latchkey 2.7.3 → 2.9.0

package/dist/src/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAEnE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,QAAgB,EAAE,WAAmB;QAC/C,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,KAAK,CACH,QAAQ,QAAQ,8BAA8B,gBAAgB,qBAAqB,QAAQ,EAAE,CAC9F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,WAAmB;QAC7B,KAAK,CAAC,IAAI,WAAW,0CAA0C,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,QAAgB;QAC1B,KAAK,CACH,+CAA+C,QAAQ,4CAA4C,CACpG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AACxD,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;AAClE,MAAM,qCAAqC,GAAG,+BAA+B,CAAC;AAC9E,MAAM,qCAAqC,GAAG,+BAA+B,CAAC;AAC9E,MAAM,gCAAgC,GAAG,0BAA0B,CAAC;AACpE,MAAM,iCAAiC,GAAG,2BAA2B,CAAC;AACtE,MAAM,mCAAmC,GAAG,6BAA6B,CAAC;AAC1E,MAAM,uDAAuD,GAC3D,iDAAiD,CAAC;AACpD,MAAM,oCAAoC,GAAG,8BAA8B,CAAC;AAC5E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,oCAAoC,GAAG,8BAA8B,CAAC;AAC5E,MAAM,oCAAoC,GAAG,8BAA8B,CAAC;AAE5E,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAC7D,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAEvD,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AACzD,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AACxD,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAEvD,SAAS,6BAA6B,CAAC,IAAY;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,QAA4B,EAC5B,SAA6B,EAC7B,YAAoB;IAEpB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,QAA4B,EAC5B,SAA6B;IAE7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAC/B,QAA4B,EAC5B,SAA6B;IAE7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;YAC9D,MAAM,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAA4B,EAAE,SAA8B;IAClF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACR,SAAS,CAAS;IAClB,WAAW,CAAS;IAC7B;;;;OAIG;IACM,qBAAqB,CAAgB;IACrC,WAAW,CAAS;IACpB,WAAW,CAAS;IAC7B;;;OAGG;IACM,eAAe,CAAU;IAClC;;OAEG;IACM,gBAAgB,CAAU;IACnC;;;OAGG;IACM,yBAAyB,CAAgB;IAClD;;OAEG;IACM,iCAAiC,CAAU;IACpD;;;OAGG;IACM,kBAAkB,CAAU;IACrC;;;;OAIG;IACM,UAAU,CAAgB;IACnC;;;;OAIG;IACM,iBAAiB,CAAS;IACnC;;;OAGG;IACM,iBAAiB,CAAS;IAEnC,YACE,SAA+C,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAC1E,uBAAyD,YAAY;QAErE,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChG,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,+BAA+B,CAAC,IAAI,IAAI,CAAC;QAE7E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QAE7E,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,GAAG,aAAa,CAC9B,MAAM,CAAC,qCAAqC,CAAC,EAC7C,QAAQ,CAAC,kBAAkB,EAC3B,4BAA4B,CAC7B,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,aAAa,CAC9B,MAAM,CAAC,qCAAqC,CAAC,EAC7C,QAAQ,CAAC,kBAAkB,EAC3B,4BAA4B,CAC7B,CAAC;QAEF,IAAI,CAAC,eAAe,GAAG,cAAc,CACnC,MAAM,CAAC,gCAAgC,CAAC,EACxC,QAAQ,CAAC,eAAe,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,cAAc,CACpC,MAAM,CAAC,iCAAiC,CAAC,EACzC,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;QACF,IAAI,CAAC,iCAAiC,GAAG,cAAc,CACrD,MAAM,CAAC,uDAAuD,CAAC,EAC/D,QAAQ,CAAC,iCAAiC,CAC3C,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,cAAc,CACtC,MAAM,CAAC,oCAAoC,CAAC,EAC5C,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QAEF,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,MAAM,CAAC,mCAAmC,CAAC,EAC3C,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,iBAAiB,CAAC;QAEnD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,IAAI,CAAC,iBAAiB,GAAG,aAAa,CACpC,MAAM,CAAC,oCAAoC,CAAC,EAC5C,QAAQ,CAAC,iBAAiB,EAC1B,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,wBAAwB,CAC/C,MAAM,CAAC,oCAAoC,CAAC,EAC5C,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACH,6BAA6B;QAC3B,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEvE,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YACvC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,4BAA4B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,wBAAwB;QACtB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,YAAY,EAAiB,MAAM,sBAAsB,CAAC;AAEnE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YAAY,QAAgB,EAAE,WAAmB;QAC/C,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,KAAK,CACH,QAAQ,QAAQ,8BAA8B,gBAAgB,qBAAqB,QAAQ,EAAE,CAC9F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,WAAmB;QAC7B,KAAK,CAAC,IAAI,WAAW,0CAA0C,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,QAAgB;QAC1B,KAAK,CACH,+CAA+C,QAAQ,4CAA4C,CACpG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AACxD,