latchkey 2.7.3 → 2.9.0

package/dist/src/gateway/permissionsOverride.js

@@ -0,0 +1,171 @@
+/**
+ * Optional `x-latchkey-gateway-permissions-override` header support.
+ *
+ * The header carries a minimal HS256 JWT whose only payload field is
+ * `permissionsConfig`, an absolute path to a `permissions.json` file.
+ * When the gateway receives such a header on a `/gateway/...` request and
+ * the JWT is valid, it uses the referenced permissions config instead of
+ * the default one for that single request.
+ *
+ * The signing key is derived from the Latchkey encryption key via HKDF-like
+ * HMAC-SHA256 with a domain-separation label, so the encryption key itself
+ * is never used to sign or verify these JWTs directly.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { existsSync, statSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
+/**
+ * HTTP header used to carry the permissions-override JWT. Lowercased to match
+ * how Node's `http.IncomingMessage.headers` exposes header names.
+ */
+export const PERMISSIONS_OVERRIDE_HEADER = 'x-latchkey-gateway-permissions-override';
+/**
+ * Domain-separation label mixed into the HMAC that derives the JWT signing
+ * key from the Latchkey encryption key. Changing this value invalidates all
+ * previously issued tokens.
+ */
+const SIGNING_KEY_DERIVATION_LABEL = 'latchkey:gateway:permissions-override:v1';
+const JWT_HEADER = { alg: 'HS256', typ: 'JWT' };
+const JWT_HEADER_ENCODED = Buffer.from(JSON.stringify(JWT_HEADER), 'utf-8').toString('base64url');
+export class InvalidPermissionsOverrideError extends Error {
+    constructor(message) {
+        super(`Latchkey: ${message}`);
+        this.name = 'InvalidPermissionsOverrideError';
+    }
+}
+export class PermissionsOverrideFileMissingError extends Error {
+    constructor(filePath) {
+        super(`Permissions override references missing or invalid file: ${filePath}`);
+        this.name = 'PermissionsOverrideFileMissingError';
+    }
+}
+/**
+ * Derive the HS256 signing key used for permissions-override JWTs from the
+ * Latchkey encryption key. The encryption key is base64-encoded; the
+ * derived key is the raw HMAC-SHA256 output (32 bytes).
+ */
+export function derivePermissionsOverrideSigningKey(encryptionKeyBase64) {
+    const masterKey = Buffer.from(encryptionKeyBase64, 'base64');
+    return createHmac('sha256', masterKey).update(SIGNING_KEY_DERIVATION_LABEL).digest();
+}
+/**
+ * Build a permissions-override JWT for the given absolute path. The path is
+ * not validated here; callers that want to ensure the file exists must do
+ * so before calling this function.
+ */
+export function createPermissionsOverrideJwt(permissionsConfigPath, signingKey) {
+    if (!isAbsolute(permissionsConfigPath)) {
+        throw new InvalidPermissionsOverrideError(`permissionsConfig path must be absolute: ${permissionsConfigPath}`);
+    }
+    const payload = { permissionsConfig: permissionsConfigPath };
+    const payloadEncoded = Buffer.from(JSON.stringify(payload), 'utf-8').toString('base64url');
+    const signingInput = `${JWT_HEADER_ENCODED}.${payloadEncoded}`;
+    const signature = createHmac('sha256', signingKey).update(signingInput).digest('base64url');
+    return `${signingInput}.${signature}`;
+}
+function parsePayload(payloadEncoded) {
+    let payloadJson;
+    try {
+        payloadJson = Buffer.from(payloadEncoded, 'base64url').toString('utf-8');
+    }
+    catch {
+        throw new InvalidPermissionsOverrideError('Permissions override payload is not valid base64url.');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(payloadJson);
+    }
+    catch {
+        throw new InvalidPermissionsOverrideError('Permissions override payload is not valid JSON.');
+    }
+    if (typeof payload !== 'object' ||
+        payload === null ||
+        !('permissionsConfig' in payload) ||
+        typeof payload.permissionsConfig !== 'string') {
