@payloadcms/figma 0.0.1-alpha.0

package/dist/auth/project-token.js

@@ -0,0 +1,134 @@
+/**
+ * Project Token Management
+ *
+ * Handles project token (JWT) generation and refresh for authenticating
+ * to the Content API. Project tokens are scoped to a specific tenant/CMS
+ * and have a shorter lifespan (15-30 minutes) than OAuth tokens.
+ */ import { getProjectToken as fetchProjectToken } from '../api/figma-api.js';
+import { getEnvironment } from '../constants.js';
+import { isDebug } from '../utils/is-debug.js';
+import * as log from '../utils/log.js';
+import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
+import { getValidAccessToken } from './oauth-flow.js';
+/**
+ * Error during project token operations
+ */ export class ProjectTokenError extends Error {
+    cause;
+    constructor(message, cause){
+        super(message), this.cause = cause;
+        this.name = 'ProjectTokenError';
+    }
+}
+/**
+ * Parse JWT claims from token without validation
+ * Used for mock tokens where signature validation is not needed
+ *
+ * @param token - JWT token string
+ * @returns Parsed JWT payload
+ * @throws {ProjectTokenError} If JWT cannot be parsed
+ */ function parseJWTClaims(token) {
+    try {
+        // JWT format: header.payload.signature
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid JWT format');
+        }
+        // Decode the payload (second part)
+        const payload = parts[1];
+        const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+        const paddedBase64 = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, '=');
+        const decodedPayload = JSON.parse(Buffer.from(paddedBase64, 'base64').toString('utf-8'));
+        return decodedPayload;
+    } catch (error) {
+        throw new ProjectTokenError(`Failed to parse JWT claims: ${error instanceof Error ? error.message : 'Unknown error'}`, error instanceof Error ? error : undefined);
+    }
+}
+/**
+ * Get a valid project token for a tenant, refreshing if necessary
+ *
+ * This function:
+ * 1. Checks if a stored project token exists and is valid (not expired)
+ * 2. If expired or missing, gets a valid user access token
+ * 3. Calls the Figma API to generate a new project token
+ * 4. Stores the new project token in encrypted storage
+ * 5. Returns the JWT string
+ *
+ * The project token is used by local Payload instances to authenticate
+ * requests to the Content API without requiring a round-trip to Sinatra.
+ *
+ * @param tokenStore - Token store for persisting tokens
+ * @param tenantId - The tenant/CMS ID to get a token for
+ * @returns Promise resolving to JWT token string or null if failed
+ * @throws {ProjectTokenError} If token generation fails
+ */ export async function getValidProjectToken(tokenStore, tenantId) {
+    // Check if we have a valid project token already
+    if (tokenStore.hasValidProjectToken(tenantId)) {
+        const projectToken = tokenStore.getProjectToken(tenantId);
+        return projectToken?.token || null;
+    }
+    // We need to refresh the project token
+    // First, get a valid user access token (will auto-refresh if needed)
+    let accessToken;
+    try {
+        accessToken = await getValidAccessToken(tokenStore);
+    } catch (error) {
+        throw new ProjectTokenError('Failed to get valid access token for project token refresh', error instanceof Error ? error : undefined);
+    }
+    if (!accessToken) {
+        // No valid user tokens available - user needs to authenticate
+        return null;
+    }
+    // Fetch a new project token from the Figma API
+    const projectToken = await fetchProjectToken(accessToken, tenantId);
+    // Validate the JWT signature and claims (skip for mocks)
+    const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false';
+    let validatedClaims;
+    if (shouldMock) {
+        // MOCK: Skip JWT validation and parse claims directly
+        if (isDebug()) {
+            log.debug('Skipping JWT validation for mock project token');
+        }
+        validatedClaims = parseJWTClaims(projectToken.token);
+    } else {
+        // REAL: Validate JWT signature against JWKS
+        try {
+            validatedClaims = await validateProjectToken(projectToken.token, getEnvironment());
+        } catch (validationError) {
+            // Handle validation errors
+            if (validationError instanceof JWTValidationError) {
+                throw new ProjectTokenError(`Project token validation failed: ${validationError.message}`, validationError);
+            }
+            throw validationError;
+        }
+    }
+    // Ensure exp claim is present
+    if (!validatedClaims.exp) {
+        throw new ProjectTokenError('Project token missing expiration (exp) claim');
+    }
+    // Store the project token with validated expiration and claims
+    tokenStore.setProjectToken(tenantId, {
+        claims: validatedClaims,
+        expiresAt: validatedClaims.exp * 1000,
+        tenantId,
+        token: projectToken.token
+    });
+    return projectToken.token;
+}
+/**
+ * Refresh a project token for a tenant
+ *
+ * Forces a refresh of the project token even if the current one is still valid.
+ * Useful for testing or when you want to ensure you have the freshest token.
+ *
+ * @param tokenStore - Token store for persisting tokens
+ * @param tenantId - The tenant/CMS ID to refresh token for
+ * @returns Promise resolving to JWT token string or null if failed
+ * @throws {ProjectTokenError} If token refresh fails
+ */ export async function refreshProjectToken(tokenStore, tenantId) {
+    // Clear the existing project token to force a refresh
+    tokenStore.clearProjectToken(tenantId);
+    // Get a new token (which will fetch from API since we just cleared it)
+    return getValidProjectToken(tokenStore, tenantId);
+}
+
+//# sourceMappingURL=project-token.js.map

package/dist/auth/project-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/project-token.ts"],"sourcesContent":["/**\n * Project Token Management\n *\n * Handles project token (JWT) generation and refresh for authenticating\n * to the Content API. Project tokens are scoped to a specific tenant/CMS\n * and have a shorter lifespan (15-30 minutes) than OAuth tokens.\n */\n\nimport type { TokenStore } from './token-store.js'\nimport type { JWTPayload } from './types.js'\n\nimport { getProjectToken as fetchProjectToken } from '../api/figma-api.js'\nimport { getEnvironment } from '../constants.js'\nimport { isDebug } from '../utils/is-debug.js'\nimport * as log from '../utils/log.js'\nimport { JWTValidationError, validateProjectToken } from './jwt-validator.js'\nimport { getValidAccessToken } from './oauth-flow.js'\n\n/**\n * Error during project token operations\n */\nexport class ProjectTokenError extends Error {\n  constructor(\n    message: string,\n    public cause?: Error,\n  ) {\n    super(message)\n    this.name = 'ProjectTokenError'\n  }\n}\n\n/**\n * Parse JWT claims from token without validation\n * Used for mock tokens where signature validation is not needed\n *\n * @param token - JWT token string\n * @returns Parsed JWT payload\n * @throws {ProjectTokenError} If JWT cannot be parsed\n */\nfunction parseJWTClaims(token: string): JWTPayload {\n  try {\n    // JWT format: header.payload.signature\n    const parts = token.split('.')\n    if (parts.length !