latchkey 3.14.0 → 3.16.0

package/README.md

@@ -228,6 +228,15 @@ You can also configure browser login flows for registered services. For details,
 see `latchkey services register --help`.
 
 
+### Plugins
+
+It is also possible to add support for a new service by
+installing a plugin that implements it. A Latchkey plugin is
+a git repository; installation is a matter of running `git
+clone` in `~/.latchkey/plugins/`. For more details, see the
+[plugins docs](./docs/plugins.md).
+
+
 ### Indirect credentials
 
 Some services can't express their credentials as static curl
@@ -436,6 +445,7 @@ defaults:
 - `LATCHKEY_GATEWAY_LISTEN_PASSWORD`: optional shared secret used by the server side. When set, `latchkey gateway` rejects (with `401`) any request that does not present the same value in the `X-Latchkey-Gateway-Password` header. The header is stripped before requests are forwarded upstream.
 - `LATCHKEY_GATEWAY_PERMISSIONS_OVERRIDE`: optional permissions-override JWT (see `latchkey gateway create-jwt`) used by the client side. When set together with `LATCHKEY_GATEWAY`, the CLI sends the value in the `X-Latchkey-Gateway-Permissions-Override` header on every outgoing gateway request, causing the remote gateway to enforce the permissions.json file referenced by the JWT instead of its default one.
 - `LATCHKEY_APP_NAME_PREFIX`: prefix used for the app, project, and OAuth client names that Latchkey creates on your behalf inside third-party consoles (defaults to `Latchkey`).
+- `LATCHKEY_LATCKEY_DIAGNOSTIC_HEADERS`: if set, Latchkey adds special headers with diagnostic information to the outgoing requests. This currently includes `X-Latchkey-Matched-Service`, indicating the service that Latchkey matched the request to and injected credentials for.
 
 All of the above settings, except for `LATCHKEY_DIRECTORY`,
 `LATCHKEY_ENCRYPTION_KEY`, `LATCHKEY_GATEWAY_PASSWORD`,

