allsquare 0.1.1

package/dist/auth/oauth-client.d.ts

@@ -0,0 +1,43 @@
+import { Context, Effect, Layer } from "effect";
+import { HttpClient } from "effect/unstable/http";
+import { OAuthRequestError } from "../errors.js";
+import type { OAuthEndpoints, TokenResponse } from "./model.js";
+export declare const buildAuthorizationUrl: (options: {
+    readonly endpoint: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly resource: string;
+    readonly scopes: ReadonlyArray<string>;
+    readonly state: string;
+    readonly challenge: string;
+}) => string;
+declare const OAuthClient_base: Context.ServiceClass<OAuthClient, "@allsquare/cli/OAuthClient", {
+    readonly discover: (resource: string) => Effect.Effect<OAuthEndpoints, OAuthRequestError>;
+    readonly register: (options: {
+        readonly endpoints: OAuthEndpoints;
+        readonly name: string;
+        readonly redirectUri: string;
+    }) => Effect.Effect<string, OAuthRequestError>;
+    readonly exchangeCode: (options: {
+        readonly endpoints: OAuthEndpoints;
+        readonly clientId: string;
+        readonly code: string;
+        readonly verifier: string;
+        readonly redirectUri: string;
+    }) => Effect.Effect<TokenResponse, OAuthRequestError>;
+    readonly refresh: (options: {
+        readonly endpoints: OAuthEndpoints;
+        readonly clientId: string;
+        readonly refreshToken: string;
+    }) => Effect.Effect<TokenResponse, OAuthRequestError>;
+    readonly revoke: (options: {
+        readonly endpoints: OAuthEndpoints;
+        readonly clientId: string;
+        readonly token: string;
+    }) => Effect.Effect<void, OAuthRequestError>;
+}>;
+export declare class OAuthClient extends OAuthClient_base {
+    static readonly layer: Layer.Layer<OAuthClient, never, HttpClient.HttpClient>;
+}
+export {};
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/auth/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAC/D,OAAO,EACL,UAAU,EAGX,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAMhD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA+F/D,eAAO,MAAM,qBAAqB,GAAI,SAAS;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,KAAG,MAoBH,CAAA;;uBAGoB,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC;uBACtE,CAAC,OAAO,EAAE;QAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAC7B,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC;2BACvB,CAAC,OAAO,EAAE;QAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;QAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAC7B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC;sBACnC,CAAC,OAAO,EAAE;QAC1B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;QAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC;qBACpC,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;QAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC;;AAvB9C,qBAAa,WAAY,SAAQ,gBAwBC;IAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,yDAuLpB;CACF"}