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAC9C,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;AAClE,MAAM,qCAAqC,GAAG,+BAA+B,CAAC;AAC9E,MAAM,qCAAqC,GAAG,+BAA+B,CAAC;AAC9E,MAAM,gCAAgC,GAAG,0BAA0B,CAAC;AACpE,MAAM,iCAAiC,GAAG,2BAA2B,CAAC;AACtE,MAAM,mCAAmC,GAAG,6BAA6B,CAAC;AAC1E,MAAM,uDAAuD,GAC3D,iDAAiD,CAAC;AACpD,MAAM,oCAAoC,GAAG,8BAA8B,CAAC;AAC5E,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,oCAAoC,GAAG,8BAA8B,CAAC;AAC5E,MAAM,oCAAoC,GAAG,8BAA8B,CAAC;AAC5E,MAAM,iCAAiC,GAAG,2BAA2B,CAAC;AACtE,MAAM,wCAAwC,GAAG,kCAAkC,CAAC;AACpF,MAAM,6CAA6C,GAAG,uCAAuC,CAAC;AAE9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAC7D,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;AACvD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAEvD,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AACzD,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AACxD,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AACvD,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAE/C,SAAS,6BAA6B,CAAC,IAAY;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,QAA4B,EAC5B,SAA6B,EAC7B,YAAoB;IAEpB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,QAA4B,EAC5B,SAA6B;IAE7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAC/B,QAA4B,EAC5B,SAA6B;IAE7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;YAC9D,MAAM,IAAI,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAA4B,EAAE,SAA8B;IAClF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,MAAM;IACR,SAAS,CAAS;IAClB,WAAW,CAAS;IAC7B;;;;OAIG;IACM,qBAAqB,CAAgB;IACrC,WAAW,CAAS;IACpB,WAAW,CAAS;IAC7B;;;OAGG;IACM,eAAe,CAAU;IAClC;;OAEG;IACM,gBAAgB,CAAU;IACnC;;;OAGG;IACM,yBAAyB,CAAgB;IAClD;;OAEG;IACM,iCAAiC,CAAU;IACpD;;;OAGG;IACM,kBAAkB,CAAU;IACrC;;;;OAIG;IACM,UAAU,CAAgB;IACnC;;;;OAIG;IACM,iBAAiB,CAAS;IACnC;;;OAGG;IACM,iBAAiB,CAAS;IACnC;;;;;;;OAOG;IACM,eAAe,CAAgB;IACxC;;;;;;;;OAQG;IACM,qBAAqB,CAAgB;IAC9C;;;;;;;;OAQG;IACM,0BAA0B,CAAgB;IAEnD,YACE,SAA+C,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAC1E,uBAAyD,YAAY;QAErE,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChG,IAAI,CAAC,qBAAqB,GAAG,MAAM,CAAC,+BAA+B,CAAC,IAAI,IAAI,CAAC;QAE7E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QAE7E,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,GAAG,aAAa,CAC9B,MAAM,CAAC,qCAAqC,CAAC,EAC7C,QAAQ,CAAC,kBAAkB,EAC3B,4BAA4B,CAC7B,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,aAAa,CAC9B,MAAM,CAAC,qCAAqC,CAAC,EAC7C,QAAQ,CAAC,kBAAkB,EAC3B,4BAA4B,CAC7B,CAAC;QAEF,IAAI,CAAC,eAAe,GAAG,cAAc,CACnC,MAAM,CAAC,gCAAgC,CAAC,EACxC,QAAQ,CAAC,eAAe,CACzB,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,cAAc,CACpC,MAAM,CAAC,iCAAiC,CAAC,EACzC,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;QACF,IAAI,CAAC,iCAAiC,GAAG,cAAc,CACrD,MAAM,CAAC,uDAAuD,CAAC,EAC/D,QAAQ,CAAC,iCAAiC,CAC3C,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,cAAc,CACtC,MAAM,CAAC,oCAAoC,CAAC,EAC5C,QAAQ,CAAC,kBAAkB,CAC5B,CAAC;QAEF,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,MAAM,CAAC,mCAAmC,CAAC,EAC3C,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;QACF,IAAI,CAAC,yBAAyB,GAAG,iBAAiB,CAAC;QAEnD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAErE,IAAI,CAAC,iBAAiB,GAAG,aAAa,CACpC,MAAM,CAAC,oCAAoC,CAAC,EAC5C,QAAQ,CAAC,iBAAiB,EAC1B,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,wBAAwB,CAC/C,MAAM,CAAC,oCAAoC,CAAC,EAC5C,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;QAEF,MAAM,eAAe,GAAG,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAClE,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnF,MAAM,qBAAqB,GAAG,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAC/E,IAAI,CAAC,qBAAqB;YACxB,qBAAqB,KAAK,SAAS,IAAI,qBAAqB,KAAK,EAAE;gBACjE,CAAC,CAAC,qBAAqB;gBACvB,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,0BAA0B,GAAG,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACzF,IAAI,CAAC,0BAA0B;YAC7B,0BAA0B,KAAK,SAAS,IAAI,0BAA0B,KAAK,EAAE;gBAC3E,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,IAAI,CAAC;IACb,CAAC;IAED,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,6BAA6B;QAC3B,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEvE,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;YACvC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,4BAA4B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,wBAAwB;QACtB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC"}