package/dist/src/apiCredentials/base.d.ts

@@ -8,12 +8,24 @@ export declare enum ApiCredentialStatus {
     Invalid = "invalid",
     Unknown = "unknown"
 }
+/**
+ * The stored form of credentials: plain JSON whose `objectType` names the
+ * {@link ApiCredentialsType} that can read it back.
+ */
+export interface SerializedApiCredentials {
+    readonly objectType: string;
+}
 /**
  * Base interface for all API credentials.
  * Each credential type must specify how to inject itself into a curl call.
  */
 export interface ApiCredentials {
     readonly objectType: string;
+    /**
+     * The form the credentials are stored in. Left out by credentials that are
+     * only ever built on the fly from stored ones and never stored themselves.
+     */
+    toJSON?(): SerializedApiCredentials;
     /**
      * Inject credentials into a curl call by modifying the given arguments array.
      * Implementations may add headers, change the URL, or transform arguments in any way.
@@ -31,6 +43,17 @@ export interface ApiCredentials {
      */
     isExpired(): boolean | undefined;
 }
+/**
+ * How stored credentials of one `objectType` are read back. This is the static
+ * side of a credentials class: `fromJSON` validates the stored JSON and builds
+ * the credentials from it, throwing on data it does not accept. Every
+ * credentials class latchkey ships with is one, and a plugin that defines its
+ * own class lists it in its manifest so that its credentials can be stored.
+ */
+export interface ApiCredentialsType {
+    readonly objectType: string;
+    fromJSON(data: unknown): ApiCredentials;
+}
 /**
  * Bearer token authentication (Authorization: Bearer <token>).
  */
@@ -46,13 +69,14 @@ export declare const AuthorizationBearerSchema: z.ZodObject<{
 }>;
 export type AuthorizationBearerData = z.infer<typeof AuthorizationBearerSchema>;
 export declare class AuthorizationBearer implements ApiCredentials {
+    static readonly objectType: "authorizationBearer";
     readonly objectType: "authorizationBearer";
     readonly token: string;
     constructor(token: string);
     injectIntoCurlCall(curlArguments: readonly string[]): Promise<readonly string[]>;
     isExpired(): boolean | undefined;
     toJSON(): AuthorizationBearerData;
-    static fromJSON(data: AuthorizationBearerData): AuthorizationBearer;
+    static fromJSON(data: unknown): AuthorizationBearer;
 }
 /**
  * Raw authorization header (Authorization: <token>).
@@ -69,13 +93,14 @@ export declare const AuthorizationBareSchema: z.ZodObject<{
 }>;
 export type AuthorizationBareData = z.infer<typeof AuthorizationBareSchema>;
 export declare class AuthorizationBare implements ApiCredentials {
+    static readonly objectType: "authorizationBare";
     readonly objectType: "authorizationBare";
     readonly token: string;
     constructor(token: string);
     injectIntoCurlCall(curlArguments: readonly string[]): Promise<readonly string[]>;
     isExpired(): boolean | undefined;
     toJSON(): AuthorizationBareData;
-    static fromJSON(data: AuthorizationBareData): AuthorizationBare;
+    static fromJSON(data: unknown): AuthorizationBare;
 }
 /**
  * Raw curl arguments stored directly as credentials.
@@ -93,13 +118,14 @@ export declare const RawCurlCredentialsSchema: z.ZodObject<{
 }>;
 export type RawCurlCredentialsData = z.infer<typeof RawCurlCredentialsSchema>;
 export declare class RawCurlCredentials implements ApiCredentials {
+    static readonly objectType: "rawCurl";
     readonly objectType: "rawCurl";
     readonly curlArguments: readonly string[];
     constructor(curlArguments: readonly string[]);
     injectIntoCurlCall(curlArguments: readonly string[]): Promise<readonly string[]>;
     isExpired(): boolean | undefined;
     toJSON(): RawCurlCredentialsData;
-    static fromJSON(data: RawCurlCredentialsData): RawCurlCredentials;
+    static fromJSON(data: unknown): RawCurlCredentials;
 }
 /**
  * OAuth 2.0 credentials (access token, refresh token, client ID, and client secret).
@@ -115,6 +141,7 @@ export declare const OAuthCredentialsSchema: z.ZodObject<{
     clientSecret: z.ZodString;
     accessTokenExpiresAt: z.ZodOptional<z.ZodString>;
     refreshTokenExpiresAt: z.ZodOptional<z.ZodString>;
+    redirectUri: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     objectType: "oauth";
     clientId: string;
@@ -123,6 +150,7 @@ export declare const OAuthCredentialsSchema: z.ZodObject<{
     refreshToken?: string | undefined;
     accessTokenExpiresAt?: string | undefined;
     refreshTokenExpiresAt?: string | undefined;
+    redirectUri?: string | undefined;
 }, {
     objectType: "oauth";
     clientId: string;
@@ -131,9 +159,11 @@ export declare const OAuthCredentialsSchema: z.ZodObject<{
     refreshToken?: string | undefined;
     accessTokenExpiresAt?: string | undefined;
     refreshTokenExpiresAt?: string | undefined;
+    redirectUri?: string | undefined;
 }>;
 export type OAuthCredentialsData = z.infer<typeof OAuthCredentialsSchema>;
 export declare class OAuthCredentials implements ApiCredentials {
+    static readonly objectType: "oauth";
     readonly objectType: "oauth";
     readonly accessToken?: string;
     readonly refreshToken?: string;
@@ -141,11 +171,29 @@ export declare class OAuthCredentials implements ApiCredentials {
     readonly clientSecret: string;
     readonly accessTokenExpiresAt?: string;
     readonly refreshTokenExpiresAt?: string;
-    constructor(clientId: string, clientSecret: string, accessToken?: string, refreshToken?: string, accessTokenExpiresAt?: string, refreshTokenExpiresAt?: string);
+    /**
+     * Where the authorization server sends the user back to, when the OAuth
+     * client only permits a pre-registered redirect URI. Left unset in the usual
+     * case, where login stands up its own loopback server and uses
+     * `http://localhost:<port>/oauth2callback`.
+     *
+     * An application that embeds latchkey sets this via `latchkey auth prepare`,
+     * pointing at a page of its own. That page has to forward the query string
+     * the authorization server appended (`code` and friends) to latchkey's
+     * loopback callback; the port is not fixed, so services that support an
+     * override pass it in the `state` parameter for the page to read back.
+     */
+    readonly redirectUri?: string;
+    constructor(clientId: string, clientSecret: string, accessToken?: string, refreshToken?: string, accessTokenExpiresAt?: string, refreshTokenExpiresAt?: string, redirectUri?: string);
+    /**
+     * The token-less form a preparation is stored in: the OAuth client the next
+     * login should use, optionally with the redirect URI it is registered with.
+     */
+    static prepared(clientId: string, clientSecret: string, redirectUri?: string): OAuthCredentials;
     injectIntoCurlCall(curlArguments: readonly string[]): Promise<readonly string[]>;
     isExpired(): boolean | undefined;
     toJSON(): OAuthCredentialsData;
-    static fromJSON(data: OAuthCredentialsData): OAuthCredentials;
+    static fromJSON(data: unknown): OAuthCredentials;
 }
 export declare class ApiCredentialsUsageError extends Error {
     constructor(message: string);

