@molecule/api-wearable-oura 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/browser-guard.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-guard.d.ts.map

package/dist/browser-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.d.ts","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAA"}

package/dist/browser-guard.js

@@ -0,0 +1,19 @@
+/**
+ * Browser guard — `@molecule/api-wearable-oura` is SERVER-ONLY.
+ *
+ * Generated by scripts/gen-browser-guards.mjs (workspace root) — edit THAT, not this.
+ * Evaluating a server package in a browser bundle is always an import-graph mistake
+ * (node APIs, secrets); without this guard it surfaces as a cryptic downstream crash
+ * ("Buffer is not defined") far from the culprit. Throwing here names the package and
+ * the fix at the exact moment the client bundle evaluates it. jsdom tests and SSR are
+ * unaffected: the throw requires browser globals AND the absence of a node runtime.
+ */
+const g = globalThis;
+if (g.window !== undefined && g.document !== undefined && !g.process?.versions?.node) {
+    throw new Error('@molecule/api-wearable-oura is SERVER-ONLY: it was bundled into browser/client code. Import it only ' +
+        'from server code (a server route/function or your API), or dynamic-import it inside ' +
+        'the server handler — never from components or shared client modules, and never ' +
+        'polyfill Buffer/process to silence this.');
+}
+export {};
+//# sourceMappingURL=browser-guard.js.map

package/dist/browser-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.js","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,GAAG,UAIT,CAAA;AACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,IAAI,KAAK,CACb,sGAAsG;QACpG,sFAAsF;QACtF,iFAAiF;QACjF,0CAA0C,CAC7C,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Oura Cloud API v2 bond for `@molecule/api-wearable`.
+ *
+ * Implements daily activity, sleep, and heart-rate ingestion against the
+ * Oura Cloud API v2 using OAuth 2.0 with refresh-token rotation. Wires
+ * under the `wearable` named-multi-provider category as `'oura'`.
+ *
+ * Oura does not track body weight, so {@link createProvider} returns
+ * `[]` from `getWeight()` — pair Oura with another wearable bond
+ * (e.g. `@molecule/api-wearable-fitbit` or `-withings`) when weight
+ * data is required.
+ *
+ * @example
+ * ```typescript
+ * import { setProvider } from '@molecule/api-wearable'
+ * import { createProvider, PROVIDER_NAME } from '@molecule/api-wearable-oura'
+ *
+ * const oura = createProvider({
+ *   redirectUri: 'https://app.example.com/auth/oura/callback',
+ *   credentialsStore: myCredentialsStore,
+ * })
+ *
+ * setProvider(PROVIDER_NAME, oura)
+ * ```
+ *
+ * @module
+ */
+export * from './browser-guard.js';
+export * from './provider.js';
+export * from './secrets.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,32 @@
+/**
+ * Oura Cloud API v2 bond for `@molecule/api-wearable`.
+ *
+ * Implements daily activity, sleep, and heart-rate ingestion against the
+ * Oura Cloud API v2 using OAuth 2.0 with refresh-token rotation. Wires
+ * under the `wearable` named-multi-provider category as `'oura'`.
+ *
+ * Oura does not track body weight, so {@link createProvider} returns
+ * `[]` from `getWeight()` — pair Oura with another wearable bond
+ * (e.g. `@molecule/api-wearable-fitbit` or `-withings`) when weight
+ * data is required.
+ *
+ * @example
+ * ```typescript
+ * import { setProvider } from '@molecule/api-wearable'
+ * import { createProvider, PROVIDER_NAME } from '@molecule/api-wearable-oura'
+ *
+ * const oura = createProvider({
+ *   redirectUri: 'https://app.example.com/auth/oura/callback',
+ *   credentialsStore: myCredentialsStore,
+ * })
+ *
+ * setProvider(PROVIDER_NAME, oura)
+ * ```
+ *
+ * @module
+ */
+export * from './browser-guard.js';
+export * from './provider.js';
+export * from './secrets.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/dist/provider.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Oura Cloud API v2 provider implementation.
+ *
+ * Wraps the Oura Cloud API v2 behind the
+ * {@link import('@molecule/api-wearable').WearableProvider} contract.
+ * Each call accepts a host-app `userId`, looks up the persisted
+ * {@link import('@molecule/api-wearable').UserConnection} via the bond's
+ * {@link import('@molecule/api-wearable').WearableCredentialsStore}, and
+ * transparently refreshes the access token on `401` (or proactively when
+ * `expiresAt` is in the past). Refreshed tokens are written back to the
+ * store before any operation returns.
+ *
+ * Security invariants (enforced by tests):
+ *   - Access tokens, refresh tokens, `Authorization` / `Basic` headers,
+ *     and OAuth `error_description` payloads are NEVER thrown, logged,
+ *     or surfaced in error messages.
+ *   - `disconnect` always removes the local record, even if the upstream
+ *     revoke call fails — leaving a record around is worse than a
+ *     stranded provider-side token.
+ *   - `getWeight` returns `[]` — Oura does not track body weight. The
+ *     bond preserves the `WearableProvider` contract by returning an
+ *     empty array rather than a non-deterministic error.
+ *
+ * @module
+ */
+import './secrets.js';
+import type { DailyActivity, HeartRateSummary, SleepSession, SleepStage, SleepStageSegment, WearableDate } from '@molecule/api-wearable';
+import type { OuraProvider, OuraProviderOptions } from './types.js';
+/** Stable provider key used in the credentials store and bond name. */
+export declare const PROVIDER_NAME = "oura";
+interface OuraDailyActivityEntry {
+    day: string;
+    steps?: number;
+    equivalent_walking_distance?: number;
+    total_calories?: number;
+    active_calories?: number;
+    high_activity_time?: number;
+    medium_activity_time?: number;
+    low_activity_time?: number;
+    inactivity_alerts?: number;
+    resting_time?: number;
+    meters_to_target?: number;
+}
+interface OuraSleepEntry {
+    id: string;
+    day: string;
+    bedtime_start: string;
+    bedtime_end: string;
+    /** Sleep type — `long_sleep` is the user's main nightly sleep. */
+    type?: string;
+    total_sleep_duration?: number;
+    time_in_bed?: number;
+    awake_time?: number;
+    light_sleep_duration?: number;
+    deep_sleep_duration?: number;
+    rem_sleep_duration?: number;
+    restless_periods?: number;
+    efficiency?: number;
+    /**
+     * Hypnogram string: each character is one 5-minute segment, with
+     * `1=deep`, `2=light`, `3=rem`, `4=awake`.