package/dist/src/curlInjection.d.ts

@@ -31,7 +31,7 @@ export declare class CredentialsExpiredError extends Error {
 }
 export interface CurlInjectionDependencies {
     readonly registry: ServiceRegistry;
-    readonly checkPermission: (curlArguments: readonly string[], configPath: string, doNotUseBuiltinSchemas: boolean) => Promise<boolean>;
+    readonly checkPermission: (request: Request, configPath: string, doNotUseBuiltinSchemas: boolean) => Promise<boolean>;
     readonly permissionsConfigPath: string;
     readonly permissionsDoNotUseBuiltinSchemas: boolean;
     readonly passthroughUnknown: boolean;

package/dist/src/curlInjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"curlInjection.d.ts","sourceRoot":"","sources":["../../src/curlInjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,GAAG,EAAE,MAAM;CAKxB;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,WAAW,EAAE,MAAM;CAKhC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,WAAW,EAAE,MAAM;CAKhC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,CACxB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,UAAU,EAAE,MAAM,EAClB,sBAAsB,EAAE,OAAO,KAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,iCAAiC,EAAE,OAAO,CAAC;IACpD,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,yBAAyB,GACtC,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA+C5B"}
+{"version":3,"file":"curlInjection.d.ts","sourceRoot":"","sources":["../../src/curlInjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAKpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,GAAG,EAAE,MAAM;CAKxB;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,WAAW,EAAE,MAAM;CAKhC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,WAAW,EAAE,MAAM;CAKhC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,CACxB,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,EAClB,sBAAsB,EAAE,OAAO,KAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,iCAAiC,EAAE,OAAO,CAAC;IACpD,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,yBAAyB,GACtC,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA4D5B"}

package/dist/src/curlInjection.js

@@ -11,6 +11,7 @@
  */
 import { maybeRefreshCredentials } from './apiCredentials/utils.js';
 import { CurlParseError, extractUrlFromCurlArguments } from './curl.js';
+import { parseCurlArgs } from '@imbue-ai/detent';
 import { ErrorMessages } from './errorMessages.js';
 export class RequestNotPermittedError extends Error {
     constructor() {
@@ -57,7 +58,21 @@ export class CredentialsExpiredError extends Error {
  * underlying permission check).
  */
 export async function prepareCurlInvocation(curlArguments, apiCredentialStore, dependencies) {
-    const allowed = await dependencies.checkPermission(curlArguments, dependencies.permissionsConfigPath, dependencies.permissionsDoNotUseBuiltinSchemas);
+    // Parse the curl arguments once for the permission check. A parse failure
+    // here means the user's curl invocation is malformed, which is treated as
+    // a URL-extraction failure (the same category as the second parse below),
+    // not a permission-check failure.
+    let parsedRequest;
+    try {
+        parsedRequest = parseCurlArgs(curlArguments);
+    }
+    catch (error) {
+        if (error instanceof CurlParseError) {
+            throw new UrlExtractionFailedError(error.message);
+        }
+        throw error;
+    }
+    const allowed = await dependencies.checkPermission(parsedRequest, dependencies.permissionsConfigPath, dependencies.permissionsDoNotUseBuiltinSchemas);
     if (!allowed) {
         throw new RequestNotPermittedError();
     }

package/dist/src/curlInjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"curlInjection.js","sourceRoot":"","sources":["../../src/curlInjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,MAAe;QACzB,KAAK,CACH,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,aAAa,CAAC,kBAAkB;YAClC,CAAC,CAAC,GAAG,aAAa,CAAC,uBAAuB,IAAI,MAAM,EAAE,CACzD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,GAAG,CAAS;IAErB,YAAY,GAAW;QACrB,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,WAAW,CAAS;IAE7B,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,WAAW,CAAS;IAE7B,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAgC,EAChC,kBAAsC,EACtC,YAAuC;IAEvC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,eAAe,CAChD,aAAa,EACb,YAAY,CAAC,qBAAqB,EAClC,YAAY,CAAC,iCAAiC,CAC/C,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,kBAAkB,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,cAAc,GAA0B,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,kBAAkB,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;QACxC,cAAc,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC5F,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"curlInjection.js","sourceRoot":"","sources":["../../src/curlInjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,MAAe;QACzB,KAAK,CACH,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,aAAa,CAAC,kBAAkB;YAClC,CAAC,CAAC,GAAG,aAAa,CAAC,uBAAuB,IAAI,MAAM,EAAE,CACzD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,GAAG,CAAS;IAErB,YAAY,GAAW;QACrB,KAAK,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,WAAW,CAAS;IAE7B,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,WAAW,CAAS;IAE7B,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAgC,EAChC,kBAAsC,EACtC,YAAuC;IAEvC,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,kCAAkC;IAClC,IAAI,aAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,eAAe,CAChD,aAAa,EACb,YAAY,CAAC,qBAAqB,EAClC,YAAY,CAAC,iCAAiC,CAC/C,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,2BAA2B,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,YAAY,CAAC,kBAAkB,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,cAAc,GAA0B,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,kBAAkB,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;QACxC,cAAc,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC5F,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,cAAc,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;AAChE,CAAC"}

package/dist/src/encryptedStorage.d.ts

@@ -1,40 +1,24 @@
 /**
- * Encrypted file storage with automatic key management.
- * Encryption keys are retrieved from:
- * 1. Provided encryptionKeyOverride option
- * 2. System keychain
- * 3. Generated and stored in keychain (first run)
- *
- * Throws if neither a system keychain nor LATCHKEY_ENCRYPTION_KEY is available.
+ * Encrypted file storage. The master encryption key is resolved by
+ * `resolveEncryptionKey` (see `encryption.ts`), which handles the keychain /
+ * override / generate-on-first-run logic. This module only deals with
+ * reading and writing encrypted files.
  */
 export declare class EncryptedStorageError extends Error {
     constructor(message: string);
 }
-export declare class EncryptionKeyLostError extends EncryptedStorageError {
-    constructor();
-}
 export declare class PathIsDirectoryError extends Error {
     constructor(filePath: string);
 }
-export interface EncryptedStorageOptions {
-    encryptionKeyOverride?: string | null;
-    serviceName?: string;
-    accountName?: string;
-    /**
-     * When false, refuse to generate a new encryption key if the keychain has no key.
-     * This prevents silently replacing a lost key, which would make existing encrypted data unreadable.
-     * Set to false when encrypted files already exist on disk.
-     */
-    allowKeyGeneration?: boolean;
-}
 /**
- * Manages encrypted file storage with automatic key handling.
+ * Read and write encrypted files using a pre-resolved master key. Use
+ * `resolveEncryptionKey` (from `encryption.ts`) to obtain the key from the
+ * keychain / environment / generation-on-first-run logic, then construct
+ * `EncryptedStorage` directly.
  */
 export declare class EncryptedStorage {
     private readonly key;
-    private constructor();
-    static create(options?: EncryptedStorageOptions): Promise<EncryptedStorage>;
-    private static initializeKey;
+    constructor(key: string);
     /**
      * Read and decrypt a file.
      */