package/dist/auth/oauth-client.js

@@ -0,0 +1,191 @@
+import { Context, Effect, Layer, Option, Schema } from "effect";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+import { OAuthRequestError } from "../errors.js";
+import { VERSION } from "../version.js";
+import { API_READ_SCOPE, API_WRITE_SCOPE } from "./model.js";
+const ProtectedResourceMetadata = Schema.Struct({
+    resource: Schema.String,
+    authorization_servers: Schema.Array(Schema.String)
+});
+const AuthorizationServerMetadata = Schema.Struct({
+    authorization_endpoint: Schema.String,
+    token_endpoint: Schema.String,
+    registration_endpoint: Schema.String,
+    revocation_endpoint: Schema.String
+});
+const RegistrationResponse = Schema.Struct({
+    client_id: Schema.String,
+    token_endpoint_auth_method: Schema.Literal("none"),
+    scope: Schema.String
+});
+const OAuthTokenResponse = Schema.Struct({
+    access_token: Schema.String,
+    token_type: Schema.Literal("Bearer"),
+    expires_in: Schema.Number,
+    refresh_token: Schema.String,
+    scope: Schema.String
+});
+const OAuthErrorResponse = Schema.Struct({
+    error: Schema.String,
+    error_description: Schema.optionalKey(Schema.String)
+});
+const decodeOAuthError = (body) => {
+    try {
+        const decoded = Schema.decodeUnknownOption(OAuthErrorResponse)(JSON.parse(body));
+        return Option.isSome(decoded)
+            ? {
+                error: decoded.value.error,
+                ...(decoded.value.error_description === undefined
+                    ? {}
+                    : { description: decoded.value.error_description })
+            }
+            : {};
+    }
+    catch {
+        return {};
+    }
+};
+const httpError = (status, body) => {
+    const decoded = decodeOAuthError(body);
+    return new OAuthRequestError({
+        message: decoded.description ?? decoded.error ?? `OAuth request failed with status ${status}`,
+        status,
+        ...(decoded.error === undefined ? {} : { oauthError: decoded.error })
+    });
+};
+const validateHttpsOrLoopback = (value, label) => Effect.try({
+    try: () => {
+        const url = new URL(value);
+        const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+            throw new Error(`${label} must use HTTPS unless it is a loopback URL`);
+        }
+        if (url.username || url.password || url.hash) {
+            throw new Error(`${label} contains unsupported URL components`);
+        }
+        return url.toString().replace(/\/$/, "");
+    },
+    catch: (cause) => new OAuthRequestError({
+        message: cause instanceof Error ? cause.message : `Invalid ${label}`
+    })
+});
+const protectedResourceMetadataUrl = (resource) => {
+    const url = new URL(resource);
+    const path = url.pathname.replace(/^\/+/, "").replace(/\/+$/, "");
+    return `${url.origin}/.well-known/oauth-protected-resource/${path}`;
+};
+const authorizationServerMetadataUrl = (authorizationServer) => new URL("/.well-known/oauth-authorization-server", authorizationServer).toString();
+export const buildAuthorizationUrl = (options) => {
+    const url = new URL(options.endpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", options.clientId);
+    url.searchParams.set("redirect_uri", options.redirectUri);
+    url.searchParams.set("resource", options.resource);
+    url.searchParams.set("scope", options.scopes.join(" "));
+    url.searchParams.set("state", options.state);
+    url.searchParams.set("code_challenge", options.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    const serialized = url.toString();
+    const queryStart = serialized.indexOf("?");
+    if (queryStart === -1)
+        return serialized;
+    // Next.js normalizes loopback IP literals anywhere in a NextURL, including
+    // inside an encoded redirect_uri query value. Encoding the dots preserves
+    // the RFC 8252 loopback literal while remaining equivalent after the OAuth
+    // server parses the query string.
+    return serialized.slice(0, queryStart + 1) +
+        serialized.slice(queryStart + 1).replaceAll("127.0.0.1", "127%2E0%2E0%2E1");
+};
+export class OAuthClient extends Context.Service()("@allsquare/cli/OAuthClient") {
+    static layer = Layer.effect(OAuthClient, Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        const executeJson = (request, schema) => client.execute(request.pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", `allsquare-cli/${VERSION}`))).pipe(Effect.flatMap((response) => {
+            if (response.status < 200 || response.status >= 300) {
+                return response.text.pipe(Effect.orElseSucceed(() => ""), Effect.flatMap((body) => Effect.fail(httpError(response.status, body))));
+            }
+            return HttpClientResponse.schemaBodyJson(schema)(response).pipe(Effect.mapError((cause) => new OAuthRequestError({
+                message: `OAuth server returned an invalid response: ${cause.message}`,
+                status: response.status
+            })));
+        }), Effect.mapError((cause) => cause instanceof OAuthRequestError
+            ? cause
+            : new OAuthRequestError({
+                message: `OAuth request failed: ${cause.message}`
+            })));
+        const executeEmpty = (request) => client.execute(request.pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", `allsquare-cli/${VERSION}`))).pipe(Effect.flatMap((response) => response.status >= 200 && response.status < 300
+            ? Effect.void
+            : response.text.pipe(Effect.orElseSucceed(() => ""), Effect.flatMap((body) => Effect.fail(httpError(response.status, body))))), Effect.mapError((cause) => cause instanceof OAuthRequestError
+            ? cause
+            : new OAuthRequestError({
+                message: `OAuth request failed: ${cause.message}`
+            })));
+        const tokenResponse = (response) => ({
+            accessToken: response.access_token,
+            refreshToken: response.refresh_token,
+            tokenType: response.token_type,
+            expiresIn: response.expires_in,
+            scopes: response.scope.split(/\s+/).filter(Boolean)
+        });
+        return OAuthClient.of({
+            discover: (resource) => Effect.gen(function* () {
+                const canonicalResource = yield* validateHttpsOrLoopback(resource, "API resource");
+                const protectedMetadata = yield* executeJson(HttpClientRequest.get(protectedResourceMetadataUrl(canonicalResource)), ProtectedResourceMetadata);
+                const metadataResource = yield* validateHttpsOrLoopback(protectedMetadata.resource, "protected resource metadata");
+                if (metadataResource !== canonicalResource) {
+                    return yield* new OAuthRequestError({
+                        message: "Protected resource metadata does not match the configured API URL"
+                    });
+                }
+                const authorizationServer = protectedMetadata.authorization_servers[0];
+                if (!authorizationServer) {
+                    return yield* new OAuthRequestError({
+                        message: "Protected resource metadata did not identify an authorization server"
+                    });
+                }
+                const server = yield* validateHttpsOrLoopback(authorizationServer, "authorization server");
+                const metadata = yield* executeJson(HttpClientRequest.get(authorizationServerMetadataUrl(server)), AuthorizationServerMetadata);
+                const authorizationEndpoint = yield* validateHttpsOrLoopback(metadata.authorization_endpoint, "authorization endpoint");
+                const tokenEndpoint = yield* validateHttpsOrLoopback(metadata.token_endpoint, "token endpoint");
+                const registrationEndpoint = yield* validateHttpsOrLoopback(metadata.registration_endpoint, "registration endpoint");
+                const revocationEndpoint = yield* validateHttpsOrLoopback(metadata.revocation_endpoint, "revocation endpoint");
+                return {
+                    resource: canonicalResource,
+                    authorizationEndpoint,
+                    tokenEndpoint,
+                    registrationEndpoint,
+                    revocationEndpoint
+                };
+            }),
+            register: ({ endpoints, name, redirectUri }) => HttpClientRequest.post(endpoints.registrationEndpoint).pipe(HttpClientRequest.bodyJson({
+                client_name: name,
+                redirect_uris: [redirectUri],
+                grant_types: ["authorization_code", "refresh_token"],
+                response_types: ["code"],
+                token_endpoint_auth_method: "none",
+                scope: `${API_READ_SCOPE} ${API_WRITE_SCOPE}`
+            }), Effect.mapError((cause) => new OAuthRequestError({
+                message: `Could not encode client registration: ${cause.message}`
+            })), Effect.flatMap((request) => executeJson(request, RegistrationResponse)), Effect.map((response) => response.client_id)),
+            exchangeCode: ({ endpoints, clientId, code, verifier, redirectUri }) => executeJson(HttpClientRequest.post(endpoints.tokenEndpoint).pipe(HttpClientRequest.bodyUrlParams({
+                grant_type: "authorization_code",
+                client_id: clientId,
+                code,
+                code_verifier: verifier,
+                redirect_uri: redirectUri,
+                resource: endpoints.resource
+            })), OAuthTokenResponse).pipe(Effect.map(tokenResponse)),
+            refresh: ({ endpoints, clientId, refreshToken }) => executeJson(HttpClientRequest.post(endpoints.tokenEndpoint).pipe(HttpClientRequest.bodyUrlParams({
+                grant_type: "refresh_token",
+                client_id: clientId,
+                refresh_token: refreshToken,
+                resource: endpoints.resource
+            })), OAuthTokenResponse).pipe(Effect.map(tokenResponse)),
+            revoke: ({ endpoints, clientId, token }) => executeEmpty(HttpClientRequest.post(endpoints.revocationEndpoint).pipe(HttpClientRequest.bodyUrlParams({
+                client_id: clientId,
+                token,
+                token_type_hint: "refresh_token"
+            })))
+        });
+    }));
+}
+//# sourceMappingURL=oauth-client.js.map

