latchkey 2.8.0 → 2.9.0

package/dist/tests/gatewayExtensions.test.js

@@ -0,0 +1,398 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { ApiCredentialStore } from '../src/apiCredentials/store.js';
+import { Config } from '../src/config.js';
+import { EncryptedStorage } from '../src/encryptedStorage.js';
+import { ServiceRegistry } from '../src/serviceRegistry.js';
+import { startGateway } from '../src/gateway/server.js';
+import { derivePermissionsOverrideSigningKey, createPermissionsOverrideJwt, PERMISSIONS_OVERRIDE_HEADER, } from '../src/gateway/permissionsOverride.js';
+import { EXTENSION_PLACEHOLDER_HOST, ExtensionLoadError, loadExtensions, } from '../src/gateway/extensions.js';
+import { GATEWAY_PASSWORD_HEADER } from '../src/gateway/password.js';
+const TEST_ENCRYPTION_KEY = 'dGVzdGtleXRlc3RrZXl0ZXN0a2V5dGVzdGtleXRlc3Q=';
+function writeExtension(directory, fileName, source) {
+    const filePath = join(directory, fileName);
+    writeFileSync(filePath, source, 'utf-8');
+    return filePath;
+}
+// ─── Unit tests: loadExtensions ───────────────────────────────────────────────
+describe('loadExtensions', () => {
+    let tempDir;
+    let extensionsDir;
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), 'latchkey-ext-test-'));
+        extensionsDir = join(tempDir, 'extensions');
+        mkdirSync(extensionsDir, { recursive: true });
+    });
+    afterEach(() => {
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it('returns an empty list when the directory does not exist', async () => {
+        const extensions = await loadExtensions(join(tempDir, 'nonexistent'));
+        expect(extensions).toEqual([]);
+    });
+    it('returns an empty list when the path is a file, not a directory', async () => {
+        const filePath = join(tempDir, 'not-a-dir');
+        writeFileSync(filePath, 'noop', 'utf-8');
+        const extensions = await loadExtensions(filePath);
+        expect(extensions).toEqual([]);
+    });
+    it('skips files with unsupported suffixes (including .js)', async () => {
+        writeExtension(extensionsDir, 'README.txt', 'not an extension');
+        writeExtension(extensionsDir, 'config.json', '{}');
+        // .js is intentionally not supported: extensions must be `.mjs` so Node
+        // never has to fall back to the CommonJS-then-ESM reparse, which emits
+        // a MODULE_TYPELESS_PACKAGE_JSON warning.
+        writeExtension(extensionsDir, 'looks-like-an-extension.js', `export default () => false;`);
+        const extensions = await loadExtensions(extensionsDir);
+        expect(extensions).toEqual([]);
+    });
+    it('loads a single .mjs extension', async () => {
+        writeExtension(extensionsDir, 'hello.mjs', `export default async (req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('hi');
+        return true;
+      };`);
+        const extensions = await loadExtensions(extensionsDir);
+        expect(extensions).toHaveLength(1);
+        expect(extensions[0].sourceFile).toContain('hello.mjs');
+        expect(typeof extensions[0].handler).toBe('function');
+    });
+    it('loads multiple files in deterministic alphabetical order', async () => {
+        writeExtension(extensionsDir, 'b-second.mjs', `export default () => false;`);
+        writeExtension(extensionsDir, 'a-first.mjs', `export default () => false;`);
+        const extensions = await loadExtensions(extensionsDir);
+        expect(extensions.map((extension) => extension.sourceFile.endsWith('a-first.mjs'))).toEqual([
+            true,
+            false,
+        ]);
+        expect(extensions.map((extension) => extension.sourceFile.endsWith('b-second.mjs'))).toEqual([
+            false,
+            true,
+        ]);
+    });
+    it('throws ExtensionLoadError when a file has a syntax error', async () => {
+        writeExtension(extensionsDir, 'broken.mjs', 'this is not valid javascript ((((');
+        await expect(loadExtensions(extensionsDir)).rejects.toThrow(ExtensionLoadError);
+    });
+    it('throws ExtensionLoadError when there is no default export', async () => {
+        writeExtension(extensionsDir, 'no-default.mjs', `export const handler = () => {};`);
+        await expect(loadExtensions(extensionsDir)).rejects.toThrow(/must export a default function/);
+    });
+    it('throws ExtensionLoadError when the default export is not a function', async () => {
+        writeExtension(extensionsDir, 'object-default.mjs', `export default { handler: () => {} };`);
