) {\n        this.expiresAt = Date.now() + tokens.expires_in * 1000;\n      }\n\n      // Invoke callback if provided\n      if (this.onTokenRefresh) {\n        await this.onTokenRefresh({\n          accessToken: this.accessToken,\n          refreshToken: this.refreshToken,\n          expiresAt: this.expiresAt,\n        });\n      }\n    } catch (error) {\n      if (error instanceof TokenRefreshError) {\n        throw error;\n      }\n      throw new TokenRefreshError('Failed to refresh token', { cause: error });\n    }\n  }\n\n  /**\n   * Set a new access token\n   */\n  setAccessToken(token: string, expiresIn?: number): void {\n    this.accessToken = token;\n    if (expiresIn) {\n      this.expiresAt = Date.now() + expiresIn * 1000;\n    }\n  }\n\n  /**\n   * Set a new refresh token\n   */\n  setRefreshToken(token: string): void {\n    this.refreshToken = token;\n  }\n\n  /**\n   * Get current tokens (for persistence)\n   */\n  getTokens(): {\n    accessToken: string | undefined;\n    refreshToken: string | undefined;\n    expiresAt: number | undefined;\n  } {\n    return {\n      accessToken: this.accessToken,\n      refreshToken: this.refreshToken,\n      expiresAt: this.expiresAt,\n    };\n  }\n\n  /**\n   * Check if we should proactively refresh the token\n   */\n  private shouldRefreshToken(): boolean {\n    if (!this.accessToken) {\n      return true;\n    }\n\n    if (!this.expiresAt) {\n      return false;\n    }\n\n    // Refresh if within buffer time of expiration\n    return Date.now() >= this.expiresAt - TOKEN_EXPIRY_BUFFER_MS;\n  }\n}\n\n/**\n * Factory function to create OAuth2 auth provider\n */\nexport function createOAuth2Auth(config: OAuth2AuthConfig): OAuth2Auth {\n  return new OAuth2Auth(config);\n}\n"]}

package/dist/auth/index.d.cts

@@ -0,0 +1,192 @@
+import { A as AuthProvider, d as AuthType, a as ApiTokenAuthConfig, P as PatAuthConfig, B as BasicAuthConfig, O as OAuth2AuthConfig } from '../types-E6djPHpW.cjs';
+export { b as ApiTokenAuthConfigSchema, c as AuthConfig, e as BasicAuthConfigSchema, f as OAuth2AuthConfigSchema, g as OAuth2TokenResponse, h as OAuth2TokenResponseSchema, i as PatAuthConfigSchema } from '../types-E6djPHpW.cjs';
+import 'zod';
+
+/**
+ * API Token authentication provider for Atlassian Cloud
+ *
+ * Uses email + API token authentication which creates a Basic auth header.
+ * This is the recommended auth method for Atlassian Cloud APIs.
+ *
+ * @see https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/
+ *
+ * @example
+ * ```typescript
+ * const auth = new ApiTokenAuth({
+ *   email: 'user@example.com',
+ *   apiToken: 'your-api-token'
+ * });
+ * ```
+ */
+declare class ApiTokenAuth implements AuthProvider {
+    readonly type: AuthType;
+    private readonly email;
+    private readonly apiToken;
+    private readonly encodedCredentials;
+    constructor(config: ApiTokenAuthConfig);
+    /**
+     * Returns the Authorization header with Basic auth
+     */
+    getAuthHeaders(): Record<string, string>;
+    /**
+     * API token auth is always valid (no expiration)
+     */
+    isValid(): boolean;
+    /**
+     * Encode string to base64 (works in both browser and Node.js)
+     */
+    private encodeBase64;
+}
+/**
+ * Factory function to create API Token auth provider
+ */
+declare function createApiTokenAuth(config: ApiTokenAuthConfig): ApiTokenAuth;
+
+/**
+ * Personal Access Token (PAT) authentication provider
+ *
+ * Uses Bearer token authentication with a PAT.
+ * Supported by Jira Server/Data Center and some Cloud APIs.
