latchkey 2.17.2 → 2.19.0

package/dist/src/services/ramp.js

@@ -0,0 +1,185 @@
+/**
+ * Ramp service implementation (browser / AI agent-key pathway, production only).
+ *
+ * `latchkey auth browser ramp` runs the OAuth 2.0 authorization-code + PKCE flow
+ * against Ramp's public client (a fixed client ID, no secret). The hosted consent
+ * screen (auth_level=auto) mints an "AI agent key"; latchkey catches the loopback
+ * callback, exchanges the code for a bearer + refresh token at
+ * `.../developer/v1/token/pkce`, and stores them as OAuthCredentials (auto-refreshed).
+ *
+ * Agent keys use the agent-tools endpoints -- POST https://api.ramp.com/developer/v1/
+ * agent-tools/<tool> with a {"rationale": ...} body (they are auth-level barred from
+ * the standard REST endpoints). Spec: https://api.ramp.com/v1/public/agent-tools/spec/.
+ */
+import { randomUUID } from 'node:crypto';
+import { OAuthCredentials } from '../apiCredentials/base.js';
+import { exchangeCodeForTokens, generateCodeChallenge, generateCodeVerifier, refreshAccessToken, startOAuthCallbackServer, } from '../oauthUtils.js';
+import { isBrowserClosedError, LoginCancelledError, Service, ServiceSession } from './core/base.js';
+/** Ramp's public OAuth client (PKCE, no secret), from ramp-cli. */
+const RAMP_OAUTH_CLIENT_ID = 'ramp_id_6pKvd0IR3d8Kuzp82SV6YgpVCZOlz68Px6s3wVsr';
+/** Hosted authorize endpoint (where the user signs in / approves the agent key). */
+const RAMP_AUTHORIZE_URL = 'https://app.ramp.com/v1/authorize';
+/** PKCE token endpoint (code exchange + refresh). */
+const RAMP_PKCE_TOKEN_ENDPOINT = 'https://api.ramp.com/developer/v1/token/pkce';
+/** Loopback callback path; matches ramp-cli's `/callback`. */
+const RAMP_OAUTH_CALLBACK_PATH = '/callback';
+/** Time to wait for the user to finish the hosted login + agent-key approval. */
+const RAMP_LOGIN_TIMEOUT_MS = 300_000;
+/**
+ * Scopes requested on the authorize URL: exactly the scopes Ramp's agent-tools
+ * OpenAPI declares (no regular-REST-only scopes -- agent keys can't use the standard
+ * REST API anyway). Ramp grants only the subset the signed-in user is entitled to
+ * (returned in the token's `scope`), so over-requesting is harmless, but omitting a
+ * scope an endpoint needs fails at call time with DEVELOPER_7100.
+ */
+const RAMP_OAUTH_SCOPES = [
+    'accounting:read',
+    'ai_spend:read',
+    'approvals:write',
+    'bills:read',
+    'cards:read_agentic',
+    'cards:write',
+    'comments:write',
+    'funds:write',
+    'limits:read',
+    'limits:write',
+    'memos:read',
+    'purchase_orders:read',
+    'receipts:write',
+    'reimbursements:read',
+    'reimbursements:write',
+    'tasks:read',
+    'transactions:read',
+    'transactions:write',
+    'treasury:read',
+    'trips:read',
+    'trips:write',
+    'unified_requests:read',
+    'users:read',
+    'vendors:read',
+    'vendors:write',
+    'x402:write',
+].join(' ');
+/**
+ * Browser login session: runs the OAuth authorization-code + PKCE flow in a
+ * Playwright browser and returns OAuthCredentials. login() is overridden wholesale
+ * (the base template's static loginUrl + response-watching model doesn't fit a
+ * per-session authorize URL with a localhost callback), mirroring NotionMcpSession.
+ */
+class RampOAuthServiceSession extends ServiceSession {
+    onResponse(_response) {
+        // Not used -- login completion is signalled by the OAuth callback, not by
+        // inspecting page responses.
+    }
+    isLoginComplete() {
+        // Not used -- login() is overridden entirely.
+        return false;
+    }
+    finalizeCredentials(_browser, _context, _oldCredentials) {
+        // Not used -- login() is overridden entirely.
+        return Promise.resolve(null);
+    }
+    async login(encryptedStorage, launchOptions = {}, _oldCredentials) {
+        const { withTempBrowserContext } = await import('../playwrightUtils.js');
+        const clientId = RAMP_OAUTH_CLIENT_ID;
+        return withTempBrowserContext(encryptedStorage, launchOptions, async ({ context }) => {
+            const page = await context.newPage();
+            const abortController = new AbortController();
+            const closeHandler = () => {
+                abortController.abort();
+            };
+            page.on('close', closeHandler);
+            context.on('close', closeHandler);
+            try {
+                // 1. Stand up the localhost callback server (random port; Ramp's public
+                //    client allows arbitrary loopback ports per RFC 8252).
+                const { port, codePromise } = await startOAuthCallbackServer(RAMP_LOGIN_TIMEOUT_MS, abortController.signal, RAMP_OAUTH_CALLBACK_PATH);
+                const redirectUri = `http://localhost:${port.toString()}${RAMP_OAUTH_CALLBACK_PATH}`;