package/dist/auth/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../src/auth/oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/D,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EACL,cAAc,EACd,eAAe,EAChB,MAAM,YAAY,CAAA;AAGnB,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACnD,CAAC,CAAA;AAEF,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,sBAAsB,EAAE,MAAM,CAAC,MAAM;IACrC,cAAc,EAAE,MAAM,CAAC,MAAM;IAC7B,qBAAqB,EAAE,MAAM,CAAC,MAAM;IACpC,mBAAmB,EAAE,MAAM,CAAC,MAAM;CACnC,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC,MAAM;IAC3B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,aAAa,EAAE,MAAM,CAAC,MAAM;IAC5B,KAAK,EAAE,MAAM,CAAC,MAAM;CACrB,CAAC,CAAA;AAEF,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;CACrD,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAGpC,EAAE;IACF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAChF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3B,CAAC,CAAC;gBACE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;gBAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;oBAC/C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;aACtD;YACH,CAAC,CAAC,EAAE,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAChB,MAAc,EACd,IAAY,EACO,EAAE;IACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,IAAI,iBAAiB,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,IAAI,oCAAoC,MAAM,EAAE;QAC7F,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KACtE,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,CAC9B,KAAa,EACb,KAAa,EAC6B,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAA;QACxE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAA;QACjE,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1C,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,iBAAiB,CAAC;QACpB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE;KACrE,CAAC;CACL,CAAC,CAAA;AAEJ,MAAM,4BAA4B,GAAG,CAAC,QAAgB,EAAE,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACjE,OAAO,GAAG,GAAG,CAAC,MAAM,yCAAyC,IAAI,EAAE,CAAA;AACrE,CAAC,CAAA;AAED,MAAM,8BAA8B,GAAG,CAAC,mBAA2B,EAAE,EAAE,CACrE,IAAI,GAAG,CAAC,yCAAyC,EAAE,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAA;AAEpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAQrC,EAAU,EAAE;IACX,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IACjC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,OAAO,UAAU,CAAA;IAExC,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,kCAAkC;IAClC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC;QACxC,UAAU,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;AAC/E,CAAC,CAAA;AAED,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,OAAO,EAwB5C,CAAC,4BAA4B,CAAC;IAChC,MAAM,CAAU,KAAK,GAAG,KAAK,CAAC,MAAM,CAClC,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;QAE3C,MAAM,WAAW,GAAG,CAClB,OAA4C,EAC5C,MAA0D,EACrB,EAAE,CACvC,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACzD,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB,OAAO,EAAE,CAAC,CACtE,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACpD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CACvB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CACxE,CAAA;YACH,CAAC;YACD,OAAO,kBAAkB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,iBAAiB,CAAC;gBACpB,OAAO,EAAE,8CAA8C,KAAK,CAAC,OAAO,EAAE;gBACtE,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC,CACN,CAAA;QACH,CAAC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,iBAAiB;YAChC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,iBAAiB,CAAC;gBACpB,OAAO,EAAE,yBAAyB,KAAK,CAAC,OAAO,EAAE;aAClD,CAAC,CAAC,CACV,CAAA;QAEH,MAAM,YAAY,GAAG,CACnB,OAA4C,EACJ,EAAE,CAC1C,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACzD,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB,OAAO,EAAE,CAAC,CACtE,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAChB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CACxE,CAAC,EACR,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,iBAAiB;YAChC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,iBAAiB,CAAC;gBACpB,OAAO,EAAE,yBAAyB,KAAK,CAAC,OAAO,EAAE;aAClD,CAAC,CAAC,CACV,CAAA;QAEH,MAAM,aAAa,GAAG,CAAC,QAAwC,EAAiB,EAAE,CAAC,CAAC;YAClF,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACpD,CAAC,CAAA;QAEF,OAAO,WAAW,CAAC,EAAE,CAAC;YACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAClB,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;gBAClF,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,WAAW,CAC1C,iBAAiB,CAAC,GAAG,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC,EACtE,yBAAyB,CAC1B,CAAA;gBACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,uBAAuB,CACrD,iBAAiB,CAAC,QAAQ,EAC1B,6BAA6B,CAC9B,CAAA;gBACD,IAAI,gBAAgB,KAAK,iBAAiB,EAAE,CAAC;oBAC3C,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;wBAClC,OAAO,EAAE,mEAAmE;qBAC7E,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;gBACtE,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC;wBAClC,OAAO,EAAE,sEAAsE;qBAChF,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC3C,mBAAmB,EACnB,sBAAsB,CACvB,CAAA;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAW,CACjC,iBAAiB,CAAC,GAAG,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,EAC7D,2BAA2B,CAC5B,CAAA;gBAED,MAAM,qBAAqB,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC1D,QAAQ,CAAC,sBAAsB,EAC/B,wBAAwB,CACzB,CAAA;gBACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAClD,QAAQ,CAAC,cAAc,EACvB,gBAAgB,CACjB,CAAA;gBACD,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,uBAAuB,CACzD,QAAQ,CAAC,qBAAqB,EAC9B,uBAAuB,CACxB,CAAA;gBACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,uBAAuB,CACvD,QAAQ,CAAC,mBAAmB,EAC5B,qBAAqB,CACtB,CAAA;gBAED,OAAO;oBACL,QAAQ,EAAE,iBAAiB;oBAC3B,qBAAqB;oBACrB,aAAa;oBACb,oBAAoB;oBACpB,kBAAkB;iBACnB,CAAA;YACH,CAAC,CAAC;YACJ,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAC7C,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,IAAI,CACzD,iBAAiB,CAAC,QAAQ,CAAC;gBACzB,WAAW,EAAE,IAAI;gBACjB,aAAa,EAAE,CAAC,WAAW,CAAC;gBAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,0BAA0B,EAAE,MAAM;gBAClC,KAAK,EAAE,GAAG,cAAc,IAAI,eAAe,EAAE;aAC9C,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,iBAAiB,CAAC;gBACpB,OAAO,EAAE,yCAAyC,KAAK,CAAC,OAAO,EAAE;aAClE,CAAC,CAAC,EACL,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,EACvE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC7C;YACH,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CACrE,WAAW,CACT,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,IAAI,CAClD,iBAAiB,CAAC,aAAa,CAAC;gBAC9B,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,aAAa,EAAE,QAAQ;gBACvB,YAAY,EAAE,WAAW;gBACzB,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC,CACH,EACD,kBAAkB,CACnB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnC,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CACjD,WAAW,CACT,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,IAAI,CAClD,iBAAiB,CAAC,aAAa,CAAC;gBAC9B,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC,CACH,EACD,kBAAkB,CACnB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CACzC,YAAY,CACV,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CACvD,iBAAiB,CAAC,aAAa,CAAC;gBAC9B,SAAS,EAAE,QAAQ;gBACnB,KAAK;gBACL,eAAe,EAAE,eAAe;aACjC,CAAC,CACH,CACF;SACJ,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA"}

