@37signals/basecamp 0.2.0

package/dist/oauth/types.d.ts

@@ -0,0 +1,98 @@
+/**
+ * OAuth 2.0 type definitions for Basecamp SDK.
+ *
+ * Provides types for OAuth configuration, tokens, and exchange requests.
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ */
+/**
+ * OAuth 2.0 server configuration from discovery endpoint.
+ */
+export interface OAuthConfig {
+    /** The authorization server's issuer identifier */
+    issuer: string;
+    /** URL of the authorization endpoint */
+    authorizationEndpoint: string;
+    /** URL of the token endpoint */
+    tokenEndpoint: string;
+    /** URL of the dynamic client registration endpoint (optional) */
+    registrationEndpoint?: string;
+    /** List of OAuth 2.0 scopes supported (optional) */
+    scopesSupported?: string[];
+}
+/**
+ * OAuth 2.0 access token response.
+ */
+export interface OAuthToken {
+    /** The access token string */
+    accessToken: string;
+    /** The refresh token string (optional) */
+    refreshToken?: string;
+    /** Token type (usually "Bearer") */
+    tokenType: string;
+    /** Lifetime of the access token in seconds (optional) */
+    expiresIn?: number;
+    /** Calculated expiration date (optional) */
+    expiresAt?: Date;
+    /** OAuth scope granted (optional) */
+    scope?: string;
+}
+/**
+ * Parameters for exchanging an authorization code for tokens.
+ */
+export interface ExchangeRequest {
+    /** URL of the token endpoint */
+    tokenEndpoint: string;
+    /** The authorization code received from the authorization server */
+    code: string;
+    /** The redirect URI used in the authorization request */
+    redirectUri: string;
+    /** The client identifier */
+    clientId: string;
+    /** The client secret (optional for public clients) */
+    clientSecret?: string;
+    /** PKCE code verifier (optional) */
+    codeVerifier?: string;
+    /**
+     * Use Launchpad's non-standard token format.
+     * When true, uses `type=web_server` instead of `grant_type=authorization_code`.
+     */
+    useLegacyFormat?: boolean;
+}
+/**
+ * Parameters for refreshing an access token.
+ */
+export interface RefreshRequest {
+    /** URL of the token endpoint */
+    tokenEndpoint: string;
+    /** The refresh token */
+    refreshToken: string;
+    /** The client identifier (optional) */
+    clientId?: string;
+    /** The client secret (optional) */
+    clientSecret?: string;
+    /**
+     * Use Launchpad's non-standard token format.
+     * When true, uses `type=refresh` instead of `grant_type=refresh_token`.
+     */
+    useLegacyFormat?: boolean;
+}
+/**
+ * Raw token response from OAuth server.
+ * Used internally for JSON parsing.
+ */
+export interface RawTokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    token_type: string;
+    expires_in?: number;
+    scope?: string;
+}
+/**
+ * OAuth error response from server.
+ */
+export interface OAuthErrorResponse {
+    error: string;
+    error_description?: string;
+    error_uri?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/oauth/types.js

@@ -0,0 +1,8 @@
+/**
+ * OAuth 2.0 type definitions for Basecamp SDK.
+ *
+ * Provides types for OAuth configuration, tokens, and exchange requests.
+ * Supports both standard OAuth 2.0 and Basecamp's Launchpad legacy format.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/pagination-utils.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Pagination utility functions.
+ *
+ * Extracted to its own module to avoid circular dependencies between
+ * client.ts (which imports generated services) and base.ts (which
+ * generated services extend).
+ */
+/**
+ * Parses the next URL from a Link header.
+ * Looks for rel="next" in the header value.
+ *
+ * @param linkHeader - The Link header value
+ * @returns The URL for the next page, or null if not found
+ */
+export declare function parseNextLink(linkHeader: string | null): string | null;
+/**
+ * Resolves a possibly-relative URL against a base URL.
+ * If target is already absolute, it is returned unchanged.
+ */
+export declare function resolveURL(base: string, target: string): string;
+/**
+ * Checks whether two absolute URLs share the same origin (scheme + host + port).
+ * Handles default port normalization (e.g. https://example.com:443 === https://example.com).
+ * Relative URLs should be resolved with resolveURL before calling this function.
+ */
+export declare function isSameOrigin(a: string, b: string): boolean;
+//# sourceMappingURL=pagination-utils.d.ts.map

