confluence.js 2.2.0-dev20260320072155 → 3.0.0

package/dist/core/oauth/helpers.js

@@ -0,0 +1,108 @@
+import { OAuthError } from '../errors/index.js';
+const AUTHORIZE_URL = 'https://auth.atlassian.com/authorize';
+const TOKEN_URL = 'https://auth.atlassian.com/oauth/token';
+const ACCESSIBLE_RESOURCES_URL = 'https://api.atlassian.com/oauth/token/accessible-resources';
+const DEFAULT_AUDIENCE = 'api.atlassian.com';
+const JSON_HEADERS = { 'Content-Type': 'application/json', Accept: 'application/json' };
+function mapTokenResponse(data) {
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresIn: data.expires_in,
+        scope: data.scope,
+        tokenType: data.token_type,
+    };
+}
+/** `fetch` does not reject on a non-2xx status, so the status is checked here and turned into an `OAuthError`. */
+async function requestJson(url, init) {
+    let response;
+    try {
+        response = await fetch(url, init);
+    }
+    catch (err) {
+        throw new OAuthError(`Request to ${url} failed before a response arrived`, { cause: err });
+    }
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        let body = text;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            //
+        }
+        throw new OAuthError(`Request to ${url} failed with status ${response.status} ${response.statusText}${text ? `: ${text}` : ''}`, { status: response.status, body });
+    }
+    return response.json();
+}
+/**
+ * Build the URL to send the user to so they can grant access.
+ *
+ * `state` is yours to generate and to verify when the callback comes back — it is what stops CSRF on the redirect.
+ *
+ * @stable
+ */
+export function generateAuthorizationUrl(params) {
+    const query = new URLSearchParams({
+        audience: params.audience ?? DEFAULT_AUDIENCE,
+        client_id: params.clientId,
+        scope: params.scopes.join(' '),
+        redirect_uri: params.redirectUri,
+        state: params.state,
+        response_type: 'code',
+        prompt: params.prompt ?? 'consent',
+    });
+    return `${AUTHORIZE_URL}?${query.toString()}`;
+}
+/**
+ * Exchange the authorization `code` from the redirect callback for tokens.
+ *
+ * @stable
+ */
+export async function exchangeAuthorizationCode(params) {
+    const data = await requestJson(TOKEN_URL, {
+        method: 'POST',
+        headers: JSON_HEADERS,
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            client_id: params.clientId,
+            client_secret: params.clientSecret,
+            code: params.code,
+            redirect_uri: params.redirectUri,
+        }),
+    });
+    return mapTokenResponse(data);
+}
+/**
+ * Refresh an access token.
+ *
+ * Atlassian rotates the refresh token on every call: persist the one you get back and drop the old one, or the next
+ * refresh fails.
+ *
+ * @stable
+ */
+export async function refreshOAuth2Token(params) {
+    const data = await requestJson(TOKEN_URL, {
+        method: 'POST',
+        headers: JSON_HEADERS,
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            client_id: params.clientId,
+            client_secret: params.clientSecret,
+            refresh_token: params.refreshToken,
+        }),
+    });
+    return mapTokenResponse(data);
+}
+/**
+ * List the Confluence sites this access token can reach. The `id` of an entry is its cloud id.
+ *
+ * @stable
+ */
+export async function getAccessibleResources(accessToken) {
+    return requestJson(ACCESSIBLE_RESOURCES_URL, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json' },
+    });
+}
+//# sourceMappingURL=helpers.js.map

package/dist/core/oauth/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/core/oauth/helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,SAAS,GAAG,wCAAwC,CAAC;AAC3D,MAAM,wBAAwB,GAAG,4DAA4D,CAAC;AAC9F,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAUxF,SAAS,gBAAgB,CAAC,IAAsB;IAC9C,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED,kHAAkH;AAClH,KAAK,UAAU,WAAW,CAAI,GAAW,EAAE,IAAiB;IAC1D,IAAI,QAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,cAAc,GAAG,mCAAmC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,GAAY,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,EAAE;QACJ,CAAC;QAED,MAAM,IAAI,UAAU,CAClB,cAAc,GAAG,uBAAuB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC1G,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAOxC;IACC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;QAC7C,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;KACnC,CAAC,CAAC;IAEH,OAAO,GAAG,aAAa,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAK/C;IACC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAmB,SAAS,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,WAAW;SACjC,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAIxC;IACC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAmB,SAAS,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,OAAO,WAAW,CAAuB,wBAAwB,EAAE;QACjE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAChF,CAAC,CAAC;AACL,CAAC"}