+        throw new InvalidPermissionsOverrideError("Permissions override payload must contain a string 'permissionsConfig' field.");
+    }
+    const permissionsConfig = payload.permissionsConfig;
+    if (!isAbsolute(permissionsConfig)) {
+        throw new InvalidPermissionsOverrideError(`Permissions override 'permissionsConfig' must be an absolute path: ${permissionsConfig}`);
+    }
+    return { permissionsConfig };
+}
+/**
+ * Verify a permissions-override JWT and return its payload. Throws
+ * `InvalidPermissionsOverrideError` on any structural, signature, or content
+ * issue (i.e. anything that should be reported as "the JWT is invalid").
+ *
+ * This intentionally does not check that the referenced file exists; that
+ * concern is handled by `resolvePermissionsOverride` so that file-system
+ * errors can be reported separately from JWT errors.
+ */
+export function verifyPermissionsOverrideJwt(token, signingKey) {
+    const segments = token.split('.');
+    if (segments.length !== 3) {
+        throw new InvalidPermissionsOverrideError('Permissions override JWT must have three dot-separated segments.');
+    }
+    const headerEncoded = segments[0];
+    const payloadEncoded = segments[1];
+    const signatureEncoded = segments[2];
+    let headerJson;
+    try {
+        headerJson = Buffer.from(headerEncoded, 'base64url').toString('utf-8');
+    }
+    catch {
+        throw new InvalidPermissionsOverrideError('Permissions override header is not valid base64url.');
+    }
+    let header;
+    try {
+        header = JSON.parse(headerJson);
+    }
+    catch {
+        throw new InvalidPermissionsOverrideError('Permissions override header is not valid JSON.');
+    }
+    if (typeof header !== 'object' ||
+        header === null ||
+        header.alg !== 'HS256' ||
+        header.typ !== 'JWT') {
+        throw new InvalidPermissionsOverrideError("Permissions override header must declare alg='HS256' and typ='JWT'.");
+    }
+    let providedSignature;
+    try {
+        providedSignature = Buffer.from(signatureEncoded, 'base64url');
+    }
+    catch {
+        throw new InvalidPermissionsOverrideError('Permissions override signature is not valid base64url.');
+    }
+    const expectedSignature = createHmac('sha256', signingKey)
+        .update(`${headerEncoded}.${payloadEncoded}`)
+        .digest();
+    if (providedSignature.length !== expectedSignature.length ||
+        !timingSafeEqual(providedSignature, expectedSignature)) {
+        throw new InvalidPermissionsOverrideError('Permissions override signature is invalid.');
+    }
+    return parsePayload(payloadEncoded);
+}
+/**
+ * Verify a permissions-override JWT and additionally require the referenced
+ * file to exist as a regular file. Returns the absolute path on success.
+ */
+export function resolvePermissionsOverride(token, signingKey) {
+    const { permissionsConfig } = verifyPermissionsOverrideJwt(token, signingKey);
+    if (!existsSync(permissionsConfig) || !statSync(permissionsConfig).isFile()) {
+        throw new PermissionsOverrideFileMissingError(permissionsConfig);
+    }
+    return permissionsConfig;
+}
+/**
+ * Apply the optional `X-Latchkey-Gateway-Permissions-Override` header to a
+ * request: when absent, return the default config path; when present,
+ * validate the JWT and return the referenced path. Throws
+ * `InvalidPermissionsOverrideError` (=> 401) or
+ * `PermissionsOverrideFileMissingError` (=> 400) on invalid input.
+ */
+export function resolveRequestPermissionsConfig(headers, defaultConfigPath, signingKey) {
+    const headerValue = headers[PERMISSIONS_OVERRIDE_HEADER];
+    const token = typeof headerValue === 'string' ? headerValue : undefined;
+    if (token === undefined)
+        return defaultConfigPath;
+    return resolvePermissionsOverride(token, signingKey);
+}
+//# sourceMappingURL=permissionsOverride.js.map