package/dist/src/apiCredentials/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,kBAAkB,CAChB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9B;;;OAGG;IACH,SAAS,IAAI,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEhF,qBAAa,mBAAoB,YAAW,cAAc;IACxD,QAAQ,CAAC,UAAU,EAAG,qBAAqB,CAAU;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM;IAIzB,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,uBAAuB;IAOjC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB;CAGpE;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;EAGlC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,qBAAa,iBAAkB,YAAW,cAAc;IACtD,QAAQ,CAAC,UAAU,EAAG,mBAAmB,CAAU;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM;IAIzB,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,qBAAqB;IAO/B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB;CAGhE;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE9E,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE9B,aAAa,EAAE,SAAS,MAAM,EAAE;IAI5C,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,sBAAsB;IAOhC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,kBAAkB;CAGlE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAQjC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAU;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;gBAGtC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,EACrB,oBAAoB,CAAC,EAAE,MAAM,EAC7B,qBAAqB,CAAC,EAAE,MAAM;IAUhC,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAShF,SAAS,IAAI,OAAO,GAAG,SAAS;IAQhC,MAAM,IAAI,oBAAoB;IAa9B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB;CAU9D;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,MAAM,CAAC,IAAI,wBAAwB,CAAC;IACpC;;;;;;;;;OASG;IACH,kBAAkB,CAChB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9B;;;OAGG;IACH,SAAS,IAAI,OAAO,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAAC;CACzC;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEhF,qBAAa,mBAAoB,YAAW,cAAc;IACxD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAG,qBAAqB,CAAU;IAC5D,QAAQ,CAAC,UAAU,wBAAkC;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM;IAIzB,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,uBAAuB;IAOjC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,mBAAmB;CAIpD;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;EAGlC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE5E,qBAAa,iBAAkB,YAAW,cAAc;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAG,mBAAmB,CAAU;IAC1D,QAAQ,CAAC,UAAU,sBAAgC;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM;IAIzB,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,qBAAqB;IAO/B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB;CAIlD;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE9E,qBAAa,kBAAmB,YAAW,cAAc;IACvD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IAChD,QAAQ,CAAC,UAAU,YAAiC;IACpD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE9B,aAAa,EAAE,SAAS,MAAM,EAAE;IAI5C,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIhF,SAAS,IAAI,OAAO,GAAG,SAAS;IAIhC,MAAM,IAAI,sBAAsB;IAOhC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB;CAInD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASjC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E,qBAAa,gBAAiB,YAAW,cAAc;IACrD,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAU;IAC9C,QAAQ,CAAC,UAAU,UAA+B;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAM5B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,YAAY,CAAC,EAAE,MAAM,EACrB,oBAAoB,CAAC,EAAE,MAAM,EAC7B,qBAAqB,CAAC,EAAE,MAAM,EAC9B,WAAW,CAAC,EAAE,MAAM;IAWtB;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAY/F,kBAAkB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAShF,SAAS,IAAI,OAAO,GAAG,SAAS;IAQhC,MAAM,IAAI,oBAAoB;IAc9B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB;CAYjD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/src/apiCredentials/base.js