package/dist/core/oauth/index.d.ts

@@ -0,0 +1,7 @@
+export { generateAuthorizationUrl, exchangeAuthorizationCode, refreshOAuth2Token, getAccessibleResources, } from './helpers.js';
+export { parseCallbackUrl } from './parseCallbackUrl.js';
+export type { CallbackParams, ParseCallbackUrlOptions } from './parseCallbackUrl.js';
+export { createOAuth2Manager } from './oauth2Manager.js';
+export type { OAuth2Manager, OAuth2ManagerOptions } from './oauth2Manager.js';
+export type { OAuth2TokenResponse, AccessibleResource, TokenRefreshEvent, OnTokenRefresh } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/core/oauth/index.js

@@ -0,0 +1,4 @@
+export { generateAuthorizationUrl, exchangeAuthorizationCode, refreshOAuth2Token, getAccessibleResources, } from './helpers.js';
+export { parseCallbackUrl } from './parseCallbackUrl.js';
+export { createOAuth2Manager } from './oauth2Manager.js';
+//# sourceMappingURL=index.js.map

package/dist/core/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/core/oauth/oauth2Manager.d.ts

@@ -0,0 +1,30 @@
+import type { OnTokenRefresh } from './types.js';
+export interface OAuth2ManagerOptions {
+    accessToken?: string;
+    refreshToken?: string;
+    clientId?: string;
+    clientSecret?: string;
+    expiresAt?: number;
+    cloudId?: string;
+    siteUrl?: string;
+    onTokenRefresh?: OnTokenRefresh;
+}
+export interface OAuth2Manager {
+    /** Whether a refresh is even possible — needs all three of `refreshToken`, `clientId`, `clientSecret`. */
+    canRefresh(): boolean;
+    /** `Bearer <token>`, refreshing first if the token is missing or within the skew window of expiry. */
+    getAuthorizationHeader(): Promise<string>;
+    /** The gateway base URL for the resolved cloud id. */
+    getBaseUrl(): Promise<string>;
+    /** Refresh regardless of expiry. Used by the 401 retry path. */
+    forceRefresh(): Promise<void>;
+}
+/**
+ * Holds the OAuth 2.0 token state for one client: refreshes before expiry, resolves the cloud id once, and reports
+ * rotated refresh tokens through `onTokenRefresh`.
+ *
+ * Both the refresh and the cloud-id lookup are single-flighted, so N concurrent requests hitting an expired token
+ * produce one token call, not N.
+ */
+export declare function createOAuth2Manager(options: OAuth2ManagerOptions): OAuth2Manager;
+//# sourceMappingURL=oauth2Manager.d.ts.map

package/dist/core/oauth/oauth2Manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2Manager.d.ts","sourceRoot":"","sources":["../../../src/core/oauth/oauth2Manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,cAAc,EAAE,MAAM,YAAY,CAAC;AAUrE,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,0GAA0G;IAC1G,UAAU,IAAI,OAAO,CAAC;IACtB,sGAAsG;IACtG,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,sDAAsD;IACtD,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,gEAAgE;IAChE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4JhF"}