== 3) {\n      throw new Error('Invalid JWT format')\n    }\n\n    // Decode the payload (second part)\n    const payload = parts[1]\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/')\n    const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=')\n\n    const decodedPayload = JSON.parse(Buffer.from(paddedBase64, 'base64').toString('utf-8'))\n\n    return decodedPayload as JWTPayload\n  } catch (error) {\n    throw new ProjectTokenError(\n      `Failed to parse JWT claims: ${error instanceof Error ? error.message : 'Unknown error'}`,\n      error instanceof Error ? error : undefined,\n    )\n  }\n}\n\n/**\n * Get a valid project token for a tenant, refreshing if necessary\n *\n * This function:\n * 1. Checks if a stored project token exists and is valid (not expired)\n * 2. If expired or missing, gets a valid user access token\n * 3. Calls the Figma API to generate a new project token\n * 4. Stores the new project token in encrypted storage\n * 5. Returns the JWT string\n *\n * The project token is used by local Payload instances to authenticate\n * requests to the Content API without requiring a round-trip to Sinatra.\n *\n * @param tokenStore - Token store for persisting tokens\n * @param tenantId - The tenant/CMS ID to get a token for\n * @returns Promise resolving to JWT token string or null if failed\n * @throws {ProjectTokenError} If token generation fails\n */\nexport async function getValidProjectToken(\n  tokenStore: TokenStore,\n  tenantId: string,\n): Promise<null | string> {\n  // Check if we have a valid project token already\n  if (tokenStore.hasValidProjectToken(tenantId)) {\n    const projectToken = tokenStore.getProjectToken(tenantId)\n    return projectToken?.token || null\n  }\n\n  // We need to refresh the project token\n  // First, get a valid user access token (will auto-refresh if needed)\n  let accessToken: null | string\n  try {\n    accessToken = await getValidAccessToken(tokenStore)\n  } catch (error) {\n    throw new ProjectTokenError(\n      'Failed to get valid access token for project token refresh',\n      error instanceof Error ? error : undefined,\n    )\n  }\n\n  if (!accessToken) {\n    // No valid user tokens available - user needs to authenticate\n    return null\n  }\n\n  // Fetch a new project token from the Figma API\n  const projectToken = await fetchProjectToken(accessToken, tenantId)\n\n  // Validate the JWT signature and claims (skip for mocks)\n  const shouldMock = process.env.FIGMA_MOCK_PROJECT_TOKEN !== 'false'\n  let validatedClaims: JWTPayload\n\n  if (shouldMock) {\n    // MOCK: Skip JWT validation and parse claims directly\n    if (isDebug()) {\n      log.debug('Skipping JWT validation for mock project token')\n    }\n    validatedClaims = parseJWTClaims(projectToken.token)\n  } else {\n    // REAL: Validate JWT signature against JWKS\n    try {\n      validatedClaims = await validateProjectToken(projectToken.token, getEnvironment())\n    } catch (validationError) {\n      // Handle validation errors\n      if (validationError instanceof JWTValidationError) {\n        throw new ProjectTokenError(\n          `Project token validation failed: ${validationError.message}`,\n          validationError,\n        )\n      }\n      throw validationError\n    }\n  }\n\n  // Ensure exp claim is present\n  if (!validatedClaims.exp) {\n    throw new ProjectTokenError('Project token missing expiration (exp) claim')\n  }\n\n  // Store the project token with validated expiration and claims\n  tokenStore.setProjectToken(tenantId, {\n    claims: validatedClaims,\n    expiresAt: validatedClaims.exp * 1000, // Convert from seconds to milliseconds\n    tenantId,\n    token: projectToken.token,\n  })\n\n  return projectToken.token\n}\n\n/**\n * Refresh a project token for a tenant\n *\n * Forces a refresh of the project token even if the current one is still valid.\n * Useful for testing or when you want to ensure you have the freshest token.\n *\n * @param tokenStore - Token store for persisting tokens\n * @param tenantId - The tenant/CMS ID to refresh token for\n * @returns Promise resolving to JWT token string or null if failed\n * @throws {ProjectTokenError} If token refresh fails\n */\nexport async function refreshProjectToken(\n  tokenStore: TokenStore,\n  tenantId: string,\n): Promise<null | string> {\n  // Clear the existing project token to force a refresh\n  tokenStore.clearProjectToken(tenantId)\n\n  // Get a new token (which will fetch from API since we just cleared it)\n  return getValidProjectToken(tokenStore, tenantId)\n}\n"],"names":["getProjectToken","fetchProjectToken","getEnvironment","isDebug","log","JWTValidationError","validateProjectToken","getValidAccessToken","ProjectTokenError","Error","message","cause","name","parseJWTClaims","token","parts","split","length","payload","base64","replace","paddedBase64","padEnd","decodedPayload","JSON","parse","Buffer","from","toString","error","undefined","getValidProjectToken","tokenStore","tenantId","hasValidProjectToken","projectToken","accessToken","shouldMock","process","env","FIGMA_MOCK_PROJECT_TOKEN","validatedClaims","debug","validationError","exp","setProjectToken","claims","expiresAt","refreshProjectToken","clearProjectToken"],"mappings":"AAAA;;;;;;CAMC,GAKD,SAASA,mBAAmBC,iBAAiB,QAAQ,sBAAqB;AAC1E,SAASC,cAAc,QAAQ,kBAAiB;AAChD,SAASC,OAAO,QAAQ,uBAAsB;AAC9C,YAAYC,SAAS,kBAAiB;AACtC,SAASC,kBAAkB,EAAEC,oBAAoB,QAAQ,qBAAoB;AAC7E,SAASC,mBAAmB,QAAQ,kBAAiB;AAErD;;CAEC,GACD,OAAO,MAAMC,0BAA0BC;;IACrC,YACEC,OAAe,EACf,AAAOC,KAAa,CACpB;QACA,KAAK,CAACD,eAFCC,QAAAA;QAGP,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA;;;;;;;CAOC,GACD,SAASC,eAAeC,KAAa;IACnC,IAAI;QACF,uCAAuC;QACvC,MAAMC,QAAQD,MAAME,KAAK,CAAC;QAC1B,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,MAAM,IAAIR,MAAM;QAClB;QAEA,mCAAmC;QACnC,MAAMS,UAAUH,KAAK,CAAC,EAAE;QACxB,MAAMI,SAASD,QAAQE,OAAO,CAAC,MAAM,KAAKA,OAAO,CAAC,MAAM;QACxD,MAAMC,eAAeF,OAAOG,MAAM,CAACH,OAAOF,MAAM,GAAI,AAAC,CAAA,IAAKE,OAAOF,MAAM,GAAG,CAAC,IAAK,GAAI;QAEpF,MAAMM,iBAAiBC,KAAKC,KAAK,CAACC,OAAOC,IAAI,CAACN,cAAc,UAAUO,QAAQ,CAAC;QAE/E,OAAOL;IACT,EAAE,OAAOM,OAAO;QACd,MAAM,IAAIrB,kBACR,CAAC,4BAA4B,EAAEqB,iBAAiBpB,QAAQoB,MAAMnB,OAAO,GAAG,iBAAiB,EACzFmB,iBAAiBpB,QAAQoB,QAAQC;IAErC;AACF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC,qBACpBC,UAAsB,EACtBC,QAAgB;IAEhB,iDAAiD;IACjD,IAAID,WAAWE,oBAAoB,CAACD,WAAW;QAC7C,MAAME,eAAeH,WAAWhC,eAAe,CAACiC;QAChD,OAAOE,cAAcrB,SAAS;IAChC;IAEA,uCAAuC;IACvC,qEAAqE;IACrE,IAAIsB;IACJ,IAAI;QACFA,cAAc,MAAM7B,oBAAoByB;IAC1C,EAAE,OAAOH,OAAO;QACd,MAAM,IAAIrB,kBACR,8DACAqB,iBAAiBpB,QAAQoB,QAAQC;IAErC;IAEA,IAAI,CAACM,aAAa;QAChB,8DAA8D;QAC9D,OAAO;IACT;IAEA,+CAA+C;IAC/C,MAAMD,eAAe,MAAMlC,kBAAkBmC,aAAaH;IAE1D,yDAAyD;IACzD,MAAMI,aAAaC,QAAQC,GAAG,CAACC,wBAAwB,KAAK;IAC5D,IAAIC;IAEJ,IAAIJ,YAAY;QACd,sDAAsD;QACtD,IAAIlC,WAAW;YACbC,IAAIsC,KAAK,CAAC;QACZ;QACAD,kBAAkB5B,eAAesB,aAAarB,KAAK;IACrD,OAAO;QACL,4CAA4C;QAC5C,IAAI;YACF2B,kBAAkB,MAAMnC,qBAAqB6B,aAAarB,KAAK,EAAEZ;QACnE,EAAE,OAAOyC,iBAAiB;YACxB,2BAA2B;YAC3B,IAAIA,2BAA2BtC,oBAAoB;gBACjD,MAAM,IAAIG,kBACR,CAAC,iCAAiC,EAAEmC,gBAAgBjC,OAAO,EAAE,EAC7DiC;YAEJ;YACA,MAAMA;QACR;IACF;IAEA,8BAA8B;IAC9B,IAAI,CAACF,gBAAgBG,GAAG,EAAE;QACxB,MAAM,IAAIpC,kBAAkB;IAC9B;IAEA,+DAA+D;IAC/DwB,WAAWa,eAAe,CAACZ,UAAU;QACnCa,QAAQL;QACRM,WAAWN,gBAAgBG,GAAG,GAAG;QACjCX;QACAnB,OAAOqB,aAAarB,KAAK;IAC3B;IAEA,OAAOqB,aAAarB,KAAK;AAC3B;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAekC,oBACpBhB,UAAsB,EACtBC,QAAgB;IAEhB,sDAAsD;IACtDD,WAAWiB,iBAAiB,CAAChB;IAE7B,uEAAuE;IACvE,OAAOF,qBAAqBC,YAAYC;AAC1C"}

package/dist/auth/project-token.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=project-token.spec.d.ts.map