package/dist/src/encryptedStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryptedStorage.d.ts","sourceRoot":"","sources":["../../src/encryptedStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAuB,SAAQ,qBAAqB;;CAUhE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAED,MAAM,WAAW,uBAAuB;IACtC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,OAAO;WAIM,MAAM,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC;mBAKhE,aAAa;IAkClC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAgCzC;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;CAkBnD"}
+{"version":3,"file":"encryptedStorage.d.ts","sourceRoot":"","sources":["../../src/encryptedStorage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAI7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,GAAG,EAAE,MAAM;IAIvB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAgCzC;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;CAkBnD"}

package/dist/src/encryptedStorage.js

@@ -1,18 +1,13 @@
 /**
- * Encrypted file storage with automatic key management.
- * Encryption keys are retrieved from:
- * 1. Provided encryptionKeyOverride option
- * 2. System keychain
- * 3. Generated and stored in keychain (first run)
- *
- * Throws if neither a system keychain nor LATCHKEY_ENCRYPTION_KEY is available.
+ * Encrypted file storage. The master encryption key is resolved by
+ * `resolveEncryptionKey` (see `encryption.ts`), which handles the keychain /
+ * override / generate-on-first-run logic. This module only deals with
+ * reading and writing encrypted files.
  */
 import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { writeFileAtomic } from './atomicWrite.js';
-import { DEFAULT_KEYRING_SERVICE_NAME, DEFAULT_KEYRING_ACCOUNT_NAME } from './config.js';
-import { encrypt, decrypt, generateKey, DecryptionError } from './encryption.js';
-import { retrieveFromKeychain, storeInKeychain, KeychainNotAvailableError } from './keychain.js';
+import { decrypt, DecryptionError, encrypt } from './encryption.js';
 const ENCRYPTED_FILE_PREFIX = 'LATCHKEY_ENCRYPTED:';
 export class EncryptedStorageError extends Error {
     constructor(message) {
@@ -20,15 +15,6 @@ export class EncryptedStorageError extends Error {
         this.name = 'EncryptedStorageError';
     }
 }
-export class EncryptionKeyLostError extends EncryptedStorageError {
-    constructor() {
-        super('The encryption key was lost from the system keychain and encrypted data already exists. ' +
-            'Generating a new key would make existing data unreadable. ' +
-            'Restore the keychain or set LATCHKEY_ENCRYPTION_KEY, ' +
-            'or delete the encrypted files and start fresh with `latchkey auth clear`.');
-        this.name = 'EncryptionKeyLostError';
-    }
-}
 export class PathIsDirectoryError extends Error {
     constructor(filePath) {
         super(`Path is a directory, not a file: ${filePath}`);
@@ -36,45 +22,16 @@ export class PathIsDirectoryError extends Error {
     }
 }
 /**
- * Manages encrypted file storage with automatic key handling.
+ * Read and write encrypted files using a pre-resolved master key. Use
+ * `resolveEncryptionKey` (from `encryption.ts`) to obtain the key from the
+ * keychain / environment / generation-on-first-run logic, then construct
+ * `EncryptedStorage` directly.
  */
 export class EncryptedStorage {
     key;
     constructor(key) {
         this.key = key;
     }
-    static async create(options = {}) {
-        const key = await EncryptedStorage.initializeKey(options);
-        return new EncryptedStorage(key);
-    }
-    static async initializeKey(options) {
-        // If key was provided via override, use it
-        if (options.encryptionKeyOverride !== undefined && options.encryptionKeyOverride !== null) {
-            return options.encryptionKeyOverride;
-        }
-        const serviceName = options.serviceName ?? DEFAULT_KEYRING_SERVICE_NAME;
-        const accountName = options.accountName ?? DEFAULT_KEYRING_ACCOUNT_NAME;
-        try {
-            const keychainKey = await retrieveFromKeychain(serviceName, accountName);
-            if (keychainKey) {
-                return keychainKey;
-            }
-            if (options.allowKeyGeneration === false) {
-                throw new EncryptionKeyLostError();
-            }
-            // Generate new key and store in keychain
-            const newKey = generateKey();
-            await storeInKeychain(serviceName, accountName, newKey);
-            return newKey;
-        }
-        catch (error) {
-            if (error instanceof KeychainNotAvailableError) {
-                throw new EncryptedStorageError('No encryption key available. ' +
-                    'Set LATCHKEY_ENCRYPTION_KEY or ensure system keychain is accessible.');
-            }
-            throw error;
-        }
-    }
     /**
      * Read and decrypt a file.
      */