@@ -17,7 +17,8 @@ export const AuthorizationBearerSchema = z.object({
     token: z.string(),
 });
 export class AuthorizationBearer {
-    objectType = 'authorizationBearer';
+    static objectType = 'authorizationBearer';
+    objectType = AuthorizationBearer.objectType;
     token;
     constructor(token) {
         this.token = token;
@@ -35,7 +36,8 @@ export class AuthorizationBearer {
         };
     }
     static fromJSON(data) {
-        return new AuthorizationBearer(data.token);
+        const parsed = AuthorizationBearerSchema.parse(data);
+        return new AuthorizationBearer(parsed.token);
     }
 }
 /**
@@ -46,7 +48,8 @@ export const AuthorizationBareSchema = z.object({
     token: z.string(),
 });
 export class AuthorizationBare {
-    objectType = 'authorizationBare';
+    static objectType = 'authorizationBare';
+    objectType = AuthorizationBare.objectType;
     token;
     constructor(token) {
         this.token = token;
@@ -64,7 +67,8 @@ export class AuthorizationBare {
         };
     }
     static fromJSON(data) {
-        return new AuthorizationBare(data.token);
+        const parsed = AuthorizationBareSchema.parse(data);
+        return new AuthorizationBare(parsed.token);
     }
 }
 /**
@@ -76,7 +80,8 @@ export const RawCurlCredentialsSchema = z.object({
     curlArguments: z.array(z.string()),
 });
 export class RawCurlCredentials {
-    objectType = 'rawCurl';
+    static objectType = 'rawCurl';
+    objectType = RawCurlCredentials.objectType;
     curlArguments;
     constructor(curlArguments) {
         this.curlArguments = curlArguments;
@@ -94,7 +99,8 @@ export class RawCurlCredentials {
         };
     }
     static fromJSON(data) {
-        return new RawCurlCredentials(data.curlArguments);
+        const parsed = RawCurlCredentialsSchema.parse(data);
+        return new RawCurlCredentials(parsed.curlArguments);
     }
 }
 /**
@@ -111,22 +117,48 @@ export const OAuthCredentialsSchema = z.object({
     clientSecret: z.string(),
     accessTokenExpiresAt: z.string().optional(),
     refreshTokenExpiresAt: z.string().optional(),
+    redirectUri: z.string().optional(),
 });
 export class OAuthCredentials {
-    objectType = 'oauth';
+    static objectType = 'oauth';
+    objectType = OAuthCredentials.objectType;
     accessToken;
     refreshToken;
     clientId;
     clientSecret;
     accessTokenExpiresAt;
     refreshTokenExpiresAt;
-    constructor(clientId, clientSecret, accessToken, refreshToken, accessTokenExpiresAt, refreshTokenExpiresAt) {
+    /**
+     * Where the authorization server sends the user back to, when the OAuth
+     * client only permits a pre-registered redirect URI. Left unset in the usual
+     * case, where login stands up its own loopback server and uses
+     * `http://localhost:<port>/oauth2callback`.
+     *
+     * An application that embeds latchkey sets this via `latchkey auth prepare`,
+     * pointing at a page of its own. That page has to forward the query string
+     * the authorization server appended (`code` and friends) to latchkey's
+     * loopback callback; the port is not fixed, so services that support an
+     * override pass it in the `state` parameter for the page to read back.
+     */
+    redirectUri;
+    // `redirectUri` trails the token fields, out of its natural place next to
+    // the client id and secret, so that existing positional callers — including
+    // plugins built against an earlier version — keep working.
+    constructor(clientId, clientSecret, accessToken, refreshToken, accessTokenExpiresAt, refreshTokenExpiresAt, redirectUri) {
         this.clientId = clientId;
         this.clientSecret = clientSecret;
         this.accessToken = accessToken;
         this.refreshToken = refreshToken;
         this.accessTokenExpiresAt = accessTokenExpiresAt;
         this.refreshTokenExpiresAt = refreshTokenExpiresAt;
+        this.redirectUri = redirectUri;
+    }
+    /**
+     * The token-less form a preparation is stored in: the OAuth client the next
+     * login should use, optionally with the redirect URI it is registered with.
+     */
+    static prepared(clientId, clientSecret, redirectUri) {
+        return new OAuthCredentials(clientId, clientSecret, undefined, undefined, undefined, undefined, redirectUri);
     }
     injectIntoCurlCall(curlArguments) {
         if (this.accessToken === undefined) {
@@ -150,11 +182,13 @@ export class OAuthCredentials {
             refreshToken: this.refreshToken,
             accessTokenExpiresAt: this.accessTokenExpiresAt,
             refreshTokenExpiresAt: this.refreshTokenExpiresAt,
+            redirectUri: this.redirectUri,
         };
         return result;
     }
     static fromJSON(data) {
-        return new OAuthCredentials(data.clientId, data.clientSecret, data.accessToken, data.refreshToken, data.accessTokenExpiresAt, data.refreshTokenExpiresAt);
+        const parsed = OAuthCredentialsSchema.parse(data);
+        return new OAuthCredentials(parsed.clientId, parsed.clientSecret, parsed.accessToken, parsed.refreshToken, parsed.accessTokenExpiresAt, parsed.refreshTokenExpiresAt, parsed.redirectUri);
     }
 }
 export class ApiCredentialsUsageError extends Error {

