@knpkv/atlassian-common 0.2.0

package/dist/auth/OAuthEndpoints.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Atlassian OAuth2 endpoint URLs, scope constants, authorization URL builder, and PKCE.
+ *
+ * **Mental model**
+ *
+ * - **Constants + builder**: Endpoint URLs are plain strings; {@link buildAuthUrl}
+ *   assembles the full authorization URL with audience, scopes, CSRF state, and PKCE.
+ * - **Scope sets**: {@link CONFLUENCE_SCOPES} and {@link JIRA_SCOPES} define the
+ *   minimum permissions for each product's OAuth flow.
+ * - **PKCE**: {@link generateCodeVerifier} and {@link computeCodeChallenge} implement
+ *   RFC 7636 S256 to protect the authorization code grant from interception.
+ *
+ * @module
+ */
+import * as Effect from "effect/Effect";
+/**
+ * OAuth2 authorization endpoint.
+ *
+ * @category Endpoints
+ */
+export declare const AUTH_URL = "https://auth.atlassian.com/authorize";
+/**
+ * OAuth2 token endpoint.
+ *
+ * @category Endpoints
+ */
+export declare const TOKEN_URL = "https://auth.atlassian.com/oauth/token";
+/**
+ * OAuth2 token revocation endpoint.
+ *
+ * @category Endpoints
+ */
+export declare const REVOKE_URL = "https://auth.atlassian.com/oauth/revoke";
+/**
+ * Accessible resources endpoint (to get cloud IDs).
+ *
+ * @category Endpoints
+ */
+export declare const RESOURCES_URL = "https://api.atlassian.com/oauth/token/accessible-resources";
+/**
+ * User info endpoint.
+ *
+ * @category Endpoints
+ */
+export declare const ME_URL = "https://api.atlassian.com/me";
+/**
+ * Confluence scopes for OAuth2.
+ *
+ * @category Scopes
+ */
+export declare const CONFLUENCE_SCOPES: string[];
+/**
+ * Jira scopes for OAuth2.
+ *
+ * @category Scopes
+ */
+export declare const JIRA_SCOPES: string[];
+/**
+ * Options for building OAuth2 authorization URL.
+ *
+ * @category Types
+ */
+export interface BuildAuthUrlOptions {
+    /** OAuth2 client ID */
+    readonly clientId: string;
+    /** State parameter for CSRF protection */
+    readonly state: string;
+    /** Local callback server port */
+    readonly port: number;
+    /** OAuth2 scopes */
+    readonly scopes: ReadonlyArray<string>;
+    /** PKCE code_challenge (S256). Omit to skip PKCE. */
+    readonly codeChallenge?: string | undefined;
+}
+/**
+ * Build OAuth2 authorization URL.
+ *
+ * @category Utilities
+ */
+export declare const buildAuthUrl: (options: BuildAuthUrlOptions) => string;
+/**
+ * Generate a cryptographically random PKCE code verifier (RFC 7636).
+ * Uses Web Crypto API (available in Node 18+, Deno, browsers).
+ *
+ * @category PKCE
+ */
+export declare const generateCodeVerifier: () => string;
+/**
+ * Compute S256 code challenge from a code verifier (RFC 7636).
+ * Uses Web Crypto `subtle.digest` — returns Effect since digest is async.
+ *
+ * @category PKCE
+ */
+export declare const computeCodeChallenge: (verifier: string) => Effect.Effect<string>;
+//# sourceMappingURL=OAuthEndpoints.d.ts.map

package/dist/auth/OAuthEndpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthEndpoints.d.ts","sourceRoot":"","sources":["../../src/auth/OAuthEndpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC;;;;GAIG;AACH,eAAO,MAAM,QAAQ,yCAAyC,CAAA;AAE9D;;;;GAIG;AACH,eAAO,MAAM,SAAS,2CAA2C,CAAA;AAEjE;;;;GAIG;AACH,eAAO,MAAM,UAAU,4CAA4C,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,aAAa,+DAA+D,CAAA;AAEzF;;;;GAIG;AACH,eAAO,MAAM,MAAM,iCAAiC,CAAA;AAEpD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAM7B,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,UAQvB,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,uBAAuB;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oBAAoB;IACpB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,qDAAqD;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5C;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,mBAAmB,KAAG,MAe3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAIvC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAGzE,CAAA"}