package/dist/core/oauth/oauth2Manager.js

@@ -0,0 +1,138 @@
+import { getAccessibleResources, refreshOAuth2Token } from './helpers.js';
+import { isOAuthError, OAuthError } from '../errors/index.js';
+import { PRODUCT } from '../productInfo.js';
+/** 3LO tokens are only accepted through the gateway, never on the site's own domain. */
+const GATEWAY_BASE = `https://api.atlassian.com/ex/${PRODUCT.gatewaySlug}`;
+/** Refresh this many ms before `expiresAt`, to absorb clock skew and in-flight latency. */
+const EXPIRY_SKEW_MS = 60_000;
+function normalizeUrl(url) {
+    return url.replace(/\/+$/, '').toLowerCase();
+}
+/**
+ * Holds the OAuth 2.0 token state for one client: refreshes before expiry, resolves the cloud id once, and reports
+ * rotated refresh tokens through `onTokenRefresh`.
+ *
+ * Both the refresh and the cloud-id lookup are single-flighted, so N concurrent requests hitting an expired token
+ * produce one token call, not N.
+ */
+export function createOAuth2Manager(options) {
+    const { clientId, clientSecret, siteUrl, onTokenRefresh } = options;
+    let accessToken = options.accessToken;
+    let refreshToken = options.refreshToken;
+    let expiresAt = options.expiresAt;
+    let cloudId = options.cloudId;
+    let refreshPromise;
+    let cloudIdPromise;
+    const canRefresh = () => refreshToken !== undefined && clientId !== undefined && clientSecret !== undefined;
+    const needsRefresh = () => {
+        if (!canRefresh())
+            return false;
+        if (accessToken === undefined)
+            return true;
+        // No expiry known means no basis to act on — wait for a 401 rather than
+        // refreshing a token that may be perfectly good.
+        if (expiresAt === undefined)
+            return false;
+        return Date.now() >= expiresAt - EXPIRY_SKEW_MS;
+    };
+    const doRefresh = async () => {
+        if (!canRefresh()) {
+            throw new OAuthError('Cannot refresh the OAuth 2.0 access token: `refreshToken`, `clientId` and `clientSecret` are required.');
+        }
+        const response = await refreshOAuth2Token({
+            clientId: clientId,
+            clientSecret: clientSecret,
+            refreshToken: refreshToken,
+        });
+        accessToken = response.accessToken;
+        if (response.refreshToken) {
+            refreshToken = response.refreshToken;
+        }
+        expiresAt = Date.now() + response.expiresIn * 1000;
+        // Awaited, so a caller persisting the rotated token has finished before the
+        // request that triggered the refresh goes out.
+        await onTokenRefresh?.({ accessToken, refreshToken, expiresAt });
+    };
+    const refresh = async () => {
+        // Cleared in `finally`, so a failed refresh does not poison later attempts.
+        refreshPromise ??= doRefresh();
+        try {
+            await refreshPromise;
+        }
+        finally {
+            refreshPromise = undefined;
+        }
+    };
+    const ensureAccessToken = async () => {
+        if (needsRefresh())
+            await refresh();
+        if (accessToken === undefined) {
+            throw new OAuthError('No OAuth 2.0 access token is available and it cannot be refreshed. Provide an `accessToken`, or the full ' +
+                'refresh credentials (`refreshToken`, `clientId`, `clientSecret`).');
+        }
+        return accessToken;
+    };
+    /**
+     * The sites this token can reach, refreshing once if the token turns out to be stale.
+     *
+     * This lookup runs before the request loop, so the client's own 401-and-retry never covers it. Without this, a token
+     * whose expiry is unknown — the shape you get when a caller supplies `accessToken` without `expiresAt` — would fail
+     * the cloud-id lookup permanently instead of refreshing the way any other request would.
+     */
+    const listResources = async () => {
+        try {
+            return await getAccessibleResources(await ensureAccessToken());
+        }
+        catch (err) {
+            if (!isOAuthError(err) || err.status !== 401 || !canRefresh())
+                throw err;
+            await refresh();
+            return getAccessibleResources(await ensureAccessToken());
+        }
+    };
+    const selectResource = (resources) => {
+        if (resources.length === 0) {
+            throw new OAuthError('No accessible Confluence resources were returned for this OAuth 2.0 token. Check the granted scopes and ' +
+                'that the user has access to at least one Confluence site.');
+        }
+        if (siteUrl !== undefined) {
+            const target = normalizeUrl(siteUrl);
+            const match = resources.find(resource => normalizeUrl(resource.url) === target);
+            if (!match) {
+                throw new OAuthError(`No accessible resource matches siteUrl "${siteUrl}". Available: ${resources.map(r => r.url).join(', ')}.`);
+            }
+            return match;
+        }
+        if (resources.length > 1) {
+            throw new OAuthError('Multiple accessible Confluence resources found; pass `cloudId` or `siteUrl` to disambiguate. Available: ' +
+                `${resources.map(r => r.url).join(', ')}.`);
+        }
+        return resources[0];
+    };
+    const resolveCloudId = async () => {
+        if (cloudId !== undefined)
+            return cloudId;
+        cloudIdPromise ??= (async () => {
+            const resources = await listResources();
+            cloudId = selectResource(resources).id;
+            return cloudId;
+        })();
+        try {
+            return await cloudIdPromise;
+        }
+        finally {
+            cloudIdPromise = undefined;
+        }
+    };
+    return {
+        canRefresh,
+        async getAuthorizationHeader() {
+            return `Bearer ${await ensureAccessToken()}`;
+        },
+        async getBaseUrl() {
+            return `${GATEWAY_BASE}/${await resolveCloudId()}`;
+        },
+        forceRefresh: refresh,
+    };
+}
+//# sourceMappingURL=oauth2Manager.js.map