+     */
+    sleep_phase_5_min?: string;
+}
+interface OuraSleepResponse {
+    data?: OuraSleepEntry[];
+}
+interface OuraHeartRateSample {
+    bpm: number;
+    source?: string;
+    timestamp: string;
+}
+interface OuraHeartRateResponse {
+    data?: OuraHeartRateSample[];
+}
+/**
+ * Base64url-encodes the bytes (RFC 4648 §5 with `=` padding stripped).
+ *
+ * @param bytes - The bytes to encode.
+ * @returns A base64url string.
+ */
+export declare const base64UrlEncode: (bytes: Uint8Array) => string;
+/**
+ * Translates an Oura `usercollection/daily_activity` entry into the
+ * normalized {@link DailyActivity} shape. Missing fields are
+ * zero-defaulted so handlers can sum across days without null guards.
+ *
+ * @param date - The calendar day requested.
+ * @param entry - Oura's daily-activity response entry, or `undefined`.
+ * @returns A normalized daily activity record.
+ */
+export declare const fromOuraActivity: (date: WearableDate, entry: OuraDailyActivityEntry | undefined) => DailyActivity;
+/**
+ * Maps an Oura `sleep_phase_5_min` digit onto our normalized
+ * {@link SleepStage} taxonomy. Oura uses `1=deep`, `2=light`, `3=rem`,
+ * `4=awake`; anything else falls through to `unknown`.
+ *
+ * @param digit - The single hypnogram character.
+ * @returns A normalized sleep stage.
+ */
+export declare const mapSleepPhaseDigit: (digit: string) => SleepStage;
+/**
+ * Decodes Oura's `sleep_phase_5_min` hypnogram into a list of contiguous
+ * {@link SleepStageSegment} records anchored at `bedtimeStart`.
+ *
+ * Each character represents a 5-minute window. Adjacent same-stage
+ * windows are coalesced into a single segment so consumers don't have
+ * to do the bookkeeping.
+ *
+ * @param hypnogram - The Oura hypnogram string.
+ * @param bedtimeStart - ISO 8601 timestamp anchoring segment 0.
+ * @returns Decoded sleep segments, or `undefined` when no hypnogram exists.
+ */
+export declare const decodeOuraHypnogram: (hypnogram: string | undefined, bedtimeStart: string) => SleepStageSegment[] | undefined;
+/**
+ * Translates an Oura `usercollection/sleep` payload into a list of
+ * normalized {@link SleepSession} records ordered by start ascending.
+ *
+ * Oura's `type === 'long_sleep'` corresponds to the user's main nightly
+ * sleep — the bond marks any matching session as `isMainSleep: true`,
+ * with naps and short sessions as `false`.
+ *
+ * @param date - Calendar day requested.
+ * @param raw - Oura's sleep response payload.
+ * @returns Normalized sleep sessions.
+ */
+export declare const fromOuraSleep: (date: WearableDate, raw: OuraSleepResponse) => SleepSession[];
+/**
+ * Aggregates an Oura `usercollection/heartrate` payload into the
+ * normalized {@link HeartRateSummary} shape.
+ *
+ * Oura returns per-sample BPM readings rather than a daily resting-HR
+ * value or zone breakdown; the bond derives a coarse resting-HR estimate
+ * from the minimum sample of the day. Zone data is not reported by this
+ * endpoint, so `zones` is left undefined.
+ *
+ * @param date - Calendar day the response was requested for.
+ * @param raw - Oura's heart-rate response payload.
+ * @returns A normalized heart-rate summary.
+ */
+export declare const fromOuraHeartRate: (date: WearableDate, raw: OuraHeartRateResponse) => HeartRateSummary;
+/**
+ * Creates an Oura wearable provider.
+ *
+ * @param options - Required: `redirectUri` + `credentialsStore`. Falls
+ *   back to `OAUTH_OURA_CLIENT_ID` / `OAUTH_OURA_CLIENT_SECRET` env
+ *   vars when `clientId` / `clientSecret` are omitted.
+ * @returns An Oura-flavored {@link OuraProvider}.
+ */
+export declare const createProvider: (options: OuraProviderOptions) => OuraProvider;
+export {};
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,OAAO,cAAc,CAAA;AAKrB,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,iBAAiB,EAIjB,YAAY,EAGb,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAsB,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEvF,uEAAuE;AACvE,eAAO,MAAM,aAAa,SAAS,CAAA;AA0BnC,UAAU,sBAAsB;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAMD,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,UAAU,iBAAiB;IACzB,IAAI,CAAC,EAAE,cAAc,EAAE,CAAA;CACxB;AAED,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,UAAU,qBAAqB;IAC7B,IAAI,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC7B;AAwCD;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,UAAU,KAAG,MAMnD,CAAA;AAcD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAM,YAAY,EAClB,OAAO,sBAAsB,GAAG,SAAS,KACxC,aAoBF,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,UAalD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC9B,WAAW,MAAM,GAAG,SAAS,EAC7B,cAAc,MAAM,KACnB,iBAAiB,EAAE,GAAG,SAyBxB,CAAA;AAqBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,YAAY,EAAE,KAAK,iBAAiB,KAAG,YAAY,EAsBtF,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,YAAY,EAClB,KAAK,qBAAqB,KACzB,gBAcF,CAAA;AAMD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,mBAAmB,KAAG,YAqU7D,CAAA"}

package/dist/provider.js

@@ -0,0 +1,556 @@
+/**
+ * Oura Cloud API v2 provider implementation.
+ *
+ * Wraps the Oura Cloud API v2 behind the
+ * {@link import('@molecule/api-wearable').WearableProvider} contract.
+ * Each call accepts a host-app `userId`, looks up the persisted
+ * {@link import('@molecule/api-wearable').UserConnection} via the bond's
+ * {@link import('@molecule/api-wearable').WearableCredentialsStore}, and
+ * transparently refreshes the access token on `401` (or proactively when
+ * `expiresAt` is in the past). Refreshed tokens are written back to the
+ * store before any operation returns.
+ *
+ * Security invariants (enforced by tests):
+ *   - Access tokens, refresh tokens, `Authorization` / `Basic` headers,
+ *     and OAuth `error_description` payloads are NEVER thrown, logged,
+ *     or surfaced in error messages.
+ *   - `disconnect` always removes the local record, even if the upstream
+ *     revoke call fails — leaving a record around is worse than a
+ *     stranded provider-side token.
+ *   - `getWeight` returns `[]` — Oura does not track body weight. The
+ *     bond preserves the `WearableProvider` contract by returning an
+ *     empty array rather than a non-deterministic error.
+ *
+ * @module
+ */
+import { randomBytes as nodeRandomBytes } from 'node:crypto';
+// Side-effect import: registers this bond's secret definitions so the
+// runtime registry is populated even when provider.js is imported directly
+// (not through the package barrel).