package/dist/auth/OAuthEndpoints.js

@@ -0,0 +1,112 @@
+/**
+ * Atlassian OAuth2 endpoint URLs, scope constants, authorization URL builder, and PKCE.
+ *
+ * **Mental model**
+ *
+ * - **Constants + builder**: Endpoint URLs are plain strings; {@link buildAuthUrl}
+ *   assembles the full authorization URL with audience, scopes, CSRF state, and PKCE.
+ * - **Scope sets**: {@link CONFLUENCE_SCOPES} and {@link JIRA_SCOPES} define the
+ *   minimum permissions for each product's OAuth flow.
+ * - **PKCE**: {@link generateCodeVerifier} and {@link computeCodeChallenge} implement
+ *   RFC 7636 S256 to protect the authorization code grant from interception.
+ *
+ * @module
+ */
+import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+/**
+ * OAuth2 authorization endpoint.
+ *
+ * @category Endpoints
+ */
+export const AUTH_URL = "https://auth.atlassian.com/authorize";
+/**
+ * OAuth2 token endpoint.
+ *
+ * @category Endpoints
+ */
+export const TOKEN_URL = "https://auth.atlassian.com/oauth/token";
+/**
+ * OAuth2 token revocation endpoint.
+ *
+ * @category Endpoints
+ */
+export const REVOKE_URL = "https://auth.atlassian.com/oauth/revoke";
+/**
+ * Accessible resources endpoint (to get cloud IDs).
+ *
+ * @category Endpoints
+ */
+export const RESOURCES_URL = "https://api.atlassian.com/oauth/token/accessible-resources";
+/**
+ * User info endpoint.
+ *
+ * @category Endpoints
+ */
+export const ME_URL = "https://api.atlassian.com/me";
+/**
+ * Confluence scopes for OAuth2.
+ *
+ * @category Scopes
+ */
+export const CONFLUENCE_SCOPES = [
+    "read:page:confluence",
+    "write:page:confluence",
+    "delete:page:confluence",
+    "read:me",
+    "offline_access"
+];
+/**
+ * Jira scopes for OAuth2.
+ *
+ * @category Scopes
+ */
+export const JIRA_SCOPES = [
+    "read:jira-work",
+    "write:jira-work",
+    "read:jira-user",
+    "manage:jira-project",
+    "manage:jira-configuration",
+    "read:me",
+    "offline_access"
+];
+/**
+ * Build OAuth2 authorization URL.
+ *
+ * @category Utilities
+ */
+export const buildAuthUrl = (options) => {
+    const params = new URLSearchParams({
+        audience: "api.atlassian.com",
+        client_id: options.clientId,
+        scope: options.scopes.join(" "),
+        redirect_uri: `http://localhost:${options.port}/callback`,
+        state: options.state,
+        response_type: "code",
+        prompt: "consent"
+    });
+    if (options.codeChallenge) {
+        params.set("code_challenge", options.codeChallenge);
+        params.set("code_challenge_method", "S256");
+    }
+    return `${AUTH_URL}?${params.toString()}`;
+};
+/**
+ * Generate a cryptographically random PKCE code verifier (RFC 7636).
+ * Uses Web Crypto API (available in Node 18+, Deno, browsers).
+ *
+ * @category PKCE
+ */
+export const generateCodeVerifier = () => {
+    const bytes = new Uint8Array(32);
+    globalThis.crypto.getRandomValues(bytes);
+    return Encoding.encodeBase64Url(bytes);
+};
+/**
+ * Compute S256 code challenge from a code verifier (RFC 7636).
+ * Uses Web Crypto `subtle.digest` — returns Effect since digest is async.
+ *
+ * @category PKCE
+ */
+export const computeCodeChallenge = (verifier) => Effect.promise(() => globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))).pipe(Effect.map((hash) => Encoding.encodeBase64Url(new Uint8Array(hash))));
+//# sourceMappingURL=OAuthEndpoints.js.map

package/dist/auth/OAuthEndpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthEndpoints.js","sourceRoot":"","sources":["../../src/auth/OAuthEndpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,sCAAsC,CAAA;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,wCAAwC,CAAA;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,yCAAyC,CAAA;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,4DAA4D,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,8BAA8B,CAAA;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,SAAS;IACT,gBAAgB;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,2BAA2B;IAC3B,SAAS;IACT,gBAAgB;CACjB,CAAA;AAoBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAA4B,EAAU,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,QAAQ,EAAE,mBAAmB;QAC7B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/B,YAAY,EAAE,oBAAoB,OAAO,CAAC,IAAI,WAAW;QACzD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,MAAM;QACrB,MAAM,EAAE,SAAS;KAClB,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AAC3C,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAW,EAAE;IAC/C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAyB,EAAE,CAC9E,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CACvG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CACrE,CAAA"}