package/dist/auth/pkce.d.ts

@@ -0,0 +1,9 @@
+import { Crypto, Effect } from "effect";
+import { OAuthRequestError } from "../errors.js";
+export interface PkceAuthorization {
+    readonly verifier: string;
+    readonly challenge: string;
+    readonly state: string;
+}
+export declare const createPkceAuthorization: Effect.Effect<PkceAuthorization, OAuthRequestError, Crypto.Crypto>;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAY,MAAM,QAAQ,CAAA;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,CACjD,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,CAAC,MAAM,CAed,CAAA"}

package/dist/auth/pkce.js

@@ -0,0 +1,12 @@
+import { Crypto, Effect, Encoding } from "effect";
+import { OAuthRequestError } from "../errors.js";
+export const createPkceAuthorization = Effect.gen(function* () {
+    const crypto = yield* Crypto.Crypto;
+    const verifier = Encoding.encodeBase64Url(yield* crypto.randomBytes(32));
+    const challenge = Encoding.encodeBase64Url(yield* crypto.digest("SHA-256", new TextEncoder().encode(verifier)));
+    const state = Encoding.encodeBase64Url(yield* crypto.randomBytes(32));
+    return { verifier, challenge, state };
+}).pipe(Effect.mapError((cause) => new OAuthRequestError({
+    message: `Could not create PKCE authorization values: ${cause.message}`
+})));
+//# sourceMappingURL=pkce.js.map

package/dist/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAQhD,MAAM,CAAC,MAAM,uBAAuB,GAIhC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CACxC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACpE,CAAA;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAErE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AACvC,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,IAAI,iBAAiB,CAAC;IACpB,OAAO,EAAE,+CAA+C,KAAK,CAAC,OAAO,EAAE;CACxE,CAAC,CAAC,CACN,CAAA"}