package/dist/src/apiCredentials/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/apiCredentials/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,sCAAe,CAAA;IACf,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;AACrB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AA6BD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAIH,MAAM,OAAO,mBAAmB;IACrB,UAAU,GAAG,qBAA8B,CAAC;IAC5C,KAAK,CAAS;IAEvB,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,yBAAyB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAIH,MAAM,OAAO,iBAAiB;IACnB,UAAU,GAAG,mBAA4B,CAAC;IAC1C,KAAK,CAAS;IAEvB,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA2B;QACzC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAIH,MAAM,OAAO,kBAAkB;IACpB,UAAU,GAAG,SAAkB,CAAC;IAChC,aAAa,CAAoB;IAE1C,YAAY,aAAgC;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA4B;QAC1C,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,MAAM,OAAO,gBAAgB;IAClB,UAAU,GAAG,OAAgB,CAAC;IAC9B,WAAW,CAAU;IACrB,YAAY,CAAU;IACtB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,oBAAoB,CAAU;IAC9B,qBAAqB,CAAU;IAExC,YACE,QAAgB,EAChB,YAAoB,EACpB,WAAoB,EACpB,YAAqB,EACrB,oBAA6B,EAC7B,qBAA8B;QAE9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,wBAAwB,CAChC,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,yBAAyB,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,SAAS;QACP,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,MAAM;QACJ,MAAM,MAAM,GAAyB;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAA0B;QACxC,OAAO,IAAI,gBAAgB,CACzB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,qBAAqB,CAC3B,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/apiCredentials/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,sCAAe,CAAA;IACf,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;AACrB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAsDD;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAIH,MAAM,OAAO,mBAAmB;IAC9B,MAAM,CAAU,UAAU,GAAG,qBAA8B,CAAC;IACnD,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC;IAC5C,KAAK,CAAS;IAEvB,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,yBAAyB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAa;QAC3B,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAIH,MAAM,OAAO,iBAAiB;IAC5B,MAAM,CAAU,UAAU,GAAG,mBAA4B,CAAC;IACjD,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC;IAC1C,KAAK,CAAS;IAEvB,YAAY,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAa;QAC3B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAIH,MAAM,OAAO,kBAAkB;IAC7B,MAAM,CAAU,UAAU,GAAG,SAAkB,CAAC;IACvC,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC;IAC3C,aAAa,CAAoB;IAE1C,YAAY,aAAgC;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,SAAS;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAa;QAC3B,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC;;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,MAAM,OAAO,gBAAgB;IAC3B,MAAM,CAAU,UAAU,GAAG,OAAgB,CAAC;IACrC,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC;IACzC,WAAW,CAAU;IACrB,YAAY,CAAU;IACtB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,oBAAoB,CAAU;IAC9B,qBAAqB,CAAU;IACxC;;;;;;;;;;;OAWG;IACM,WAAW,CAAU;IAE9B,0EAA0E;IAC1E,4EAA4E;IAC5E,2DAA2D;IAC3D,YACE,QAAgB,EAChB,YAAoB,EACpB,WAAoB,EACpB,YAAqB,EACrB,oBAA6B,EAC7B,qBAA8B,EAC9B,WAAoB;QAEpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,QAAgB,EAAE,YAAoB,EAAE,WAAoB;QAC1E,OAAO,IAAI,gBAAgB,CACzB,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,aAAgC;QACjD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,wBAAwB,CAChC,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,yBAAyB,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,SAAS;QACP,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;IAChD,CAAC;IAED,MAAM;QACJ,MAAM,MAAM,GAAyB;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAa;QAC3B,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,gBAAgB,CACzB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,oBAAoB,EAC3B,MAAM,CAAC,qBAAqB,EAC5B,MAAM,CAAC,WAAW,CACnB,CAAC;IACJ,CAAC;;AAGH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF"}