package/dist/pagination-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination-utils.d.ts","sourceRoot":"","sources":["../src/pagination-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAYtE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAQ1D"}

package/dist/pagination-utils.js

@@ -0,0 +1,54 @@
+/**
+ * Pagination utility functions.
+ *
+ * Extracted to its own module to avoid circular dependencies between
+ * client.ts (which imports generated services) and base.ts (which
+ * generated services extend).
+ */
+/**
+ * Parses the next URL from a Link header.
+ * Looks for rel="next" in the header value.
+ *
+ * @param linkHeader - The Link header value
+ * @returns The URL for the next page, or null if not found
+ */
+export function parseNextLink(linkHeader) {
+    if (!linkHeader)
+        return null;
+    for (const part of linkHeader.split(",")) {
+        const trimmed = part.trim();
+        if (trimmed.includes('rel="next"')) {
+            const match = trimmed.match(/<([^>]+)>/);
+            return match?.[1] ?? null;
+        }
+    }
+    return null;
+}
+/**
+ * Resolves a possibly-relative URL against a base URL.
+ * If target is already absolute, it is returned unchanged.
+ */
+export function resolveURL(base, target) {
+    try {
+        return new URL(target, base).href;
+    }
+    catch {
+        return target;
+    }
+}
+/**
+ * Checks whether two absolute URLs share the same origin (scheme + host + port).
+ * Handles default port normalization (e.g. https://example.com:443 === https://example.com).
+ * Relative URLs should be resolved with resolveURL before calling this function.
+ */
+export function isSameOrigin(a, b) {
+    try {
+        const urlA = new URL(a);
+        const urlB = new URL(b);
+        return urlA.origin === urlB.origin;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=pagination-utils.js.map

package/dist/pagination-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination-utils.js","sourceRoot":"","sources":["../src/pagination-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,UAAyB;IACrD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/pagination.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pagination types and utilities for the Basecamp SDK.
+ *
+ * Provides ListResult (an Array subclass with metadata), pagination options,
+ * and header parsing utilities used by generated service methods.
+ */
+/**
+ * Metadata about a paginated list response.
+ */
+export interface ListMeta {
+    /** Total number of items across all pages (from X-Total-Count header). */
+    readonly totalCount: number;
+    /** True when results were truncated (by maxItems or page safety cap). */
+    readonly truncated: boolean;
+}
+/**
+ * Options for controlling pagination behavior.
+ */
+export interface PaginationOptions {
+    /**
+     * Maximum number of items to return across all pages.
+     * When undefined or 0, all pages are fetched.
+     */
+    maxItems?: number;
+}
+/**
+ * An array of results with pagination metadata.
+ *
+ * Extends Array<T> so it's fully backwards-compatible: works with
+ * .forEach(), .map(), spread, .length, indexing, and Array.isArray().
+ * Additional metadata is accessible via the `.meta` property.
+ *
+ * @example
+ * ```ts
+ * const todos = await client.todos.list(projectId, todolistId);
+ * console.log(`Showing ${todos.length} of ${todos.meta.totalCount} todos`);
+ * todos.forEach(todo => console.log(todo.content));
+ * ```
+ */
+export declare class ListResult<T> extends Array<T> {
+    readonly meta: ListMeta;
+    /**
+     * Array species methods (map, filter, slice, etc.) should return plain
+     * Arrays, not ListResult instances. Without this override, those methods
+     * would call `new ListResult(length)` which fails because our constructor
+     * expects (items[], meta).
+     */
+    static get [Symbol.species](): ArrayConstructor;
+    constructor(items: T[], meta: ListMeta);
+}
+/**
+ * Parses the X-Total-Count header from a Response.
+ * Returns 0 if the header is missing or invalid.
+ */
+export declare function parseTotalCount(response: Response): number;
+//# sourceMappingURL=pagination.d.ts.map

package/dist/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,UAAU,CAAC,CAAC,CAAE,SAAQ,KAAK,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;;;;OAKG;IACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAE9C;gBAEW,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ;CAavC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAK1D"}