package/dist/auth/OAuthErrors.d.ts

@@ -0,0 +1,76 @@
+/**
+ * OAuth flow step for error context.
+ *
+ * @category Types
+ */
+export type OAuthStep = "configure" | "authorize" | "token" | "resources" | "user-info" | "refresh" | "revoke";
+declare const OAuthError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthError";
+} & Readonly<A>;
+/**
+ * Error during OAuth2 flow.
+ *
+ * @example
+ * ```typescript
+ * import { Effect } from "effect"
+ * import { OAuthError } from "@knpkv/atlassian-common/auth"
+ *
+ * Effect.gen(function* () {
+ *   // ... oauth operation
+ * }).pipe(
+ *   Effect.catchTag("OAuthError", (error) =>
+ *     Effect.sync(() => console.error(`OAuth error at ${error.step}: ${error.message}`))
+ *   )
+ * )
+ * ```
+ *
+ * @category Errors
+ */
+export declare class OAuthError extends OAuthError_base<{
+    readonly step: OAuthStep;
+    readonly cause?: unknown;
+}> {
+    get message(): string;
+}
+declare const AuthMissingError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AuthMissingError";
+} & Readonly<A>;
+/**
+ * Error when authentication is missing.
+ *
+ * @example
+ * ```typescript
+ * import { Effect } from "effect"
+ * import { AuthMissingError } from "@knpkv/atlassian-common/auth"
+ *
+ * Effect.gen(function* () {
+ *   // ... requires auth
+ * }).pipe(
+ *   Effect.catchTag("AuthMissingError", () =>
+ *     Effect.sync(() => console.error("Please login first"))
+ *   )
+ * )
+ * ```
+ *
+ * @category Errors
+ */
+export declare class AuthMissingError extends AuthMissingError_base<{
+    readonly tool?: string;
+}> {
+    get message(): string;
+}
+declare const OAuthNotConfiguredError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "OAuthNotConfiguredError";
+} & Readonly<A>;
+/**
+ * Error when OAuth is not configured.
+ *
+ * @category Errors
+ */
+export declare class OAuthNotConfiguredError extends OAuthNotConfiguredError_base<{
+    readonly tool?: string;
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=OAuthErrors.d.ts.map

package/dist/auth/OAuthErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthErrors.d.ts","sourceRoot":"","sources":["../../src/auth/OAuthErrors.ts"],"names":[],"mappings":"AAmBA;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;;;;AAE9G;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAG7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAG7B;CACF"}