package/dist/core/oauth/oauth2Manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2Manager.js","sourceRoot":"","sources":["../../../src/core/oauth/oauth2Manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,wFAAwF;AACxF,MAAM,YAAY,GAAG,gCAAgC,OAAO,CAAC,WAAW,EAAE,CAAC;AAC3E,2FAA2F;AAC3F,MAAM,cAAc,GAAG,MAAM,CAAC;AAwB9B,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAEpE,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACtC,IAAI,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACxC,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAClC,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAE9B,IAAI,cAAyC,CAAC;IAC9C,IAAI,cAA2C,CAAC;IAEhD,MAAM,UAAU,GAAG,GAAY,EAAE,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,CAAC;IAErH,MAAM,YAAY,GAAG,GAAY,EAAE;QACjC,IAAI,CAAC,UAAU,EAAE;YAAE,OAAO,KAAK,CAAC;QAEhC,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAE3C,wEAAwE;QACxE,iDAAiD;QACjD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE1C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,cAAc,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAClB,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;YACxC,QAAQ,EAAE,QAAS;YACnB,YAAY,EAAE,YAAa;YAC3B,YAAY,EAAE,YAAa;SAC5B,CAAC,CAAC;QAEH,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QAEnC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QACvC,CAAC;QAED,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;QAEnD,4EAA4E;QAC5E,+CAA+C;QAC/C,MAAM,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,4EAA4E;QAC5E,cAAc,KAAK,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,cAAc,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,IAAqB,EAAE;QACpD,IAAI,YAAY,EAAE;YAAE,MAAM,OAAO,EAAE,CAAC;QAEpC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,UAAU,CAClB,2GAA2G;gBACzG,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,aAAa,GAAG,KAAK,IAAmC,EAAE;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,sBAAsB,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE;gBAAE,MAAM,GAAG,CAAC;YAEzE,MAAM,OAAO,EAAE,CAAC;YAEhB,OAAO,sBAAsB,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,SAA+B,EAAsB,EAAE;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,UAAU,CAClB,0GAA0G;gBACxG,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC;YAEhF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAClB,2CAA2C,OAAO,iBAAiB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,UAAU,CAClB,0GAA0G;gBACxG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,IAAqB,EAAE;QACjD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAE1C,cAAc,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;YAExC,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAEvC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,cAAc,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QAEV,KAAK,CAAC,sBAAsB;YAC1B,OAAO,UAAU,MAAM,iBAAiB,EAAE,EAAE,CAAC;QAC/C,CAAC;QAED,KAAK,CAAC,UAAU;YACd,OAAO,GAAG,YAAY,IAAI,MAAM,cAAc,EAAE,EAAE,CAAC;QACrD,CAAC;QAED,YAAY,EAAE,OAAO;KACtB,CAAC;AACJ,CAAC"}