package/dist/src/apiCredentials/serialization.d.ts

@@ -4,148 +4,20 @@
  * This module is separate from base.ts to avoid circular dependencies:
  * service files import base types from base.ts, and this module imports
  * from both base.ts and service files.
+ *
+ * Which credentials can be read back is decided by a list of
+ * {@link ApiCredentialsType}s. {@link BUILTIN_API_CREDENTIALS_TYPES} covers
+ * everything Latchkey ships with and is the default; the CLI passes the
+ * combined built-in and plugin list instead.
  */
-import { z } from 'zod';
-import { type ApiCredentials } from './base.js';
-/**
- * Union schema for all credential types.
- */
-export declare const ApiCredentialsSchema: z.ZodDiscriminatedUnion<"objectType", [z.ZodObject<{
-    objectType: z.ZodLiteral<"authorizationBearer">;
-    token: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "authorizationBearer";
-    token: string;
-}, {
-    objectType: "authorizationBearer";
-    token: string;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"authorizationBare">;
-    token: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "authorizationBare";
-    token: string;
-}, {
-    objectType: "authorizationBare";
-    token: string;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"slack">;
-    token: z.ZodString;
-    dCookie: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "slack";
-    token: string;
-    dCookie: string;
-}, {
-    objectType: "slack";
-    token: string;
-    dCookie: string;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"oauth">;
-    accessToken: z.ZodOptional<z.ZodString>;
-    refreshToken: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    accessTokenExpiresAt: z.ZodOptional<z.ZodString>;
-    refreshTokenExpiresAt: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    objectType: "oauth";
-    clientId: string;
-    clientSecret: string;
-    accessToken?: string | undefined;
-    refreshToken?: string | undefined;
-    accessTokenExpiresAt?: string | undefined;
-    refreshTokenExpiresAt?: string | undefined;
-}, {
-    objectType: "oauth";
-    clientId: string;
-    clientSecret: string;
-    accessToken?: string | undefined;
-    refreshToken?: string | undefined;
-    accessTokenExpiresAt?: string | undefined;
-    refreshTokenExpiresAt?: string | undefined;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"rawCurl">;
-    curlArguments: z.ZodArray<z.ZodString, "many">;
-}, "strip", z.ZodTypeAny, {
-    objectType: "rawCurl";
-    curlArguments: string[];
-}, {
-    objectType: "rawCurl";
-    curlArguments: string[];
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"telegramBot">;
-    token: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "telegramBot";
-    token: string;
-}, {
-    objectType: "telegramBot";
-    token: string;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"aws">;
-    accessKeyId: z.ZodString;
-    secretAccessKey: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "aws";
-    accessKeyId: string;
-    secretAccessKey: string;
-}, {
-    objectType: "aws";
-    accessKeyId: string;
-    secretAccessKey: string;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"googleApiKey">;
-    apiKey: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "googleApiKey";
-    apiKey: string;
-}, {
-    objectType: "googleApiKey";
-    apiKey: string;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"zoomServerToServer">;
-    accountId: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    accessToken: z.ZodOptional<z.ZodString>;
-    accessTokenExpiresAt: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    objectType: "zoomServerToServer";
-    clientId: string;
-    clientSecret: string;
-    accountId: string;
-    accessToken?: string | undefined;
-    accessTokenExpiresAt?: string | undefined;
-}, {
-    objectType: "zoomServerToServer";
-    clientId: string;
-    clientSecret: string;
-    accountId: string;
-    accessToken?: string | undefined;
-    accessTokenExpiresAt?: string | undefined;
-}>, z.ZodObject<{
-    objectType: z.ZodLiteral<"tailscale">;
-    token: z.ZodString;
-    tailnet: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    objectType: "tailscale";
-    token: string;
-    tailnet: string;
-}, {
-    objectType: "tailscale";
-    token: string;
-    tailnet: string;
-}>]>;
-export type ApiCredentialsData = z.infer<typeof ApiCredentialsSchema>;
-/**
- * Deserialize credentials from JSON data.
- */
-export declare function deserializeCredentials(data: ApiCredentialsData): ApiCredentials;
+import { type ApiCredentials, type ApiCredentialsType, type SerializedApiCredentials } from './base.js';
+export declare const BUILTIN_API_CREDENTIALS_TYPES: readonly ApiCredentialsType[];
+export declare function deserializeCredentials(data: unknown, apiCredentialsTypes?: readonly ApiCredentialsType[]): ApiCredentials;
 /**
- * Serialize credentials to JSON data.
+ * Refuses credentials that could not be read back afterwards, so that the
+ * mistake surfaces when they are stored rather than when they are needed.
  */
-export declare function serializeCredentials(credentials: ApiCredentials): ApiCredentialsData;
+export declare function serializeCredentials(credentials: ApiCredentials, apiCredentialsTypes?: readonly ApiCredentialsType[]): SerializedApiCredentials;
 export declare class ApiCredentialsSerializationError extends Error {
     constructor(message: string);
 }