+import './secrets.js';
+import { getLogger } from '@molecule/api-bond';
+import { get, post } from '@molecule/api-http';
+/** Stable provider key used in the credentials store and bond name. */
+export const PROVIDER_NAME = 'oura';
+const DEFAULT_API_BASE_URL = 'https://api.ouraring.com/v2';
+const DEFAULT_AUTHORIZE_URL = 'https://cloud.ouraring.com/oauth/authorize';
+const DEFAULT_TOKEN_URL = 'https://api.ouraring.com/oauth/token';
+const DEFAULT_REVOKE_URL = 'https://api.ouraring.com/oauth/revoke';
+const DEFAULT_TIMEOUT_MS = 15_000;
+const DEFAULT_SCOPES = ['daily', 'heartrate', 'personal', 'session'];
+// Oura's `sleep_phase_5_min` hypnogram uses 5-minute segments per
+// character. RFC link: https://cloud.ouraring.com/v2/docs#operation/sleep_route_v2
+const SLEEP_PHASE_SEGMENT_SECONDS = 300;
+/* -------------------------------------------------------------------------- *
+ * Error sanitization.
+ * -------------------------------------------------------------------------- */
+/**
+ * Sanitizes anything thrown by `@molecule/api-http` (or downstream
+ * fetch errors) into a token-free Error. The original error's `message`
+ * may contain `Authorization: Bearer …` headers or echoed
+ * `error_description` strings that include the access/refresh token.
+ *
+ * @param scope - Short label of the calling operation (e.g. `"connect"`).
+ * @param error - The original error.
+ * @returns A new Error safe to throw and log.
+ */
+const sanitizeError = (scope, error) => {
+    const httpError = error;
+    const status = httpError?.response?.status;
+    const code = httpError?.code;
+    const parts = [`Oura ${scope} failed`];
+    if (status !== undefined)
+        parts.push(`status=${status}`);
+    if (code)
+        parts.push(`code=${code}`);
+    return new Error(parts.join(' '));
+};
+/**
+ * Whether an HTTP error indicates an expired/invalid access token.
+ *
+ * @param error - The original error.
+ * @returns True when the response status is 401.
+ */
+const isUnauthorized = (error) => {
+    return error?.response?.status === 401;
+};
+/* -------------------------------------------------------------------------- *
+ * Encoding helpers.
+ * -------------------------------------------------------------------------- */
+/**
+ * Base64url-encodes the bytes (RFC 4648 §5 with `=` padding stripped).
+ *
+ * @param bytes - The bytes to encode.
+ * @returns A base64url string.
+ */
+export const base64UrlEncode = (bytes) => {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+};
+/* -------------------------------------------------------------------------- *
+ * Normalization helpers.
+ * -------------------------------------------------------------------------- */
+const totalActiveMinutes = (entry) => {
+    // Oura returns activity-time fields in seconds.
+    const high = entry.high_activity_time ?? 0;
+    const medium = entry.medium_activity_time ?? 0;
+    const low = entry.low_activity_time ?? 0;
+    return Math.round((high + medium + low) / 60);
+};
+/**
+ * Translates an Oura `usercollection/daily_activity` entry into the
+ * normalized {@link DailyActivity} shape. Missing fields are
+ * zero-defaulted so handlers can sum across days without null guards.
+ *
+ * @param date - The calendar day requested.
+ * @param entry - Oura's daily-activity response entry, or `undefined`.
+ * @returns A normalized daily activity record.
+ */
+export const fromOuraActivity = (date, entry) => {
+    if (!entry) {
+        return {
+            date,
+            steps: 0,
+            distanceMeters: 0,
+            caloriesOut: 0,
+            activeMinutes: 0,
+        };
+    }
+    return {
+        date: entry.day || date,
+        steps: entry.steps ?? 0,
+        // `equivalent_walking_distance` is reported in meters.
+        distanceMeters: entry.equivalent_walking_distance ?? 0,
+        // `total_calories` is the most-comparable Fitbit `caloriesOut` analog
+        // (active + BMR equivalent).
+        caloriesOut: entry.total_calories ?? 0,
+        activeMinutes: totalActiveMinutes(entry),
+    };
+};
+/**
+ * Maps an Oura `sleep_phase_5_min` digit onto our normalized
+ * {@link SleepStage} taxonomy. Oura uses `1=deep`, `2=light`, `3=rem`,
+ * `4=awake`; anything else falls through to `unknown`.
+ *
+ * @param digit - The single hypnogram character.
+ * @returns A normalized sleep stage.
+ */
+export const mapSleepPhaseDigit = (digit) => {
+    switch (digit) {
+        case '1':
+            return 'deep';
+        case '2':
+            return 'light';
+        case '3':
+            return 'rem';
+        case '4':
+            return 'awake';
+        default:
+            return 'unknown';
+    }
+};
+/**
+ * Decodes Oura's `sleep_phase_5_min` hypnogram into a list of contiguous
+ * {@link SleepStageSegment} records anchored at `bedtimeStart`.
+ *
+ * Each character represents a 5-minute window. Adjacent same-stage
+ * windows are coalesced into a single segment so consumers don't have
+ * to do the bookkeeping.
+ *
+ * @param hypnogram - The Oura hypnogram string.
+ * @param bedtimeStart - ISO 8601 timestamp anchoring segment 0.
+ * @returns Decoded sleep segments, or `undefined` when no hypnogram exists.
+ */
+export const decodeOuraHypnogram = (hypnogram, bedtimeStart) => {
+    if (!hypnogram || hypnogram.length === 0)
+        return undefined;
+    const anchor = new Date(bedtimeStart).getTime();
+    if (Number.isNaN(anchor))
+        return undefined;
+    const segments = [];
+    let runStage = null;
+    let runStartIndex = 0;
+    for (let i = 0; i <= hypnogram.length; i += 1) {
+        const stage = i < hypnogram.length ? mapSleepPhaseDigit(hypnogram[i]) : null;
+        if (stage !== runStage) {
+            if (runStage !== null) {
+                const startMs = anchor + runStartIndex * SLEEP_PHASE_SEGMENT_SECONDS * 1000;
+                const endMs = anchor + i * SLEEP_PHASE_SEGMENT_SECONDS * 1000;
+                segments.push({
+                    stage: runStage,
+                    start: new Date(startMs).toISOString(),
+                    end: new Date(endMs).toISOString(),
+                    durationSeconds: (i - runStartIndex) * SLEEP_PHASE_SEGMENT_SECONDS,
+                });
+            }
+            runStage = stage;
+            runStartIndex = i;
+        }
+    }
+    return segments;
+};
+const stageSummaryFromOura = (entry) => {
+    const out = {};
+    // Oura returns stage durations in seconds.
