@javargasm/opencode-kiro-auth 0.1.0 → 0.2.0

package/dist/kiro-cli-sync.d.ts

@@ -1,16 +1,70 @@
+export type KiroCredentialSource = "kiro-cli-db" | "kiro-sso-cache";
 export interface KiroCliCredentials {
     accessToken: string;
     refreshToken: string;
     clientId?: string;
     clientSecret?: string;
     region: string;
-    authMethod: "idc" | "desktop";
-    email?: string;
     profileArn?: string;
+    authMethod: "idc" | "desktop" | "social" | "builder-id";
+    email?: string;
+    source?: KiroCredentialSource;
+    /** Exact `auth_kv.key` for the imported token row, present for DB imports. */
+    tokenKey?: string;
+}
+export interface AuthKvRow {
+    key: string;
+    value: string;
 }
+export declare function selectKiroTokenRowForWrite(rows: AuthKvRow[], creds: Pick<KiroCliCredentials, "authMethod" | "tokenKey">): AuthKvRow | undefined;
+export declare function sameKiroCliCredential(left: KiroCliCredentials | null, right: KiroCliCredentials | null): boolean;
+/**
+ * Import credentials from Kiro IDE's AWS SSO OIDC cache file.
+ *
+ * Path: `~/.aws/sso/cache/kiro-auth-token.json` (per the AWS SSO OIDC
+ * client spec; AWS CLI and Kiro IDE both write here on successful SSO login).
+ *
+ * The file contains the bearer access token, refresh token, expiry, region,
+ * and the SSO auth method ("IdC", etc.). It does NOT contain the OIDC
+ * clientId/clientSecret — those are stored in Kiro IDE's SQLite DB.
+ *
+ * This is a fallback for when the SQLite read fails (locked, missing,
+ * unreadable) or yields no tokens. Without OIDC client creds, refresh must
+ * go through the desktop endpoint; we set `authMethod: "desktop"` for that
+ * path. The original SSO identity (IdC) is preserved by leaving
+ * `region` and the token values intact.
+ *
+ * Returns null if the file doesn't exist, is unreadable, isn't valid JSON,
+ * or has no token fields. Never throws.
+ */
+export declare function importFromKiroSsoCache(): Promise<KiroCliCredentials | null>;
 /**
- * Import credentials from Kiro CLI DB first, then SSO cache fallback.
- * Returns null if neither source yields valid credentials. Never throws.
+ * Top-level import: try the Kiro IDE SQLite DB first, then fall back to
+ * the AWS SSO cache JSON. The cache is a strictly weaker source (no
+ * OIDC clientId/clientSecret) so the SQLite read is preferred.
+ *
+ * Returns null only when neither path yields valid credentials.
+ * Never throws.
  */
 export declare function importFromKiroCli(): Promise<KiroCliCredentials | null>;
+/**
+ * Attempt to read credentials from Kiro IDE's local database WITHOUT checking
+ * token expiry. This is the last-resort fallback: the access token is probably
+ * stale, but the refresh token might still be valid for one more exchange.
+ *
+ * Returns null if the DB doesn't exist, is unreadable, or has no tokens at all.
+ * Never throws.
+ */
+export declare function getKiroCliCredentialsAllowExpired(exclude?: KiroCliCredentials | null): Promise<KiroCliCredentials | null>;
+/**
+ * Write refreshed credentials back to Kiro CLI's local SQLite database.
+ *
+ * This enables bidirectional sync for credentials originally imported from the
+ * DB. The credential must carry `source: "kiro-cli-db"` and the exact imported
+ * `auth_kv` token key; unrelated token families are never overwritten.
+ *
+ * Never throws — all errors are caught and logged. A failed write-back is
+ * non-fatal; the refreshed token is still valid in memory.
+ */
+export declare function saveKiroCliCredentials(creds: KiroCliCredentials): Promise<boolean>;
 //# sourceMappingURL=kiro-cli-sync.d.ts.map

package/dist/kiro-cli-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kiro-cli-sync.d.ts","sourceRoot":"","sources":["../src/kiro-cli-sync.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,KAAK,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAgND;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAI5E"}
+{"version":3,"file":"kiro-cli-sync.d.ts","sourceRoot":"","sources":["../src/kiro-cli-sync.ts"],"names":[],"mappings":"AA2CA,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AA6PD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,SAAS,EAAE,EACjB,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,UAAU,CAAC,GACzD,SAAS,GAAG,SAAS,CAIvB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,kBAAkB,GAAG,IAAI,EAC/B,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAC/B,OAAO,CAQT;AAqLD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA2CjF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAI5E;AAED;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,CAAC,EAAE,kBAAkB,GAAG,IAAI,GAClC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAQpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CA4FxF"}

package/dist/models.d.ts

@@ -87,12 +87,20 @@ export interface KiroApiModel {
         };
     };
 }
+export declare function resetProfileArnCache(skipResolution?: boolean): void;
+export declare function seedProfileArn(arn: string): void;
+/**
+ * Resolve the Kiro profile ARN by calling ListAvailableProfiles.
+ * Builder ID device-code login doesn't receive a profileArn, so we
+ * discover it here. Returns null on failure (graceful fallback).
+ */
+export declare function resolveProfileArn(accessToken: string, apiRegion: string): Promise<string | null>;
 /**
  * Fetch the list of models actually available for this account from Kiro.
  * Filters out "auto" — it appears in ListAvailableModels but is rejected
  * by GenerateAssistantResponse with INVALID_MODEL_ID.
  */
-export declare function fetchAvailableModels(accessToken: string, apiRegion: string, fallbackProfileArn?: string): Promise<KiroApiModel[]>;
+export declare function fetchAvailableModels(accessToken: string, apiRegion: string, profileArn: string): Promise<KiroApiModel[]>;
 /**
  * Build pi model definitions from the Kiro ListAvailableModels API response.
  * Adds any new model IDs dynamically to KIRO_MODEL_IDS so resolveKiroModel passes.