package/dist/src/encryptedStorage.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryptedStorage.js","sourceRoot":"","sources":["../../src/encryptedStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAEjG,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,qBAAqB;IAC/D;QACE,KAAK,CACH,0FAA0F;YACxF,4DAA4D;YAC5D,uDAAuD;YACvD,2EAA2E,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAcD;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAAS;IAE7B,YAAoB,GAAW;QAC7B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAmC,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAgC;QACjE,2CAA2C;QAC3C,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;YAC1F,OAAO,OAAO,CAAC,qBAAqB,CAAC;QACvC,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC;QACxE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC;QAExE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACzE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;gBACzC,MAAM,IAAI,sBAAsB,EAAE,CAAC;YACrC,CAAC;YAED,yCAAyC;YACzC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;gBAC/C,MAAM,IAAI,qBAAqB,CAC7B,+BAA+B;oBAC7B,sEAAsE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAC7B,0BAA0B,QAAQ,IAAI;gBACpC,oDAAoD,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,qBAAqB,CAC7B,2BAA2B,KAAK,CAAC,OAAO,IAAI,GAAG,sCAAsC,CACtF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,QAAgB,EAAE,OAAe;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,qBAAqB,GAAG,aAAa,CAAC;QAE1D,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"encryptedStorage.js","sourceRoot":"","sources":["../../src/encryptedStorage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEpE,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAgB;QAC1B,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IACV,GAAG,CAAS;IAE7B,YAAY,GAAW;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,QAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAC7B,0BAA0B,QAAQ,IAAI;gBACpC,oDAAoD,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,qBAAqB,CAC7B,2BAA2B,KAAK,CAAC,OAAO,IAAI,GAAG,sCAAsC,CACtF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,QAAgB,EAAE,OAAe;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,qBAAqB,GAAG,aAAa,CAAC;QAE1D,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/src/encryption.d.ts

@@ -1,6 +1,10 @@
 /**
  * Encryption utilities for secure credential storage.
  * Uses AES-256-GCM for authenticated encryption.
+ *
+ * Also exposes `resolveEncryptionKey`, which returns the master key Latchkey
+ * uses for encryption (and for deriving sub-keys for other purposes such as
+ * signing gateway permissions-override JWTs).
  */
 export declare class EncryptionError extends Error {
     constructor(message: string);
@@ -8,6 +12,47 @@ export declare class EncryptionError extends Error {
 export declare class DecryptionError extends Error {
     constructor(message: string);
 }
+/**
+ * Common base class for encryption-key resolution problems. Catching this
+ * lets callers handle all key-acquisition failures uniformly.
+ */
+export declare class EncryptionKeyError extends Error {
+    constructor(message: string);
+}
+export declare class EncryptionKeyLostError extends EncryptionKeyError {
+    constructor();
+}
+export declare class EncryptionKeyUnavailableError extends EncryptionKeyError {
+    constructor();
+}
+export interface ResolveEncryptionKeyOptions {
+    /**
+     * If provided, this key is used as-is and the keychain is not consulted.
+     */
+    encryptionKeyOverride?: string | null;
+    serviceName?: string;
+    accountName?: string;
+    /**
+     * When false, refuse to generate a new encryption key if the keychain has
+     * no key. Used to prevent silently replacing a lost key, which would make
+     * existing encrypted data unreadable. Set to false when encrypted files
+     * already exist on disk.
+     */
+    allowKeyGeneration?: boolean;
+}
+/**
+ * Resolve the Latchkey master encryption key. Precedence:
+ *   1. `encryptionKeyOverride` from the caller (typically
+ *      `LATCHKEY_ENCRYPTION_KEY`),
+ *   2. system keychain entry,
+ *   3. freshly generated key, stored in the keychain (only when
+ *      `allowKeyGeneration` is true).
+ *
+ * Throws `EncryptionKeyLostError` when the keychain has no key but generation
+ * is disallowed, and `EncryptionKeyUnavailableError` when no key can be
+ * obtained at all (e.g. no keychain available and no override set).
+ */
+export declare function resolveEncryptionKey(options?: ResolveEncryptionKeyOptions): Promise<string>;
 /**
  * Encrypt data using AES-256-GCM.
  * The key should be a base64-encoded 256-bit key.

package/dist/src/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/encryption.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA0BpE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiCxE;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAuB,SAAQ,kBAAkB;;CAU7D;AAED,qBAAa,6BAA8B,SAAQ,kBAAkB;;CAQpE;AAED,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA0BpE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiCxE;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/dist/src/encryption.js