package/dist/auth/project-token.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-token.spec.d.ts","sourceRoot":"","sources":["../../src/auth/project-token.spec.ts"],"names":[],"mappings":""}

package/dist/auth/project-token.spec.js

@@ -0,0 +1,332 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import * as figmaApi from '../api/figma-api.js';
+import * as constants from '../constants.js';
+import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
+import * as oauthFlow from './oauth-flow.js';
+import { getValidProjectToken, ProjectTokenError, refreshProjectToken } from './project-token.js';
+import { TokenStore } from './token-store.js';
+// Mock all external dependencies
+vi.mock('../api/figma-api.js');
+vi.mock('./oauth-flow.js');
+vi.mock('../constants.js');
+// Mock only the validateProjectToken function from jwt-validator
+// Keep JWTValidationError class unmocked so it works properly in tests
+vi.mock('./jwt-validator.js', async (importOriginal)=>{
+    // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        validateProjectToken: vi.fn()
+    };
+});
+describe('Project Token Management', ()=>{
+    let tokenStore;
+    const mockTenantId = 'test-tenant-123';
+    const mockAccessToken = 'figt_mock_access_token';
+    const mockProjectTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.mock.signature';
+    let originalEnv;
+    beforeEach(()=>{
+        // Create a unique test store for each test
+        tokenStore = new TokenStore({
+            configName: `payloadcms-figma-test-${Date.now()}`
+        });
+        // Disable mocking to test real validation flow
+        originalEnv = process.env.FIGMA_MOCK_PROJECT_TOKEN;
+        process.env.FIGMA_MOCK_PROJECT_TOKEN = 'false';
+        // Default mock implementations
+        vi.mocked(constants.getEnvironment).mockReturnValue('staging');
+        vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(mockAccessToken);
+        vi.mocked(figmaApi.getProjectToken).mockResolvedValue({
+            expiresAt: Date.now() + 30 * 60 * 1000,
+            tenantId: mockTenantId,
+            token: mockProjectTokenJWT
+        });
+        vi.mocked(validateProjectToken).mockResolvedValue({
+            aud: mockTenantId,
+            email: 'test@example.com',
+            exp: Math.floor(Date.now() / 1000) + 1800,
+            iat: Math.floor(Date.now() / 1000),
+            seat_type: 'full'
+        });
+    });
+    afterEach(()=>{
+        tokenStore.clearTokens();
+        tokenStore.clearAllProjectTokens();
+        vi.clearAllMocks();
+        // Restore original environment
+        if (originalEnv === undefined) {
+            delete process.env.FIGMA_MOCK_PROJECT_TOKEN;
+        } else {
+            process.env.FIGMA_MOCK_PROJECT_TOKEN = originalEnv;
+        }
+    });
+    describe('getValidProjectToken', ()=>{
+        describe('with valid cached token', ()=>{
+            it('should return cached token immediately without API calls', async ()=>{
+                // Store a valid project token
+                const validToken = {
+                    claims: {
+                        aud: mockTenantId,
+                        email: 'test@example.com',
+                        exp: Math.floor(Date.now() / 1000) + 1800,
+                        iat: Math.floor(Date.now() / 1000),
+                        seat_type: 'full'
+                    },
+                    expiresAt: Date.now() + 30 * 60 * 1000,
+                    tenantId: mockTenantId,
+                    token: mockProjectTokenJWT
+                };
+                tokenStore.setProjectToken(mockTenantId, validToken);
+                const result = await getValidProjectToken(tokenStore, mockTenantId);
+                expect(result).toBe(mockProjectTokenJWT);
+                // Should not call any external APIs
+                expect(oauthFlow.getValidAccessToken).not.toHaveBeenCalled();
+                expect(figmaApi.getProjectToken).not.toHaveBeenCalled();
+                expect(validateProjectToken).not.toHaveBeenCalled();
+            });
+            it('should use hasValidProjectToken for expiry check', async ()=>{
+                // Mock hasValidProjectToken to return true
+                const hasValidSpy = vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(true);
+                const getTokenSpy = vi.spyOn(tokenStore, 'getProjectToken').mockReturnValue({
+                    claims: {
+                        exp: Math.floor(Date.now() / 1000) + 1800
+                    },
+                    expiresAt: Date.now() + 30 * 60 * 1000,
+                    tenantId: mockTenantId,
+                    token: mockProjectTokenJWT
+                });
+                await getValidProjectToken(tokenStore, mockTenantId);
+                expect(hasValidSpy).toHaveBeenCalledWith(mockTenantId);
+                expect(getTokenSpy).toHaveBeenCalledWith(mockTenantId);
+            });
+        });
+        describe('with expired or missing token', ()=>{
+            it('should fetch new token when no cached token exists', async ()=>{
+                const result = await getValidProjectToken(tokenStore, mockTenantId);
+                expect(result).toBe(mockProjectTokenJWT);
+                expect(oauthFlow.getValidAccessToken).toHaveBeenCalledWith(tokenStore);
+                expect(figmaApi.getProjectToken).toHaveBeenCalledWith(mockAccessToken, mockTenantId);
+                expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging');
+            });
+            it('should fetch new token when cached token is expired', async ()=>{
+                // Mock hasValidProjectToken to return false (expired)
+                vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(false);
+                const result = await getValidProjectToken(tokenStore, mockTenantId);
+                expect(result).toBe(mockProjectTokenJWT);
+                expect(figmaApi.getProjectToken).toHaveBeenCalled();
+            });
+            it('should apply 5-minute expiry buffer through hasValidProjectToken', async ()=>{
+                // Store a token expiring in 4 minutes (within 5-minute buffer)
+                const expiringToken = {
+                    claims: {
+                        exp: Math.floor(Date.now() / 1000) + 240
+                    },
+                    expiresAt: Date.now() + 4 * 60 * 1000,
+                    tenantId: mockTenantId,
+                    token: 'expiring-token'
+                };
+                tokenStore.setProjectToken(mockTenantId, expiringToken);
+                // hasValidProjectToken should return false due to buffer
+                expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(false);
+                // Should refresh the token
+                await getValidProjectToken(tokenStore, mockTenantId);
+                expect(figmaApi.getProjectToken).toHaveBeenCalled();
+            });
+        });
+        describe('JWT validation integration', ()=>{
+            it('should validate JWT signature after fetching', async ()=>{
+                await getValidProjectToken(tokenStore, mockTenantId);
+                expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging');
+            });
+            it('should use correct environment for validation', async ()=>{
+                vi.mocked(constants.getEnvironment).mockReturnValue('production');
+                await getValidProjectToken(tokenStore, mockTenantId);
+                expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'production');