+                // 2. PKCE verifier/challenge.
+                const codeVerifier = generateCodeVerifier();
+                const codeChallenge = generateCodeChallenge(codeVerifier);
+                // 3. Open Ramp's hosted authorize screen. auth_level=auto triggers the
+                //    "create/approve an AI agent key" prompt.
+                const authUrl = new URL(RAMP_AUTHORIZE_URL);
+                authUrl.searchParams.set('response_type', 'code');
+                authUrl.searchParams.set('client_id', clientId);
+                authUrl.searchParams.set('redirect_uri', redirectUri);
+                authUrl.searchParams.set('scope', RAMP_OAUTH_SCOPES);
+                authUrl.searchParams.set('state', randomUUID());
+                authUrl.searchParams.set('code_challenge', codeChallenge);
+                authUrl.searchParams.set('code_challenge_method', 'S256');
+                authUrl.searchParams.set('auth_level', 'auto');
+                await page.goto(authUrl.toString());
+                // 4. Wait for the user to finish and the callback to deliver the code.
+                const code = await codePromise;
+                // 5. Exchange the code for tokens (public client: no secret).
+                const tokens = exchangeCodeForTokens(RAMP_PKCE_TOKEN_ENDPOINT, code, clientId, '', redirectUri, codeVerifier);
+                const accessTokenExpiresAt = new Date(Date.now() + tokens.expires_in * 1000).toISOString();
+                await page.close();
+                // Public client: clientSecret is stored as '' so refresh sends client_id only.
+                return new OAuthCredentials(clientId, '', tokens.access_token, tokens.refresh_token, accessTokenExpiresAt);
+            }
+            catch (error) {
+                if (error instanceof Error && isBrowserClosedError(error)) {
+                    throw new LoginCancelledError();
+                }
+                throw error;
+            }
+            finally {
+                page.off('close', closeHandler);
+                context.off('close', closeHandler);
+            }
+        });
+    }
+}
+export class Ramp extends Service {
+    name = 'ramp';
+    displayName = 'Ramp';
+    baseApiUrls = ['https://api.ramp.com/'];
+    loginUrl = 'https://app.ramp.com/';
+    info = 'Ramp agent-tools API; the REST API is not supported. ' +
+        'Docs: https://api.ramp.com/v1/public/agent-tools/spec/.';
+    // Validate credentials against `search-help-center-snippets`: the one agent-tools
+    // endpoint that requires only a valid token and no specific scope (`security:
+    // [{oauth2: []}]` in the spec), so the check works regardless of which scopes the
+    // signed-in user's agent key was granted. It's a POST taking a required
+    // {query, rationale} body; a bad token returns a non-200 (404 DEVELOPER_7002).
+    credentialCheckCurlArguments = [
+        '-X',
+        'POST',
+        '-H',
+        'Content-Type: application/json',
+        '-d',
+        '{"query":"ping","rationale":"latchkey credential check"}',
+        'https://api.ramp.com/developer/v1/agent-tools/search-help-center-snippets',
+    ];
+    setCredentialsExample(serviceName) {
+        return `latchkey auth browser ${serviceName}`;
+    }
+    /**
+     * Browser login: run the OAuth authorization-code + PKCE flow and store the
+     * resulting bearer + refresh token.
+     */
+    getSession(appNamePrefix) {
+        return new RampOAuthServiceSession(this, appNamePrefix);
+    }
+    refreshCredentials(apiCredentials) {
+        // Refresh the PKCE access token with the (rotating) refresh token against the
+        // `/token/pkce` endpoint, mirroring ramp-cli.
+        if (!(apiCredentials instanceof OAuthCredentials)) {
+            return Promise.resolve(null);
+        }
+        if (apiCredentials.refreshToken === undefined || apiCredentials.refreshToken === '') {
+            return Promise.resolve(null);
+        }
+        const tokens = refreshAccessToken(RAMP_PKCE_TOKEN_ENDPOINT, apiCredentials.refreshToken, apiCredentials.clientId, apiCredentials.clientSecret);
+        if (tokens === null) {
+            return Promise.resolve(null);
+        }
+        const accessTokenExpiresAt = new Date(Date.now() + tokens.expires_in * 1000).toISOString();
+        // Ramp rotates refresh tokens; keep the old one only if none came back.
+        return Promise.resolve(new OAuthCredentials(apiCredentials.clientId, apiCredentials.clientSecret, tokens.access_token, tokens.refresh_token ?? apiCredentials.refreshToken, accessTokenExpiresAt, apiCredentials.refreshTokenExpiresAt));
+    }
+}
+export const RAMP = new Ramp();
+//# sourceMappingURL=ramp.js.map