package/dist/src/gateway/permissionsOverride.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionsOverride.js","sourceRoot":"","sources":["../../../src/gateway/permissionsOverride.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,yCAAyC,CAAC;AAErF;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,0CAA0C,CAAC;AAEhF,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAW,CAAC;AACzD,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAElG,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD,YAAY,OAAe;QACzB,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAC5D,YAAY,QAAgB;QAC1B,KAAK,CAAC,4DAA4D,QAAQ,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAAC,mBAA2B;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,MAAM,EAAE,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,qBAA6B,EAC7B,UAAkB;IAElB,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,+BAA+B,CACvC,4CAA4C,qBAAqB,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,GAAG,kBAAkB,IAAI,cAAc,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5F,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAMD,SAAS,YAAY,CAAC,cAAsB;IAC1C,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,CACvC,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,CAAC,iDAAiD,CAAC,CAAC;IAC/F,CAAC;IAED,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,CAAC,CAAC,mBAAmB,IAAI,OAAO,CAAC;QACjC,OAAQ,OAAmC,CAAC,iBAAiB,KAAK,QAAQ,EAC1E,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAI,OAAyC,CAAC,iBAAiB,CAAC;IACvF,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,+BAA+B,CACvC,sEAAsE,iBAAiB,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAa,EACb,UAAkB;IAElB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,+BAA+B,CACvC,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACnC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAEtC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,CACvC,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,CAAC,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAAkC,CAAC,GAAG,KAAK,OAAO;QAClD,MAAkC,CAAC,GAAG,KAAK,KAAK,EACjD,CAAC;QACD,MAAM,IAAI,+BAA+B,CACvC,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,IAAI,iBAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,+BAA+B,CACvC,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SACvD,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;SAC5C,MAAM,EAAE,CAAC;IAEZ,IACE,iBAAiB,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;QACrD,CAAC,eAAe,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,+BAA+B,CAAC,4CAA4C,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,UAAkB;IAC1E,MAAM,EAAE,iBAAiB,EAAE,GAAG,4BAA4B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,mCAAmC,CAAC,iBAAiB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAAiC,EACjC,iBAAyB,EACzB,UAAkB;IAElB,MAAM,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAClD,OAAO,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC"}