package/dist/pagination.js

@@ -0,0 +1,57 @@
+/**
+ * Pagination types and utilities for the Basecamp SDK.
+ *
+ * Provides ListResult (an Array subclass with metadata), pagination options,
+ * and header parsing utilities used by generated service methods.
+ */
+/**
+ * An array of results with pagination metadata.
+ *
+ * Extends Array<T> so it's fully backwards-compatible: works with
+ * .forEach(), .map(), spread, .length, indexing, and Array.isArray().
+ * Additional metadata is accessible via the `.meta` property.
+ *
+ * @example
+ * ```ts
+ * const todos = await client.todos.list(projectId, todolistId);
+ * console.log(`Showing ${todos.length} of ${todos.meta.totalCount} todos`);
+ * todos.forEach(todo => console.log(todo.content));
+ * ```
+ */
+export class ListResult extends Array {
+    meta;
+    /**
+     * Array species methods (map, filter, slice, etc.) should return plain
+     * Arrays, not ListResult instances. Without this override, those methods
+     * would call `new ListResult(length)` which fails because our constructor
+     * expects (items[], meta).
+     */
+    static get [Symbol.species]() {
+        return Array;
+    }
+    constructor(items, meta) {
+        // Use super(0) + length + indexed assignment to avoid:
+        // 1. The single-number-argument trap (super(5) creates 5 empty slots)
+        // 2. The ...spread limit (push(...items) throws RangeError on ~300k+ items)
+        super(0);
+        if (items.length > 0) {
+            this.length = items.length;
+            for (let i = 0; i < items.length; i++) {
+                this[i] = items[i];
+            }
+        }
+        this.meta = meta;
+    }
+}
+/**
+ * Parses the X-Total-Count header from a Response.
+ * Returns 0 if the header is missing or invalid.
+ */
+export function parseTotalCount(response) {
+    const header = response.headers.get("X-Total-Count");
+    if (!header)
+        return 0;
+    const parsed = parseInt(header, 10);
+    return isNaN(parsed) ? 0 : parsed;
+}
+//# sourceMappingURL=pagination.js.map

package/dist/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuBH;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,UAAc,SAAQ,KAAQ;IAChC,IAAI,CAAW;IAExB;;;;;OAKG;IACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,YAAY,KAAU,EAAE,IAAc;QACpC,uDAAuD;QACvD,sEAAsE;QACtE,4EAA4E;QAC5E,KAAK,CAAC,CAAC,CAAC,CAAC;QACT,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Security utilities for the Basecamp SDK.
+ *
+ * Provides helpers for safely logging HTTP requests without exposing
+ * sensitive information like tokens and cookies.
+ */
+/**
+ * Returns a copy of the headers with sensitive values replaced by "[REDACTED]".
+ *
+ * This is useful for safely logging HTTP requests and responses without
+ * exposing tokens, cookies, or other credentials.
+ *
+ * Redacted headers:
+ * - Authorization
+ * - Cookie
+ * - Set-Cookie
+ * - X-CSRF-Token
+ *
+ * @example
+ * ```ts
+ * const safeHeaders = redactHeaders(response.headers);
+ * console.log("Response headers:", safeHeaders);
+ * // { "content-type": "application/json", "authorization": "[REDACTED]" }
+ * ```
+ */
+export declare function redactHeaders(headers: Headers): Record<string, string>;
+/**
+ * Returns a copy of the header record with sensitive values replaced by "[REDACTED]".
+ *
+ * Similar to redactHeaders, but works with plain objects instead of Headers instances.
+ *
+ * @example
+ * ```ts
+ * const headers = { Authorization: "Bearer token", "Content-Type": "application/json" };
+ * const safe = redactHeadersRecord(headers);
+ * // { Authorization: "[REDACTED]", "Content-Type": "application/json" }
+ * ```
+ */
+export declare function redactHeadersRecord(headers: Record<string, string>): Record<string, string>;
+/**
+ * Checks if a hostname represents localhost for development/testing purposes.
+ *
+ * Matches:
+ * - "localhost" exactly
+ * - Any subdomain of localhost (e.g., "api.localhost", "dev.api.localhost")
+ * - IPv4 loopback "127.0.0.1"
+ * - IPv6 loopback "::1"
+ * - The .localhost TLD (RFC 6761) - any hostname ending in ".localhost"
+ *
+ * This is used to allow HTTP (non-HTTPS) connections during local development
+ * while enforcing HTTPS for all production traffic.
+ *
+ * @param hostname - The hostname to check (without port)
+ * @returns true if the hostname represents localhost
+ *
+ * @example
+ * ```ts
+ * isLocalhost("localhost");           // true
+ * isLocalhost("api.localhost");       // true
+ * isLocalhost("myapp.localhost");     // true
+ * isLocalhost("127.0.0.1");           // true
+ * isLocalhost("::1");                 // true
+ * isLocalhost("example.com");         // false
+ * isLocalhost("localhost.example.com"); // false
+ * ```
+ */
+export declare function isLocalhost(hostname: string): boolean;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAatE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQrD"}