package/dist/command.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "effect/unstable/cli";
+export declare const rootCommand: Command.Command<"allsquare", {}, {}, import("./errors.js").CliConfigError | import("./errors.js").CliStorageError | import("./errors.js").OAuthRequestError | import("./errors.js").OAuthCallbackError | import("./errors.js").AuthRequiredError | import("./errors.js").RefreshLockError | import("./errors.js").ApiRequestError | import("./errors.js").CliInputError | import("./errors.js").UpdateError | import("effect/Terminal").QuitError, import("./config.js").CliConfig | import("./auth/auth-service.js").AuthService | import("./api/client.js").ApiClient | import("effect/unstable/cli/Prompt").Environment | import("./update/update-service.js").UpdateService>;
+//# sourceMappingURL=command.d.ts.map

package/dist/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAa7C,eAAO,MAAM,WAAW,kpBAcvB,CAAA"}

package/dist/command.js

@@ -0,0 +1,24 @@
+import { Command } from "effect/unstable/cli";
+import { agentGuideCommand } from "./commands/agent-guide.js";
+import { authCommand } from "./commands/auth.js";
+import { balancesCommand } from "./commands/balances.js";
+import { configCommand } from "./commands/config.js";
+import { expensesCommand } from "./commands/expenses.js";
+import { groupsCommand } from "./commands/groups.js";
+import { recurringExpensesCommand } from "./commands/recurring-expenses.js";
+import { settlementsCommand } from "./commands/settlements.js";
+import { spendSummaryCommand } from "./commands/spend-summary.js";
+import { updateCommand } from "./commands/update.js";
+export const rootCommand = Command.make("allsquare").pipe(Command.withDescription("Use AllSquare from the command line"), Command.withSubcommands([
+    agentGuideCommand,
+    authCommand,
+    groupsCommand,
+    balancesCommand,
+    expensesCommand,
+    recurringExpensesCommand,
+    settlementsCommand,
+    spendSummaryCommand,
+    updateCommand,
+    configCommand
+]));
+//# sourceMappingURL=command.js.map

package/dist/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CACvD,OAAO,CAAC,eAAe,CAAC,qCAAqC,CAAC,EAC9D,OAAO,CAAC,eAAe,CAAC;IACtB,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,eAAe;IACf,eAAe;IACf,wBAAwB;IACxB,kBAAkB;IAClB,mBAAmB;IACnB,aAAa;IACb,aAAa;CACd,CAAC,CACH,CAAA"}

package/dist/commands/agent-guide.d.ts

@@ -0,0 +1,5 @@
+import { Command } from "effect/unstable/cli";
+export declare const agentGuideCommand: Command.Command<"agent-guide", {
+    readonly json: boolean;
+}, {}, never, never>;
+//# sourceMappingURL=agent-guide.d.ts.map

package/dist/commands/agent-guide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guide.d.ts","sourceRoot":"","sources":["../../src/commands/agent-guide.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAwT7C,eAAO,MAAM,iBAAiB;;oBAY5B,CAAA"}