package/dist/auth/OAuthErrors.js

@@ -0,0 +1,85 @@
+/**
+ * Tagged error types for Atlassian OAuth2 flows.
+ *
+ * **Mental model**
+ *
+ * - **Step-scoped errors**: {@link OAuthError} carries a `step` field (`"configure" | "authorize" |
+ *   "token" | "refresh" | "revoke"`) so callers can handle failures per-phase.
+ * - **Companion errors**: {@link AuthMissingError} (not logged in) and
+ *   {@link OAuthNotConfiguredError} (no client credentials) represent pre-flow failures.
+ *
+ * **Gotchas**
+ *
+ * - `OAuthError.message` is a computed getter derived from `step` + `cause` — it's not
+ *   a stored field, so don't destructure it from the constructor.
+ *
+ * @module
+ */
+import * as Data from "effect/Data";
+/**
+ * Error during OAuth2 flow.
+ *
+ * @example
+ * ```typescript
+ * import { Effect } from "effect"
+ * import { OAuthError } from "@knpkv/atlassian-common/auth"
+ *
+ * Effect.gen(function* () {
+ *   // ... oauth operation
+ * }).pipe(
+ *   Effect.catchTag("OAuthError", (error) =>
+ *     Effect.sync(() => console.error(`OAuth error at ${error.step}: ${error.message}`))
+ *   )
+ * )
+ * ```
+ *
+ * @category Errors
+ */
+export class OAuthError extends Data.TaggedError("OAuthError") {
+    get message() {
+        if (this.cause instanceof Error) {
+            return `OAuth ${this.step} failed: ${this.cause.message}`;
+        }
+        if (typeof this.cause === "string") {
+            return `OAuth ${this.step} failed: ${this.cause}`;
+        }
+        return `OAuth ${this.step} failed`;
+    }
+}
+/**
+ * Error when authentication is missing.
+ *
+ * @example
+ * ```typescript
+ * import { Effect } from "effect"
+ * import { AuthMissingError } from "@knpkv/atlassian-common/auth"
+ *
+ * Effect.gen(function* () {
+ *   // ... requires auth
+ * }).pipe(
+ *   Effect.catchTag("AuthMissingError", () =>
+ *     Effect.sync(() => console.error("Please login first"))
+ *   )
+ * )
+ * ```
+ *
+ * @category Errors
+ */
+export class AuthMissingError extends Data.TaggedError("AuthMissingError") {
+    get message() {
+        const toolPart = this.tool ? ` for ${this.tool}` : "";
+        return `Not logged in${toolPart}. Please run 'auth login' first.`;
+    }
+}
+/**
+ * Error when OAuth is not configured.
+ *
+ * @category Errors
+ */
+export class OAuthNotConfiguredError extends Data.TaggedError("OAuthNotConfiguredError") {
+    get message() {
+        const toolPart = this.tool ? `'${this.tool} auth configure'` : "'auth configure'";
+        return `OAuth not configured. Run ${toolPart} first.`;
+    }
+}
+//# sourceMappingURL=OAuthErrors.js.map

package/dist/auth/OAuthErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthErrors.js","sourceRoot":"","sources":["../../src/auth/OAuthErrors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AASnC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,UAAW,SAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAG3D;IACA,IAAa,OAAO;QAClB,IAAI,IAAI,CAAC,KAAK,YAAY,KAAK,EAAE,CAAC;YAChC,OAAO,SAAS,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QAC3D,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,SAAS,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,EAAE,CAAA;QACnD,CAAC;QACD,OAAO,SAAS,IAAI,CAAC,IAAI,SAAS,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAEvE;IACA,IAAa,OAAO;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACrD,OAAO,gBAAgB,QAAQ,kCAAkC,CAAA;IACnE,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAErF;IACA,IAAa,OAAO;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAA;QACjF,OAAO,6BAA6B,QAAQ,SAAS,CAAA;IACvD,CAAC;CACF"}

package/dist/auth/OAuthOperations.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Core OAuth2 operations against Atlassian's token and resource endpoints.
+ *
+ * **Mental model**
+ *
+ * - **Effect-native HTTP**: Every operation takes an `HttpClient` from the Effect
+ *   context and returns `Effect<A, OAuthError, HttpClient>`. Callers provide the
+ *   client via `Layer.succeed`.
+ * - **Schema-validated responses**: Token and user payloads are decoded through
+ *   Effect Schema before returning, catching API contract drift at runtime.
+ *
+ * **Common tasks**
+ *
+ * - Exchange auth code: {@link exchangeCodeForTokens}
+ * - List user sites: {@link getAccessibleResources}
+ * - Refresh expired token: {@link refreshToken}
+ * - Build storable token: {@link buildOAuthToken}
+ *
+ * @module
+ */
+import * as HttpClient from "@effect/platform/HttpClient";
+import * as Effect from "effect/Effect";
+import { type OAuthConfig, type OAuthToken } from "../config/OAuthSchemas.js";
+import { OAuthError } from "./OAuthErrors.js";
+import { type AccessibleResource, type TokenResponse, type UserInfo } from "./OAuthResponseSchemas.js";
+/**
+ * Options for exchanging an authorization code for tokens.
+ *
+ * @category Types
+ */
+export interface ExchangeCodeOptions {
+    /** Local callback server port (for redirect_uri) */
+    readonly port: number;
+    /** PKCE code verifier (if PKCE was used in auth request) */
+    readonly codeVerifier?: string | undefined;
+}
+/**
+ * Exchange authorization code for tokens.
+ *
+ * @category Operations
+ */
+export declare const exchangeCodeForTokens: (code: string, config: OAuthConfig, options: ExchangeCodeOptions) => Effect.Effect<TokenResponse, OAuthError, HttpClient.HttpClient>;
+/**
+ * Get accessible resources (sites) for the authenticated user.
+ *
+ * @param accessToken - OAuth access token
+ *
+ * @category Operations
+ */
+export declare const getAccessibleResources: (accessToken: string) => Effect.Effect<ReadonlyArray<AccessibleResource>, OAuthError, HttpClient.HttpClient>;
+/**
+ * Get user info from /me endpoint.
+ *
+ * @param accessToken - OAuth access token
+ *
+ * @category Operations
+ */
+export declare const getUserInfo: (accessToken: string) => Effect.Effect<UserInfo, OAuthError, HttpClient.HttpClient>;
+/**
+ * Refresh an expired OAuth token.
+ *
+ * @param token - Current OAuth token (with refresh_token)
+ * @param config - OAuth client configuration
+ *
+ * @category Operations
+ */
+export declare const refreshToken: (token: OAuthToken, config: OAuthConfig) => Effect.Effect<OAuthToken, OAuthError, HttpClient.HttpClient>;
+/**
+ * Revoke an OAuth token.
+ *
+ * @param token - OAuth token to revoke
+ * @param config - OAuth client configuration
+ *
+ * @category Operations
+ */
+export declare const revokeToken: (token: OAuthToken, config: OAuthConfig) => Effect.Effect<void, OAuthError, HttpClient.HttpClient>;
+/**
+ * Build OAuthToken from token response and site info.
+ *
+ * @param tokenResponse - Token response from exchange
+ * @param site - Selected accessible resource
+ * @param user - User info
+ *
+ * @category Utilities
+ */
+export declare const buildOAuthToken: (tokenResponse: TokenResponse, site: AccessibleResource, user: UserInfo) => OAuthToken;
+//# sourceMappingURL=OAuthOperations.d.ts.map