@@ -1,8 +1,14 @@
 /**
  * Encryption utilities for secure credential storage.
  * Uses AES-256-GCM for authenticated encryption.
+ *
+ * Also exposes `resolveEncryptionKey`, which returns the master key Latchkey
+ * uses for encryption (and for deriving sub-keys for other purposes such as
+ * signing gateway permissions-override JWTs).
  */
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { DEFAULT_KEYRING_ACCOUNT_NAME, DEFAULT_KEYRING_SERVICE_NAME } from './config.js';
+import { KeychainNotAvailableError, retrieveFromKeychain, storeInKeychain } from './keychain.js';
 const ALGORITHM = 'aes-256-gcm';
 const KEY_LENGTH = 32; // 256 bits
 const IV_LENGTH = 12; // 96 bits for GCM
@@ -19,6 +25,69 @@ export class DecryptionError extends Error {
         this.name = 'DecryptionError';
     }
 }
+/**
+ * Common base class for encryption-key resolution problems. Catching this
+ * lets callers handle all key-acquisition failures uniformly.
+ */
+export class EncryptionKeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'EncryptionKeyError';
+    }
+}
+export class EncryptionKeyLostError extends EncryptionKeyError {
+    constructor() {
+        super('The encryption key was lost from the system keychain and encrypted data already exists. ' +
+            'Generating a new key would make existing data unreadable. ' +
+            'Restore the keychain or set LATCHKEY_ENCRYPTION_KEY, ' +
+            'or delete the encrypted files and start fresh with `latchkey auth clear`.');
+        this.name = 'EncryptionKeyLostError';
+    }
+}
+export class EncryptionKeyUnavailableError extends EncryptionKeyError {
+    constructor() {
+        super('No encryption key available. ' +
+            'Set LATCHKEY_ENCRYPTION_KEY or ensure system keychain is accessible.');
+        this.name = 'EncryptionKeyUnavailableError';
+    }
+}
+/**
+ * Resolve the Latchkey master encryption key. Precedence:
+ *   1. `encryptionKeyOverride` from the caller (typically
+ *      `LATCHKEY_ENCRYPTION_KEY`),
+ *   2. system keychain entry,
+ *   3. freshly generated key, stored in the keychain (only when
+ *      `allowKeyGeneration` is true).
+ *
+ * Throws `EncryptionKeyLostError` when the keychain has no key but generation
+ * is disallowed, and `EncryptionKeyUnavailableError` when no key can be
+ * obtained at all (e.g. no keychain available and no override set).
+ */
+export async function resolveEncryptionKey(options = {}) {
+    if (options.encryptionKeyOverride !== undefined && options.encryptionKeyOverride !== null) {
+        return options.encryptionKeyOverride;
+    }
+    const serviceName = options.serviceName ?? DEFAULT_KEYRING_SERVICE_NAME;
+    const accountName = options.accountName ?? DEFAULT_KEYRING_ACCOUNT_NAME;
+    try {
+        const keychainKey = await retrieveFromKeychain(serviceName, accountName);
+        if (keychainKey !== null) {
+            return keychainKey;
+        }
+        if (options.allowKeyGeneration === false) {
+            throw new EncryptionKeyLostError();
+        }
+        const newKey = generateKey();
+        await storeInKeychain(serviceName, accountName, newKey);
+        return newKey;
+    }
+    catch (error) {
+        if (error instanceof KeychainNotAvailableError) {
+            throw new EncryptionKeyUnavailableError();
+        }
+        throw error;
+    }
+}
 /**
  * Encrypt data using AES-256-GCM.
  * The key should be a base64-encoded 256-bit key.

package/dist/src/encryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/encryption.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,kBAAkB;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AAEvC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,SAAiB;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,gCAAgC,MAAM,CAAC,UAAU,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,aAAqB,EAAE,SAAiB;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,gCAAgC,MAAM,CAAC,UAAU,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEtD,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEjG,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,kBAAkB;AACxC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AAEvC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5D;QACE,KAAK,CACH,0FAA0F;YACxF,4DAA4D;YAC5D,uDAAuD;YACvD,2EAA2E,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,kBAAkB;IACnE;QACE,KAAK,CACH,+BAA+B;YAC7B,sEAAsE,CACzE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAuC,EAAE;IAEzC,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS,IAAI,OAAO,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;QAC1F,OAAO,OAAO,CAAC,qBAAqB,CAAC;IACvC,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,4BAA4B,CAAC;IAExE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACzE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,MAAM,IAAI,6BAA6B,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,SAAiB;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,gCAAgC,MAAM,CAAC,UAAU,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,aAAqB,EAAE,SAAiB;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CACvB,gCAAgC,MAAM,CAAC,UAAU,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEtD,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,MAAM,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,mCAAmC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QAC1E,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAElE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/gateway/client.d.ts

@@ -17,8 +17,12 @@ export declare class GatewayCurlRewriteError extends Error {
 }
 /**
  * POST a request to the gateway's `/latchkey/` endpoint and return its `result`.
+ * When `password` is provided, it is sent in the gateway password header so
+ * the request can be authenticated by a password-protected gateway. When
+ * `permissionsOverride` is provided, it is sent in the permissions-override
+ * header so the gateway uses an alternative permissions.json for this request.
  */
-export declare function callLatchkeyEndpoint(gatewayUrl: string, request: LatchkeyRequest): Promise<unknown>;
+export declare function callLatchkeyEndpoint(gatewayUrl: string, request: LatchkeyRequest, password?: string | null, permissionsOverride?: string | null): Promise<unknown>;
 /**
  * Build the URL used to proxy a `latchkey curl` invocation through the
  * gateway's `/gateway/` endpoint.
@@ -27,6 +31,12 @@ export declare function buildGatewayProxyUrl(gatewayUrl: string, targetUrl: stri
 /**
  * Rewrite a curl argument list so the target URL points at the gateway's
  * `/gateway/<target>` endpoint. Returns a new array; the original is unchanged.
+ *
+ * When `password` is provided, an `-H` argument carrying the gateway
+ * password header is prepended so the rewritten curl call can authenticate
+ * against a password-protected gateway. When `permissionsOverride` is
+ * provided, an `-H` argument carrying the permissions-override JWT is also
+ * prepended.
  */
-export declare function rewriteCurlArgumentsForGateway(curlArguments: readonly string[], targetUrl: string, gatewayUrl: string): readonly string[];
+export declare function rewriteCurlArgumentsForGateway(curlArguments: readonly string[], targetUrl: string, gatewayUrl: string, password?: string | null, permissionsOverride?: string | null): readonly string[];
 //# sourceMappingURL=client.d.ts.map