+ *
+ * @see https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html
+ *
+ * @example
+ * ```typescript
+ * const auth = new PatAuth({
+ *   token: 'your-personal-access-token'
+ * });
+ * ```
+ */
+declare class PatAuth implements AuthProvider {
+    readonly type: AuthType;
+    private readonly token;
+    constructor(config: PatAuthConfig);
+    /**
+     * Returns the Authorization header with Bearer token
+     */
+    getAuthHeaders(): Record<string, string>;
+    /**
+     * PAT auth is always valid (no automatic expiration check)
+     */
+    isValid(): boolean;
+}
+/**
+ * Factory function to create PAT auth provider
+ */
+declare function createPatAuth(config: PatAuthConfig): PatAuth;
+
+/**
+ * Basic authentication provider
+ *
+ * Uses HTTP Basic authentication with username and password.
+ * Primarily used with Jira Server/Data Center instances.
+ *
+ * @example
+ * ```typescript
+ * const auth = new BasicAuth({
+ *   username: 'admin',
+ *   password: 'password123'
+ * });
+ * ```
+ */
+declare class BasicAuth implements AuthProvider {
+    readonly type: AuthType;
+    private readonly encodedCredentials;
+    constructor(config: BasicAuthConfig);
+    /**
+     * Returns the Authorization header with Basic auth
+     */
+    getAuthHeaders(): Record<string, string>;
+    /**
+     * Basic auth is always valid (no expiration)
+     */
+    isValid(): boolean;
+    /**
+     * Encode string to base64 (works in both browser and Node.js)
+     */
+    private encodeBase64;
+}
+/**
+ * Factory function to create Basic auth provider
+ */
+declare function createBasicAuth(config: BasicAuthConfig): BasicAuth;
+
+/**
+ * OAuth2 authentication provider
+ *
+ * Supports OAuth 2.0 with automatic token refresh for Atlassian Cloud.
+ *
+ * @see https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/
+ *
+ * @example
+ * ```typescript
+ * const auth = new OAuth2Auth({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ *   accessToken: 'current-access-token',
+ *   refreshToken: 'refresh-token',
+ * });
+ * ```
+ */
+declare class OAuth2Auth implements AuthProvider {
+    readonly type: AuthType;
+    private readonly clientId;
+    private readonly clientSecret;
+    private readonly tokenEndpoint;
+    private accessToken;
+    private refreshToken;
+    private expiresAt;
+    /**
+     * Promise for in-flight token refresh (prevents concurrent refreshes)
+     */
+    private refreshPromise;
+    /**
+     * Callback invoked when tokens are refreshed
+     * Useful for persisting new tokens
+     */
+    onTokenRefresh?: (tokens: {
+        accessToken: string;
+        refreshToken: string | undefined;
+        expiresAt: number | undefined;
+    }) => void | Promise<void>;
+    constructor(config: OAuth2AuthConfig);
+    /**
+     * Returns the Authorization header with Bearer token
+     * Uses a mutex to prevent concurrent token refreshes
+     */
+    getAuthHeaders(): Promise<Record<string, string>>;
+    /**
+     * Check if the current token is valid
+     */
+    isValid(): boolean;
+    /**
+     * Refresh the access token using the refresh token
+     */
+    refresh(): Promise<void>;
+    /**
+     * Set a new access token
+     */
+    setAccessToken(token: string, expiresIn?: number): void;
+    /**
+     * Set a new refresh token
+     */
+    setRefreshToken(token: string): void;
+    /**
+     * Get current tokens (for persistence)
+     */
+    getTokens(): {
+        accessToken: string | undefined;
+        refreshToken: string | undefined;
+        expiresAt: number | undefined;
+    };
+    /**
+     * Check if we should proactively refresh the token
+     */
+    private shouldRefreshToken;
+}
+/**
+ * Factory function to create OAuth2 auth provider
+ */
+declare function createOAuth2Auth(config: OAuth2AuthConfig): OAuth2Auth;
+
+export { ApiTokenAuth, ApiTokenAuthConfig, AuthProvider, AuthType, BasicAuth, BasicAuthConfig, OAuth2Auth, OAuth2AuthConfig, PatAuth, PatAuthConfig, createApiTokenAuth, createBasicAuth, createOAuth2Auth, createPatAuth };