+        await expect(loadExtensions(extensionsDir)).rejects.toThrow(/must export a default function/);
+    });
+});
+// ─── Integration tests via startGateway ───────────────────────────────────────
+describe('gateway extensions integration', () => {
+    let tempDir;
+    let extensionsDir;
+    let gateway;
+    let logs;
+    let errorLogs;
+    let mockPermissionResult;
+    let lastPermissionCheckRequest;
+    let lastPermissionCheckPath;
+    function createMockConfig() {
+        return new Config((name) => {
+            if (name === 'LATCHKEY_DIRECTORY')
+                return tempDir;
+            if (name === 'LATCHKEY_ENCRYPTION_KEY')
+                return TEST_ENCRYPTION_KEY;
+            return undefined;
+        });
+    }
+    async function createTestGateway(optionOverrides = {}) {
+        const credentialsPath = join(tempDir, 'credentials.json.enc');
+        const encryptedStorage = new EncryptedStorage(TEST_ENCRYPTION_KEY);
+        encryptedStorage.writeFile(credentialsPath, '{}');
+        const apiCredentialStore = new ApiCredentialStore(credentialsPath, encryptedStorage);
+        const config = createMockConfig();
+        const deps = {
+            registry: new ServiceRegistry([]),
+            config,
+            runCurl: () => ({ returncode: 0, stdout: '', stderr: '' }),
+            runCurlAsync: () => Promise.resolve({ returncode: 0, stdout: Buffer.alloc(0), stderr: '' }),
+            checkPermission: (request, configPath, _builtin) => {
+                lastPermissionCheckRequest = request;
+                lastPermissionCheckPath = configPath;
+                return Promise.resolve(mockPermissionResult);
+            },
+            confirm: () => Promise.resolve(true),
+            exit: (code) => {
+                throw new Error(`process.exit(${String(code)})`);
+            },
+            log: (message) => {
+                logs.push(message);
+            },
+            errorLog: (message) => {
+                errorLogs.push(message);
+            },
+            version: '0.0.0-test',
+        };
+        const options = {
+            port: 0,
+            host: 'localhost',
+            maxBodySize: 10 * 1024 * 1024,
+            password: null,
+            permissionsOverrideSigningKey: derivePermissionsOverrideSigningKey(TEST_ENCRYPTION_KEY),
+            ...optionOverrides,
+        };
+        return startGateway(deps, apiCredentialStore, encryptedStorage, options);
+    }
+    function getHost() {
+        if (gateway === undefined)
+            throw new Error('Gateway not started');
+        const address = gateway.server.address();
+        if (address === null || typeof address === 'string') {
+            throw new Error('Failed to get server address');
+        }
+        const host = address.family === 'IPv6' ? `[${address.address}]` : address.address;
+        return `http://${host}:${String(address.port)}`;
+    }
+    function fetch(path, options = {}) {
+        return globalThis.fetch(`${getHost()}${path}`, options);
+    }
+    beforeEach(() => {
+        tempDir = mkdtempSync(join(tmpdir(), 'latchkey-ext-int-'));
+        extensionsDir = join(tempDir, 'extensions');
+        mkdirSync(extensionsDir, { recursive: true });
+        logs = [];
+        errorLogs = [];
+        mockPermissionResult = true;
+        lastPermissionCheckRequest = undefined;
+        lastPermissionCheckPath = undefined;
+    });
+    afterEach(async () => {
+        if (gateway) {
+            await gateway.close();
+            gateway = undefined;
+        }
+        rmSync(tempDir, { recursive: true, force: true });
+    });
+    it('serves an extension that claims a request', async () => {
+        writeExtension(extensionsDir, 'echo.mjs', `export default (req, res) => {
+        if (req.url === '/extensions/echo') {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ url: req.url }));
+          return true;
+        }
+        return false;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/echo');
+        expect(response.status).toBe(200);
+        const body = (await response.json());
+        expect(body.url).toBe('/extensions/echo');
+    });
+    it('falls through to 404 when no extension claims the request', async () => {
+        writeExtension(extensionsDir, 'narrow.mjs', `export default (req, res) => {
+        if (req.url === '/extensions/specific') {
+          res.writeHead(200);
+          res.end();
+          return true;
+        }