package/dist/commands/agent-guide.js

@@ -0,0 +1,226 @@
+import { Effect } from "effect";
+import { Command } from "effect/unstable/cli";
+import { printSuccess } from "../output.js";
+import { VERSION } from "../version.js";
+import { jsonFlag } from "./shared.js";
+const guide = {
+    schemaVersion: 1,
+    cliVersion: VERSION,
+    rules: [
+        {
+            id: "discover-before-act",
+            instruction: "List resources first, present readable choices, and map the user's selection to exact IDs. Never make the user choose from unexplained IDs."
+        },
+        {
+            id: "prefer-json",
+            instruction: "Use --json for automation. Parse the stable envelope instead of scraping human tables."
+        },
+        {
+            id: "paginate-completely",
+            instruction: "When a complete expense set matters, follow nextCursor with --cursor until it is null."
+        },
+        {
+            id: "least-privilege",
+            instruction: "Use read commands for discovery and preview. The normal login grants read and write access; this grant does not authorize any particular mutation. Users who need restricted credentials can log in with --read-only."
+        },
+        {
+            id: "authorize-writes",
+            instruction: "Before any mutation, show the intended change and obtain user authorization. --yes records that authorization for non-interactive guarded commands; it is not permission by itself."
+        },
+        {
+            id: "retry-idempotently",
+            instruction: "Reuse one --idempotency-key only when retrying the same logical write, and resend the identical command: the same flags and values, including --currency, --date, and --start-date. The order of repeated flags does not matter. Never reuse a key for a different write."
+        },
+        {
+            id: "recurring-templates",
+            instruction: "A recurring template whose start date is today or earlier creates its first expense immediately; report data.recurringExpense.immediateExpenseId when present. Deleting a template stops future expenses but keeps the ones it already created. Updates cannot change the next date or currency; delete and recreate the template for that."
+        },
+        {
+            id: "handle-errors",
+            instruction: "Retry only when error.retryable is true, and retry writes with the same --idempotency-key. For other errors, fix the input or ask the user. Treat FORBIDDEN on a group ID as possibly a wrong ID, not only a permission problem."
+        },
+        {
+            id: "recognize-replays",
+            instruction: "If a write's JSON output includes \"replayed\": true, nothing new was written; the data is the original result for that key. Say so rather than reporting a new change."
+        },
+        {
+            id: "report-exact-results",
+            instruction: "Report the API result accurately. Do not claim an external payment, email delivery, or other side effect succeeded unless the result confirms it."
+        },
+        {
+            id: "protect-credentials",
+            instruction: "Never print, request, copy, or transmit stored OAuth access or refresh tokens. Use the auth commands and operating-system credential vault."
+        }
+    ],
+    workflows: [
+        {
+            id: "select-expenses",
+            purpose: "Let the user choose current expenses without handling raw IDs.",
+            steps: [
+                {
+                    instruction: "List unsettled expenses in the target group.",
+                    command: "allsquare expenses list --group-id <GROUP_ID> --is-settled false --json"
+                },
+                {
+                    instruction: "Follow nextCursor with --cursor when it is non-null and the user needs the complete set."
+                },
+                {
+                    instruction: "Present a numbered summary with description, amount, date, payer, and participants; retain the corresponding IDs internally."
+                },
+                {
+                    instruction: "Ask the user which entries they mean, then use only the mapped IDs."
+                }
+            ]
+        },
+        {
+            id: "mutate",
+            purpose: "Perform an additive or updating write with explicit intent.",
+            steps: [
+                {
+                    instruction: "Resolve group, member, expense, or recurring-expense IDs with read commands before constructing the write."
+                },
+                {
+                    instruction: "Describe the exact proposed change, including recipients of invitations or notifications."
+                },
+                {
+                    instruction: "After the user authorizes the specific change, run the write command. If it fails with AUTH_REQUIRED, ask the user to run allsquare auth login themselves; do not retry until they have."
+                },
+                {
+                    instruction: "Execute once with --json and report the returned result. Supply a stable idempotency key only when the operation may be retried."
+                }
+            ]
+        },
+        {
+            id: "delete",
+            purpose: "Delete only the exact expense or recurring template the user approved.",
+            steps: [
+                {
+                    instruction: "Read and present the current target, including its ID, before asking for confirmation."
+                },
+                {
+                    instruction: "Obtain explicit confirmation for that target. Do not infer confirmation from an earlier read or edit request."
+                },
+                {
+                    instruction: "After confirmation, execute the relevant delete command with --yes --json."
+                }
+            ]
+        },
+        {
+            id: "update-cli",
+            purpose: "Check for a release and update only a recognized global installation.",
+            steps: [
+                {
+                    instruction: "Perform the read-only check and present the current version, latest version, installation method, and proposed command.",
+                    command: "allsquare update --check --json"
+                },
+                {
+                    instruction: "If no update is available, stop. If automaticUpdateSupported is false, return the supplied guidance and do not improvise an update command."
+                },
+                {
+                    instruction: "Obtain explicit user confirmation for the exact update command."
+                },
+                {