package/dist/auth/OAuthOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthOperations.d.ts","sourceRoot":"","sources":["../../src/auth/OAuthOperations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,UAAU,MAAM,6BAA6B,CAAA;AAEzD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,KAAK,kBAAkB,EAEvB,KAAK,aAAa,EAElB,KAAK,QAAQ,EAEd,MAAM,2BAA2B,CAAA;AAElC;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,QAAQ,WAAW,EACnB,SAAS,mBAAmB,KAC3B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CA+B9D,CAAA;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GACjC,aAAa,MAAM,KAClB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAuBlF,CAAA;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GACtB,aAAa,MAAM,KAClB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAuBzD,CAAA;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GACvB,OAAO,UAAU,EACjB,QAAQ,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAyC1D,CAAA;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,UAAU,EACjB,QAAQ,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAyBpD,CAAA;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAC1B,eAAe,aAAa,EAC5B,MAAM,kBAAkB,EACxB,MAAM,QAAQ,KACb,UAYD,CAAA"}

package/dist/auth/OAuthOperations.js

@@ -0,0 +1,169 @@
+/**
+ * Core OAuth2 operations against Atlassian's token and resource endpoints.
+ *
+ * **Mental model**
+ *
+ * - **Effect-native HTTP**: Every operation takes an `HttpClient` from the Effect
+ *   context and returns `Effect<A, OAuthError, HttpClient>`. Callers provide the
+ *   client via `Layer.succeed`.
+ * - **Schema-validated responses**: Token and user payloads are decoded through
+ *   Effect Schema before returning, catching API contract drift at runtime.
+ *
+ * **Common tasks**
+ *
+ * - Exchange auth code: {@link exchangeCodeForTokens}
+ * - List user sites: {@link getAccessibleResources}
+ * - Refresh expired token: {@link refreshToken}
+ * - Build storable token: {@link buildOAuthToken}
+ *
+ * @module
+ */
+import * as HttpClient from "@effect/platform/HttpClient";
+import * as HttpClientRequest from "@effect/platform/HttpClientRequest";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import {} from "../config/OAuthSchemas.js";
+import { ME_URL, RESOURCES_URL, REVOKE_URL, TOKEN_URL } from "./OAuthEndpoints.js";
+import { OAuthError } from "./OAuthErrors.js";
+import { AccessibleResourceSchema, TokenResponseSchema, UserInfoSchema } from "./OAuthResponseSchemas.js";
+/**
+ * Exchange authorization code for tokens.
+ *
+ * @category Operations
+ */
+export const exchangeCodeForTokens = (code, config, options) => Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const tokenBody = {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        code,
+        redirect_uri: `http://localhost:${options.port}/callback`
+    };
+    if (options.codeVerifier)
+        tokenBody.code_verifier = options.codeVerifier;
+    const request = yield* HttpClientRequest.post(TOKEN_URL).pipe(HttpClientRequest.setHeader("Content-Type", "application/json"), HttpClientRequest.bodyJson(tokenBody));
+    const response = yield* httpClient.execute(request);
+    if (response.status >= 400) {
+        const text = yield* response.text;
+        yield* Effect.logDebug(`Token exchange failed (${response.status}): ${text}`);
+        return yield* Effect.fail(new OAuthError({ step: "token", cause: `HTTP ${response.status}` }));
+    }
+    const body = yield* response.json;
+    return yield* Schema.decodeUnknown(TokenResponseSchema)(body);
+}).pipe(Effect.mapError((cause) => new OAuthError({ step: "token", cause })));
+/**
+ * Get accessible resources (sites) for the authenticated user.
+ *
+ * @param accessToken - OAuth access token
+ *
+ * @category Operations
+ */
+export const getAccessibleResources = (accessToken) => Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.get(RESOURCES_URL).pipe(HttpClientRequest.setHeader("Authorization", `Bearer ${accessToken}`), HttpClientRequest.setHeader("Accept", "application/json"));
+    const response = yield* httpClient.execute(request);
+    if (response.status >= 400) {
+        const text = yield* response.text;
+        yield* Effect.logDebug(`Accessible resources failed (${response.status}): ${text}`);
+        return yield* Effect.fail(new OAuthError({ step: "resources", cause: `HTTP ${response.status}` }));