+        return false;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/different');
+        expect(response.status).toBe(404);
+    });
+    it('returns 404 when no extensions are installed', async () => {
+        rmSync(extensionsDir, { recursive: true, force: true });
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/anything');
+        expect(response.status).toBe(404);
+    });
+    it('tries extensions in alphabetical order; first to return true wins', async () => {
+        writeExtension(extensionsDir, 'a-claim.mjs', `export default (req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('a');
+        return true;
+      };`);
+        writeExtension(extensionsDir, 'b-also-claim.mjs', `export default (req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('b');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/anything');
+        expect(await response.text()).toBe('a');
+    });
+    it('continues to the next extension when one returns false', async () => {
+        writeExtension(extensionsDir, 'a-defer.mjs', `export default (req, res) => false;`);
+        writeExtension(extensionsDir, 'b-claim.mjs', `export default (req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('handled-by-b');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/whatever');
+        expect(await response.text()).toBe('handled-by-b');
+    });
+    it('preserves query string for the handler and in the permission check', async () => {
+        writeExtension(extensionsDir, 'q.mjs', `export default (req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end(req.url);
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/q?x=1&y=2');
+        expect(await response.text()).toBe('/extensions/q?x=1&y=2');
+        const synthesizedUrl = lastPermissionCheckRequest?.url ?? '';
+        expect(synthesizedUrl).toContain('?x=1&y=2');
+        expect(synthesizedUrl).toContain(EXTENSION_PLACEHOLDER_HOST);
+    });
+    it('returns 403 when the permission check denies the request, before any extension is invoked', async () => {
+        writeExtension(extensionsDir, 'should-not-run.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('should not happen');
+        return true;
+      };`);
+        mockPermissionResult = false;
+        gateway = await createTestGateway();
+        const response = await fetch('/anything');
+        expect(response.status).toBe(403);
+        const body = (await response.json());
+        expect(body.error.toLowerCase()).toContain('not permitted');
+    });
+    it('returns 500 and logs when an extension throws', async () => {
+        writeExtension(extensionsDir, 'boom.mjs', `export default () => {
+        throw new Error('boom!');
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/boom');
+        expect(response.status).toBe(500);
+        expect(errorLogs.some((message) => message.includes('boom!'))).toBe(true);
+    });
+    it('does not call later extensions after one throws', async () => {
+        writeExtension(extensionsDir, 'a-throws.mjs', `export default () => {
+        throw new Error('first failed');
+      };`);
+        writeExtension(extensionsDir, 'b-claim.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('b');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/path');
+        expect(response.status).toBe(500);
+    });
+    it('does not let extensions intercept the health endpoint', async () => {
+        writeExtension(extensionsDir, 'broad.mjs', `export default (req, res) => {
+        res.writeHead(200, { 'Content-Type': 'text/plain' });
+        res.end('hijacked');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/');
+        expect(response.status).toBe(200);
+        const body = (await response.json());
+        expect(body.status).toBe('ok');
+    });
+    it('does not offer /gateway/<malformed-url> requests to extensions', async () => {
+        writeExtension(extensionsDir, 'broad.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('hijacked');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/gateway/not-a-url');
+        expect(response.status).toBe(400);
+    });
+    it('does not offer /latchkey/ requests to extensions', async () => {
+        writeExtension(extensionsDir, 'broad.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('hijacked');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/latchkey/', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ command: 'auth list' }),
+        });
+        // Should be handled by the latchkey RPC endpoint, not the extension.