+            });
+            it('should throw ProjectTokenError on validation failure', async ()=>{
+                const validationError = new JWTValidationError('Invalid signature', 'SIGNATURE_INVALID');
+                vi.mocked(validateProjectToken).mockRejectedValue(validationError);
+                try {
+                    await getValidProjectToken(tokenStore, mockTenantId);
+                    expect.fail('Should have thrown ProjectTokenError');
+                } catch (error) {
+                    expect(error).toBeInstanceOf(ProjectTokenError);
+                    if (error instanceof ProjectTokenError) {
+                        expect(error.message).toContain('Project token validation failed');
+                        expect(error.message).toContain('Invalid signature');
+                        expect(error.cause).toBe(validationError);
+                    }
+                }
+            });
+            it('should rethrow non-JWTValidationError errors', async ()=>{
+                const genericError = new Error('Network error');
+                vi.mocked(validateProjectToken).mockRejectedValue(genericError);
+                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(genericError);
+            });
+            it('should throw error if JWT missing exp claim', async ()=>{
+                // Mock validation returning claims without exp
+                vi.mocked(validateProjectToken).mockResolvedValue({
+                    aud: mockTenantId
+                });
+                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(ProjectTokenError);
+                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow('missing expiration (exp) claim');
+            });
+        });
+        describe('claims storage', ()=>{
+            it('should store validated claims with token', async ()=>{
+                const mockClaims = {
+                    aud: mockTenantId,
+                    email: 'user@example.com',
+                    exp: Math.floor(Date.now() / 1000) + 1800,
+                    iat: Math.floor(Date.now() / 1000),
+                    seat_type: 'full'
+                };
+                vi.mocked(validateProjectToken).mockResolvedValue(mockClaims);
+                await getValidProjectToken(tokenStore, mockTenantId);
+                const storedToken = tokenStore.getProjectToken(mockTenantId);
+                expect(storedToken?.claims).toEqual(mockClaims);
+            });
+            it('should convert exp from seconds to milliseconds for expiresAt', async ()=>{
+                const expInSeconds = Math.floor(Date.now() / 1000) + 1800 // 30 min from now
+                ;
+                vi.mocked(validateProjectToken).mockResolvedValue({
+                    aud: mockTenantId,
+                    exp: expInSeconds
+                });
+                await getValidProjectToken(tokenStore, mockTenantId);
+                const storedToken = tokenStore.getProjectToken(mockTenantId);
+                expect(storedToken?.expiresAt).toBe(expInSeconds * 1000);
+            });
+            it('should store token with correct tenantId', async ()=>{
+                await getValidProjectToken(tokenStore, mockTenantId);
+                const storedToken = tokenStore.getProjectToken(mockTenantId);
+                expect(storedToken?.tenantId).toBe(mockTenantId);
+                expect(storedToken?.token).toBe(mockProjectTokenJWT);
+            });
+        });
+        describe('error handling', ()=>{
+            it('should throw ProjectTokenError when no user access token available', async ()=>{
+                vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(new Error('User not authenticated'));
+                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(ProjectTokenError);
+                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow('Failed to get valid access token');
+            });
+            it('should return null when getValidAccessToken returns null', async ()=>{
+                vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null);
+                const result = await getValidProjectToken(tokenStore, mockTenantId);
+                expect(result).toBeNull();
+                // Should not call API if no access token
+                expect(figmaApi.getProjectToken).not.toHaveBeenCalled();
+            });
+            it('should handle API 401 errors', async ()=>{
+                const apiError = new figmaApi.FigmaApiError('Unauthorized', 401);
+                vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError);
+                try {
+                    await getValidProjectToken(tokenStore, mockTenantId);
+                    expect.fail('Should have thrown error');
+                } catch (error) {
+                    expect(error).toBe(apiError);
+                    expect(error).toBeInstanceOf(figmaApi.FigmaApiError);
+                }
+            });
+            it('should handle API 404 errors (tenant not found)', async ()=>{
+                const apiError = new figmaApi.FigmaApiError('Tenant not found', 404);
+                vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError);
+                try {
+                    await getValidProjectToken(tokenStore, mockTenantId);
+                    expect.fail('Should have thrown error');
+                } catch (error) {
+                    expect(error).toBe(apiError);
+                    expect(error).toBeInstanceOf(figmaApi.FigmaApiError);
+                }
+            });
+            it('should handle network errors', async ()=>{
+                const networkError = new Error('Network timeout');
+                vi.mocked(figmaApi.getProjectToken).mockRejectedValue(networkError);
+                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(networkError);
+            });
+            it('should wrap getValidAccessToken errors in ProjectTokenError', async ()=>{
+                const authError = new Error('OAuth refresh failed');
+                vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(authError);
+                try {
+                    await getValidProjectToken(tokenStore, mockTenantId);
+                    expect.fail('Should have thrown ProjectTokenError');
+                } catch (error) {
+                    expect(error).toBeInstanceOf(ProjectTokenError);
+                    if (error instanceof ProjectTokenError) {
+                        expect(error.cause).toBe(authError);
+                        expect(error.message).toContain('Failed to get valid access token');
+                    }
+                }
+            });
+        });
+    });
+    describe('refreshProjectToken', ()=>{
+        it('should clear existing token before fetching new one', async ()=>{
+            // Store an existing token
+            const existingToken = {
+                claims: {
+                    exp: Math.floor(Date.now() / 1000) + 1800
+                },
+                expiresAt: Date.now() + 30 * 60 * 1000,
+                tenantId: mockTenantId,
+                token: 'old-token'
+            };
+            tokenStore.setProjectToken(mockTenantId, existingToken);
+            const clearSpy = vi.spyOn(tokenStore, 'clearProjectToken');
+            await refreshProjectToken(tokenStore, mockTenantId);
+            expect(clearSpy).toHaveBeenCalledWith(mockTenantId);
+        });