package/dist/src/gateway/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/gateway/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAKhD;AAED,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,WAAW,EAAE,MAAM;CAOhC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAOD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,OAAO,CAAC,CAoClB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,SAAS,MAAM,EAAE,CAkBnB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/gateway/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAKhD;AAED,qBAAa,+BAAgC,SAAQ,KAAK;gBAC5C,WAAW,EAAE,MAAM;CAOhC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAOD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,eAAe,EACxB,QAAQ,GAAE,MAAM,GAAG,IAAW,EAC9B,mBAAmB,GAAE,MAAM,GAAG,IAAW,GACxC,OAAO,CAAC,OAAO,CAAC,CA4ClB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAM,GAAG,IAAW,EAC9B,mBAAmB,GAAE,MAAM,GAAG,IAAW,GACxC,SAAS,MAAM,EAAE,CA0BnB"}

package/dist/src/gateway/client.js

@@ -4,6 +4,8 @@
  * Commands are forwarded to the gateway's `/latchkey/` RPC endpoint, while
  * `latchkey curl` has its target URL rewritten to route through `/gateway/`.
  */
+import { GATEWAY_PASSWORD_HEADER } from './password.js';
+import { PERMISSIONS_OVERRIDE_HEADER } from './permissionsOverride.js';
 export class GatewayRequestError extends Error {
     statusCode;
     constructor(message, statusCode) {
@@ -31,14 +33,25 @@ function buildEndpointUrl(gatewayUrl, path) {
 }
 /**
  * POST a request to the gateway's `/latchkey/` endpoint and return its `result`.
+ * When `password` is provided, it is sent in the gateway password header so
+ * the request can be authenticated by a password-protected gateway. When
+ * `permissionsOverride` is provided, it is sent in the permissions-override
+ * header so the gateway uses an alternative permissions.json for this request.
  */
-export async function callLatchkeyEndpoint(gatewayUrl, request) {
+export async function callLatchkeyEndpoint(gatewayUrl, request, password = null, permissionsOverride = null) {
     const endpoint = buildEndpointUrl(gatewayUrl, '/latchkey');
+    const headers = { 'Content-Type': 'application/json' };
+    if (password !== null) {
+        headers[GATEWAY_PASSWORD_HEADER] = password;
+    }
+    if (permissionsOverride !== null) {
+        headers[PERMISSIONS_OVERRIDE_HEADER] = permissionsOverride;
+    }
     let response;
     try {
         response = await fetch(endpoint, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers,
             body: JSON.stringify(request),
         });
     }
@@ -73,8 +86,14 @@ export function buildGatewayProxyUrl(gatewayUrl, targetUrl) {
 /**
  * Rewrite a curl argument list so the target URL points at the gateway's
  * `/gateway/<target>` endpoint. Returns a new array; the original is unchanged.
+ *
+ * When `password` is provided, an `-H` argument carrying the gateway
+ * password header is prepended so the rewritten curl call can authenticate
+ * against a password-protected gateway. When `permissionsOverride` is
+ * provided, an `-H` argument carrying the permissions-override JWT is also
+ * prepended.
  */
-export function rewriteCurlArgumentsForGateway(curlArguments, targetUrl, gatewayUrl) {
+export function rewriteCurlArgumentsForGateway(curlArguments, targetUrl, gatewayUrl, password = null, permissionsOverride = null) {
     const occurrences = curlArguments.reduce((count, argument) => (argument === targetUrl ? count + 1 : count), 0);
     if (occurrences === 0) {
         throw new GatewayCurlRewriteError(`Target URL '${targetUrl}' not found in curl arguments; refusing to rewrite.`);
@@ -84,6 +103,14 @@ export function rewriteCurlArgumentsForGateway(curlArguments, targetUrl, gateway
             `refusing to rewrite to avoid ambiguous substitution.`);
     }
     const proxyUrl = buildGatewayProxyUrl(gatewayUrl, targetUrl);
-    return curlArguments.map((argument) => (argument === targetUrl ? proxyUrl : argument));
+    const rewritten = curlArguments.map((argument) => (argument === targetUrl ? proxyUrl : argument));
+    const extraHeaders = [];
+    if (password !== null) {
+        extraHeaders.push('-H', `${GATEWAY_PASSWORD_HEADER}: ${password}`);
+    }
+    if (permissionsOverride !== null) {
+        extraHeaders.push('-H', `${PERMISSIONS_OVERRIDE_HEADER}: ${permissionsOverride}`);
+    }
+    return [...extraHeaders, ...rewritten];
 }
 //# sourceMappingURL=client.js.map