package/dist/src/gateway/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAY9B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,eAAe,EACrB,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmGxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAoD9B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAkDD;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,eAAe,EACrB,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA+HxB"}

package/dist/src/gateway/server.js

@@ -8,19 +8,89 @@ import * as http from 'node:http';
 import { ErrorMessages } from '../errorMessages.js';
 import { extractTargetUrl, GATEWAY_PATH_PREFIX, handleGatewayRequest, } from './gatewayEndpoint.js';
 import { handleLatchkeyRequest } from './latchkeyEndpoint.js';
+import { GATEWAY_PASSWORD_HEADER, passwordsMatch } from './password.js';
+import { dispatchExtensionRequest, loadExtensions } from './extensions.js';
+import { InvalidPermissionsOverrideError, PermissionsOverrideFileMissingError, resolveRequestPermissionsConfig, } from './permissionsOverride.js';
 function sendErrorResponse(response, statusCode, message) {
     response.writeHead(statusCode, { 'Content-Type': 'application/json' });
     response.end(JSON.stringify({ error: message }));
 }
+/**
+ * Read a single header value, treating arrays (which Node returns for some
+ * headers) as missing because the password header is not allowed to repeat.
+ */
+function readSingleHeader(request, headerName) {
+    const value = request.headers[headerName];
+    if (typeof value === 'string')
+        return value;
+    return undefined;
+}
+/**
+ * If a password is configured, verify that the request presents it in the
+ * expected header. Returns true when the request should be allowed to
+ * proceed, and writes a 401 response and returns false otherwise.
+ */
+function enforcePassword(request, response, expectedPassword, deps) {
+    if (expectedPassword === null)
+        return true;
+    const provided = readSingleHeader(request, GATEWAY_PASSWORD_HEADER);
+    if (provided !== undefined && passwordsMatch(expectedPassword, provided)) {
+        return true;
+    }
+    const method = request.method ?? 'UNKNOWN';
+    const path = request.url ?? '';
+    deps.log(`${method} ${path} -> 401 (password)`);
+    sendErrorResponse(response, 401, 'Unauthorized: invalid or missing Latchkey gateway password.');
+    return false;
+}
+/**
+ * Run an inbound request through the loaded extensions. Resolves to true when
+ * the request has been handled in some way and false if not.
+ */
+function runExtensions(request, response, extensions, deps, options) {
+    if (extensions.length === 0)
+        return Promise.resolve(false);
+    const rawUrl = request.url ?? '';
+    const method = (request.method ?? 'GET').toUpperCase();
+    let permissionsConfigPath;
+    try {
+        permissionsConfigPath = resolveRequestPermissionsConfig(request.headers, deps.config.permissionsConfigPath, options.permissionsOverrideSigningKey);
+    }
+    catch (error) {
+        if (error instanceof InvalidPermissionsOverrideError) {
+            deps.log(`${method} ${rawUrl} -> 401 (extension)`);
+            sendErrorResponse(response, 401, error.message);
+            return Promise.resolve(true);
+        }
+        if (error instanceof PermissionsOverrideFileMissingError) {
+            deps.log(`${method} ${rawUrl} -> 400 (extension)`);
+            sendErrorResponse(response, 400, error.message);
+            return Promise.resolve(true);
+        }
+        // resolveRequestPermissionsConfig only throws the two known error
+        // types, so this branch is just defensive: an http.Server request
+        // listener is sync, and rethrowing here would crash the process.
+        deps.errorLog(`Unexpected error resolving permissions override for ${method} ${rawUrl}: ` +
+            (error instanceof Error ? error.message : String(error)));
+        sendErrorResponse(response, 500, 'Internal error');
+        return Promise.resolve(true);
+    }
+    return dispatchExtensionRequest(request, response, extensions, deps, permissionsConfigPath);
+}
 /**
  * Start the gateway HTTP server.
  */
-export function startGateway(deps, apiCredentialStore, encryptedStorage, options) {
+export async function startGateway(deps, apiCredentialStore, encryptedStorage, options) {
     const inFlightRequests = new Set();
+    const extensions = await loadExtensions(deps.config.extensionsDirectoryPath);
     const server = http.createServer((request, response) => {
         const rawUrl = request.url ?? '';
+        const method = request.method ?? 'UNKNOWN';
+        if (!enforcePassword(request, response, options.password, deps)) {
+            return;
+        }
         // Health endpoint
-        if (rawUrl === '/' && request.method === 'GET') {
+        if (rawUrl === '/' && method === 'GET') {
             response.writeHead(200, { 'Content-Type': 'application/json' });
             response.end(JSON.stringify({ status: 'ok', version: deps.version }));
             return;
@@ -39,25 +109,39 @@ export function startGateway(deps, apiCredentialStore, encryptedStorage, options
             });
             return;
         }
-        // Extract target URL
-        const targetUrl = extractTargetUrl(rawUrl);
-        if (targetUrl === null) {
-            if (rawUrl.startsWith(GATEWAY_PATH_PREFIX)) {
-                const method = request.method ?? 'UNKNOWN';
+        // Gateway proxy endpoint
+        if (rawUrl.startsWith(GATEWAY_PATH_PREFIX)) {
+            const targetUrl = extractTargetUrl(rawUrl);
+            if (targetUrl === null) {
                 deps.log(`${method} ${rawUrl.slice(GATEWAY_PATH_PREFIX.length)} -> 400`);
                 sendErrorResponse(response, 400, ErrorMessages.couldNotExtractUrl);
+                return;
             }
-            else {
+            const requestPromise = handleGatewayRequest(request, response, targetUrl, deps, apiCredentialStore, options).catch((error) => {
+                deps.errorLog(`Unexpected error handling ${method} ${targetUrl}: ${error instanceof Error ? error.message : String(error)}`);
+                if (!response.headersSent) {
+                    sendErrorResponse(response, 502, ErrorMessages.upstreamRequestFailed);
+                }
+            });
+            inFlightRequests.add(requestPromise);
+            void requestPromise.finally(() => {
+                inFlightRequests.delete(requestPromise);
+            });
+            return;
+        }
+        // Finally, try extensions (if any).
+        const requestPromise = runExtensions(request, response, extensions, deps, options)
+            .then((handled) => {
+            if (!handled && !response.headersSent) {
                 response.writeHead(404);
                 response.end();
             }
-            return;
-        }
-        const requestPromise = handleGatewayRequest(request, response, targetUrl, deps, apiCredentialStore, options).catch((error) => {
-            const method = request.method ?? 'UNKNOWN';
-            deps.errorLog(`Unexpected error handling ${method} ${targetUrl}: ${error instanceof Error ? error.message : String(error)}`);
+        })
+            .catch((error) => {
+            deps.errorLog(`Unexpected error handling extension request ${method} ${rawUrl}: ` +
+                (error instanceof Error ? error.message : String(error)));
             if (!response.headersSent) {
-                sendErrorResponse(response, 502, ErrorMessages.upstreamRequestFailed);
+                sendErrorResponse(response, 500, 'Internal error');
             }
         });
         inFlightRequests.add(requestPromise);
@@ -82,7 +166,8 @@ export function startGateway(deps, apiCredentialStore, encryptedStorage, options
     return new Promise((resolve, reject) => {
         server.on('error', reject);
         server.listen(options.port, options.host, () => {
-            deps.log(`Latchkey gateway listening on ${options.host}:${String(options.port)}`);
+            const passwordNote = options.password === null ? '' : ' (password authentication enabled)';
+            deps.log(`Latchkey gateway listening on ${options.host}:${String(options.port)}${passwordNote}`);
             resolve({ server, close });
         });
     });