package/dist/core/oauth/parseCallbackUrl.d.ts

@@ -0,0 +1,38 @@
+export interface ParseCallbackUrlOptions {
+    /**
+     * The `state` you generated for this authorization request and stored against the user's session.
+     *
+     * Checked before anything else. This is what stops an attacker from replaying someone else's callback into your
+     * session, and it only works if the value is unguessable and bound to that one user.
+     */
+    expectedState: string;
+}
+export interface CallbackParams {
+    /** The authorization code, ready for {@link exchangeAuthorizationCode}. */
+    code: string;
+    /** The `state` that came back, already verified against `expectedState`. */
+    state: string;
+}
+/**
+ * Read the authorization code out of the URL Atlassian redirected the user to.
+ *
+ * Handles the three ways this step goes wrong, each of which is easy to forget by hand:
+ *
+ * - the user declined on the consent screen, so the URL carries `error=access_denied` and no code;
+ * - `state` is missing or does not match the one you issued;
+ * - the URL is simply not a callback — no code, no error.
+ *
+ * Each throws an {@link OAuthError}; for a decline, `error` is `access_denied`, which
+ * {@link isReauthorizationRequired} recognises.
+ *
+ * @example
+ *   ```typescript
+ *   const { code } = parseCallbackUrl(request.url, { expectedState: session.oauthState });
+ *
+ *   const tokens = await exchangeAuthorizationCode({ clientId, clientSecret, code, redirectUri });
+ *   ```;
+ *
+ * @stable
+ */
+export declare function parseCallbackUrl(url: string | URL, options: ParseCallbackUrlOptions): CallbackParams;
+//# sourceMappingURL=parseCallbackUrl.d.ts.map

package/dist/core/oauth/parseCallbackUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCallbackUrl.d.ts","sourceRoot":"","sources":["../../../src/core/oauth/parseCallbackUrl.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;CACf;AAeD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,uBAAuB,GAAG,cAAc,CAyCpG"}

package/dist/core/oauth/parseCallbackUrl.js

@@ -0,0 +1,62 @@
+import { OAuthError } from '../errors/index.js';
+/** Constant-time string comparison, so a mismatch leaks nothing through timing. */
+function equals(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+/**
+ * Read the authorization code out of the URL Atlassian redirected the user to.
+ *
+ * Handles the three ways this step goes wrong, each of which is easy to forget by hand:
+ *
+ * - the user declined on the consent screen, so the URL carries `error=access_denied` and no code;
+ * - `state` is missing or does not match the one you issued;
+ * - the URL is simply not a callback — no code, no error.
+ *
+ * Each throws an {@link OAuthError}; for a decline, `error` is `access_denied`, which
+ * {@link isReauthorizationRequired} recognises.
+ *
+ * @example
+ *   ```typescript
+ *   const { code } = parseCallbackUrl(request.url, { expectedState: session.oauthState });
+ *
+ *   const tokens = await exchangeAuthorizationCode({ clientId, clientSecret, code, redirectUri });
+ *   ```;
+ *
+ * @stable
+ */
+export function parseCallbackUrl(url, options) {
+    // A relative URL is what a framework request object usually gives you; the base
+    // is irrelevant here, only the query matters.
+    const parsed = typeof url === 'string' ? new URL(url, 'http://localhost') : url;
+    const params = parsed.searchParams;
+    const error = params.get('error');
+    if (error) {
+        const description = params.get('error_description') ?? undefined;
+        throw new OAuthError(error === 'access_denied'
+            ? `The user declined authorization${description ? `: ${description}` : '.'}`
+            : `Authorization failed: ${error}${description ? ` — ${description}` : ''}`, 
+        // A decline here really does need another trip through consent. Flagged
+        // explicitly because the same code from the token endpoint means a bad
+        // client secret, where re-authorizing would loop the user for nothing.
+        { error, errorDescription: description, reauthorizationRequired: error === 'access_denied' });
+    }
+    const state = params.get('state');
+    if (state === null || !equals(state, options.expectedState)) {
+        throw new OAuthError('The `state` in the callback does not match the one issued for this authorization request. The callback was ' +
+            'not initiated by this session — discard it.', { error: 'invalid_state' });
+    }
+    const code = params.get('code');
+    if (!code) {
+        throw new OAuthError('The callback URL carries neither an authorization code nor an error.', {
+            error: 'invalid_request',
+        });
+    }
+    return { code, state };
+}
+//# sourceMappingURL=parseCallbackUrl.js.map