package/dist/src/apiCredentials/serialization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/serialization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,KAAK,cAAc,EASpB,MAAM,WAAW,CAAC;AAWnB;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAW/B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CA6B/E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,cAAc,GAAG,kBAAkB,CAgCpF;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../../src/apiCredentials/serialization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAK9B,MAAM,WAAW,CAAC;AAQnB,eAAO,MAAM,6BAA6B,EAAE,SAAS,kBAAkB,EAWtE,CAAC;AAWF,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,mBAAmB,GAAE,SAAS,kBAAkB,EAAkC,GACjF,cAAc,CAqBhB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,cAAc,EAC3B,mBAAmB,GAAE,SAAS,kBAAkB,EAAkC,GACjF,wBAAwB,CAa1B;AAED,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,OAAO,EAAE,MAAM;CAI5B"}

package/dist/src/apiCredentials/serialization.js

@@ -4,96 +4,68 @@
  * This module is separate from base.ts to avoid circular dependencies:
  * service files import base types from base.ts, and this module imports
  * from both base.ts and service files.
+ *
+ * Which credentials can be read back is decided by a list of
+ * {@link ApiCredentialsType}s. {@link BUILTIN_API_CREDENTIALS_TYPES} covers
+ * everything Latchkey ships with and is the default; the CLI passes the
+ * combined built-in and plugin list instead.
  */
 import { z } from 'zod';
-import { AuthorizationBare, AuthorizationBareSchema, AuthorizationBearer, AuthorizationBearerSchema, OAuthCredentials, OAuthCredentialsSchema, RawCurlCredentials, RawCurlCredentialsSchema, } from './base.js';
-import { AwsCredentials, AwsCredentialsSchema } from '../services/aws.js';
-import { GoogleApiKeyCredentials, GoogleApiKeyCredentialsSchema } from '../services/google/base.js';
-import { SlackApiCredentials, SlackApiCredentialsSchema } from '../services/slack.js';
-import { TelegramBotCredentials, TelegramBotCredentialsSchema } from '../services/telegram.js';
-import { ZoomServerToServerCredentials, ZoomServerToServerCredentialsSchema, } from '../services/zoom.js';
-import { TailscaleCredentials, TailscaleCredentialsSchema } from '../services/tailscale.js';
-/**
- * Union schema for all credential types.
- */
-export const ApiCredentialsSchema = z.discriminatedUnion('objectType', [
-    AuthorizationBearerSchema,
-    AuthorizationBareSchema,
-    SlackApiCredentialsSchema,
-    OAuthCredentialsSchema,
-    RawCurlCredentialsSchema,
-    TelegramBotCredentialsSchema,
-    AwsCredentialsSchema,
-    GoogleApiKeyCredentialsSchema,
-    ZoomServerToServerCredentialsSchema,
-    TailscaleCredentialsSchema,
-]);
-/**
- * Deserialize credentials from JSON data.
- */
-export function deserializeCredentials(data) {
-    switch (data.objectType) {
-        case 'authorizationBearer':
-            return AuthorizationBearer.fromJSON(data);
-        case 'authorizationBare':
-            return AuthorizationBare.fromJSON(data);
-        case 'slack':
-            return SlackApiCredentials.fromJSON(data);
-        case 'oauth':
-            return OAuthCredentials.fromJSON(data);
-        case 'rawCurl':
-            return RawCurlCredentials.fromJSON(data);
-        case 'telegramBot':
-            return TelegramBotCredentials.fromJSON(data);
-        case 'aws':
-            return AwsCredentials.fromJSON(data);
-        case 'googleApiKey':
-            return GoogleApiKeyCredentials.fromJSON(data);
-        case 'zoomServerToServer':
-            return ZoomServerToServerCredentials.fromJSON(data);
-        case 'tailscale':
-            return TailscaleCredentials.fromJSON(data);
-        default: {
-            const exhaustiveCheck = data;
-            throw new ApiCredentialsSerializationError(`Unknown credential type: ${exhaustiveCheck.objectType}`);
-        }
-    }