package/dist/src/gateway/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,iBAAiB,CACxB,QAA6B,EAC7B,UAAkB,EAClB,OAAe;IAEf,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAqB,EACrB,kBAAsC,EACtC,gBAAkC,EAClC,OAAuB;IAEvB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAiB,CAAC;IAElD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAEjC,kBAAkB;QAClB,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/C,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,kBAAkB,EAClB,gBAAgB,CACjB,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACzB,IAAI,CAAC,QAAQ,CACX,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACrC,KAAK,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/B,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;gBAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzE,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACxB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,EACP,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,kBAAkB,EAClB,OAAO,CACR,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;YAC3C,IAAI,CAAC,QAAQ,CACX,6BAA6B,MAAM,IAAI,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9G,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;YACxE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACrC,KAAK,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/B,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;YAC7C,IAAI,CAAC,GAAG,CAAC,iCAAiC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAwB,MAAM,iBAAiB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAElC,SAAS,iBAAiB,CACxB,QAA6B,EAC7B,UAAkB,EAClB,OAAe;IAEf,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA6B,EAAE,UAAkB;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAA6B,EAC7B,QAA6B,EAC7B,gBAA+B,EAC/B,IAAqB;IAErB,IAAI,gBAAgB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,oBAAoB,CAAC,CAAC;IAChD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,6DAA6D,CAAC,CAAC;IAChG,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;GAGG;AACH,SAAS,aAAa,CACpB,OAA6B,EAC7B,QAA6B,EAC7B,UAAsC,EACtC,IAAqB,EACrB,OAAuB;IAEvB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEvD,IAAI,qBAA6B,CAAC;IAClC,IAAI,CAAC;QACH,qBAAqB,GAAG,+BAA+B,CACrD,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,OAAO,CAAC,6BAA6B,CACtC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,qBAAqB,CAAC,CAAC;YACnD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,YAAY,mCAAmC,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,qBAAqB,CAAC,CAAC;YACnD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,CAAC,QAAQ,CACX,uDAAuD,MAAM,IAAI,MAAM,IAAI;YACzE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC3D,CAAC;QACF,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;AAC9F,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAqB,EACrB,kBAAsC,EACtC,gBAAkC,EAClC,OAAuB;IAEvB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAiB,CAAC;IAElD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;QAE3C,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QAED,kBAAkB;QAClB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,cAAc,GAAG,qBAAqB,CAC1C,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,kBAAkB,EAClB,gBAAgB,CACjB,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACzB,IAAI,CAAC,QAAQ,CACX,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACrC,KAAK,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/B,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzE,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,oBAAoB,CACzC,OAAO,EACP,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,kBAAkB,EAClB,OAAO,CACR,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACzB,IAAI,CAAC,QAAQ,CACX,6BAA6B,MAAM,IAAI,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9G,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACrC,KAAK,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC/B,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oCAAoC;QACpC,MAAM,cAAc,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;aAC/E,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACtC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACxB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,QAAQ,CACX,+CAA+C,MAAM,IAAI,MAAM,IAAI;gBACjE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC3D,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;QACL,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACrC,KAAK,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/B,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,MAAM,CAAC;IAEnC,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;YAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAC;YAC3F,IAAI,CAAC,GAAG,CACN,iCAAiC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CACvF,CAAC;YACF,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/index.d.ts

@@ -6,8 +6,8 @@ export { deserializeCredentials, serializeCredentials } from './apiCredentials/s
 export { SlackApiCredentials } from './services/slack.js';
 export { ApiCredentialStore, ApiCredentialStoreError } from './apiCredentials/store.js';
 export { Config, CONFIG, InsecureFilePermissionsError } from './config.js';
-export { encrypt, decrypt, generateKey, EncryptionError, DecryptionError } from './encryption.js';
-export { EncryptedStorage, EncryptedStorageError, EncryptionKeyLostError, } from './encryptedStorage.js';
+export { encrypt, decrypt, generateKey, resolveEncryptionKey, EncryptionError, DecryptionError, EncryptionKeyError, EncryptionKeyLostError, EncryptionKeyUnavailableError, } from './encryption.js';
+export { EncryptedStorage, EncryptedStorageError } from './encryptedStorage.js';
 export { storeInKeychain, retrieveFromKeychain, deleteFromKeychain, KeychainError, KeychainNotAvailableError, KeychainTimeoutError, } from './keychain.js';
 export { run as runCurl, runCaptured as runCurlCaptured, setSubprocessRunner, resetSubprocessRunner, setCapturingSubprocessRunner, resetCapturingSubprocessRunner, } from './curl.js';
 export { typeLikeHuman, BrowserDisabledError, BrowserFlowsNotSupportedError, } from './playwrightUtils.js';

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAExF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElG,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,GAAG,IAAI,OAAO,EACd,WAAW,IAAI,eAAe,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,EACN,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,GACP,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAExF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,OAAO,EACP,OAAO,EACP,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEhF,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,GAAG,IAAI,OAAO,EACd,WAAW,IAAI,eAAe,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,EACN,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,GACP,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/src/index.js