+        expect(response.status).toBe(200);
+    });
+    it('fails startup when an extension is malformed', async () => {
+        writeExtension(extensionsDir, 'broken.mjs', 'syntax error (((');
+        await expect(createTestGateway()).rejects.toThrow(ExtensionLoadError);
+    });
+    it('still requires the gateway password for extension routes', async () => {
+        writeExtension(extensionsDir, 'pw.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('ok');
+        return true;
+      };`);
+        gateway = await createTestGateway({ password: 'sekret' });
+        const denied = await fetch('/extensions/pw');
+        expect(denied.status).toBe(401);
+        const allowed = await fetch('/extensions/pw', {
+            headers: { [GATEWAY_PASSWORD_HEADER]: 'sekret' },
+        });
+        expect(allowed.status).toBe(200);
+    });
+    it('honors the permissions-override JWT for extension routes', async () => {
+        writeExtension(extensionsDir, 'perm.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('ok');
+        return true;
+      };`);
+        const overridePath = join(tempDir, 'override-permissions.json');
+        writeFileSync(overridePath, '{"rules":[]}', 'utf-8');
+        const signingKey = derivePermissionsOverrideSigningKey(TEST_ENCRYPTION_KEY);
+        const jwt = createPermissionsOverrideJwt(overridePath, signingKey);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/perm', {
+            headers: { [PERMISSIONS_OVERRIDE_HEADER]: jwt },
+        });
+        expect(response.status).toBe(200);
+        expect(lastPermissionCheckPath).toBe(overridePath);
+    });
+    it('returns 401 for an invalid permissions-override JWT', async () => {
+        writeExtension(extensionsDir, 'p.mjs', `export default (req, res) => {
+        res.writeHead(200);
+        res.end('ok');
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/p', {
+            headers: { [PERMISSIONS_OVERRIDE_HEADER]: 'not.a.jwt' },
+        });
+        expect(response.status).toBe(401);
+    });
+    it('supports handlers that complete asynchronously after reading the request body', async () => {
+        writeExtension(extensionsDir, 'echo-body.mjs', `export default (req, res) =>
+        new Promise((resolve) => {
+          let body = '';
+          req.on('data', (chunk) => { body += chunk; });
+          req.on('end', () => {
+            res.writeHead(200, { 'Content-Type': 'text/plain' });
+            res.end(body.toUpperCase());
+            resolve(true);
+          });
+        });`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/echo-body', {
+            method: 'POST',
+            body: 'hello',
+        });
+        expect(response.status).toBe(200);
+        expect(await response.text()).toBe('HELLO');
+    });
+    it('logs the extension request line with the actual response status', async () => {
+        writeExtension(extensionsDir, 'log.mjs', `export default (req, res) => {
+        res.writeHead(202);
+        res.end();
+        return true;
+      };`);
+        gateway = await createTestGateway();
+        const response = await fetch('/extensions/log');
+        await response.text();
+        expect(logs).toContain('GET /extensions/log -> 202 (extension)');
+    });
+});
+//# sourceMappingURL=gatewayExtensions.test.js.map

package/dist/tests/gatewayExtensions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatewayExtensions.test.js","sourceRoot":"","sources":["../../tests/gatewayExtensions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAsB,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,mBAAmB,GAAG,8CAA8C,CAAC;AAE3E,SAAS,cAAc,CAAC,SAAiB,EAAE,QAAgB,EAAE,MAAc;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iFAAiF;AAEjF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,OAAe,CAAC;IACpB,IAAI,aAAqB,CAAC;IAE1B,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC5D,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC5C,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5C,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAChE,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;QACnD,wEAAwE;QACxE,uEAAuE;QACvE,0CAA0C;QAC1C,cAAc,CAAC,aAAa,EAAE,4BAA4B,EAAE,6BAA6B,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,cAAc,CACZ,aAAa,EACb,WAAW,EACX;;;;SAIG,CACJ,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,cAAc,CAAC,aAAa,EAAE,cAAc,EAAE,6BAA6B,CAAC,CAAC;QAC7E,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE,6BAA6B,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1F,IAAI;YACJ,KAAK;SACN,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3F,KAAK;YACL,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,mCAAmC,CAAC,CAAC;QACjF,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,cAAc,CAAC,aAAa,EAAE,