package/dist/src/services/ramp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ramp.js","sourceRoot":"","sources":["../../../src/services/ramp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAkB,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpG,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEhF,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAE/D,qDAAqD;AACrD,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;AAEhF,8DAA8D;AAC9D,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAE7C,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG;IACxB,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,oBAAoB;IACpB,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,cAAc;IACd,YAAY;IACZ,sBAAsB;IACtB,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,YAAY;IACZ,mBAAmB;IACnB,oBAAoB;IACpB,eAAe;IACf,YAAY;IACZ,aAAa;IACb,uBAAuB;IACvB,YAAY;IACZ,cAAc;IACd,eAAe;IACf,YAAY;CACb,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,uBAAwB,SAAQ,cAAc;IAClD,UAAU,CAAC,SAAmB;QAC5B,0EAA0E;QAC1E,6BAA6B;IAC/B,CAAC;IAES,eAAe;QACvB,8CAA8C;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAES,mBAAmB,CAC3B,QAAiB,EACjB,QAAwB,EACxB,eAAgC;QAEhC,8CAA8C;QAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,KAAK,CAClB,gBAAmE,EACnE,gBAAsE,EAAE,EACxE,eAAgC;QAEhC,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QAEtC,OAAO,sBAAsB,CAAC,gBAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACnF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAErC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,GAAG,EAAE;gBACxB,eAAe,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC;YACF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAElC,IAAI,CAAC;gBACH,wEAAwE;gBACxE,2DAA2D;gBAC3D,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,CAC1D,qBAAqB,EACrB,eAAe,CAAC,MAAM,EACtB,wBAAwB,CACzB,CAAC;gBACF,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,QAAQ,EAAE,GAAG,wBAAwB,EAAE,CAAC;gBAErF,8BAA8B;gBAC9B,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAE1D,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC5C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;gBAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;gBACrD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;gBAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;gBAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;gBAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAE/C,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAEpC,uEAAuE;gBACvE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAE/B,8DAA8D;gBAC9D,MAAM,MAAM,GAAG,qBAAqB,CAClC,wBAAwB,EACxB,IAAI,EACJ,QAAQ,EACR,EAAE,EACF,WAAW,EACX,YAAY,CACb,CAAC;gBACF,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAE3F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBAEnB,+EAA+E;gBAC/E,OAAO,IAAI,gBAAgB,CACzB,QAAQ,EACR,EAAE,EACF,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,aAAa,EACpB,oBAAoB,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,mBAAmB,EAAE,CAAC;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,IAAK,SAAQ,OAAO;IACtB,IAAI,GAAG,MAAM,CAAC;IACd,WAAW,GAAG,MAAM,CAAC;IACrB,WAAW,GAAG,CAAC,uBAAuB,CAAU,CAAC;IACjD,QAAQ,GAAG,uBAAuB,CAAC;IACnC,IAAI,GACX,uDAAuD;QACvD,yDAAyD,CAAC;IAE5D,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,wEAAwE;IACxE,+EAA+E;IACtE,4BAA4B,GAAG;QACtC,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,gCAAgC;QAChC,IAAI;QACJ,0DAA0D;QAC1D,2EAA2E;KACnE,CAAC;IAEX,qBAAqB,CAAC,WAAmB;QACvC,OAAO,yBAAyB,WAAW,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACM,UAAU,CAAC,aAAqB;QACvC,OAAO,IAAI,uBAAuB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1D,CAAC;IAEQ,kBAAkB,CAAC,cAA8B;QACxD,8EAA8E;QAC9E,8CAA8C;QAC9C,IAAI,CAAC,CAAC,cAAc,YAAY,gBAAgB,CAAC,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,cAAc,CAAC,YAAY,KAAK,SAAS,IAAI,cAAc,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACpF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAC/B,wBAAwB,EACxB,cAAc,CAAC,YAAY,EAC3B,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,YAAY,CAC5B,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,oBAAoB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3F,wEAAwE;QACxE,OAAO,OAAO,CAAC,OAAO,CACpB,IAAI,gBAAgB,CAClB,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,YAAY,EAC3B,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,aAAa,IAAI,cAAc,CAAC,YAAY,EACnD,oBAAoB,EACpB,cAAc,CAAC,qBAAqB,CACrC,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC"}