+    if (typeof entry.awake_time === 'number') {
+        out.awakeMinutes = Math.round(entry.awake_time / 60);
+    }
+    if (typeof entry.light_sleep_duration === 'number') {
+        out.lightMinutes = Math.round(entry.light_sleep_duration / 60);
+    }
+    if (typeof entry.deep_sleep_duration === 'number') {
+        out.deepMinutes = Math.round(entry.deep_sleep_duration / 60);
+    }
+    if (typeof entry.rem_sleep_duration === 'number') {
+        out.remMinutes = Math.round(entry.rem_sleep_duration / 60);
+    }
+    if (Object.keys(out).length === 0)
+        return undefined;
+    return out;
+};
+/**
+ * Translates an Oura `usercollection/sleep` payload into a list of
+ * normalized {@link SleepSession} records ordered by start ascending.
+ *
+ * Oura's `type === 'long_sleep'` corresponds to the user's main nightly
+ * sleep — the bond marks any matching session as `isMainSleep: true`,
+ * with naps and short sessions as `false`.
+ *
+ * @param date - Calendar day requested.
+ * @param raw - Oura's sleep response payload.
+ * @returns Normalized sleep sessions.
+ */
+export const fromOuraSleep = (date, raw) => {
+    const entries = raw.data ?? [];
+    return entries
+        .map((entry) => {
+        const totalSleepSeconds = entry.total_sleep_duration ?? 0;
+        const timeInBedSeconds = entry.time_in_bed ?? totalSleepSeconds;
+        const segments = decodeOuraHypnogram(entry.sleep_phase_5_min, entry.bedtime_start);
+        return {
+            id: String(entry.id),
+            date: entry.day || date,
+            start: entry.bedtime_start,
+            end: entry.bedtime_end,
+            timeInBedMinutes: Math.round(timeInBedSeconds / 60),
+            timeAsleepMinutes: Math.round(totalSleepSeconds / 60),
+            // Oura returns efficiency as 0-100 already.
+            efficiency: entry.efficiency,
+            isMainSleep: entry.type === 'long_sleep',
+            stageSummary: stageSummaryFromOura(entry),
+            segments,
+        };
+    })
+        .sort((a, b) => new Date(a.start).getTime() - new Date(b.start).getTime());
+};
+/**
+ * Aggregates an Oura `usercollection/heartrate` payload into the
+ * normalized {@link HeartRateSummary} shape.
+ *
+ * Oura returns per-sample BPM readings rather than a daily resting-HR
+ * value or zone breakdown; the bond derives a coarse resting-HR estimate
+ * from the minimum sample of the day. Zone data is not reported by this
+ * endpoint, so `zones` is left undefined.
+ *
+ * @param date - Calendar day the response was requested for.
+ * @param raw - Oura's heart-rate response payload.
+ * @returns A normalized heart-rate summary.
+ */
+export const fromOuraHeartRate = (date, raw) => {
+    const samples = raw.data ?? [];
+    if (samples.length === 0) {
+        return { date, restingHeartRate: undefined, zones: undefined };
+    }
+    let min = Number.POSITIVE_INFINITY;
+    for (const s of samples) {
+        if (typeof s.bpm === 'number' && s.bpm > 0 && s.bpm < min)
+            min = s.bpm;
+    }
+    return {
+        date,
+        restingHeartRate: Number.isFinite(min) ? min : undefined,
+        zones: undefined,
+    };
+};
+/* -------------------------------------------------------------------------- *
+ * Provider factory.
+ * -------------------------------------------------------------------------- */
+/**
+ * Creates an Oura wearable provider.
+ *
+ * @param options - Required: `redirectUri` + `credentialsStore`. Falls
+ *   back to `OAUTH_OURA_CLIENT_ID` / `OAUTH_OURA_CLIENT_SECRET` env
+ *   vars when `clientId` / `clientSecret` are omitted.
+ * @returns An Oura-flavored {@link OuraProvider}.
+ */
+export const createProvider = (options) => {
+    if (!options.redirectUri) {
+        throw new Error('Oura bond is missing required option: redirectUri');
+    }
+    if (!options.credentialsStore) {
+        throw new Error('Oura bond is missing required option: credentialsStore');
+    }
+    const apiBaseUrl = options.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+    const authorizeUrl = options.authorizeUrl ?? DEFAULT_AUTHORIZE_URL;
+    const tokenUrl = options.tokenUrl ?? DEFAULT_TOKEN_URL;
+    const revokeUrl = options.revokeUrl ?? DEFAULT_REVOKE_URL;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const scopes = options.scopes ?? DEFAULT_SCOPES;
+    const credentialsStore = options.credentialsStore;
+    const randomBytes = options.randomBytes ?? ((size) => new Uint8Array(nodeRandomBytes(size)));
+    const now = options.now ?? Date.now;
+    const logger = getLogger();
+    const getClientId = () => {
+        const id = options.clientId ?? process.env.OAUTH_OURA_CLIENT_ID;
+        if (!id) {
+            throw new Error('Oura bond is missing OAUTH_OURA_CLIENT_ID (or clientId option).');
+        }
+        return id;
+    };
+    const getClientSecret = () => {
+        const secret = options.clientSecret ?? process.env.OAUTH_OURA_CLIENT_SECRET;
+        if (!secret) {
+            throw new Error('Oura bond is missing OAUTH_OURA_CLIENT_SECRET (or clientSecret option).');
+        }
+        return secret;
+    };
+    /**
+     * Builds Authorization headers for the OAuth token endpoint. Oura
+     * accepts client_secret_basic (Basic auth) for both authorization-code
+     * and refresh-token grants.
+     *
+     * @returns Headers for the token call.
+     */
+    const tokenAuthHeaders = () => {
+        const clientId = getClientId();
+        const clientSecret = getClientSecret();
+        const basic = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
+        return {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+            authorization: `Basic ${basic}`,
+        };
+    };
+    const formEncode = (params) => Object.entries(params)
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+        .join('&');
+    const callTokenEndpoint = async (params, scope) => {
+        const headers = tokenAuthHeaders();
+        const body = formEncode(params);
+        try {
+            const response = await post(tokenUrl, body, {
+                headers,
+                timeout: timeoutMs,
+            });
+            const data = response.data;
+            if (!data?.access_token || !data?.refresh_token) {
+                // Do NOT include any field of `data` in the error — Oura may
+                // echo tokens back in `error_description` on some failures.