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;QACpF,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,cAAc,CAAC,aAAa,EAAE,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;QAC7F,MAAM,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,IAAI,OAAe,CAAC;IACpB,IAAI,aAAqB,CAAC;IAC1B,IAAI,OAAkC,CAAC;IACvC,IAAI,IAAc,CAAC;IACnB,IAAI,SAAmB,CAAC;IACxB,IAAI,oBAA6B,CAAC;IAClC,IAAI,0BAA+C,CAAC;IACpD,IAAI,uBAA2C,CAAC;IAEhD,SAAS,gBAAgB;QACvB,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,oBAAoB;gBAAE,OAAO,OAAO,CAAC;YAClD,IAAI,IAAI,KAAK,yBAAyB;gBAAE,OAAO,mBAAmB,CAAC;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC9B,kBAA2C,EAAE;QAE7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC9D,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QACnE,gBAAgB,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QAErF,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,GAAoB;YAC5B,QAAQ,EAAE,IAAI,eAAe,CAAC,EAAE,CAAC;YACjC,MAAM;YACN,OAAO,EAAE,GAAe,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACtE,YAAY,EAAE,GAA6B,EAAE,CAC3C,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzE,eAAe,EAAE,CACf,OAAgB,EAChB,UAAkB,EAClB,QAAiB,EACC,EAAE;gBACpB,0BAA0B,GAAG,OAAO,CAAC;gBACrC,uBAAuB,GAAG,UAAU,CAAC;gBACrC,OAAO,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,CAAC,IAAY,EAAS,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE;gBACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,QAAQ,EAAE,CAAC,OAAe,EAAE,EAAE;gBAC5B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,EAAE,YAAY;SACtB,CAAC;QAEF,MAAM,OAAO,GAAmB;YAC9B,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC7B,QAAQ,EAAE,IAAI;YACd,6BAA6B,EAAE,mCAAmC,CAAC,mBAAmB,CAAC;YACvF,GAAG,eAAe;SACnB,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,SAAS,OAAO;QACd,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAClF,OAAO,UAAU,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,SAAS,KAAK,CAAC,IAAY,EAAE,UAAuB,EAAE;QACpD,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC3D,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC5C,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;QACV,SAAS,GAAG,EAAE,CAAC;QACf,oBAAoB,GAAG,IAAI,CAAC;QAC5B,0BAA0B,GAAG,SAAS,CAAC;QACvC,uBAAuB,GAAG,SAAS,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,cAAc,CACZ,aAAa,EACb,UAAU,EACV;;;;;;;SAOG,CACJ,CAAC;QAEF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,cAAc,CACZ,aAAa,EACb,YAAY,EACZ;;;;;;;SAOG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,cAAc,CACZ,aAAa,EACb,aAAa,EACb;;;;SAIG,CACJ,CAAC;QACF,cAAc,CACZ,aAAa,EACb,kBAAkB,EAClB;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE,qCAAqC,CAAC,CAAC;QACpF,cAAc,CACZ,aAAa,EACb,aAAa,EACb;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,cAAc,CACZ,aAAa,EACb,OAAO,EACP;;;;SAIG,CACJ,CAAC;QAEF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAE5D,MAAM,cAAc,GAAG,0BAA0B,EAAE,GAAG,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,cAAc,CACZ,aAAa,EACb,oBAAoB,EACpB;;;;SAIG,CACJ,CAAC;QAEF,oBAAoB,GAAG,KAAK,CAAC;QAC7B,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,cAAc,CACZ,aAAa,EACb,UAAU,EACV;;SAEG,CACJ,CAAC;QAEF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,cAAc,CACZ,aAAa,EACb,cAAc,EACd;;SAEG,CACJ,CAAC;QACF,cAAc,CACZ,aAAa,EACb,aAAa,EACb;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,cAAc,CACZ,aAAa,EACb,WAAW,EACX;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,cAAc,CACZ,aAAa,EACb,WAAW,EACX;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,cAAc,CACZ,aAAa,EACb,WAAW,EACX;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;SAC/C,CAAC,CAAC;QACH,qEAAqE;QACrE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,cAAc,CAAC,aAAa,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;QAChE,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,cAAc,CACZ,aAAa,EACb,QAAQ,EACR;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;YAC5C,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,cAAc,CACZ,aAAa,EACb,UAAU,EACV;;;;SAIG,CACJ,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAChE,aAAa,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,mCAAmC,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,4BAA4B,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAEnE,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;YAC/C,OAAO,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,GAAG,EAAE;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,cAAc,CACZ,aAAa,EACb,OAAO,EACP;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YAC5C,OAAO,EAAE,EAAE,CAAC,2BAA2B,CAAC,EAAE,WAAW,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,cAAc,CACZ,aAAa,EACb,eAAe,EACf;;;;;;;;;YASM,CACP,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uBAAuB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,cAAc,CACZ,aAAa,EACb,SAAS,EACT;;;;SAIG,CACJ,CAAC;QACF,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/permissions.test.js