package/dist/security.js

@@ -0,0 +1,107 @@
+/**
+ * Security utilities for the Basecamp SDK.
+ *
+ * Provides helpers for safely logging HTTP requests without exposing
+ * sensitive information like tokens and cookies.
+ */
+/**
+ * Headers that contain sensitive values and should be redacted.
+ */
+const SENSITIVE_HEADERS = [
+    "authorization",
+    "cookie",
+    "set-cookie",
+    "x-csrf-token",
+];
+/**
+ * Returns a copy of the headers with sensitive values replaced by "[REDACTED]".
+ *
+ * This is useful for safely logging HTTP requests and responses without
+ * exposing tokens, cookies, or other credentials.
+ *
+ * Redacted headers:
+ * - Authorization
+ * - Cookie
+ * - Set-Cookie
+ * - X-CSRF-Token
+ *
+ * @example
+ * ```ts
+ * const safeHeaders = redactHeaders(response.headers);
+ * console.log("Response headers:", safeHeaders);
+ * // { "content-type": "application/json", "authorization": "[REDACTED]" }
+ * ```
+ */
+export function redactHeaders(headers) {
+    const result = {};
+    headers.forEach((value, key) => {
+        const lowerKey = key.toLowerCase();
+        if (SENSITIVE_HEADERS.includes(lowerKey)) {
+            result[key] = "[REDACTED]";
+        }
+        else {
+            result[key] = value;
+        }
+    });
+    return result;
+}
+/**
+ * Returns a copy of the header record with sensitive values replaced by "[REDACTED]".
+ *
+ * Similar to redactHeaders, but works with plain objects instead of Headers instances.
+ *
+ * @example
+ * ```ts
+ * const headers = { Authorization: "Bearer token", "Content-Type": "application/json" };
+ * const safe = redactHeadersRecord(headers);
+ * // { Authorization: "[REDACTED]", "Content-Type": "application/json" }
+ * ```
+ */
+export function redactHeadersRecord(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lowerKey = key.toLowerCase();
+        if (SENSITIVE_HEADERS.includes(lowerKey)) {
+            result[key] = "[REDACTED]";
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Checks if a hostname represents localhost for development/testing purposes.
+ *
+ * Matches:
+ * - "localhost" exactly
+ * - Any subdomain of localhost (e.g., "api.localhost", "dev.api.localhost")
+ * - IPv4 loopback "127.0.0.1"
+ * - IPv6 loopback "::1"
+ * - The .localhost TLD (RFC 6761) - any hostname ending in ".localhost"
+ *
+ * This is used to allow HTTP (non-HTTPS) connections during local development
+ * while enforcing HTTPS for all production traffic.
+ *
+ * @param hostname - The hostname to check (without port)
+ * @returns true if the hostname represents localhost
+ *
+ * @example
+ * ```ts
+ * isLocalhost("localhost");           // true
+ * isLocalhost("api.localhost");       // true
+ * isLocalhost("myapp.localhost");     // true
+ * isLocalhost("127.0.0.1");           // true
+ * isLocalhost("::1");                 // true
+ * isLocalhost("example.com");         // false
+ * isLocalhost("localhost.example.com"); // false
+ * ```
+ */
+export function isLocalhost(hostname) {
+    const normalized = hostname.toLowerCase();
+    return (normalized === "localhost" ||
+        normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized.endsWith(".localhost"));
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,cAAc;CACf,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA+B;IAE/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK;QACpB,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAClC,CAAC;AACJ,CAAC"}