+    }
+    const body = yield* response.json;
+    return yield* Schema.decodeUnknown(Schema.Array(AccessibleResourceSchema))(body);
+}).pipe(Effect.mapError((cause) => new OAuthError({ step: "resources", cause })));
+/**
+ * Get user info from /me endpoint.
+ *
+ * @param accessToken - OAuth access token
+ *
+ * @category Operations
+ */
+export const getUserInfo = (accessToken) => Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.get(ME_URL).pipe(HttpClientRequest.setHeader("Authorization", `Bearer ${accessToken}`), HttpClientRequest.setHeader("Accept", "application/json"));
+    const response = yield* httpClient.execute(request);
+    if (response.status >= 400) {
+        const text = yield* response.text;
+        yield* Effect.logDebug(`User info failed (${response.status}): ${text}`);
+        return yield* Effect.fail(new OAuthError({ step: "user-info", cause: `HTTP ${response.status}` }));
+    }
+    const body = yield* response.json;
+    return yield* Schema.decodeUnknown(UserInfoSchema)(body);
+}).pipe(Effect.mapError((cause) => new OAuthError({ step: "user-info", cause })));
+/**
+ * Refresh an expired OAuth token.
+ *
+ * @param token - Current OAuth token (with refresh_token)
+ * @param config - OAuth client configuration
+ *
+ * @category Operations
+ */
+export const refreshToken = (token, config) => Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const request = yield* HttpClientRequest.post(TOKEN_URL).pipe(HttpClientRequest.setHeader("Content-Type", "application/json"), HttpClientRequest.bodyJson({
+        grant_type: "refresh_token",
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        refresh_token: token.refresh_token
+    }), Effect.mapError((cause) => new OAuthError({ step: "refresh", cause })));
+    const response = yield* httpClient.execute(request).pipe(Effect.mapError((cause) => new OAuthError({ step: "refresh", cause })));
+    if (response.status >= 400) {
+        const text = yield* response.text.pipe(Effect.mapError((cause) => new OAuthError({ step: "refresh", cause })));
+        return yield* Effect.fail(new OAuthError({ step: "refresh", cause: `HTTP ${response.status}: ${text}` }));
+    }
+    const body = yield* response.json.pipe(Effect.mapError((cause) => new OAuthError({ step: "refresh", cause })));
+    const tokenResponse = yield* Schema.decodeUnknown(TokenResponseSchema)(body).pipe(Effect.mapError((cause) => new OAuthError({ step: "refresh", cause })));
+    return {
+        ...token,
+        access_token: tokenResponse.access_token,
+        refresh_token: tokenResponse.refresh_token,
+        expires_at: Date.now() + tokenResponse.expires_in * 1000,
+        scope: tokenResponse.scope
+    };
+});
+/**
+ * Revoke an OAuth token.
+ *
+ * @param token - OAuth token to revoke
+ * @param config - OAuth client configuration
+ *
+ * @category Operations
+ */
+export const revokeToken = (token, config) => Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const request = yield* HttpClientRequest.post(REVOKE_URL).pipe(HttpClientRequest.setHeader("Content-Type", "application/json"), HttpClientRequest.bodyJson({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        token: token.refresh_token
+    }), Effect.mapError((cause) => new OAuthError({ step: "revoke", cause })));
+    const response = yield* httpClient.execute(request).pipe(Effect.mapError((cause) => new OAuthError({ step: "revoke", cause })));
+    if (response.status >= 400) {
+        return yield* Effect.fail(new OAuthError({
+            step: "revoke",
+            cause: `Token revocation failed with status ${response.status}`
+        }));
+    }
+});
+/**
+ * Build OAuthToken from token response and site info.
+ *
+ * @param tokenResponse - Token response from exchange
+ * @param site - Selected accessible resource
+ * @param user - User info
+ *
+ * @category Utilities
+ */
+export const buildOAuthToken = (tokenResponse, site, user) => ({
+    access_token: tokenResponse.access_token,
+    refresh_token: tokenResponse.refresh_token,
+    expires_at: Date.now() + tokenResponse.expires_in * 1000,
+    scope: tokenResponse.scope,
+    cloud_id: site.id,
+    site_url: site.url,
+    user: {
+        account_id: user.account_id,
+        name: user.name,
+        email: user.email
+    }
+});
+//# sourceMappingURL=OAuthOperations.js.map