@@ -2,7 +2,11 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
+import { parseCurlArgs } from '@imbue-ai/detent';
 import { checkPermission, PermissionCheckError } from '../src/permissions.js';
+function requestFromCurl(args) {
+    return parseCurlArgs(args);
+}
 describe('checkPermission', () => {
     let tempDir;
     beforeEach(() => {
@@ -13,7 +17,7 @@ describe('checkPermission', () => {
     });
     it('should allow requests when no config file exists', async () => {
         const configPath = join(tempDir, 'nonexistent', 'permissions.json');
-        const result = await checkPermission(['-X', 'GET', 'https://api.example.com/anything'], configPath);
+        const result = await checkPermission(requestFromCurl(['-X', 'GET', 'https://api.example.com/anything']), configPath);
         expect(result).toBe(true);
     });
     it('should allow requests matching a permission rule', async () => {
@@ -35,7 +39,7 @@ describe('checkPermission', () => {
             },
             rules: [{ 'example-api': ['example-read'] }],
         }));
-        const result = await checkPermission(['https://api.example.com/users'], configPath);
+        const result = await checkPermission(requestFromCurl(['https://api.example.com/users']), configPath);
         expect(result).toBe(true);
     });
     it('should deny requests not matching any permission rule', async () => {
@@ -57,7 +61,7 @@ describe('checkPermission', () => {
             },
             rules: [{ 'example-api': ['example-read'] }],
         }));
-        const result = await checkPermission(['-X', 'POST', 'https://api.example.com/users'], configPath);
+        const result = await checkPermission(requestFromCurl(['-X', 'POST', 'https://api.example.com/users']), configPath);
         expect(result).toBe(false);
     });
     it('should deny requests to unrecognized domains when rules exist', async () => {
@@ -79,20 +83,20 @@ describe('checkPermission', () => {
             },
             rules: [{ 'example-api': ['example-read'] }],
         }));
-        const result = await checkPermission(['https://api.other.com/something'], configPath);
+        const result = await checkPermission(requestFromCurl(['https://api.other.com/something']), configPath);
         expect(result).toBe(false);
     });
     it('should throw PermissionCheckError for invalid config files', async () => {
         const configPath = join(tempDir, 'permissions.json');
         writeFileSync(configPath, 'not valid json');
-        await expect(checkPermission(['https://api.example.com/anything'], configPath)).rejects.toThrow(PermissionCheckError);
+        await expect(checkPermission(requestFromCurl(['https://api.example.com/anything']), configPath)).rejects.toThrow(PermissionCheckError);
     });
     it('should accept URLs without a scheme (defaulting to http://) when rules allow them', async () => {
         const configPath = join(tempDir, 'permissions.json');
         writeFileSync(configPath, JSON.stringify({
             rules: [{ any: ['any'] }],
         }));
-        const result = await checkPermission(['www.seznam.cz'], configPath);
+        const result = await checkPermission(requestFromCurl(['www.seznam.cz']), configPath);
         expect(result).toBe(true);
     });
     it('should throw PermissionCheckError when a rule references an unknown schema', async () => {
@@ -100,15 +104,15 @@ describe('checkPermission', () => {
         writeFileSync(configPath, JSON.stringify({
             rules: [{ 'non-existent-schema': ['any'] }],
         }));
-        await expect(checkPermission(['https://api.example.com/anything'], configPath, true)).rejects.toThrow(PermissionCheckError);
+        await expect(checkPermission(requestFromCurl(['https://api.example.com/anything']), configPath, true)).rejects.toThrow(PermissionCheckError);
     });
     it('should allow all requests with the any/any rule', async () => {
         const configPath = join(tempDir, 'permissions.json');
         writeFileSync(configPath, JSON.stringify({
             rules: [{ any: ['any'] }],
         }));
-        const resultGet = await checkPermission(['https://api.example.com/anything'], configPath);
-        const resultPost = await checkPermission(['-X', 'POST', '-d', '{"key":"value"}', 'https://api.other.com/resource'], configPath);
+        const resultGet = await checkPermission(requestFromCurl(['https://api.example.com/anything']), configPath);
+        const resultPost = await checkPermission(requestFromCurl(['-X', 'POST', '-d', '{"key":"value"}', 'https://api.other.com/resource']), configPath);
         expect(resultGet).toBe(true);
         expect(resultPost).toBe(true);
     });
@@ -117,7 +121,7 @@ describe('checkPermission', () => {