package/dist/src/sharedOperations.d.ts

@@ -41,4 +41,15 @@ export interface AuthBrowserPrepareResult {
     readonly alreadyPrepared: boolean;
 }
 export declare function authBrowserPrepare(registry: ServiceRegistry, apiCredentialStore: ApiCredentialStore, encryptedStorage: EncryptedStorage, config: Config, serviceName: string): Promise<AuthBrowserPrepareResult>;
+export interface PrepareServiceResult {
+    readonly serviceName: string;
+    readonly credentialType: string;
+}
+/**
+ * Store credentials for a service from a validated JSON payload
+ * (`latchkey auth prepare <service> <json>`). The whole operation is rejected — and
+ * nothing is stored — if the JSON is malformed, fails the service's schema, or
+ * the service does not support prepare.
+ */
+export declare function prepareService(registry: ServiceRegistry, apiCredentialStore: ApiCredentialStore, serviceName: string, json: string): PrepareServiceResult;
 //# sourceMappingURL=sharedOperations.d.ts.map

package/dist/src/sharedOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharedOperations.d.ts","sourceRoot":"","sources":["../../src/sharedOperations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAO9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAO5D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,WAAW,EAAE,MAAM;CAMhC;AAED,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,WAAW,EAAE,MAAM;CAOhC;AAkCD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/C,SAAS,MAAM,EAAE,CAoBnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,UAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC,CAyB7B;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAC,CAwB5F;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,wBAAwB,CAAC,CA8BnC"}
+{"version":3,"file":"sharedOperations.d.ts","sourceRoot":"","sources":["../../src/sharedOperations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAO9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAY5D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,WAAW,EAAE,MAAM;CAMhC;AAED,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,WAAW,EAAE,MAAM;CAOhC;AAkCD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/C,SAAS,MAAM,EAAE,CAoBnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;IAC/C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,UAAQ,GACd,OAAO,CAAC,kBAAkB,CAAC,CAyB7B;AAED,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,mBAAmB,CAAA;CAAE,CAAC,CAAC,CAwB5F;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,wBAAwB,CAAC,CA8BnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,eAAe,EACzB,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,oBAAoB,CAyBtB"}