+                throw new Error(`Oura ${scope} failed: malformed token response`);
+            }
+            return data;
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.startsWith(`Oura ${scope} failed:`)) {
+                throw error;
+            }
+            throw sanitizeError(scope, error);
+        }
+    };
+    const refreshAccessToken = async (connection) => {
+        const tokenResponse = await callTokenEndpoint({
+            grant_type: 'refresh_token',
+            refresh_token: connection.refreshToken,
+        }, 'token refresh');
+        const refreshed = {
+            ...connection,
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token,
+            expiresAt: typeof tokenResponse.expires_in === 'number'
+                ? now() + tokenResponse.expires_in * 1000
+                : undefined,
+            scopes: tokenResponse.scope
+                ? tokenResponse.scope.split(' ').filter(Boolean)
+                : connection.scopes,
+        };
+        await credentialsStore.write(PROVIDER_NAME, refreshed);
+        return refreshed;
+    };
+    const loadConnection = async (userId) => {
+        const connection = await credentialsStore.read(userId, PROVIDER_NAME);
+        if (!connection) {
+            throw new Error(`Oura connection not found for user '${userId}'`);
+        }
+        return connection;
+    };
+    /**
+     * Calls a function with the user's access token, refreshing the token
+     * once on a 401 response (or proactively when `expiresAt` is in the past).
+     *
+     * @param scope - Calling-operation label for sanitized error messages.
+     * @param userId - Host-app user id.
+     * @param call - Function performing the HTTP request given an access token.
+     * @returns The HTTP response body.
+     */
+    const withAuth = async (scope, userId, call) => {
+        let connection = await loadConnection(userId);
+        let refreshed = false;
+        if (typeof connection.expiresAt === 'number' && connection.expiresAt <= now()) {
+            connection = await refreshAccessToken(connection);
+            refreshed = true;
+        }
+        try {
+            const response = await call(connection.accessToken);
+            return response.data;
+        }
+        catch (error) {
+            if (!isUnauthorized(error) || refreshed) {
+                logger.error(`Oura ${scope} failed`, sanitizeError(scope, error));
+                throw sanitizeError(scope, error);
+            }
+            try {
+                connection = await refreshAccessToken(connection);
+                const response = await call(connection.accessToken);
+                return response.data;
+            }
+            catch (retryError) {
+                if (retryError instanceof Error && retryError.message.startsWith('Oura bond is missing ')) {
+                    logger.error(`Oura ${scope} failed`, retryError);
+                    throw retryError;
+                }
+                logger.error(`Oura ${scope} failed`, sanitizeError(scope, retryError));
+                throw sanitizeError(scope, retryError);
+            }
+        }
+    };
+    const authedRequestOptions = (accessToken, extra) => ({
+        ...extra,
+        headers: {
+            accept: 'application/json',
+            ...(extra?.headers ?? {}),
+            authorization: `Bearer ${accessToken}`,
+        },
+        timeout: extra?.timeout ?? timeoutMs,
+    });
+    const buildAuthorizeUrl = (state) => {
+        const params = {
+            client_id: getClientId(),
+            response_type: 'code',
+            redirect_uri: options.redirectUri,
+            scope: scopes.join(' '),
+            state,
+        };
+        const qs = formEncode(params);
+        return authorizeUrl.includes('?') ? `${authorizeUrl}&${qs}` : `${authorizeUrl}?${qs}`;
+    };
+    const startAuthorize = () => {
+        const state = base64UrlEncode(randomBytes(16));
+        return { url: buildAuthorizeUrl(state), state };
+    };
+    /**
+     * Performs the authorization-code → token exchange and persists the
+     * resulting connection.
+     *
+     * @param userId - Host-app user id.
+     * @param code - OAuth authorization code from the redirect callback.
+     * @returns The newly-persisted user connection.
+     */
+    const connectInternal = async (userId, code) => {
+        const tokenResponse = await callTokenEndpoint({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: options.redirectUri,
+        }, 'connect');
+        const connection = {
+            userId,
+            // Oura's token endpoint does not return a stable user id; the host
+            // can fetch `usercollection/personal_info` separately if it needs
+            // one. For now we leave `providerAccountId` empty.
+            providerAccountId: '',
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token,
+            expiresAt: typeof tokenResponse.expires_in === 'number'
+                ? now() + tokenResponse.expires_in * 1000
+                : undefined,
+            scopes: tokenResponse.scope ? tokenResponse.scope.split(' ').filter(Boolean) : undefined,
+            connectedAt: now(),
+        };
+        await credentialsStore.write(PROVIDER_NAME, connection);
+        return connection;
+    };
+    return {
+        providerName: PROVIDER_NAME,
+        startAuthorize,
+        async connect(userId, code) {
+            return connectInternal(userId, code);
+        },
+        async refreshConnection(userId) {
+            const connection = await loadConnection(userId);
+            try {
+                return await refreshAccessToken(connection);
+            }
+            catch (error) {
+                if (error instanceof Error && error.message.startsWith('Oura ')) {
+                    throw error;
+                }
+                throw sanitizeError('refresh', error);
+            }
+        },
+        async disconnect(userId) {
+            let connection = null;
+            try {
+                connection = await credentialsStore.read(userId, PROVIDER_NAME);
+            }
+            catch (error) {
+                logger.error('Oura disconnect read failed', sanitizeError('disconnect', error));
+            }
+            if (connection) {
+                try {
+                    // Oura's revoke endpoint accepts the access token in the body.
+                    const headers = tokenAuthHeaders();
+                    const body = formEncode({ access_token: connection.accessToken });
+                    await post(revokeUrl, body, { headers, timeout: timeoutMs });
+                }
+                catch (error) {
+                    // Best-effort revoke — the local record still must be removed
+                    // below. Sanitize so the access token never leaks.
+                    logger.error('Oura revoke failed', sanitizeError('disconnect', error));
+                }
+            }
+            await credentialsStore.remove(userId, PROVIDER_NAME);
+        },
+        async getDailyActivity(userId, date) {
+            const data = await withAuth('getDailyActivity', userId, (accessToken) => get(`${apiBaseUrl}/usercollection/daily_activity?start_date=${encodeURIComponent(date)}&end_date=${encodeURIComponent(date)}`, authedRequestOptions(accessToken)));
+            const entry = (data.data ?? []).find((d) => d.day === date) ?? data.data?.[0];
+            return fromOuraActivity(date, entry);
+        },
+        async getDailySleep(userId, date) {
+            const data = await withAuth('getDailySleep', userId, (accessToken) => get(`${apiBaseUrl}/usercollection/sleep?start_date=${encodeURIComponent(date)}&end_date=${encodeURIComponent(date)}`, authedRequestOptions(accessToken)));
+            return fromOuraSleep(date, data);
+        },
+        async getDailyHeartRate(userId, date) {
+            // Oura's heart-rate endpoint takes ISO-8601 datetimes, not calendar
+            // days. We bucket the requested calendar day in UTC; hosts that need
+            // local-day buckets can wire their own range.