         writeFileSync(configPath, JSON.stringify({
             rules: [],
         }));
-        const result = await checkPermission(['https://api.example.com/anything'], configPath);
+        const result = await checkPermission(requestFromCurl(['https://api.example.com/anything']), configPath);
         expect(result).toBe(false);
     });
 });

package/dist/tests/permissions.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.test.js","sourceRoot":"","sources":["../../tests/permissions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE9E,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,CAAC,IAAI,EAAE,KAAK,EAAE,kCAAkC,CAAC,EACjD,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;qBACrC;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,cAAc,EAAE;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzB;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,+BAA+B,CAAC,EAAE,UAAU,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;qBACrC;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,cAAc,EAAE;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzB;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,CAAC,IAAI,EAAE,MAAM,EAAE,+BAA+B,CAAC,EAC/C,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;qBACrC;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,cAAc,EAAE;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzB;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,iCAAiC,CAAC,EAAE,UAAU,CAAC,CAAC;QAEtF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAE5C,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,kCAAkC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7F,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1B,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,CACV,eAAe,CAAC,CAAC,kCAAkC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CACxE,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1B,CAAC,CACH,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,CAAC,kCAAkC,CAAC,EAAE,UAAU,CAAC,CAAC;QAC1F,MAAM,UAAU,GAAG,MAAM,eAAe,CACtC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,EACzE,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,EAAE;SACV,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,kCAAkC,CAAC,EAAE,UAAU,CAAC,CAAC;QAEvF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"permissions.test.js","sourceRoot":"","sources":["../../tests/permissions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE9E,SAAS,eAAe,CAAC,IAAuB;IAC9C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,eAAe,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC,EAClE,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;qBACrC;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,cAAc,EAAE;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzB;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,eAAe,CAAC,CAAC,+BAA+B,CAAC,CAAC,EAClD,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;qBACrC;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,cAAc,EAAE;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzB;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,+BAA+B,CAAC,CAAC,EAChE,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE;gBACP,aAAa,EAAE;oBACb,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE;qBACrC;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;gBACD,cAAc,EAAE;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzB;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;SAC7C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,eAAe,CAAC,CAAC,iCAAiC,CAAC,CAAC,EACpD,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAE5C,MAAM,MAAM,CACV,eAAe,CAAC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,EAAE,UAAU,CAAC,CACnF,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1B,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,CACV,eAAe,CAAC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CACzF,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC1B,CAAC,CACH,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,eAAe,CACrC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,EACrD,UAAU,CACX,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,eAAe,CACtC,eAAe,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,EAC1F,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrD,aAAa,CACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,EAAE;SACV,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,EACrD,UAAU,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "latchkey",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "A CLI tool that injects API credentials into curl requests to third-party services",
   "author": "Imbue <hynek@imbue.com>",
   "repository": {

package/dist/src/gateway/permissionPointer.d.ts

@@ -1,56 +0,0 @@
-/**
- * Optional `x-latchkey-gateway-permission-pointer` header support.