@@ -7,8 +7,8 @@ export { deserializeCredentials, serializeCredentials } from './apiCredentials/s
 export { SlackApiCredentials } from './services/slack.js';
 export { ApiCredentialStore, ApiCredentialStoreError } from './apiCredentials/store.js';
 export { Config, CONFIG, InsecureFilePermissionsError } from './config.js';
-export { encrypt, decrypt, generateKey, EncryptionError, DecryptionError } from './encryption.js';
-export { EncryptedStorage, EncryptedStorageError, EncryptionKeyLostError, } from './encryptedStorage.js';
+export { encrypt, decrypt, generateKey, resolveEncryptionKey, EncryptionError, DecryptionError, EncryptionKeyError, EncryptionKeyLostError, EncryptionKeyUnavailableError, } from './encryption.js';
+export { EncryptedStorage, EncryptedStorageError } from './encryptedStorage.js';
 export { storeInKeychain, retrieveFromKeychain, deleteFromKeychain, KeychainError, KeychainNotAvailableError, KeychainTimeoutError, } from './keychain.js';
 export { run as runCurl, runCaptured as runCurlCaptured, setSubprocessRunner, resetSubprocessRunner, setCapturingSubprocessRunner, resetCapturingSubprocessRunner, } from './curl.js';
 export { typeLikeHuman, BrowserDisabledError, BrowserFlowsNotSupportedError, } from './playwrightUtils.js';

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,2BAA2B;AAC3B,OAAO,EAEL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAExF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElG,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,GAAG,IAAI,OAAO,EACd,WAAW,IAAI,eAAe,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,WAAW;AACX,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,EACN,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,GACP,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,2BAA2B;AAC3B,OAAO,EAEL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAExF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,OAAO,EACP,OAAO,EACP,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEhF,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,GAAG,IAAI,OAAO,EACd,WAAW,IAAI,eAAe,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAE9B,WAAW;AACX,OAAO,EACL,OAAO,EACP,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,EACN,OAAO,EACP,OAAO,EACP,MAAM,EACN,MAAM,GACP,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/src/oauthUtils.d.ts

@@ -31,15 +31,24 @@ export interface OAuthCallbackServer {
  * @param callbackPath - Path to listen for OAuth callback (default: '/oauth2callback')
  */
 export declare function startOAuthCallbackServer(timeoutMs: number, signal?: AbortSignal, callbackPath?: string): Promise<OAuthCallbackServer>;
+/**
+ * Generate a PKCE code verifier (RFC 7636).
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generate a PKCE code challenge from a verifier using S256.
+ */
+export declare function generateCodeChallenge(verifier: string): string;
 /**
  * Exchange authorization code for access and refresh tokens.
  * @param tokenEndpoint - The OAuth token endpoint URL
  * @param code - The authorization code received from the OAuth callback
  * @param clientId - The OAuth client ID
- * @param clientSecret - The OAuth client secret
+ * @param clientSecret - The OAuth client secret (empty string for public clients)
  * @param redirectUri - The redirect URI used in the authorization request
+ * @param codeVerifier - Optional PKCE code verifier
  */
-export declare function exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string): OAuthTokenExchangeResponse;
+export declare function exchangeCodeForTokens(tokenEndpoint: string, code: string, clientId: string, clientSecret: string, redirectUri: string, codeVerifier?: string): OAuthTokenExchangeResponse;
 /**
  * Refresh OAuth access token using the refresh token.
  * @param tokenEndpoint - The OAuth token endpoint URL

package/dist/src/oauthUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthUtils.d.ts","sourceRoot":"","sources":["../../src/oauthUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AAED,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,YAAY,SAAoB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAmF9B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,0BAA0B,CA2C5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,kBAAkB,GAAG,IAAI,CAmC3B"}
+{"version":3,"file":"oauthUtils.d.ts","sourceRoot":"","sources":["../../src/oauthUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AAED,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,YAAY,SAAoB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAmF9B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,0BAA0B,CAgD5B;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,kBAAkB,GAAG,IAAI,CAqC3B"}

package/dist/src/oauthUtils.js

@@ -1,6 +1,7 @@
 /**
  * Generic OAuth utilities for localhost callback server and token exchange.
  */
+import * as crypto from 'node:crypto';
 import * as http from 'node:http';
 import { runCaptured } from './curl.js';
 import { LoginCancelledError, LoginFailedError } from './services/core/base.js';
@@ -98,22 +99,40 @@ export function startOAuthCallbackServer(timeoutMs, signal, callbackPath = '/oau
         });
     });
 }
+/**
+ * Generate a PKCE code verifier (RFC 7636).
+ */
+export function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+/**
+ * Generate a PKCE code challenge from a verifier using S256.
+ */
+export function generateCodeChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
 /**
  * Exchange authorization code for access and refresh tokens.
  * @param tokenEndpoint - The OAuth token endpoint URL
  * @param code - The authorization code received from the OAuth callback
  * @param clientId - The OAuth client ID
- * @param clientSecret - The OAuth client secret
+ * @param clientSecret - The OAuth client secret (empty string for public clients)
  * @param redirectUri - The redirect URI used in the authorization request
+ * @param codeVerifier - Optional PKCE code verifier
  */
-export function exchangeCodeForTokens(tokenEndpoint, code, clientId, clientSecret, redirectUri) {
+export function exchangeCodeForTokens(tokenEndpoint, code, clientId, clientSecret, redirectUri, codeVerifier) {
     const body = new URLSearchParams({
         code,
         client_id: clientId,
-        client_secret: clientSecret,
         redirect_uri: redirectUri,
         grant_type: 'authorization_code',
     });
+    if (clientSecret) {
+        body.set('client_secret', clientSecret);
+    }
+    if (codeVerifier) {
+        body.set('code_verifier', codeVerifier);
+    }
     const result = runCaptured([
         '-s',
         '-X',
@@ -153,9 +172,11 @@ export function refreshAccessToken(tokenEndpoint, refreshToken, clientId, client
     const body = new URLSearchParams({
         refresh_token: refreshToken,
         client_id: clientId,
-        client_secret: clientSecret,
         grant_type: 'refresh_token',
     });
+    if (clientSecret) {
+        body.set('client_secret', clientSecret);
+    }
     const result = runCaptured([
         '-s',
         '-X',