package/dist/services/authorization.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Authorization service for Basecamp SDK.
+ *
+ * Provides functionality to fetch authorization information including
+ * the authenticated user's identity and list of accessible accounts.
+ */
+import { BaseService, type RawClient } from "./base.js";
+import type { BasecampHooks } from "../hooks.js";
+import type { AuthStrategy } from "../auth-strategy.js";
+/**
+ * The authenticated user's identity.
+ */
+export interface Identity {
+    /** User's unique identifier */
+    id: number;
+    /** User's first name */
+    firstName: string;
+    /** User's last name */
+    lastName: string;
+    /** User's email address */
+    emailAddress: string;
+}
+/**
+ * A Basecamp account the user has access to.
+ */
+export interface AuthorizedAccount {
+    /** Account's unique identifier */
+    id: number;
+    /** Account name */
+    name: string;
+    /** Product type (e.g., "bc3" for Basecamp, "hey" for HEY) */
+    product: string;
+    /** API URL for this account */
+    href: string;
+    /** Web app URL for this account */
+    appHref: string;
+    /** Whether the account is hidden from the user's view */
+    hidden?: boolean;
+    /** Whether the account subscription has expired */
+    expired?: boolean;
+    /** Whether this is the user's featured/primary account */
+    featured?: boolean;
+}
+/**
+ * Authorization information response.
+ */
+export interface AuthorizationInfo {
+    /** Token expiration timestamp */
+    expiresAt: Date;
+    /** The authenticated user's identity */
+    identity: Identity;
+    /** List of accounts the user can access */
+    accounts: AuthorizedAccount[];
+}
+/**
+ * Options for fetching authorization information.
+ */
+export interface GetAuthorizationInfoOptions {
+    /**
+     * Override the default authorization endpoint URL.
+     * Defaults to "https://launchpad.37signals.com/authorization.json"
+     */
+    endpoint?: string;
+    /**
+     * Filter accounts by product type.
+     * Common values: "bc3" (Basecamp 3), "bcx" (Basecamp 2), "hey" (HEY)
+     */
+    filterProduct?: string;
+}
+/**
+ * Service for authorization-related operations.
+ *
+ * This service communicates with the Launchpad authorization endpoint
+ * rather than the standard Basecamp API.
+ *
+ * @example
+ * ```ts
+ * import { createBasecampClient } from "@37signals/basecamp";
+ *
+ * const client = createBasecampClient({
+ *   accountId: "12345",
+ *   accessToken: "your-token",
+ * });
+ *
+ * // Get all accounts
+ * const info = await client.authorization.getInfo();
+ * console.log(`Logged in as ${info.identity.firstName}`);
+ *
+ * // Filter to only Basecamp 3 accounts
+ * const bc3Info = await client.authorization.getInfo({ filterProduct: "bc3" });
+ * for (const account of bc3Info.accounts) {
+ *   console.log(account.name);
+ * }
+ * ```
+ */
+export declare class AuthorizationService extends BaseService {
+    private authStrategy;
+    private userAgent;
+    constructor(client: RawClient, hooks: BasecampHooks | undefined, authStrategy: AuthStrategy, userAgent: string);
+    /**
+     * Fetches authorization information for the current access token.
+     *
+     * Returns the authenticated user's identity and list of accounts
+     * they have access to.
+     *
+     * @param options - Optional configuration
+     * @returns Authorization information including identity and accounts
+     *
+     * @example
+     * ```ts
+     * const info = await authService.getInfo();
+     *
+     * console.log(`User: ${info.identity.firstName} ${info.identity.lastName}`);
+     * console.log(`Email: ${info.identity.emailAddress}`);
+     * console.log(`Token expires: ${info.expiresAt}`);
+     *
+     * for (const account of info.accounts) {
+     *   console.log(`${account.name} (${account.product})`);
+     * }
+     * ```
+     */
+    getInfo(options?: GetAuthorizationInfoOptions): Promise<AuthorizationInfo>;
+}
+//# sourceMappingURL=authorization.d.ts.map

package/dist/services/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/services/authorization.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,wCAAwC;IACxC,QAAQ,EAAE,QAAQ,CAAC;IACnB,2CAA2C;IAC3C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,oBAAqB,SAAQ,WAAW;IACnD,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,SAAS,CAAS;gBAGxB,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,aAAa,GAAG,SAAS,EAChC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,MAAM;IAOnB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,OAAO,CAAC,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA8DrF"}