+        it('should call getValidProjectToken after clearing', async ()=>{
+            const result = await refreshProjectToken(tokenStore, mockTenantId);
+            expect(result).toBe(mockProjectTokenJWT);
+            // Verify API was called (meaning cache was bypassed)
+            expect(figmaApi.getProjectToken).toHaveBeenCalled();
+        });
+        it('should force refresh even if token is still valid', async ()=>{
+            // Store a valid token
+            const validToken = {
+                claims: {
+                    exp: Math.floor(Date.now() / 1000) + 3600
+                },
+                expiresAt: Date.now() + 60 * 60 * 1000,
+                tenantId: mockTenantId,
+                token: 'valid-token'
+            };
+            tokenStore.setProjectToken(mockTenantId, validToken);
+            // Verify it's considered valid
+            expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(true);
+            await refreshProjectToken(tokenStore, mockTenantId);
+            // Should have fetched new token despite valid cache
+            expect(figmaApi.getProjectToken).toHaveBeenCalled();
+        });
+        it('should return new token after refresh', async ()=>{
+            const newTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.new.signature';
+            vi.mocked(figmaApi.getProjectToken).mockResolvedValue({
+                expiresAt: Date.now() + 30 * 60 * 1000,
+                tenantId: mockTenantId,
+                token: newTokenJWT
+            });
+            const result = await refreshProjectToken(tokenStore, mockTenantId);
+            expect(result).toBe(newTokenJWT);
+            expect(tokenStore.getProjectToken(mockTenantId)?.token).toBe(newTokenJWT);
+        });
+        it('should propagate errors from getValidProjectToken', async ()=>{
+            const apiError = new figmaApi.FigmaApiError('API Error', 500);
+            vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError);
+            try {
+                await refreshProjectToken(tokenStore, mockTenantId);
+                expect.fail('Should have thrown error');
+            } catch (error) {
+                expect(error).toBe(apiError);
+                expect(error).toBeInstanceOf(figmaApi.FigmaApiError);
+            }
+        });
+        it('should return null when refresh fails due to no access token', async ()=>{
+            vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null);
+            const result = await refreshProjectToken(tokenStore, mockTenantId);
+            expect(result).toBeNull();
+        });
+    });
+});
+
+//# sourceMappingURL=project-token.spec.js.map

package/dist/auth/project-token.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/project-token.spec.ts"],"sourcesContent":["import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { ProjectToken } from './types.js'\n\nimport * as figmaApi from '../api/figma-api.js'\nimport * as constants from '../constants.js'\nimport { JWTValidationError, validateProjectToken } from './jwt-validator.js'\nimport * as oauthFlow from './oauth-flow.js'\nimport { getValidProjectToken, ProjectTokenError, refreshProjectToken } from './project-token.js'\nimport { TokenStore } from './token-store.js'\n\n// Mock all external dependencies\nvi.mock('../api/figma-api.js')\nvi.mock('./oauth-flow.js')\nvi.mock('../constants.js')\n\n// Mock only the validateProjectToken function from jwt-validator\n// Keep JWTValidationError class unmocked so it works properly in tests\nvi.mock('./jwt-validator.js', async (importOriginal) => {\n  // eslint-disable-next-line @typescript-eslint/consistent-type-imports\n  const actual = await importOriginal<typeof import('./jwt-validator.js')>()\n  return {\n    ...actual,\n    validateProjectToken: vi.fn(),\n  }\n})\n\ndescribe('Project Token Management', () => {\n  let tokenStore: TokenStore\n  const mockTenantId = 'test-tenant-123'\n  const mockAccessToken = 'figt_mock_access_token'\n  const mockProjectTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.mock.signature'\n  let originalEnv: string | undefined\n\n  beforeEach(() => {\n    // Create a unique test store for each test\n    tokenStore = new TokenStore({ configName: `payloadcms-figma-test-${Date.now()}` })\n\n    // Disable mocking to test real validation flow\n    originalEnv = process.env.FIGMA_MOCK_PROJECT_TOKEN\n    process.env.FIGMA_MOCK_PROJECT_TOKEN = 'false'\n\n    // Default mock implementations\n    vi.mocked(constants.getEnvironment).mockReturnValue('staging')\n    vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(mockAccessToken)\n    vi.mocked(figmaApi.getProjectToken).mockResolvedValue({\n      expiresAt: Date.now() + 30 * 60 * 1000, // 30 minutes (milliseconds)\n      tenantId: mockTenantId,\n      token: mockProjectTokenJWT,\n    })\n    vi.mocked(validateProjectToken).mockResolvedValue({\n      aud: mockTenantId, // Audience claim contains the CMS ID\n      email: 'test@example.com',\n      exp: Math.floor(Date.now() / 1000) + 1800, // 30 minutes in seconds\n      iat: Math.floor(Date.now() / 1000),\n      seat_type: 'full',\n    })\n  })\n\n  afterEach(() => {\n    tokenStore.clearTokens()\n    tokenStore.clearAllProjectTokens()\n    vi.clearAllMocks()\n\n    // Restore original environment\n    if (originalEnv === undefined) {\n      delete process.env.FIGMA_MOCK_PROJECT_TOKEN\n    } else {\n      process.env.FIGMA_MOCK_PROJECT_TOKEN = originalEnv\n    }\n  })\n\n  describe('getValidProjectToken', () => {\n    describe('with valid cached token', () => {\n      it('should return cached token immediately without API calls', async () => {\n        // Store a valid project token\n        const validToken: ProjectToken = {\n          claims: {\n            aud: mockTenantId, // Audience claim contains the CMS ID\n            email: 'test@example.com',\n            exp: Math.floor(Date.now() / 1000) + 1800, // 30 minutes from now\n            iat: Math.floor(Date.now() / 1000),\n            seat_type: 'full',\n          },\n          expiresAt: Date.now() + 30 * 60 * 1000, // 30 minutes\n          tenantId: mockTenantId,\n          token: mockProjectTokenJWT,\n        }\n        tokenStore.setProjectToken(mockTenantId, validToken)\n\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBe(mockProjectTokenJWT)\n        // Should not call any external APIs\n        expect(oauthFlow.getValidAccessToken).not.toHaveBeenCalled()\n        expect(figmaApi.getProjectToken).not.toHaveBeenCalled()\n        expect(validateProjectToken).not.toHaveBeenCalled()\n      })\n\n      it('should use hasValidProjectToken for expiry check', async () => {\n        // Mock hasValidProjectToken to return true\n        const hasValidSpy = vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(true)\n        const getTokenSpy = vi.spyOn(tokenStore, 'getProjectToken').mockReturnValue({\n          claims: { exp: Math.floor(Date.now() / 1000) + 1800 },\n          expiresAt: Date.now() + 30 * 60 * 1000,\n          tenantId: mockTenantId,\n          token: mockProjectTokenJWT,\n        })\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(hasValidSpy).toHaveBeenCalledWith(mockTenantId)\n        expect(getTokenSpy).toHaveBeenCalledWith(mockTenantId)\n      })\n    })\n\n    describe('with expired or missing token', () => {\n      it('should fetch new token when no cached token exists', async () => {\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBe(mockProjectTokenJWT)\n        