+                    instruction: "Only after confirmation, run the guarded update. Package-manager output is captured so JSON remains parseable.",
+                    command: "allsquare update --yes --json"
+                }
+            ]
+        },
+        {
+            id: "settle-expenses",
+            purpose: "Preview selected expenses, coordinate any external payment, and then record exactly the confirmed settlement.",
+            steps: [
+                {
+                    instruction: "Use the select-expenses workflow and retain only the IDs the user selected."
+                },
+                {
+                    instruction: "Preview those exact IDs before recording anything.",
+                    command: "allsquare settlements preview <GROUP_ID> --expense-id <ID> [--expense-id <ID>] --json"
+                },
+                {
+                    instruction: "Present every payment instruction. Render venmoMarkdownLink when present; otherwise explain that no Venmo username is saved."
+                },
+                {
+                    instruction: "Venmo is external: the user reviews and submits each payment or request. AllSquare cannot initiate or verify it, so never claim it completed."
+                },
+                {
+                    instruction: "After the user says the payment/request is complete or explicitly chooses to record settlement without it, confirm the exact expense IDs again."
+                },
+                {
+                    instruction: "Record only those confirmed IDs. The CLI previews again before the write.",
+                    command: "allsquare settlements settle <GROUP_ID> --expense-id <ID> [--expense-id <ID>] --yes --json"
+                }
+            ]
+        }
+    ],
+    outputContract: {
+        success: {
+            stream: "stdout",
+            exitCode: 0,
+            envelope: {
+                discriminant: { field: "ok", value: true },
+                requiredFields: ["ok", "data"]
+            }
+        },
+        failure: {
+            stream: "stderr",
+            exitCode: "nonzero",
+            envelope: {
+                discriminant: { field: "ok", value: false },
+                requiredFields: ["ok", "error"],
+                error: {
+                    requiredFields: ["code", "message", "retryable"],
+                    optionalFields: ["details"]
+                }
+            },
+            exitCodes: {
+                "2": "Invalid input or configuration; fix the command before retrying",
+                "3": "Authentication or permission; ask the user to run allsquare auth login, or check the ID",
+                "4": "Conflict with current state, such as an already settled expense",
+                "5": "Temporary or service failure; retry when error.retryable is true",
+                "6": "Not found; confirm the ID with a list command",
+                "1": "Unexpected failure"
+            },
+            errorCodes: [
+                { code: "INVALID_ARGUMENT", meaning: "Input failed validation locally or on the server; see error.message and details.fields", retryable: false },
+                { code: "AUTH_REQUIRED", meaning: "No usable session or the session lacks write access; the user must log in", retryable: false },
+                { code: "FORBIDDEN", meaning: "Not allowed. Groups you do not belong to and groups that do not exist both return this, so a wrong group ID looks like a permission error", retryable: false },
+                { code: "NOT_FOUND", meaning: "The expense, recurring expense, or other resource does not exist", retryable: false },
+                { code: "CONFLICT", meaning: "Conflicts with current state, such as settling an already settled expense or reusing an idempotency key with a different request", retryable: false },
+                { code: "IN_PROGRESS", meaning: "The same idempotent write is still running; wait details.retryAfterSeconds, then retry with the same idempotency key to get its result", retryable: true },
+                { code: "RATE_LIMITED", meaning: "Too many requests; wait details.retryAfterSeconds before retrying", retryable: true },
+                { code: "SERVICE_UNAVAILABLE", meaning: "The server failed; the outcome of a write is uncertain, so retry with the same idempotency key", retryable: true },
+                { code: "NETWORK_ERROR", meaning: "No response was received; retry a write only with the same idempotency key", retryable: true },
+                { code: "AUTH_BUSY", meaning: "Another CLI process is refreshing the session", retryable: true }
+            ]
+        },
+        pagination: "Expense lists return data.nextCursor. Pass a non-null value back with --cursor to fetch the next page."
+    }
+};
+const renderStep = (step, index) => `${index + 1}. ${step.instruction}${step.command === undefined ? "" : `\n   ${step.command}`}`;
+const renderGuide = (value) => [
+    `AllSquare CLI agent guide (schema ${value.schemaVersion}, CLI ${value.cliVersion})`,
+    "",
+    "Operating rules",
+    ...value.rules.map((rule, index) => `${index + 1}. ${rule.instruction}`),
+    ...value.workflows.flatMap((workflow) => [
+        "",
+        `${workflow.id}: ${workflow.purpose}`,
+        ...workflow.steps.map(renderStep)
+    ]),
+    "",
+    "Machine-readable output",
+    `- Success: ${value.outputContract.success.stream}, exit ${value.outputContract.success.exitCode}; ok=true with required fields ${value.outputContract.success.envelope.requiredFields.join(", ")}.`,
+    `- Failure: ${value.outputContract.failure.stream}, ${value.outputContract.failure.exitCode} exit; ok=false with required fields ${value.outputContract.failure.envelope.requiredFields.join(", ")}; error requires ${value.outputContract.failure.envelope.error.requiredFields.join(", ")} and may include ${value.outputContract.failure.envelope.error.optionalFields.join(", ")}.`,
+    `- Exit codes: ${Object.entries(value.outputContract.failure.exitCodes).map(([code, meaning]) => `${code} ${meaning}`).join("; ")}.`,
+    "- Error codes:",
+    ...value.outputContract.failure.errorCodes.map((entry) => `  ${entry.code}${entry.retryable ? " (retryable)" : ""}: ${entry.meaning}`),
+    `- Pagination: ${value.outputContract.pagination}`
+].join("\n");
+export const agentGuideCommand = Command.make("agent-guide", { json: jsonFlag }, Effect.fn(function* ({ json }) {
+    yield* printSuccess({
+        data: guide,
+        json,
+        renderHuman: renderGuide
+    });
+})).pipe(Command.withDescription("Show versioned workflows and safety rules for AI agents"));
+//# sourceMappingURL=agent-guide.js.map