package/dist/src/gateway/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/gateway/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,UAAU,CAAS;IAE5B,YAAY,OAAe,EAAE,UAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,WAAmB;QAC7B,KAAK,CACH,IAAI,WAAW,oDAAoD;YACjE,mDAAmD,CACtD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,OAAwB;IAExB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAE3D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,QAAQ,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,UAAgD,CAAC;IACrD,IAAI,CAAC;QACH,UAAU;YACR,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA0C,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAC3B,kDAAkD,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAC5F,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GACX,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YAClC,CAAC,CAAC,UAAU,CAAC,KAAK;YAClB,CAAC,CAAC,oCAAoC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,SAAiB;IACxE,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,SAAS,EAAE,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,aAAgC,EAChC,SAAiB,EACjB,UAAkB;IAElB,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EACjE,CAAC,CACF,CAAC;IACF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,SAAS,qDAAqD,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,SAAS,aAAa,WAAW,CAAC,QAAQ,EAAE,4BAA4B;YACrF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7D,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/gateway/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAEvE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,UAAU,CAAS;IAE5B,YAAY,OAAe,EAAE,UAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,WAAmB;QAC7B,KAAK,CACH,IAAI,WAAW,oDAAoD;YACjE,mDAAmD,CACtD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,OAAwB,EACxB,WAA0B,IAAI,EAC9B,sBAAqC,IAAI;IAEzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAE3D,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,uBAAuB,CAAC,GAAG,QAAQ,CAAC;IAC9C,CAAC;IACD,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,CAAC,2BAA2B,CAAC,GAAG,mBAAmB,CAAC;IAC7D,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,QAAQ,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,UAAgD,CAAC;IACrD,IAAI,CAAC;QACH,UAAU;YACR,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA0C,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAC3B,kDAAkD,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,QAAQ,EAAE,EAC5F,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GACX,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YAClC,CAAC,CAAC,UAAU,CAAC,KAAK;YAClB,CAAC,CAAC,oCAAoC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,SAAiB;IACxE,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,SAAS,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,aAAgC,EAChC,SAAiB,EACjB,UAAkB,EAClB,WAA0B,IAAI,EAC9B,sBAAqC,IAAI;IAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EACjE,CAAC,CACF,CAAC;IACF,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,SAAS,qDAAqD,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,SAAS,aAAa,WAAW,CAAC,QAAQ,EAAE,4BAA4B;YACrF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClG,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,uBAAuB,KAAK,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,2BAA2B,KAAK,mBAAmB,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/dist/src/gateway/extensions.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Extensions: user-supplied HTTP handlers mounted on the gateway.
+ *
+ * The gateway scans `extensionsDirectory` for `*.mjs` files at startup
+ * and dynamically imports each one. Each module's default export must be
+ * a function `(request, response) => boolean | Promise<boolean>`:
+ *
+ *   - return `true` when the extension has handled the request (i.e. it
+ *     has written / will write the response). The gateway will not consult
+ *     any further extensions.
+ *   - return `false` to defer to the next extension. The handler must not
+ *     touch the response in this case.
+ *
+ * Extensions only see Node's raw HTTP request / response. They do NOT have
+ * access to credential storage, the curl-injection pipeline, or the service
+ * registry. Each extension request is run through the same
+ * `permissions.json` machinery as `/gateway/...` proxy requests, by
+ * synthesising a request whose URL uses fixed placeholder values
+ * (representing "this gateway") while preserving the inbound method, path,
+ * and headers.
+ */
+import * as http from 'node:http';
+import type { CliDependencies } from '../cliCommands.js';
+/**
+ * Placeholder URL parts that stand in for "this gateway" when extension
+ * requests are run through the permission check. They use RFC 2606's
+ * reserved `.invalid` TLD so the synthetic URL is guaranteed never to
+ * resolve to a real host. Detent schemas matching extension routes should
+ * key on these exact values.
+ */
+export declare const EXTENSION_PLACEHOLDER_SCHEME = "https";
+export declare const EXTENSION_PLACEHOLDER_HOST = "latchkey-self.invalid";
+export declare const EXTENSION_PLACEHOLDER_PORT = 1;
+export type ExtensionHandler = (request: http.IncomingMessage, response: http.ServerResponse) => boolean | Promise<boolean>;
+export interface LoadedExtension {
+    readonly handler: ExtensionHandler;
+    /** Absolute path of the file the handler was loaded from. */
+    readonly sourceFile: string;
+}
+export declare class ExtensionLoadError extends Error {
+    constructor(message: string);
+}
+/**
+ * Load every extension module in `directory` and return the resulting
+ * ordered list. Extensions are tried in alphabetical order of filename, so
+ * the loader returns them in that order. Returns an empty list if the
+ * directory does not exist. Throws `ExtensionLoadError` on the first file
+ * that fails to import or has the wrong shape.
+ */
+export declare function loadExtensions(directory: string): Promise<readonly LoadedExtension[]>;
+/**
+ * Run the permission check for an inbound extension request and offer it to
+ * each loaded extension in order. Returns true when an extension claimed
+ * the request (i.e. responded or threw). When false, no extension touched
+ * the response and the caller is responsible for sending a fallback
+ * (typically `404`).
+ */
+export declare function dispatchExtensionRequest(request: http.IncomingMessage, response: http.ServerResponse, extensions: readonly LoadedExtension[], deps: CliDependencies, permissionsConfigPath: string): Promise<boolean>;
+//# sourceMappingURL=extensions.d.ts.map

package/dist/src/gateway/extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../src/gateway/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAKzD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,UAAU,CAAC;AACpD,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAClE,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAI5C,MAAM,MAAM,gBAAgB,GAAG,CAC7B,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,QAAQ,EAAE,IAAI,CAAC,cAAc,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAMD,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAWD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAiC3F;AA0CD;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,QAAQ,EAAE,IAAI,CAAC,cAAc,EAC7B,UAAU,EAAE,SAAS,eAAe,EAAE,EACtC,IAAI,EAAE,eAAe,EACrB,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC,OAAO,CAAC,CA6ClB"}