+            const startDatetime = `${date}T00:00:00+00:00`;
+            const endDatetime = `${date}T23:59:59+00:00`;
+            const data = await withAuth('getDailyHeartRate', userId, (accessToken) => get(`${apiBaseUrl}/usercollection/heartrate?start_datetime=${encodeURIComponent(startDatetime)}&end_datetime=${encodeURIComponent(endDatetime)}`, authedRequestOptions(accessToken)));
+            return fromOuraHeartRate(date, data);
+        },
+        async getWeight(_userId, _range) {
+            // Oura does NOT track body weight — there is no equivalent of
+            // Fitbit's `body/log/weight` endpoint. Returning an empty array
+            // preserves the WearableProvider contract; consumers can detect
+            // the absence by checking `result.length === 0` and falling back
+            // to a different bond (e.g. `@molecule/api-wearable-fitbit` or
+            // `-withings`) for weight readings.
+            void _userId;
+            void _range;
+            return [];
+        },
+    };
+};
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAA;AAE5D,sEAAsE;AACtE,2EAA2E;AAC3E,oCAAoC;AACpC,OAAO,cAAc,CAAA;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAiB9C,uEAAuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAA;AAEnC,MAAM,oBAAoB,GAAG,6BAA6B,CAAA;AAC1D,MAAM,qBAAqB,GAAG,4CAA4C,CAAA;AAC1E,MAAM,iBAAiB,GAAG,sCAAsC,CAAA;AAChE,MAAM,kBAAkB,GAAG,uCAAuC,CAAA;AAClE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;AAE7E,kEAAkE;AAClE,mFAAmF;AACnF,MAAM,2BAA2B,GAAG,GAAG,CAAA;AAoEvC;;gFAEgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,KAAc,EAAS,EAAE;IAC7D,MAAM,SAAS,GAAG,KAA8B,CAAA;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAA;IAC1C,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,CAAA;IAC5B,MAAM,KAAK,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAA;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAA;IACxD,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACpC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACnC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE;IACjD,OAAQ,KAA+B,EAAE,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAA;AACnE,CAAC,CAAA;AAED;;gFAEgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC,CAAA;AAED;;gFAEgF;AAEhF,MAAM,kBAAkB,GAAG,CAAC,KAA6B,EAAU,EAAE;IACnE,gDAAgD;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,IAAI,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAkB,EAClB,KAAyC,EAC1B,EAAE;IACjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,CAAC;YACR,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,CAAC;SACjB,CAAA;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;QACvB,uDAAuD;QACvD,cAAc,EAAE,KAAK,CAAC,2BAA2B,IAAI,CAAC;QACtD,sEAAsE;QACtE,6BAA6B;QAC7B,WAAW,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;QACtC,aAAa,EAAE,kBAAkB,CAAC,KAAK,CAAC;KACzC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAc,EAAE;IAC9D,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,GAAG;YACN,OAAO,MAAM,CAAA;QACf,KAAK,GAAG;YACN,OAAO,OAAO,CAAA;QAChB,KAAK,GAAG;YACN,OAAO,KAAK,CAAA;QACd,KAAK,GAAG;YACN,OAAO,OAAO,CAAA;QAChB;YACE,OAAO,SAAS,CAAA;IACpB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,SAA6B,EAC7B,YAAoB,EACa,EAAE;IACnC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAA;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,IAAI,QAAQ,GAAsB,IAAI,CAAA;IACtC,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7E,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,2BAA2B,GAAG,IAAI,CAAA;gBAC3E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,2BAA2B,GAAG,IAAI,CAAA;gBAC7D,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,QAAQ;oBACf,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;oBACtC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;oBAClC,eAAe,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,GAAG,2BAA2B;iBACnE,CAAC,CAAA;YACJ,CAAC;YACD,QAAQ,GAAG,KAAK,CAAA;YAChB,aAAa,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,oBAAoB,GAAG,CAAC,KAAqB,EAAiC,EAAE;IACpF,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,2CAA2C;IAC3C,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,EAAE,CAAC;QACnD,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;QAClD,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACjD,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACnD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAkB,EAAE,GAAsB,EAAkB,EAAE;IAC1F,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IAC9B,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,KAAK,EAAgB,EAAE;QAC3B,MAAM,iBAAiB,GAAG,KAAK,CAAC,oBAAoB,IAAI,CAAC,CAAA;QACzD,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAA;QAC/D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;QAClF,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;YACvB,KAAK,EAAE,KAAK,CAAC,aAAa;YAC1B,GAAG,EAAE,KAAK,CAAC,WAAW;YACtB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC;YACnD,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC;YACrD,4CAA4C;YAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,YAAY;YACxC,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC;YACzC,QAAQ;SACT,CAAA;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAC9E,CAAC,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,IAAkB,EAClB,GAA0B,EACR,EAAE;IACpB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAChE,CAAC;IACD,IAAI,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAA;IACxE,CAAC;IACD,OAAO;QACL,IAAI;QACJ,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACxD,KAAK,EAAE,SAAS;KACjB,CAAA;AACH,CAAC,CAAA;AAED;;gFAEgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA4B,EAAgB,EAAE;IAC3E,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAA;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAA;IAC/C,MAAM,gBAAgB,GAA6B,OAAO,CAAC,gBAAgB,CAAA;IAC3E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAE1B,MAAM,WAAW,GAAG,GAAW,EAAE;QAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;QAC/D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IAED,MAAM,eAAe,GAAG,GAAW,EAAE;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;QAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;QAC5F,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED;;;;;;OAMG;IACH,MAAM,gBAAgB,GAAG,GAA2B,EAAE;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;QAC9B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,OAAO;YACL,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;SAChC,CAAA;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,MAA8B,EAAU,EAAE,CAC5D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,CAAA;IAEd,MAAM,iBAAiB,GAAG,KAAK,EAC7B,MAA8B,EAC9B,KAAa,EACe,EAAE;QAC9B,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAoB,QAAQ,EAAE,IAAI,EAAE;gBAC7D,OAAO;gBACP,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC1B,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;gBAChD,6DAA6D;gBAC7D,4DAA4D;gBAC5D,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,mCAAmC,CAAC,CAAA;YACnE,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,EAAE,CAAC;gBAChF,MAAM,KAAK,CAAA;YACb,CAAC;YACD,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,KAAK,EAAE,UAA0B,EAA2B,EAAE;QACvF,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C;YACE,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,UAAU,CAAC,YAAY;SACvC,EACD,eAAe,CAChB,CAAA;QACD,MAAM,SAAS,GAAmB;YAChC,GAAG,UAAU;YACb,WAAW,EAAE,aAAa,CAAC,YAAY;YACvC,YAAY,EAAE,aAAa,CAAC,aAAa;YACzC,SAAS,EACP,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI;gBACzC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,aAAa,CAAC,KAAK;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAChD,CAAC,CAAC,UAAU,CAAC,MAAM;SACtB,CAAA;QACD,MAAM,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;QACtD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAA2B,EAAE;QACvE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,GAAG,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;IAED;;;;;;;;OAQG;IACH,MAAM,QAAQ,GAAG,KAAK,EACpB,KAAa,EACb,MAAc,EACd,IAAuD,EAC3C,EAAE;QACd,IAAI,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,SAAS,GAAG,KAAK,CAAA;QAErB,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC;YAC9E,UAAU,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YACjD,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YACnD,OAAO,QAAQ,CAAC,IAAI,CAAA;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;gBACxC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;gBACjE,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACnC,CAAC;YACD,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;gBACjD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;gBACnD,OAAO,QAAQ,CAAC,IAAI,CAAA;YACtB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,IAAI,UAAU,YAAY,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;oBAC1F,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,UAAU,CAAC,CAAA;oBAChD,MAAM,UAAU,CAAA;gBAClB,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;gBACtE,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,oBAAoB,GAAG,CAC3B,WAAmB,EACnB,KAAmD,EACN,EAAE,CAAC,CAAC;QACjD,GAAG,KAAK;QACR,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;YACzB,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,SAAS;KACrC,CAAC,CAAA;IAEF,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAU,EAAE;QAClD,MAAM,MAAM,GAA2B;YACrC,SAAS,EAAE,WAAW,EAAE;YACxB,aAAa,EAAE,MAAM;YACrB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK;SACN,CAAA;QACD,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC7B,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,CAAA;IACvF,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,GAAuB,EAAE;QAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9C,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACjD,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAE,IAAY,EAA2B,EAAE;QACtF,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C;YACE,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC,EACD,SAAS,CACV,CAAA;QACD,MAAM,UAAU,GAAmB;YACjC,MAAM;YACN,mEAAmE;YACnE,kEAAkE;YAClE,mDAAmD;YACnD,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE,aAAa,CAAC,YAAY;YACvC,YAAY,EAAE,aAAa,CAAC,aAAa;YACzC,SAAS,EACP,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI;gBACzC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACxF,WAAW,EAAE,GAAG,EAAE;SACnB,CAAA;QACD,MAAM,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;QACvD,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;IAED,OAAO;QACL,YAAY,EAAE,aAAa;QAE3B,cAAc;QAEd,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY;YACxC,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;YACpC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,OAAO,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChE,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,MAAM,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAc;YAC7B,IAAI,UAAU,GAA0B,IAAI,CAAA;YAC5C,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YACjE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,+DAA+D;oBAC/D,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAA;oBAClC,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;oBACjE,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,8DAA8D;oBAC9D,mDAAmD;oBACnD,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAA;gBACxE,CAAC;YACH,CAAC;YACD,MAAM,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,IAAkB;YACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,kBAAkB,EAClB,MAAM,EACN,CAAC,WAAW,EAAE,EAAE,CACd,GAAG,CACD,GAAG,UAAU,6CAA6C,kBAAkB,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,EACzH,oBAAoB,CAAC,WAAW,CAAC,CAClC,CACJ,CAAA;YACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC7E,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,IAAkB;YACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoB,eAAe,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtF,GAAG,CACD,GAAG,UAAU,oCAAoC,kBAAkB,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAChH,oBAAoB,CAAC,WAAW,CAAC,CAClC,CACF,CAAA;YACD,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,IAAkB;YACxD,oEAAoE;YACpE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,aAAa,GAAG,GAAG,IAAI,iBAAiB,CAAA;YAC9C,MAAM,WAAW,GAAG,GAAG,IAAI,iBAAiB,CAAA;YAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,mBAAmB,EACnB,MAAM,EACN,CAAC,WAAW,EAAE,EAAE,CACd,GAAG,CACD,GAAG,UAAU,4CAA4C,kBAAkB,CAAC,aAAa,CAAC,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAC5I,oBAAoB,CAAC,WAAW,CAAC,CAClC,CACJ,CAAA;YACD,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACtC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,MAAyB;YACxD,8DAA8D;YAC9D,gEAAgE;YAChE,gEAAgE;YAChE,iEAAiE;YACjE,+DAA+D;YAC/D,oCAAoC;YACpC,KAAK,OAAO,CAAA;YACZ,KAAK,MAAM,CAAA;YACX,OAAO,EAAE,CAAA;QACX,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Oura wearable bond secret definitions — self-registered at import time so the
+ * runtime secrets registry (`@molecule/api-secrets`) can drive boot-time
+ * configuration reports and actionable "not configured" errors.
+ *
+ * Content is derived MECHANICALLY from this package's mlcl registry secrets
+ * entry (label/instructions/setupUrl/example) via the fleet formula, so
+ * packages sharing a key register byte-identical definitions and
+ * registration order never matters.
+ *
+ * @module
+ */
+import type { SecretDefinition } from '@molecule/api-secrets';
+/** Secret definitions required by the Oura wearable bond. */
+export declare const wearableOuraSecretDefinitions: SecretDefinition[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,6DAA6D;AAC7D,eAAO,MAAM,6BAA6B,EAAE,gBAAgB,EAc3D,CAAA"}

package/dist/secrets.js

@@ -0,0 +1,30 @@
+/**
+ * Oura wearable bond secret definitions — self-registered at import time so the
+ * runtime secrets registry (`@molecule/api-secrets`) can drive boot-time
+ * configuration reports and actionable "not configured" errors.
+ *
+ * Content is derived MECHANICALLY from this package's mlcl registry secrets
+ * entry (label/instructions/setupUrl/example) via the fleet formula, so
+ * packages sharing a key register byte-identical definitions and
+ * registration order never matters.
+ *
+ * @module
+ */
+import { registerSecrets } from '@molecule/api-secrets';
+/** Secret definitions required by the Oura wearable bond. */
+export const wearableOuraSecretDefinitions = [
+    {
+        key: 'OAUTH_OURA_CLIENT_ID',
+        description: 'Oura OAuth client ID — Create an OAuth application in the Oura Cloud developer portal.',
+        helpUrl: 'https://cloud.ouraring.com/oauth/applications',
+        required: true,
+    },
+    {
+        key: 'OAUTH_OURA_CLIENT_SECRET',
+        description: 'Oura client secret — Shown when creating the OAuth application in Oura Cloud.',
+        helpUrl: 'https://cloud.ouraring.com/oauth/applications',
+        required: true,
+    },
+];
+registerSecrets(wearableOuraSecretDefinitions);
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAuB;IAC/D;QACE,GAAG,EAAE,sBAAsB;QAC3B,WAAW,EACT,wFAAwF;QAC1F,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,WAAW,EAAE,+EAA+E;QAC5F,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,IAAI;KACf;CACF,CAAA;AAED,eAAe,CAAC,6BAA6B,CAAC,CAAA"}

package/dist/types.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Oura Ring wearable bond types for molecule.dev.