package/dist/src/sharedOperations.js

@@ -9,7 +9,7 @@ import { ApiCredentialStatus } from './apiCredentials/base.js';
 import { getCredentialStatus } from './apiCredentials/utils.js';
 import { loadBrowserConfig } from './configDataStore.js';
 import { BrowserDisabledError, BrowserFlowsNotSupportedError, GraphicalEnvironmentNotFoundError, hasGraphicalEnvironment, } from './playwrightUtils.js';
-import { isBrowserClosedError, LoginCancelledError } from './services/core/base.js';
+import { isBrowserClosedError, LoginCancelledError, PrepareInputInvalidError, PrepareNotSupportedError, } from './services/core/base.js';
 import { RegisteredService } from './services/core/registered.js';
 // Error classes
 export class UnknownServiceError extends Error {
@@ -142,4 +142,31 @@ export async function authBrowserPrepare(registry, apiCredentialStore, encrypted
     apiCredentialStore.save(service.name, apiCredentials);
     return { alreadyPrepared: false };
 }
+/**
+ * Store credentials for a service from a validated JSON payload
+ * (`latchkey auth prepare <service> <json>`). The whole operation is rejected — and
+ * nothing is stored — if the JSON is malformed, fails the service's schema, or
+ * the service does not support prepare.
+ */
+export function prepareService(registry, apiCredentialStore, serviceName, json) {
+    const service = lookupService(registry, serviceName);
+    // Services opt in to prepare by implementing prepareFromJson; absence is the
+    // default "not supported" state.
+    if (service.prepareFromJson === undefined) {
+        throw new PrepareNotSupportedError(serviceName);
+    }
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(json);
+    }
+    catch (error) {
+        throw new PrepareInputInvalidError(serviceName, `not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    // prepareFromJson validates against the service's schema and throws
+    // PrepareInputInvalidError on any mismatch, so a store only happens once the
+    // input is fully valid.
+    const credentials = service.prepareFromJson(parsedJson);
+    apiCredentialStore.save(service.name, credentials);
+    return { serviceName: service.name, credentialType: credentials.objectType };
+}
 //# sourceMappingURL=sharedOperations.js.map