package/dist/core/oauth/parseCallbackUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCallbackUrl.js","sourceRoot":"","sources":["../../../src/core/oauth/parseCallbackUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAmBhD,mFAAmF;AACnF,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAiB,EAAE,OAAgC;IAClF,gFAAgF;IAChF,8CAA8C;IAC9C,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAElC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;QAEjE,MAAM,IAAI,UAAU,CAClB,KAAK,KAAK,eAAe;YACvB,CAAC,CAAC,kCAAkC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;YAC5E,CAAC,CAAC,yBAAyB,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,uBAAuB,EAAE,KAAK,KAAK,eAAe,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAElC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,UAAU,CAClB,6GAA6G;YAC3G,6CAA6C,EAC/C,EAAE,KAAK,EAAE,eAAe,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,sEAAsE,EAAE;YAC3F,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/core/oauth/types.d.ts

@@ -0,0 +1,34 @@
+/** Normalised (camelCase) response from the Atlassian token endpoint. */
+export interface OAuth2TokenResponse {
+    accessToken: string;
+    /**
+     * The rotated refresh token, present when `offline_access` was requested. Persist it — Atlassian invalidates the one
+     * you sent.
+     */
+    refreshToken?: string;
+    /** Access-token lifetime in seconds, as returned by Atlassian. Typically 3600. */
+    expiresIn: number;
+    /** Space-separated granted scopes. */
+    scope: string;
+    /** Always `bearer`. */
+    tokenType: string;
+}
+/** An entry from `GET /oauth/token/accessible-resources`. */
+export interface AccessibleResource {
+    /** The cloud id — this is what `cloudId` expects. */
+    id: string;
+    name: string;
+    /** Site URL, e.g. `https://your-domain.atlassian.net`. */
+    url: string;
+    scopes: string[];
+    avatarUrl: string;
+}
+/** Payload handed to `onTokenRefresh` after every successful refresh. */
+export interface TokenRefreshEvent {
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+}
+export type OnTokenRefresh = (event: TokenRefreshEvent) => void | Promise<void>;
+//# sourceMappingURL=types.d.ts.map

package/dist/core/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/oauth/types.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/core/oauth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/oauth/types.ts"],"names":[],"mappings":""}

package/dist/core/productInfo.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The handful of places where the shared core has to name its own product.
+ *
+ * This file is generated. Everything else under `core/` is identical across the libraries, and stays that way by
+ * reading these values rather than hard-coding a product name.
+ */
+interface ProductInfo {
+    packageName: string;
+    gatewaySlug: string;
+    scopeHint: string;
+}
+/** Typed as plain strings on purpose: a product may leave the optional fields empty, and the code must still check. */
+export declare const PRODUCT: ProductInfo;
+/**
+ * The package name reduced to something safe inside a multipart boundary and a symbol key.
+ *
+ * A boundary may not contain a dot without being quoted, and `confluence.js` has one.
+ */
+export declare const PRODUCT_SLUG: string;
+export {};
+//# sourceMappingURL=productInfo.d.ts.map

package/dist/core/productInfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"productInfo.d.ts","sourceRoot":"","sources":["../../src/core/productInfo.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uHAAuH;AACvH,eAAO,MAAM,OAAO,EAAE,WAarB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAqD,CAAC"}

package/dist/core/productInfo.js

@@ -0,0 +1,20 @@
+/** Typed as plain strings on purpose: a product may leave the optional fields empty, and the code must still check. */
+export const PRODUCT = {
+    /** The npm package name, e.g. `confluence.js`. */
+    packageName: 'confluence.js',
+    /**
+     * The Atlassian gateway slug, as in `https://api.atlassian.com/ex/<slug>/{cloudId}`.
+     *
+     * Empty for products that are not behind the Atlassian gateway, where OAuth 2.0 (3LO) does not apply.
+     */
+    gatewaySlug: 'confluence',
+    /** Product-specific advice appended to a scope-mismatch 401, where the scope families differ per product. */
+    scopeHint: 'Note that v2 endpoints need granular scopes (read:page:confluence) while v1 endpoints need classic ones (read:confluence-content.all).',
+};
+/**
+ * The package name reduced to something safe inside a multipart boundary and a symbol key.
+ *
+ * A boundary may not contain a dot without being quoted, and `confluence.js` has one.
+ */
+export const PRODUCT_SLUG = PRODUCT.packageName.replace(/[^a-zA-Z0-9]+/g, '-');
+//# sourceMappingURL=productInfo.js.map