- *
- * The header carries a minimal HS256 JWT whose only payload field is
- * `permissionsConfig`, an absolute path to a `permissions.json` file.
- * When the gateway receives such a header on a `/gateway/...` request and
- * the JWT is valid, it uses the referenced permissions config instead of
- * the default one for that single request.
- *
- * The signing key is derived from the Latchkey encryption key via HKDF-like
- * HMAC-SHA256 with a domain-separation label, so the encryption key itself
- * is never used to sign or verify these JWTs directly.
- */
-/**
- * HTTP header used to carry the permission-pointer JWT. Lowercased to match
- * how Node's `http.IncomingMessage.headers` exposes header names.
- */
-export declare const PERMISSION_POINTER_HEADER = "x-latchkey-gateway-permission-pointer";
-export declare class InvalidPermissionPointerError extends Error {
-    constructor(message: string);
-}
-export declare class PermissionPointerFileMissingError extends Error {
-    constructor(filePath: string);
-}
-/**
- * Derive the HS256 signing key used for permission-pointer JWTs from the
- * Latchkey encryption key. The encryption key is base64-encoded; the
- * derived key is the raw HMAC-SHA256 output (32 bytes).
- */
-export declare function derivePermissionPointerSigningKey(encryptionKeyBase64: string): Buffer;
-/**
- * Build a permission-pointer JWT for the given absolute path. The path is
- * not validated here; callers that want to ensure the file exists must do
- * so before calling this function.
- */
-export declare function createPermissionPointerJwt(permissionsConfigPath: string, signingKey: Buffer): string;
-interface PermissionPointerPayload {
-    readonly permissionsConfig: string;
-}
-/**
- * Verify a permission-pointer JWT and return its payload. Throws
- * `InvalidPermissionPointerError` on any structural, signature, or content
- * issue (i.e. anything that should be reported as "the JWT is invalid").
- *
- * This intentionally does not check that the referenced file exists; that
- * concern is handled by `resolvePermissionPointer` so that file-system
- * errors can be reported separately from JWT errors.
- */
-export declare function verifyPermissionPointerJwt(token: string, signingKey: Buffer): PermissionPointerPayload;
-/**
- * Verify a permission-pointer JWT and additionally require the referenced
- * file to exist as a regular file. Returns the absolute path on success.
- */
-export declare function resolvePermissionPointer(token: string, signingKey: Buffer): string;
-export {};
-//# sourceMappingURL=permissionPointer.d.ts.map

package/dist/src/gateway/permissionPointer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionPointer.d.ts","sourceRoot":"","sources":["../../../src/gateway/permissionPointer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAYjF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,QAAQ,EAAE,MAAM;CAI7B;AAkBD;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAGrF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,MAAM,EAC7B,UAAU,EAAE,MAAM,GACjB,MAAM,CAWR;AAED,UAAU,wBAAwB;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAsCD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,wBAAwB,CAqD1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAMlF"}