package/dist/src/sharedOperations.js.map

@@ -1 +1 @@
-{"version":3,"file":"sharedOperations.js","sourceRoot":"","sources":["../../src/sharedOperations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE,gBAAgB;AAEhB,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,WAAmB;QAC7B,KAAK,CACH,oBAAoB,WAAW,2DAA2D,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,WAAmB;QAC7B,KAAK,CACH,WAAW,WAAW,+BAA+B;YACnD,sCAAsC,WAAW,sBAAsB,CAC1E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,UAAU;AAEV,SAAS,aAAa,CAAC,QAAyB,EAAE,WAAmB;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAI7C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,iCAAiC,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAE,aAAa,CAAC,cAAc;KAC7C,CAAC;AACJ,CAAC;AAED,aAAa;AAEb,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,kBAAsC,EACtC,MAAc,EACd,OAAgD;IAEhD,IAAI,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEtC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,YAAY,iBAAiB,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACnD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,eAAe,GACnB,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,uBAAuB,EAAE,CAAC;YAC3F,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAyB,EACzB,kBAAsC,EACtC,MAAc,EACd,WAAmB,EACnB,OAAO,GAAG,KAAK;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;IACpF,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEnE,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAChD,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,MAAM,CAAC,0BAA0B,EACjC,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,YAAY,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;IAE1F,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW;QACX,gBAAgB;QAChB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC;QACjE,cAAc,EAAE,OAAO,CAAC,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAyB,EACzB,kBAAsC,EACtC,MAAc;IAEd,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;IAEnD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,cAAc,EACd,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAE/B,EAAE;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,gBAAgB,GACpB,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,MAAM,mBAAmB,CACvB,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,MAAM,CAAC,0BAA0B,CAClC;YACH,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAEhC,OAAO,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAyB,EACzB,kBAAsC,EACtC,gBAAkC,EAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,OAAO,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,CACxC,gBAAgB,EAChB,aAAa,EACb,cAAc,IAAI,SAAS,CAC5B,CAAC;IACF,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAyB,EACzB,kBAAsC,EACtC,gBAAkC,EAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,cAAc,CAAC;IACnB,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACtD,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"sharedOperations.js","sourceRoot":"","sources":["../../src/sharedOperations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGlE,gBAAgB;AAEhB,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,WAAmB;QAC7B,KAAK,CACH,oBAAoB,WAAW,2DAA2D,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,WAAmB;QAC7B,KAAK,CACH,WAAW,WAAW,+BAA+B;YACnD,sCAAsC,WAAW,sBAAsB,CAC1E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,UAAU;AAEV,SAAS,aAAa,CAAC,QAAyB,EAAE,WAAmB;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAI7C,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,iCAAiC,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAE,aAAa,CAAC,cAAc;KAC7C,CAAC;AACJ,CAAC;AAED,aAAa;AAEb,MAAM,UAAU,YAAY,CAC1B,QAAyB,EACzB,kBAAsC,EACtC,MAAc,EACd,OAAgD;IAEhD,IAAI,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEtC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,YAAY,iBAAiB,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACnD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,eAAe,GACnB,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,uBAAuB,EAAE,CAAC;YAC3F,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAyB,EACzB,kBAAsC,EACtC,MAAc,EACd,WAAmB,EACnB,OAAO,GAAG,KAAK;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;IACpF,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEnE,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAChD,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,MAAM,CAAC,0BAA0B,EACjC,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,YAAY,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;IAE1F,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW;QACX,gBAAgB;QAChB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC;QACjE,cAAc,EAAE,OAAO,CAAC,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAAyB,EACzB,kBAAsC,EACtC,MAAc;IAEd,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;IAEnD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,cAAc,EACd,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAE/B,EAAE;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,gBAAgB,GACpB,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,MAAM,mBAAmB,CACvB,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,MAAM,CAAC,0BAA0B,CAClC;YACH,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAEhC,OAAO,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAyB,EACzB,kBAAsC,EACtC,gBAAkC,EAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,OAAO,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,CACxC,gBAAgB,EAChB,aAAa,EACb,cAAc,IAAI,SAAS,CAC5B,CAAC;IACF,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAyB,EACzB,kBAAsC,EACtC,gBAAkC,EAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,cAAc,CAAC;IACnB,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACtD,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,kBAAsC,EACtC,WAAmB,EACnB,IAAY;IAEZ,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAErD,6EAA6E;IAC7E,iCAAiC;IACjC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAwB,CAChC,WAAW,EACX,mBAAmB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IACxD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnD,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;AAC/E,CAAC"}

package/dist/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "2.17.2";
+export declare const VERSION = "2.19.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/src/version.js

@@ -1,4 +1,4 @@
 // Auto-generated from package.json by scripts/generateVersion.js.
 // Do not edit by hand; run `node scripts/generateVersion.js` to refresh.
-export const VERSION = "2.17.2";
+export const VERSION = "2.19.0";
 //# sourceMappingURL=version.js.map