package/dist/src/oauthUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauthUtils.js","sourceRoot":"","sources":["../../src/oauthUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAahF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD;QACE,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,MAAoB,EACpB,YAAY,GAAG,iBAAiB;IAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAEnC,OAAO,IAAI,OAAO,CAAsB,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACtE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,OAAmC,CAAC;YAExC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1D,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,YAAY,CAAC,OAAO,CAAC,CAAC;oBACxB,CAAC;oBACD,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC,CAAC;gBAEF,MAAM,YAAY,GAAG,GAAG,EAAE;oBACxB,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;gBACpC,CAAC,CAAC;gBAEF,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO,EAAE,CAAC;wBACV,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;wBAClC,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAChC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;oBAEhF,IAAI,SAAS,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;wBACxC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;wBAE7D,IAAI,IAAI,EAAE,CAAC;4BACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;4BACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACd,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;4BACnD,OAAO,EAAE,CAAC;4BACV,OAAO,CAAC,IAAI,CAAC,CAAC;wBAChB,CAAC;6BAAM,CAAC;4BACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;4BACrD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;4BACjB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;4BACnD,OAAO,EAAE,CAAC;4BACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,qDAAqD,CAAC,CAAC,CAAC;wBACtF,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBACxB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;oBACnD,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,+BAA+B,EAAE,CAAC,CAAC;gBAChD,CAAC,EAAE,SAAS,CAAC,CAAC;gBAEd,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC3B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;oBACnD,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB,EACrB,IAAY,EACZ,QAAgB,EAChB,YAAoB,EACpB,WAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,IAAI;QACJ,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,WAAW,CACxB;QACE,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,iDAAiD;QACjD,IAAI;QACJ,IAAI,CAAC,QAAQ,EAAE;QACf,aAAa;KACd,EACD,EAAE,CACH,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,qDAAqD,MAAM,CAAC,MAAM,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAuB,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,QAAsC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,YAAoB,EACpB,QAAgB,EAChB,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,WAAW,CACxB;QACE,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,iDAAiD;QACjD,IAAI;QACJ,IAAI,CAAC,QAAQ,EAAE;QACf,aAAa;KACd,EACD,EAAE,CACH,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAuB,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauthUtils.js","sourceRoot":"","sources":["../../src/oauthUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAahF,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACxD;QACE,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAChD,CAAC;CACF;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiB,EACjB,MAAoB,EACpB,YAAY,GAAG,iBAAiB;IAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAEnC,OAAO,IAAI,OAAO,CAAsB,CAAC,aAAa,EAAE,YAAY,EAAE,EAAE;QACtE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,OAAmC,CAAC;YAExC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1D,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,YAAY,CAAC,OAAO,CAAC,CAAC;oBACxB,CAAC;oBACD,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC,CAAC;gBAEF,MAAM,YAAY,GAAG,GAAG,EAAE;oBACxB,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;gBACpC,CAAC,CAAC;gBAEF,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO,EAAE,CAAC;wBACV,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;wBAClC,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAChC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;oBAEhF,IAAI,SAAS,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;wBACxC,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;wBAE7D,IAAI,IAAI,EAAE,CAAC;4BACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;4BACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BACd,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;4BACnD,OAAO,EAAE,CAAC;4BACV,OAAO,CAAC,IAAI,CAAC,CAAC;wBAChB,CAAC;6BAAM,CAAC;4BACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;4BACrD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;4BACjB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;4BACnD,OAAO,EAAE,CAAC;4BACV,MAAM,CAAC,IAAI,gBAAgB,CAAC,qDAAqD,CAAC,CAAC,CAAC;wBACtF,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;wBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBACxB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;oBACnD,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,+BAA+B,EAAE,CAAC,CAAC;gBAChD,CAAC,EAAE,SAAS,CAAC,CAAC;gBAEd,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC3B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;oBACnD,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB,EACrB,IAAY,EACZ,QAAgB,EAChB,YAAoB,EACpB,WAAmB,EACnB,YAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,IAAI;QACJ,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CACxB;QACE,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,iDAAiD;QACjD,IAAI;QACJ,IAAI,CAAC,QAAQ,EAAE;QACf,aAAa;KACd,EACD,EAAE,CACH,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,qDAAqD,MAAM,CAAC,MAAM,EAAE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAuB,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YACtD,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,QAAsC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,YAAoB,EACpB,QAAgB,EAChB,YAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,eAAe;KAC5B,CAAC,CAAC;IACH,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CACxB;QACE,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,iDAAiD;QACjD,IAAI;QACJ,IAAI,CAAC,QAAQ,EAAE;QACf,aAAa;KACd,EACD,EAAE,CACH,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAuB,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/permissions.d.ts