+import { AuthorizationBare, AuthorizationBearer, OAuthCredentials, RawCurlCredentials, } from './base.js';
+import { AwsCredentials } from '../services/aws.js';
+import { GoogleApiKeyCredentials } from '../services/google/base.js';
+import { SlackApiCredentials } from '../services/slack.js';
+import { TelegramBotCredentials } from '../services/telegram.js';
+import { ZoomServerToServerCredentials } from '../services/zoom.js';
+import { TailscaleCredentials } from '../services/tailscale.js';
+export const BUILTIN_API_CREDENTIALS_TYPES = [
+    AuthorizationBearer,
+    AuthorizationBare,
+    SlackApiCredentials,
+    OAuthCredentials,
+    RawCurlCredentials,
+    TelegramBotCredentials,
+    AwsCredentials,
+    GoogleApiKeyCredentials,
+    ZoomServerToServerCredentials,
+    TailscaleCredentials,
+];
+const OBJECT_TYPE_SCHEMA = z.object({ objectType: z.string() });
+function findApiCredentialsType(objectType, apiCredentialsTypes) {
+    return apiCredentialsTypes.find((type) => type.objectType === objectType);
 }
-/**
- * Serialize credentials to JSON data.
- */
-export function serializeCredentials(credentials) {
-    if (credentials instanceof AuthorizationBearer) {
-        return credentials.toJSON();
+export function deserializeCredentials(data, apiCredentialsTypes = BUILTIN_API_CREDENTIALS_TYPES) {
+    const header = OBJECT_TYPE_SCHEMA.safeParse(data);
+    if (!header.success) {
+        throw new ApiCredentialsSerializationError('Credential data does not name an objectType.');
     }
-    if (credentials instanceof AuthorizationBare) {
-        return credentials.toJSON();
+    const objectType = header.data.objectType;
+    const type = findApiCredentialsType(objectType, apiCredentialsTypes);
+    if (type === undefined) {
+        throw new ApiCredentialsSerializationError(`Unknown credential type '${objectType}'. Credentials of a type defined by a plugin ` +
+            'can only be used while that plugin is installed.');
     }
-    if (credentials instanceof SlackApiCredentials) {
-        return credentials.toJSON();
+    try {
+        return type.fromJSON(data);
     }
-    if (credentials instanceof OAuthCredentials) {
-        return credentials.toJSON();
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new ApiCredentialsSerializationError(`Invalid '${objectType}' credential data: ${message}`);
     }
-    if (credentials instanceof RawCurlCredentials) {
-        return credentials.toJSON();
-    }
-    if (credentials instanceof TelegramBotCredentials) {
-        return credentials.toJSON();
-    }
-    if (credentials instanceof AwsCredentials) {
-        return credentials.toJSON();
-    }
-    if (credentials instanceof GoogleApiKeyCredentials) {
-        return credentials.toJSON();
-    }
-    if (credentials instanceof ZoomServerToServerCredentials) {
-        return credentials.toJSON();
+}
+/**
+ * Refuses credentials that could not be read back afterwards, so that the
+ * mistake surfaces when they are stored rather than when they are needed.
+ */
+export function serializeCredentials(credentials, apiCredentialsTypes = BUILTIN_API_CREDENTIALS_TYPES) {
+    if (credentials.toJSON === undefined) {
+        throw new ApiCredentialsSerializationError(`Credentials of type '${credentials.objectType}' are never stored.`);
     }
-    if (credentials instanceof TailscaleCredentials) {
-        return credentials.toJSON();
+    if (findApiCredentialsType(credentials.objectType, apiCredentialsTypes) === undefined) {
+        throw new ApiCredentialsSerializationError(`Unknown credential type '${credentials.objectType}'. A plugin defining its own ` +
+            "credentials class has to list its type in 'apiCredentialsTypes'.");
     }
-    throw new ApiCredentialsSerializationError(`Unknown credential type: ${credentials.objectType}`);
+    return credentials.toJSON();
 }
 export class ApiCredentialsSerializationError extends Error {
     constructor(message) {