+ *
+ * @module
+ */
+import type { WearableCredentialsStore, WearableProvider as WearableProviderType } from '@molecule/api-wearable';
+export type { DailyActivity, HeartRateSummary, HeartRateZone, SleepSession, SleepStage, SleepStageSegment, SleepStageSummary, UserConnection, WearableCredentialsStore, WearableDate, WearableDateRange, WearableProvider, WeightEntry, } from '@molecule/api-wearable';
+declare global {
+    namespace NodeJS {
+        /**
+         * Process Env interface.
+         */
+        interface ProcessEnv {
+            /**
+             * The Oura OAuth client ID. Required to mint and refresh access
+             * tokens.
+             *
+             * @see https://cloud.ouraring.com/docs/authentication
+             */
+            OAUTH_OURA_CLIENT_ID?: string;
+            /**
+             * The Oura OAuth client secret. Required for the
+             * `authorization_code` and `refresh_token` grant flows.
+             *
+             * @see https://cloud.ouraring.com/docs/authentication
+             */
+            OAUTH_OURA_CLIENT_SECRET?: string;
+        }
+    }
+}
+/**
+ * Configuration options for {@link createProvider}.
+ */
+export interface OuraProviderOptions {
+    /**
+     * OAuth client id. Defaults to `process.env.OAUTH_OURA_CLIENT_ID`.
+     */
+    clientId?: string;
+    /**
+     * OAuth client secret. Defaults to
+     * `process.env.OAUTH_OURA_CLIENT_SECRET`.
+     */
+    clientSecret?: string;
+    /**
+     * OAuth redirect URI registered with the Oura application.
+     */
+    redirectUri: string;
+    /**
+     * Persists user connections (access + refresh tokens). Required.
+     */
+    credentialsStore: WearableCredentialsStore;
+    /**
+     * OAuth scopes to request when starting authorization. Defaults to the
+     * union needed for daily activity, sleep, heart-rate, and personal
+     * info reads.
+     */
+    scopes?: readonly string[];
+    /**
+     * Override the Oura Cloud API base URL. Defaults to
+     * `https://api.ouraring.com/v2`.
+     */
+    apiBaseUrl?: string;
+    /**
+     * Override the Oura OAuth authorize endpoint. Defaults to
+     * `https://cloud.ouraring.com/oauth/authorize`.
+     */
+    authorizeUrl?: string;
+    /**
+     * Override the Oura OAuth token endpoint. Defaults to
+     * `https://api.ouraring.com/oauth/token`.
+     */
+    tokenUrl?: string;
+    /**
+     * Override the Oura OAuth token-revoke endpoint. Defaults to
+     * `https://api.ouraring.com/oauth/revoke`.
+     */
+    revokeUrl?: string;
+    /**
+     * Request timeout in milliseconds. Defaults to `15_000`.
+     */
+    timeoutMs?: number;
+    /**
+     * Optional override for the random-bytes generator used for the OAuth
+     * `state` parameter. Tests inject a deterministic generator.
+     */
+    randomBytes?: (size: number) => Uint8Array;
+    /**
+     * Optional clock override, primarily for tests. Defaults to `Date.now`.
+     */
+    now?: () => number;
+}
+/**
+ * Result of {@link OuraProvider.startAuthorize} — the URL the host
+ * should redirect the user to plus the `state` value to round-trip.
+ */
+export interface OuraAuthorizeStart {
+    /** Oura OAuth authorize URL. */
+    url: string;
+    /** Opaque `state` value the host MUST verify on the callback. */
+    state: string;
+}
+/**
+ * Public surface returned by {@link createProvider}. Extends the
+ * stack-neutral {@link import('@molecule/api-wearable').WearableProvider}
+ * with an Oura-flavored `startAuthorize()` helper for hosts that want
+ * the bond to build the authorize URL.
+ */
+export interface OuraProvider extends WearableProviderType {
+    /**
+     * Builds the Oura authorize URL with a random `state` value. The host
+     * is responsible for round-tripping `state` through the OAuth callback
+     * and verifying it before calling {@link OuraProvider.connect}.
+     *
+     * @returns The URL to redirect to and the `state` value.
+     */
+    startAuthorize(): OuraAuthorizeStart;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,gBAAgB,IAAI,oBAAoB,EACzC,MAAM,wBAAwB,CAAA;AAE/B,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,wBAAwB,EACxB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACZ,MAAM,wBAAwB,CAAA;AAE/B,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,MAAM,CAAC;QACf;;WAEG;QACH,UAAiB,UAAU;YACzB;;;;;eAKG;YACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;YAE7B;;;;;eAKG;YACH,wBAAwB,CAAC,EAAE,MAAM,CAAA;SAClC;KACF;CACF;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB;;OAEG;IACH,gBAAgB,EAAE,wBAAwB,CAAA;IAC1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,CAAA;IAC1C;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,oBAAoB;IACxD;;;;;;OAMG;IACH,cAAc,IAAI,kBAAkB,CAAA;CACrC"}

package/dist/types.js

@@ -0,0 +1,7 @@
+/**
+ * Oura Ring wearable bond types for molecule.dev.
+ *
+ * @module
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@molecule/api-wearable-oura",
+  "version": "1.0.0",
+  "description": "Oura Ring Cloud API v2 bond for molecule.dev — daily activity, sleep (REM/deep/light), and heart-rate ingestion via OAuth 2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "molecule",
+    "wearable",
+    "oura",
+    "ring",
+    "sleep",
+    "readiness",
+    "heart-rate",
+    "oauth"
+  ],
+  "license": "Apache-2.0",
+  "peerDependencies": {
+    "@molecule/api-bond": "^1.0.0",
+    "@molecule/api-http": "^1.0.0",
+    "@molecule/api-secrets": "^1.0.0",
+    "@molecule/api-wearable": "^1.0.0"
+  },
+  "devDependencies": {
+    "@molecule/api-bond": "1.0.0",
+    "@molecule/api-http": "1.0.0",
+    "@molecule/api-wearable": "1.0.0",
+    "@types/node": "26.1.2",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/molecule-dev/molecule.git",
+    "directory": "packages/api/bonds/wearable/oura"
+  },
+  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/bonds/wearable/oura",
+  "bugs": "https://github.com/molecule-dev/molecule/issues",
+  "publishConfig": {
+    "access": "public"
+  }
+}