@@ -1,25 +1,22 @@
 /**
  * Permission checking for outgoing HTTP requests based on the
  * Detent library.
- *
- * When a permissions config file exists, outgoing curl requests are checked
- * against the user's permission rules before being sent.
  */
 export declare class PermissionCheckError extends Error {
     constructor(message: string);
 }
 /**
- * Check whether a curl request is allowed by permission rules.
+ * Check whether a request is allowed by permission rules.
  *
  * When no permissions config file is present at the given path, the check is
  * skipped (returns true). When a config exists, the request is validated
  * against its rules.
  *
- * @param curlArguments - The raw curl arguments (before credential injection).
+ * @param request - The request to check.
  * @param configPath - Path to the permissions config file.
  * @param doNotUseBuiltinSchemas - When true, detent's built-in schemas are not used.
  * @returns true if the request is allowed (or no config exists), false if denied.
  * @throws PermissionCheckError if parsing or checking fails unexpectedly.
  */
-export declare function checkPermission(curlArguments: readonly string[], configPath: string, doNotUseBuiltinSchemas?: boolean): Promise<boolean>;
+export declare function checkPermission(request: Request, configPath: string, doNotUseBuiltinSchemas?: boolean): Promise<boolean>;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/src/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,UAAU,EAAE,MAAM,EAClB,sBAAsB,UAAQ,GAC7B,OAAO,CAAC,OAAO,CAAC,CAmBlB"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,EAClB,sBAAsB,UAAQ,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/src/permissions.js

@@ -1,12 +1,9 @@
 /**
  * Permission checking for outgoing HTTP requests based on the
  * Detent library.
- *
- * When a permissions config file exists, outgoing curl requests are checked
- * against the user's permission rules before being sent.
  */
 import { existsSync } from 'node:fs';
-import { check, parseCurlArgs, CurlParseError, ConfigError, RequestSchemaError, } from '@imbue-ai/detent';
+import { check, ConfigError, RequestSchemaError } from '@imbue-ai/detent';
 export class PermissionCheckError extends Error {
     constructor(message) {
         super(message);
@@ -14,31 +11,27 @@ export class PermissionCheckError extends Error {
     }
 }
 /**
- * Check whether a curl request is allowed by permission rules.
+ * Check whether a request is allowed by permission rules.
  *
  * When no permissions config file is present at the given path, the check is
  * skipped (returns true). When a config exists, the request is validated
  * against its rules.
  *
- * @param curlArguments - The raw curl arguments (before credential injection).
+ * @param request - The request to check.
  * @param configPath - Path to the permissions config file.
  * @param doNotUseBuiltinSchemas - When true, detent's built-in schemas are not used.
  * @returns true if the request is allowed (or no config exists), false if denied.
  * @throws PermissionCheckError if parsing or checking fails unexpectedly.
  */
-export async function checkPermission(curlArguments, configPath, doNotUseBuiltinSchemas = false) {
+export async function checkPermission(request, configPath, doNotUseBuiltinSchemas = false) {
     if (!existsSync(configPath)) {
         return true;
     }
     try {
-        const request = parseCurlArgs(curlArguments);
-        const useBuiltinSchemas = !doNotUseBuiltinSchemas;
-        return await check(request, configPath, useBuiltinSchemas);
+        return await check(request, configPath, !doNotUseBuiltinSchemas);
     }
     catch (error) {
-        if (error instanceof CurlParseError ||
-            error instanceof ConfigError ||
-            error instanceof RequestSchemaError) {
+        if (error instanceof ConfigError || error instanceof RequestSchemaError) {
             throw new PermissionCheckError(`Permission check failed: ${error.message}`);
         }
         throw error;