package/dist/commands/agent-guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guide.js","sourceRoot":"","sources":["../../src/commands/agent-guide.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAoDtC,MAAM,KAAK,GAAe;IACxB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO;IACnB,KAAK,EAAE;QACL;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,6IAA6I;SAChJ;QACD;YACE,EAAE,EAAE,aAAa;YACjB,WAAW,EACT,wFAAwF;SAC3F;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,wFAAwF;SAC3F;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,WAAW,EACT,uNAAuN;SAC1N;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,WAAW,EACT,qLAAqL;SACxL;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,WAAW,EACT,2QAA2Q;SAC9Q;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,6UAA6U;SAChV;QACD;YACE,EAAE,EAAE,eAAe;YACnB,WAAW,EACT,kOAAkO;SACrO;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,WAAW,EACT,yKAAyK;SAC5K;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,WAAW,EACT,mJAAmJ;SACtJ;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EACT,6IAA6I;SAChJ;KACF;IACD,SAAS,EAAE;QACT;YACE,EAAE,EAAE,iBAAiB;YACrB,OAAO,EAAE,gEAAgE;YACzE,KAAK,EAAE;gBACL;oBACE,WAAW,EAAE,8CAA8C;oBAC3D,OAAO,EACL,yEAAyE;iBAC5E;gBACD;oBACE,WAAW,EACT,0FAA0F;iBAC7F;gBACD;oBACE,WAAW,EACT,8HAA8H;iBACjI;gBACD;oBACE,WAAW,EACT,qEAAqE;iBACxE;aACF;SACF;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,OAAO,EAAE,6DAA6D;YACtE,KAAK,EAAE;gBACL;oBACE,WAAW,EACT,4GAA4G;iBAC/G;gBACD;oBACE,WAAW,EACT,2FAA2F;iBAC9F;gBACD;oBACE,WAAW,EACT,0LAA0L;iBAC7L;gBACD;oBACE,WAAW,EACT,kIAAkI;iBACrI;aACF;SACF;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,OAAO,EAAE,wEAAwE;YACjF,KAAK,EAAE;gBACL;oBACE,WAAW,EACT,wFAAwF;iBAC3F;gBACD;oBACE,WAAW,EACT,+GAA+G;iBAClH;gBACD;oBACE,WAAW,EACT,4EAA4E;iBAC/E;aACF;SACF;QACD;YACE,EAAE,EAAE,YAAY;YAChB,OAAO,EACL,uEAAuE;YACzE,KAAK,EAAE;gBACL;oBACE,WAAW,EACT,yHAAyH;oBAC3H,OAAO,EAAE,iCAAiC;iBAC3C;gBACD;oBACE,WAAW,EACT,6IAA6I;iBAChJ;gBACD;oBACE,WAAW,EACT,iEAAiE;iBACpE;gBACD;oBACE,WAAW,EACT,gHAAgH;oBAClH,OAAO,EAAE,+BAA+B;iBACzC;aACF;SACF;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,OAAO,EACL,+GAA+G;YACjH,KAAK,EAAE;gBACL;oBACE,WAAW,EACT,6EAA6E;iBAChF;gBACD;oBACE,WAAW,EAAE,oDAAoD;oBACjE,OAAO,EACL,uFAAuF;iBAC1F;gBACD;oBACE,WAAW,EACT,8HAA8H;iBACjI;gBACD;oBACE,WAAW,EACT,+IAA+I;iBAClJ;gBACD;oBACE,WAAW,EACT,iJAAiJ;iBACpJ;gBACD;oBACE,WAAW,EACT,2EAA2E;oBAC7E,OAAO,EACL,4FAA4F;iBAC/F;aACF;SACF;KACF;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE;gBACR,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC1C,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;aAC/B;SACF;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE;gBACR,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC3C,cAAc,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC;gBAC/B,KAAK,EAAE;oBACL,cAAc,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC;oBAChD,cAAc,EAAE,CAAC,SAAS,CAAC;iBAC5B;aACF;YACD,SAAS,EAAE;gBACT,GAAG,EAAE,iEAAiE;gBACtE,GAAG,EAAE,yFAAyF;gBAC9F,GAAG,EAAE,iEAAiE;gBACtE,GAAG,EAAE,kEAAkE;gBACvE,GAAG,EAAE,+CAA+C;gBACpD,GAAG,EAAE,oBAAoB;aAC1B;YACD,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,wFAAwF,EAAE,SAAS,EAAE,KAAK,EAAE;gBACjJ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,2EAA2E,EAAE,SAAS,EAAE,KAAK,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2IAA2I,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC7L,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kEAAkE,EAAE,SAAS,EAAE,KAAK,EAAE;gBACpH,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kIAAkI,EAAE,SAAS,EAAE,KAAK,EAAE;gBACnL,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,wIAAwI,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC3L,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,mEAAmE,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvH,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gGAAgG,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC3J,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,4EAA4E,EAAE,SAAS,EAAE,IAAI,EAAE;gBACjI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,+CAA+C,EAAE,SAAS,EAAE,IAAI,EAAE;aACjG;SACF;QACD,UAAU,EACR,wGAAwG;KAC3G;CACF,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAE,KAAa,EAAU,EAAE,CACjE,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,WAAW,GAC/B,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,OAAO,EACxD,EAAE,CAAA;AAEJ,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC;IACjD,qCAAqC,KAAK,CAAC,aAAa,SAAS,KAAK,CAAC,UAAU,GAAG;IACpF,EAAE;IACF,iBAAiB;IACjB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;IACxE,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvC,EAAE;QACF,GAAG,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,EAAE;QACrC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;IACF,EAAE;IACF,yBAAyB;IACzB,cAAc,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,UAAU,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,kCAAkC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;IACpM,cAAc,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,wCAAwC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;IACvX,iBAAiB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;IACpI,gBAAgB;IAChB,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9E,iBAAiB,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE;CACnD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAC3C,aAAa,EACb,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAC,EAAE,IAAI,EAAE;IAC1B,KAAK,CAAC,CAAC,YAAY,CAAC;QAClB,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,WAAW,EAAE,WAAW;KACzB,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAC5B,yDAAyD,CAC1D,CAAC,CAAA"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,5 @@
+import { Command } from "effect/unstable/cli";
+import { AuthService } from "../auth/auth-service.js";
+import { CliInputError } from "../errors.js";
+export declare const authCommand: Command.Command<"auth", {}, {}, CliInputError | import("../auth/auth-service.js").AuthError, AuthService>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AA+G5C,eAAO,MAAM,WAAW,2GAGvB,CAAA"}