expect(oauthFlow.getValidAccessToken).toHaveBeenCalledWith(tokenStore)\n        expect(figmaApi.getProjectToken).toHaveBeenCalledWith(mockAccessToken, mockTenantId)\n        expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging')\n      })\n\n      it('should fetch new token when cached token is expired', async () => {\n        // Mock hasValidProjectToken to return false (expired)\n        vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(false)\n\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBe(mockProjectTokenJWT)\n        expect(figmaApi.getProjectToken).toHaveBeenCalled()\n      })\n\n      it('should apply 5-minute expiry buffer through hasValidProjectToken', async () => {\n        // Store a token expiring in 4 minutes (within 5-minute buffer)\n        const expiringToken: ProjectToken = {\n          claims: { exp: Math.floor(Date.now() / 1000) + 240 }, // 4 minutes\n          expiresAt: Date.now() + 4 * 60 * 1000,\n          tenantId: mockTenantId,\n          token: 'expiring-token',\n        }\n        tokenStore.setProjectToken(mockTenantId, expiringToken)\n\n        // hasValidProjectToken should return false due to buffer\n        expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(false)\n\n        // Should refresh the token\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(figmaApi.getProjectToken).toHaveBeenCalled()\n      })\n    })\n\n    describe('JWT validation integration', () => {\n      it('should validate JWT signature after fetching', async () => {\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging')\n      })\n\n      it('should use correct environment for validation', async () => {\n        vi.mocked(constants.getEnvironment).mockReturnValue('production')\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'production')\n      })\n\n      it('should throw ProjectTokenError on validation failure', async () => {\n        const validationError = new JWTValidationError('Invalid signature', 'SIGNATURE_INVALID')\n        vi.mocked(validateProjectToken).mockRejectedValue(validationError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown ProjectTokenError')\n        } catch (error) {\n          expect(error).toBeInstanceOf(ProjectTokenError)\n          if (error instanceof ProjectTokenError) {\n            expect(error.message).toContain('Project token validation failed')\n            expect(error.message).toContain('Invalid signature')\n            expect(error.cause).toBe(validationError)\n          }\n        }\n      })\n\n      it('should rethrow non-JWTValidationError errors', async () => {\n        const genericError = new Error('Network error')\n        vi.mocked(validateProjectToken).mockRejectedValue(genericError)\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(genericError)\n      })\n\n      it('should throw error if JWT missing exp claim', async () => {\n        // Mock validation returning claims without exp\n        vi.mocked(validateProjectToken).mockResolvedValue({\n          aud: mockTenantId,\n          // No exp claim - intentionally omitted to test validation\n        })\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          ProjectTokenError,\n        )\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          'missing expiration (exp) claim',\n        )\n      })\n    })\n\n    describe('claims storage', () => {\n      it('should store validated claims with token', async () => {\n        const mockClaims = {\n          aud: mockTenantId,\n          email: 'user@example.com',\n          exp: Math.floor(Date.now() / 1000) + 1800,\n          iat: Math.floor(Date.now() / 1000),\n          seat_type: 'full',\n        }\n        vi.mocked(validateProjectToken).mockResolvedValue(mockClaims)\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        const storedToken = tokenStore.getProjectToken(mockTenantId)\n        expect(storedToken?.claims).toEqual(mockClaims)\n      })\n\n      it('should convert exp from seconds to milliseconds for expiresAt', async () => {\n        const expInSeconds = Math.floor(Date.now() / 1000) + 1800 // 30 min from now\n        vi.mocked(validateProjectToken).mockResolvedValue({\n          aud: mockTenantId,\n          exp: expInSeconds,\n        })\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        const storedToken = tokenStore.getProjectToken(mockTenantId)\n        expect(storedToken?.expiresAt).toBe(expInSeconds * 1000)\n      })\n\n      it('should store token with correct tenantId', async () => {\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        const storedToken = tokenStore.getProjectToken(mockTenantId)\n        expect(storedToken?.tenantId).toBe(mockTenantId)\n        expect(storedToken?.token).toBe(mockProjectTokenJWT)\n      })\n    })\n\n    describe('error handling', () => {\n      it('should throw ProjectTokenError when no user access token available', async () => {\n        vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(\n          new Error('User not authenticated'),\n        )\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          ProjectTokenError,\n        )\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          'Failed to get valid access token',\n        )\n      })\n\n      it('should return null when getValidAccessToken returns null', async () => {\n        vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null)\n\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBeNull()\n        // Should not call API if no access token\n        expect(figmaApi.getProjectToken).not.toHaveBeenCalled()\n      })\n\n      it('should handle API 401 errors', async () => {\n        const apiError = new figmaApi.FigmaApiError('Unauthorized', 401)\n        vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown error')\n        } catch (error) {\n          expect(error).toBe(apiError)\n          expect(error).toBeInstanceOf(figmaApi.FigmaApiError)\n        }\n      })\n\n      it('should handle API 404 errors (tenant not found)', async () => {\n        const apiError = new figmaApi.FigmaApiError('Tenant not found', 404)\n        vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown error')\n        } catch (error) {\n          expect(error).toBe(apiError)\n          expect(error).toBeInstanceOf(figmaApi.FigmaApiError)\n        }\n      })\n\n      it('should handle network errors', async () => {\n        const networkError = new Error('Network timeout')\n        vi.mocked(figmaApi.getProjectToken).mockRejectedValue(networkError)\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(networkError)\n      })\n\n      it('should wrap getValidAccessToken errors in ProjectTokenError', async () => {\n        const authError = new Error('OAuth refresh failed')\n        vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(authError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown ProjectTokenError')\n        } catch (error) {\n          expect(error).toBeInstanceOf(ProjectTokenError)\n          if (error instanceof ProjectTokenError) {\n            expect(error.cause).toBe(authError)\n            expect(error.message).toContain('Failed to get valid access token')\n          }\n        }\n      })\n    })\n  })\n\n  describe('refreshProjectToken', () => {\n    it('should clear existing token before fetching new one', async () => {\n      // Store an existing token\n      const existingToken: ProjectToken = {\n        claims: { exp: Math.floor(Date.now() / 1000) + 1800 },\n        expiresAt: Date.now() + 30 * 60 * 1000,\n        tenantId: mockTenantId,\n        token: 'old-token',\n      }\n      tokenStore.setProjectToken(mockTenantId, existingToken)\n\n      const clearSpy = vi.spyOn(tokenStore, 'clearProjectToken')\n\n      await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(clearSpy).toHaveBeenCalledWith(mockTenantId)\n    })\n\n    it('should call getValidProjectToken after clearing', async () => {\n      const result = await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(result).toBe(mockProjectTokenJWT)\n      // Verify API was called (meaning cache was bypassed)\n      expect(figmaApi.getProjectToken).toHaveBeenCalled()\n    })\n\n    it('should force refresh even if token is still valid', async () => {\n      // Store a valid token\n      const validToken: ProjectToken = {\n        claims: { exp: Math.floor(Date.now() / 1000) + 3600 }, // 1 hour\n        expiresAt: Date.now() + 60 * 60 * 1000,\n        tenantId: mockTenantId,\n        token: 'valid-token',\n      }\n      tokenStore.setProjectToken(mockTenantId, validToken)\n\n      // Verify it's considered valid\n      expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(true)\n\n      await refreshProjectToken(tokenStore, mockTenantId)\n\n      // Should have fetched new token despite valid cache\n      expect(figmaApi.getProjectToken).toHaveBeenCalled()\n    })\n\n    it('should return new token after refresh', async () => {\n      const newTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.new.signature'\n      vi.mocked(figmaApi.getProjectToken).mockResolvedValue({\n        expiresAt: Date.now() + 30 * 60 * 1000, // 30 minutes (milliseconds)\n        tenantId: mockTenantId,\n        token: newTokenJWT,\n      })\n\n      const result = await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(result).toBe(newTokenJWT)\n      expect(tokenStore.getProjectToken(mockTenantId)?.token).toBe(newTokenJWT)\n    })\n\n    it('should propagate errors from getValidProjectToken', async () => {\n      const apiError = new figmaApi.FigmaApiError('API Error', 500)\n      vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError)\n\n      try {\n        await refreshProjectToken(tokenStore, mockTenantId)\n        expect.fail('Should have thrown error')\n      } catch (error) {\n        expect(error).toBe(apiError)\n        expect(error).toBeInstanceOf(figmaApi.FigmaApiError)\n      }\n    })\n\n    it('should return null when refresh fails due to no access token', async () => {\n      vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null)\n\n      const result = await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(result).toBeNull()\n    })\n  })\n})\n"],"names":["afterEach","beforeEach","describe","expect","it","vi","figmaApi","constants","JWTValidationError","validateProjectToken","oauthFlow","getValidProjectToken","ProjectTokenError","refreshProjectToken","TokenStore","mock","importOriginal","actual","fn","tokenStore","mockTenantId","mockAccessToken","mockProjectTokenJWT","originalEnv","configName","Date","now","process","env","FIGMA_MOCK_PROJECT_TOKEN","mocked","getEnvironment","mockReturnValue","getValidAccessToken","mockResolvedValue","getProjectToken","expiresAt","tenantId","token","aud","email","exp","Math","floor","iat","seat_type","clearTokens","clearAllProjectTokens","clearAllMocks","undefined","validToken","claims","setProjectToken","result","toBe","not","toHaveBeenCalled","hasValidSpy","spyOn","getTokenSpy","toHaveBeenCalledWith","expiringToken","hasValidProjectToken","validationError","mockRejectedValue","fail","error","toBeInstanceOf","message","toContain","cause","genericError","Error","rejects","toThrow","mockClaims","storedToken","toEqual","expInSeconds","toBeNull","apiError","FigmaApiError","networkError","authError","existingToken","clearSpy","newTokenJWT"],"mappings":"AAAA,SAASA,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAIxE,YAAYC,cAAc,sBAAqB;AAC/C,YAAYC,eAAe,kBAAiB;AAC5C,SAASC,kBAAkB,EAAEC,oBAAoB,QAAQ,qBAAoB;AAC7E,YAAYC,eAAe,kBAAiB;AAC5C,SAASC,oBAAoB,EAAEC,iBAAiB,EAAEC,mBAAmB,QAAQ,qBAAoB;AACjG,SAASC,UAAU,QAAQ,mBAAkB;AAE7C,iCAAiC;AACjCT,GAAGU,IAAI,CAAC;AACRV,GAAGU,IAAI,CAAC;AACRV,GAAGU,IAAI,CAAC;AAER,iEAAiE;AACjE,uEAAuE;AACvEV,GAAGU,IAAI,CAAC,sBAAsB,OAAOC;IACnC,sEAAsE;IACtE,MAAMC,SAAS,MAAMD;IACrB,OAAO;QACL,GAAGC,MAAM;QACTR,sBAAsBJ,GAAGa,EAAE;IAC7B;AACF;AAEAhB,SAAS,4BAA4B;IACnC,IAAIiB;IACJ,MAAMC,eAAe;IACrB,MAAMC,kBAAkB;IACxB,MAAMC,sBAAsB;IAC5B,IAAIC;IAEJtB,WAAW;QACT,2CAA2C;QAC3CkB,aAAa,IAAIL,WAAW;YAAEU,YAAY,CAAC,sBAAsB,EAAEC,KAAKC,GAAG,IAAI;QAAC;QAEhF,+CAA+C;QAC/CH,cAAcI,QAAQC,GAAG,CAACC,wBAAwB;QAClDF,QAAQC,GAAG,CAACC,wBAAwB,GAAG;QAEvC,+BAA+B;QAC/BxB,GAAGyB,MAAM,CAACvB,UAAUwB,cAAc,EAAEC,eAAe,CAAC;QACpD3B,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAEC,iBAAiB,CAACb;QAC3DhB,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAED,iBAAiB,CAAC;YACpDE,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;YAClCW,UAAUjB;YACVkB,OAAOhB;QACT;QACAjB,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAAC;YAChDK,KAAKnB;YACLoB,OAAO;YACPC,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;YACrCkB,KAAKF,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK;YAC7BmB,WAAW;QACb;IACF;IAEA7C,UAAU;QACRmB,WAAW2B,WAAW;QACtB3B,WAAW4B,qBAAqB;QAChC1C,GAAG2C,aAAa;QAEhB,+BAA+B;QAC/B,IAAIzB,gBAAgB0B,WAAW;YAC7B,OAAOtB,QAAQC,GAAG,CAACC,wBAAwB;QAC7C,OAAO;YACLF,QAAQC,GAAG,CAACC,wBAAwB,GAAGN;QACzC;IACF;IAEArB,SAAS,wBAAwB;QAC/BA,SAAS,2BAA2B;YAClCE,GAAG,4DAA4D;gBAC7D,8BAA8B;gBAC9B,MAAM8C,aAA2B;oBAC/BC,QAAQ;wBACNZ,KAAKnB;wBACLoB,OAAO;wBACPC,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;wBACrCkB,KAAKF,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK;wBAC7BmB,WAAW;oBACb;oBACAT,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;oBAClCW,UAAUjB;oBACVkB,OAAOhB;gBACT;gBACAH,WAAWiC,eAAe,CAAChC,cAAc8B;gBAEzC,MAAMG,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQC,IAAI,CAAChC;gBACpB,oCAAoC;gBACpCnB,OAAOO,UAAUuB,mBAAmB,EAAEsB,GAAG,CAACC,gBAAgB;gBAC1DrD,OAAOG,SAAS6B,eAAe,EAAEoB,GAAG,CAACC,gBAAgB;gBACrDrD,OAAOM,sBAAsB8C,GAAG,CAACC,gBAAgB;YACnD;YAEApD,GAAG,oDAAoD;gBACrD,2CAA2C;gBAC3C,MAAMqD,cAAcpD,GAAGqD,KAAK,CAACvC,YAAY,wBAAwBa,eAAe,CAAC;gBACjF,MAAM2B,cAActD,GAAGqD,KAAK,CAACvC,YAAY,mBAAmBa,eAAe,CAAC;oBAC1EmB,QAAQ;wBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;oBAAK;oBACpDU,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;oBAClCW,UAAUjB;oBACVkB,OAAOhB;gBACT;gBAEA,MAAMX,qBAAqBQ,YAAYC;gBAEvCjB,OAAOsD,aAAaG,oBAAoB,CAACxC;gBACzCjB,OAAOwD,aAAaC,oBAAoB,CAACxC;YAC3C;QACF;QAEAlB,SAAS,iCAAiC;YACxCE,GAAG,sDAAsD;gBACvD,MAAMiD,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQC,IAAI,CAAChC;gBACpBnB,OAAOO,UAAUuB,mBAAmB,EAAE2B,oBAAoB,CAACzC;gBAC3DhB,OAAOG,SAAS6B,eAAe,EAAEyB,oBAAoB,CAACvC,iBAAiBD;gBACvEjB,OAAOM,sBAAsBmD,oBAAoB,CAACtC,qBAAqB;YACzE;YAEAlB,GAAG,uDAAuD;gBACxD,sDAAsD;gBACtDC,GAAGqD,KAAK,CAACvC,YAAY,wBAAwBa,eAAe,CAAC;gBAE7D,MAAMqB,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQC,IAAI,CAAChC;gBACpBnB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;YACnD;YAEApD,GAAG,oEAAoE;gBACrE,+DAA+D;gBAC/D,MAAMyD,gBAA8B;oBAClCV,QAAQ;wBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;oBAAI;oBACnDU,WAAWX,KAAKC,GAAG,KAAK,IAAI,KAAK;oBACjCW,UAAUjB;oBACVkB,OAAO;gBACT;gBACAnB,WAAWiC,eAAe,CAAChC,cAAcyC;gBAEzC,yDAAyD;gBACzD1D,OAAOgB,WAAW2C,oBAAoB,CAAC1C,eAAekC,IAAI,CAAC;gBAE3D,2BAA2B;gBAC3B,MAAM3C,qBAAqBQ,YAAYC;gBAEvCjB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;YACnD;QACF;QAEAtD,SAAS,8BAA8B;YACrCE,GAAG,gDAAgD;gBACjD,MAAMO,qBAAqBQ,YAAYC;gBAEvCjB,OAAOM,sBAAsBmD,oBAAoB,CAACtC,qBAAqB;YACzE;YAEAlB,GAAG,iDAAiD;gBAClDC,GAAGyB,MAAM,CAACvB,UAAUwB,cAAc,EAAEC,eAAe,CAAC;gBAEpD,MAAMrB,qBAAqBQ,YAAYC;gBAEvCjB,OAAOM,sBAAsBmD,oBAAoB,CAACtC,qBAAqB;YACzE;YAEAlB,GAAG,wDAAwD;gBACzD,MAAM2D,kBAAkB,IAAIvD,mBAAmB,qBAAqB;gBACpEH,GAAGyB,MAAM,CAACrB,sBAAsBuD,iBAAiB,CAACD;gBAElD,IAAI;oBACF,MAAMpD,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOC,cAAc,CAACvD;oBAC7B,IAAIsD,iBAAiBtD,mBAAmB;wBACtCT,OAAO+D,MAAME,OAAO,EAAEC,SAAS,CAAC;wBAChClE,OAAO+D,MAAME,OAAO,EAAEC,SAAS,CAAC;wBAChClE,OAAO+D,MAAMI,KAAK,EAAEhB,IAAI,CAACS;oBAC3B;gBACF;YACF;YAEA3D,GAAG,gDAAgD;gBACjD,MAAMmE,eAAe,IAAIC,MAAM;gBAC/BnE,GAAGyB,MAAM,CAACrB,sBAAsBuD,iBAAiB,CAACO;gBAElD,MAAMpE,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAACH;YAC/E;YAEAnE,GAAG,+CAA+C;gBAChD,+CAA+C;gBAC/CC,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAAC;oBAChDK,KAAKnB;gBAEP;gBAEA,MAAMjB,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E9D;gBAEF,MAAMT,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E;YAEJ;QACF;QAEAxE,SAAS,kBAAkB;YACzBE,GAAG,4CAA4C;gBAC7C,MAAMuE,aAAa;oBACjBpC,KAAKnB;oBACLoB,OAAO;oBACPC,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;oBACrCkB,KAAKF,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK;oBAC7BmB,WAAW;gBACb;gBACAxC,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAACyC;gBAElD,MAAMhE,qBAAqBQ,YAAYC;gBAEvC,MAAMwD,cAAczD,WAAWgB,eAAe,CAACf;gBAC/CjB,OAAOyE,aAAazB,QAAQ0B,OAAO,CAACF;YACtC;YAEAvE,GAAG,iEAAiE;gBAClE,MAAM0E,eAAepC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ,KAAK,kBAAkB;;gBAC5ErB,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAAC;oBAChDK,KAAKnB;oBACLqB,KAAKqC;gBACP;gBAEA,MAAMnE,qBAAqBQ,YAAYC;gBAEvC,MAAMwD,cAAczD,WAAWgB,eAAe,CAACf;gBAC/CjB,OAAOyE,aAAaxC,WAAWkB,IAAI,CAACwB,eAAe;YACrD;YAEA1E,GAAG,4CAA4C;gBAC7C,MAAMO,qBAAqBQ,YAAYC;gBAEvC,MAAMwD,cAAczD,WAAWgB,eAAe,CAACf;gBAC/CjB,OAAOyE,aAAavC,UAAUiB,IAAI,CAAClC;gBACnCjB,OAAOyE,aAAatC,OAAOgB,IAAI,CAAChC;YAClC;QACF;QAEApB,SAAS,kBAAkB;YACzBE,GAAG,sEAAsE;gBACvEC,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAE+B,iBAAiB,CACxD,IAAIQ,MAAM;gBAGZ,MAAMrE,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E9D;gBAEF,MAAMT,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E;YAEJ;YAEAtE,GAAG,4DAA4D;gBAC7DC,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAEC,iBAAiB,CAAC;gBAE3D,MAAMmB,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQ0B,QAAQ;gBACvB,yCAAyC;gBACzC5E,OAAOG,SAAS6B,eAAe,EAAEoB,GAAG,CAACC,gBAAgB;YACvD;YAEApD,GAAG,gCAAgC;gBACjC,MAAM4E,WAAW,IAAI1E,SAAS2E,aAAa,CAAC,gBAAgB;gBAC5D5E,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACgB;gBAEtD,IAAI;oBACF,MAAMrE,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOZ,IAAI,CAAC0B;oBACnB7E,OAAO+D,OAAOC,cAAc,CAAC7D,SAAS2E,aAAa;gBACrD;YACF;YAEA7E,GAAG,mDAAmD;gBACpD,MAAM4E,WAAW,IAAI1E,SAAS2E,aAAa,CAAC,oBAAoB;gBAChE5E,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACgB;gBAEtD,IAAI;oBACF,MAAMrE,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOZ,IAAI,CAAC0B;oBACnB7E,OAAO+D,OAAOC,cAAc,CAAC7D,SAAS2E,aAAa;gBACrD;YACF;YAEA7E,GAAG,gCAAgC;gBACjC,MAAM8E,eAAe,IAAIV,MAAM;gBAC/BnE,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACkB;gBAEtD,MAAM/E,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAACQ;YAC/E;YAEA9E,GAAG,+DAA+D;gBAChE,MAAM+E,YAAY,IAAIX,MAAM;gBAC5BnE,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAE+B,iBAAiB,CAACmB;gBAE3D,IAAI;oBACF,MAAMxE,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOC,cAAc,CAACvD;oBAC7B,IAAIsD,iBAAiBtD,mBAAmB;wBACtCT,OAAO+D,MAAMI,KAAK,EAAEhB,IAAI,CAAC6B;wBACzBhF,OAAO+D,MAAME,OAAO,EAAEC,SAAS,CAAC;oBAClC;gBACF;YACF;QACF;IACF;IAEAnE,SAAS,uBAAuB;QAC9BE,GAAG,uDAAuD;YACxD,0BAA0B;YAC1B,MAAMgF,gBAA8B;gBAClCjC,QAAQ;oBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;gBAAK;gBACpDU,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;gBAClCW,UAAUjB;gBACVkB,OAAO;YACT;YACAnB,WAAWiC,eAAe,CAAChC,cAAcgE;YAEzC,MAAMC,WAAWhF,GAAGqD,KAAK,CAACvC,YAAY;YAEtC,MAAMN,oBAAoBM,YAAYC;YAEtCjB,OAAOkF,UAAUzB,oBAAoB,CAACxC;QACxC;QAEAhB,GAAG,mDAAmD;YACpD,MAAMiD,SAAS,MAAMxC,oBAAoBM,YAAYC;YAErDjB,OAAOkD,QAAQC,IAAI,CAAChC;YACpB,qDAAqD;YACrDnB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;QACnD;QAEApD,GAAG,qDAAqD;YACtD,sBAAsB;YACtB,MAAM8C,aAA2B;gBAC/BC,QAAQ;oBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;gBAAK;gBACpDU,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;gBAClCW,UAAUjB;gBACVkB,OAAO;YACT;YACAnB,WAAWiC,eAAe,CAAChC,cAAc8B;YAEzC,+BAA+B;YAC/B/C,OAAOgB,WAAW2C,oBAAoB,CAAC1C,eAAekC,IAAI,CAAC;YAE3D,MAAMzC,oBAAoBM,YAAYC;YAEtC,oDAAoD;YACpDjB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;QACnD;QAEApD,GAAG,yCAAyC;YAC1C,MAAMkF,cAAc;YACpBjF,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAED,iBAAiB,CAAC;gBACpDE,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;gBAClCW,UAAUjB;gBACVkB,OAAOgD;YACT;YAEA,MAAMjC,SAAS,MAAMxC,oBAAoBM,YAAYC;YAErDjB,OAAOkD,QAAQC,IAAI,CAACgC;YACpBnF,OAAOgB,WAAWgB,eAAe,CAACf,eAAekB,OAAOgB,IAAI,CAACgC;QAC/D;QAEAlF,GAAG,qDAAqD;YACtD,MAAM4E,WAAW,IAAI1E,SAAS2E,aAAa,CAAC,aAAa;YACzD5E,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACgB;YAEtD,IAAI;gBACF,MAAMnE,oBAAoBM,YAAYC;gBACtCjB,OAAO8D,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACd/D,OAAO+D,OAAOZ,IAAI,CAAC0B;gBACnB7E,OAAO+D,OAAOC,cAAc,CAAC7D,SAAS2E,aAAa;YACrD;QACF;QAEA7E,GAAG,gEAAgE;YACjEC,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAEC,iBAAiB,CAAC;YAE3D,MAAMmB,SAAS,MAAMxC,oBAAoBM,YAAYC;YAErDjB,OAAOkD,QAAQ0B,QAAQ;QACzB;IACF;AACF"}

package/dist/auth/refresh.d.ts

@@ -0,0 +1,35 @@
+import type { FigmaTokens } from './types.js';
+/**
+ * Error thrown when token refresh fails
+ */
+export declare class TokenRefreshError extends Error {
+    statusCode?: number | undefined;
+    constructor(message: string, statusCode?: number | undefined);
+}
+/**
+ * Refresh an expired OAuth2 access token using a refresh token
+ *
+ * Makes a POST request to Figma's token endpoint with the refresh token
+ * to obtain a new access token. Uses public client pattern (no client secret).
+ *
+ * @param refreshToken - The refresh token to use
+ * @param clientId - OAuth2 client ID (defaults to config)
+ * @returns Promise resolving to new tokens
+ * @throws TokenRefreshError if refresh fails
+ */
+export declare function refreshAccessToken(refreshToken: string, clientId?: string): Promise<FigmaTokens>;
+/**
+ * Exchange an authorization code for OAuth2 tokens
+ *
+ * This is used during the initial OAuth flow after the user authorizes the app.
+ * Uses public client pattern with PKCE (code verifier is required).
+ *
+ * @param code - Authorization code from OAuth callback
+ * @param codeVerifier - PKCE code verifier (required for public clients)
+ * @param redirectUri - Redirect URI used in the authorization request
+ * @param clientId - OAuth2 client ID (defaults to config)
+ * @returns Promise resolving to tokens
+ * @throws TokenRefreshError if exchange fails
+ */
+export declare function exchangeCodeForTokens(code: string, codeVerifier: string, redirectUri?: string, clientId?: string): Promise<FigmaTokens>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/auth/refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,WAAW,EAAE,MAAM,YAAY,CAAA;AAMjE;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGjC,UAAU,CAAC,EAAE,MAAM;gBAD1B,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA;CAK7B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,QAAQ,GAAE,MAA8B,GACvC,OAAO,CAAC,WAAW,CAAC,CAmDtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,GAAE,MAAiC,EAC9C,QAAQ,GAAE,MAA8B,GACvC,OAAO,CAAC,WAAW,CAAC,CA8FtB"}