package/dist/auth/OAuthOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthOperations.js","sourceRoot":"","sources":["../../src/auth/OAuthOperations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,UAAU,MAAM,6BAA6B,CAAA;AACzD,OAAO,KAAK,iBAAiB,MAAM,oCAAoC,CAAA;AACvE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAqC,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAEL,wBAAwB,EAExB,mBAAmB,EAEnB,cAAc,EACf,MAAM,2BAA2B,CAAA;AAclC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,MAAmB,EACnB,OAA4B,EACqC,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,SAAS,GAA2B;QACxC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI;QACJ,YAAY,EAAE,oBAAoB,OAAO,CAAC,IAAI,WAAW;KAC1D,CAAA;IACD,IAAI,OAAO,CAAC,YAAY;QAAE,SAAS,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAA;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3D,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,EAC/D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CACtC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEnD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;QACjC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QAC7E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CACpE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;IAEjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAA;AAC/D,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CACrE,CAAA;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,WAAmB,EACkE,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CACvD,iBAAiB,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,EACrE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAC1D,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEnD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;QACjC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACnF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CACxE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;IAEjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAClF,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CACzE,CAAA;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,WAAmB,EACyC,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAChD,iBAAiB,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,EACrE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAC1D,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAEnD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;QACjC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAA;QACxE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CACxE,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;IAEjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAA;AAC1D,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CACzE,CAAA;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAiB,EACjB,MAAmB,EAC2C,EAAE,CAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3D,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,EAC/D,iBAAiB,CAAC,QAAQ,CAAC;QACzB,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE,CAAA;IAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CACpC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE,CAAA;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CACvE,CAAA;IAED,OAAO;QACL,GAAG,KAAK;QACR,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI;QACxD,KAAK,EAAE,aAAa,CAAC,KAAK;KAC3B,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAAiB,EACjB,MAAmB,EACqC,EAAE,CAC1D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAC5D,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,EAC/D,iBAAiB,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,KAAK,EAAE,KAAK,CAAC,aAAa;KAC3B,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CACtE,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CACtE,CAAA;IAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,uCAAuC,QAAQ,CAAC,MAAM,EAAE;SAChE,CAAC,CACH,CAAA;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,aAA4B,EAC5B,IAAwB,EACxB,IAAc,EACF,EAAE,CAAC,CAAC;IAChB,YAAY,EAAE,aAAa,CAAC,YAAY;IACxC,aAAa,EAAE,aAAa,CAAC,aAAa;IAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI;IACxD,KAAK,EAAE,aAAa,CAAC,KAAK;IAC1B,QAAQ,EAAE,IAAI,CAAC,EAAE;IACjB,QAAQ,EAAE,IAAI,CAAC,GAAG;IAClB,IAAI,EAAE;QACJ,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB;CACF,CAAC,CAAA"}