package/dist/core/productInfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"productInfo.js","sourceRoot":"","sources":["../../src/core/productInfo.ts"],"names":[],"mappings":"AAYA,uHAAuH;AACvH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,kDAAkD;IAClD,WAAW,EAAE,eAAe;IAE5B;;;;OAIG;IACH,WAAW,EAAE,YAAY;IAEzB,6GAA6G;IAC7G,SAAS,EAAE,wIAAwI;CACpJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC"}

package/dist/core/schemas/auth.d.ts

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+import type { OnTokenRefresh } from '../oauth/types.js';
+export declare const authBasicSchema: z.ZodObject<{
+    type: z.ZodLiteral<"basic">;
+    email: z.ZodString;
+    apiToken: z.ZodString;
+}, z.core.$strip>;
+export declare const authBearerTokenSchema: z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    token: z.ZodString;
+}, z.core.$strip>;
+export declare const authBearerProviderSchema: z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    getToken: z.ZodCustom<() => Promise<string>, () => Promise<string>>;
+}, z.core.$strip>;
+export declare const authBearerSchema: z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    token: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    getToken: z.ZodCustom<() => Promise<string>, () => Promise<string>>;
+}, z.core.$strip>]>;
+/**
+ * Atlassian OAuth 2.0 (3LO).
+ *
+ * Either hand over an `accessToken` and manage its lifetime yourself, or hand over the full refresh credential set and
+ * let the client refresh on its own. The two refinements below encode exactly that: the second one exists because a
+ * partial credential set is always a mistake — it looks configured, then fails on the first refresh.
+ */
+export declare const authOAuth2Schema: z.ZodObject<{
+    type: z.ZodLiteral<"oauth2">;
+    accessToken: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    cloudId: z.ZodOptional<z.ZodString>;
+    siteUrl: z.ZodOptional<z.ZodString>;
+    onTokenRefresh: z.ZodOptional<z.ZodCustom<OnTokenRefresh, OnTokenRefresh>>;
+}, z.core.$strip>;
+export declare const authSchema: z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodLiteral<"basic">;
+    email: z.ZodString;
+    apiToken: z.ZodString;
+}, z.core.$strip>, z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    token: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+    getToken: z.ZodCustom<() => Promise<string>, () => Promise<string>>;
+}, z.core.$strip>]>, z.ZodObject<{
+    type: z.ZodLiteral<"oauth2">;
+    accessToken: z.ZodOptional<z.ZodString>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+    cloudId: z.ZodOptional<z.ZodString>;
+    siteUrl: z.ZodOptional<z.ZodString>;
+    onTokenRefresh: z.ZodOptional<z.ZodCustom<OnTokenRefresh, OnTokenRefresh>>;
+}, z.core.$strip>]>;
+export type AuthBasic = z.infer<typeof authBasicSchema>;
+export type AuthOAuth2 = z.infer<typeof authOAuth2Schema>;
+export type AuthBearerToken = z.infer<typeof authBearerTokenSchema>;
+export type AuthBearerProvider = z.infer<typeof authBearerProviderSchema>;
+export type AuthBearer = z.infer<typeof authBearerSchema>;
+export type Auth = z.infer<typeof authSchema>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/schemas/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/schemas/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,eAAO,MAAM,eAAe;;;;iBAI1B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;gCAEV,OAAO,CAAC,MAAM,CAAC;iBAGxC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;gCALF,OAAO,CAAC,MAAM,CAAC;mBAKgD,CAAC;AAE3F;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAwC1B,CAAC;AAEJ,eAAO,MAAM,UAAU;;;;;;;;;gCAxDI,OAAO,CAAC,MAAM,CAAC;;;;;;;;;;;mBAwD8C,CAAC;AAEzF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC"}