package/dist/tests/cli.test.js

@@ -18,6 +18,7 @@ import { GITLAB } from '../src/services/gitlab.js';
 import { GITHUB } from '../src/services/github.js';
 import { derivePermissionsOverrideSigningKey, verifyPermissionsOverrideJwt, } from '../src/gateway/permissionsOverride.js';
 import { TELEGRAM } from '../src/services/telegram.js';
+import { GOOGLE_GMAIL } from '../src/services/google/gmail.js';
 import { deleteRegisteredService, loadRegisteredServices, saveRegisteredService, } from '../src/configDataStore.js';
 import { loadRegisteredServicesIntoServiceRegistry } from '../src/serviceRegistry.js';
 // Use a fixed test key for deterministic test behavior (32 bytes = 256 bits, base64 encoded)
@@ -948,6 +949,55 @@ describe('CLI commands with dependency injection', () => {
             expect(exitCode).toBe(1);
         });
     });
+    describe('prepare command', () => {
+        it('stores an OAuth client for a Google service and reports success', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, '{}');
+            const deps = createMockDependencies({
+                registry: new ServiceRegistry([GOOGLE_GMAIL]),
+            });
+            await runCommand(['auth', 'prepare', 'google-gmail', '{"clientId":"cid","clientSecret":"csecret"}'], deps);
+            expect(logs).toContain('Done');
+            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
+            expect(storedData['google-gmail']).toEqual({
+                objectType: 'oauth',
+                clientId: 'cid',
+                clientSecret: 'csecret',
+            });
+        });
+        it('returns an error for an unknown service', async () => {
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'prepare', 'unknown-service', '{}'], deps);
+            expect(exitCode).toBe(1);
+        });
+        it('returns an error for a service that does not support prepare', async () => {
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'prepare', 'slack', '{"clientId":"a","clientSecret":"b"}'], deps);
+            expect(exitCode).toBe(1);
+        });
+        it('returns an error and stores nothing for malformed JSON', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, '{}');
+            const deps = createMockDependencies({
+                registry: new ServiceRegistry([GOOGLE_GMAIL]),
+            });
+            await runCommand(['auth', 'prepare', 'google-gmail', '{not valid'], deps);
+            expect(exitCode).toBe(1);
+            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
+            expect(storedData['google-gmail']).toBeUndefined();
+        });
+        it('returns an error for input that fails the schema', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, '{}');
+            const deps = createMockDependencies({
+                registry: new ServiceRegistry([GOOGLE_GMAIL]),
+            });
+            await runCommand(['auth', 'prepare', 'google-gmail', '{"clientId":"only-id"}'], deps);
+            expect(exitCode).toBe(1);
+            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
+            expect(storedData['google-gmail']).toBeUndefined();
+        });
+    });
     describe('curl command', () => {
         it('should pass arguments to subprocess', async () => {
             const storePath = join(tempDir, 'credentials.json');
@@ -1018,6 +1068,18 @@ describe('CLI commands with dependency injection', () => {
             await runCommand(['curl', 'https://unknown-api.example.com'], deps);
             expect(exitCode).toBe(1);
         });
+        it('should return error when OAuth credentials lack an access token', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, JSON.stringify({
+                'google-gmail': { objectType: 'oauth', clientId: 'cid', clientSecret: 'csecret' },
+            }));
+            const deps = createMockDependencies({
+                registry: new ServiceRegistry([GOOGLE_GMAIL]),
+            });
+            await runCommand(['curl', 'https://gmail.googleapis.com/gmail/v1/users/me/profile'], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.length).toBeGreaterThan(0);
+        });
         it('should pass through unknown service when passthroughUnknown is enabled', async () => {
             const deps = createMockDependencies({
                 config: createMockConfig({ passthroughUnknown: true }),
@@ -1860,12 +1922,31 @@ describe('CLI commands with dependency injection', () => {
             await runCommand(['auth', 'browser-prepare', 'slack'], deps);
             expect(logs).toContain('Already prepared.');
         });
+        it('forwards `prepare` to the gateway /latchkey endpoint', async () => {
+            const fetchMock = makeFetchMock(new Response(JSON.stringify({ result: { serviceName: 'google-gmail', credentialType: 'oauth' } }), { status: 200 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['auth', 'prepare', 'google-gmail', '{"clientId":"cid","clientSecret":"csecret"}'], deps);
+            expect(fetchMock).toHaveBeenCalledTimes(1);
+            const [url, init] = fetchMock.mock.calls[0];
+            expect(url).toBe(`${GATEWAY_URL}/latchkey`);
+            expect(JSON.parse(init.body)).toEqual({
+                command: 'auth prepare',
+                params: {
+                    serviceName: 'google-gmail',
+                    json: '{"clientId":"cid","clientSecret":"csecret"}',
+                },
+            });
+            expect(logs).toContain('Done');
+        });
         it.each([
             ['services list', ['services', 'list']],
             ['services info', ['services', 'info', 'foo']],
             ['auth list', ['auth', 'list']],
             ['auth browser', ['auth', 'browser', 'slack']],
             ['auth browser-prepare', ['auth', 'browser-prepare', 'slack']],
+            ['auth prepare', ['auth', 'prepare', 'foo', '{}']],
         ])('reports gateway errors on stderr (not stdout) for `%s`', async (_name, argv) => {
             makeFetchMock(new Response(JSON.stringify({ error: 'Unknown service: foo.' }), { status: 400 }));
             const deps = createMockDependencies({