package/dist/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAQA,gEAAgE;AAChE,eAAO,MAAM,cAAc,aAuBzB,CAAC;AAGH,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMxD;AA8BD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtE;AAaD,KAAK,KAAK,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;AAIlC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,UAAU,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iEAAiE;IACjE,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,eAAO,MAAM,UAAU,EAAE,SAAS,EAwNjC,CAAC;AAIF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,kCAAkC,CAAC,EAAE;QACnC,UAAU,CAAC,EAAE;YACX,aAAa,CAAC,EAAE;gBAAE,UAAU,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE;wBAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;qBAAE,CAAA;iBAAE,CAAA;aAAE,CAAC;YAClE,QAAQ,CAAC,EAAE;gBAAE,UAAU,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE;wBAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;qBAAE,CAAA;iBAAE,CAAA;aAAE,CAAC;SAC5D,CAAC;KACH,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,YAAY,EAAE,CAAC,CA0BzB;AAqBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,CAkCzE;AAKD,wBAAgB,sBAAsB,IAAI,SAAS,EAAE,GAAG,IAAI,CAE3D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,GAAG,IAAI,CAEvE"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAOA,gEAAgE;AAChE,eAAO,MAAM,cAAc,aAuBzB,CAAC;AAGH,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMxD;AA8BD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtE;AAaD,KAAK,KAAK,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;AAIlC,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,UAAU,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iEAAiE;IACjE,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,eAAO,MAAM,UAAU,EAAE,SAAS,EAwNjC,CAAC;AAIF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,kCAAkC,CAAC,EAAE;QACnC,UAAU,CAAC,EAAE;YACX,aAAa,CAAC,EAAE;gBAAE,UAAU,CAAC,EAAE;oBAAE,MAAM,CAAC,EAAE;wBAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;qBAAE,CAAA;iBAAE,CAAA;aAAE,CAAC;YAClE,QAAQ,CAAC,EAAE;gBAAE,UAAU,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE;wBAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;qBAAE,CAAA;iBAAE,CAAA;aAAE,CAAC;SAC5D,CAAC;KACH,CAAC;CACH;AAKD,wBAAgB,oBAAoB,CAAC,cAAc,UAAQ,GAAG,IAAI,CAGjE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEhD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAiBzB;AAqBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,CAkCzE;AAKD,wBAAgB,sBAAsB,IAAI,SAAS,EAAE,GAAG,IAAI,CAE3D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,GAAG,IAAI,CAEvE"}

package/dist/oauth.d.ts

@@ -12,7 +12,7 @@ export interface KiroCredentials {
     clientId: string;
     clientSecret: string;
     region: string;
-    authMethod: "builder-id" | "idc" | "desktop";
+    authMethod: "builder-id" | "idc" | "desktop" | "social";
 }
 export interface DeviceAuthResponse {
     verificationUri: string;
@@ -37,10 +37,40 @@ export declare function tryRegisterAndAuthorize(startUrl: string, region: string
     devAuth: DeviceAuthResponse;
 } | null>;
 export declare function pollForToken(oidcEndpoint: string, clientId: string, clientSecret: string, devAuth: DeviceAuthResponse, signal: AbortSignal | undefined): Promise<TokenResponse>;
-export declare function refreshKiroToken(refreshTokenPacked: string, region: string, authMethod: "builder-id" | "idc" | "desktop"): Promise<{
+export declare function refreshKiroToken(refreshTokenPacked: string, region: string, authMethod: "builder-id" | "idc" | "desktop" | "social"): Promise<{
     access: string;
     refresh: string;
     expires: number;
 }>;
+/**
+ * Run the full social (Builder ID) sign-in flow.
+ *
+ * 1. Generate PKCE verifier + challenge.
+ * 2. Start localhost callback server on port 49153.
+ * 3. Return the sign-in URL for the caller to redirect the browser to.
+ * 4. Wait for the OAuth callback with the authorization code.
+ * 5. Exchange the code for tokens via Kiro's desktop auth endpoint.
+ * 6. Fetch and cache dynamic models if profileArn is returned.
+ *
+ * If Kiro portal detects an enterprise (IdC) account, it redirects with
+ * `login_option=awsidc` instead of a code. In that case, the callback
+ * server shows the IdC delegation page and the flow transparently
+ * switches to a device-code flow for IdC.
+ *
+ * Returns the sign-in URL immediately and a promise that resolves with the
+ * credentials once the flow completes (regardless of social or IdC path).
+ */
+export declare function startSocialLogin(): Promise<{
+    signInUrl: string;
+    waitForCredentials: () => Promise<{
+        accessToken: string;
+        refreshToken: string;
+        refreshPacked: string;
+        profileArn?: string;
+        region: string;
+        authMethod: "social" | "idc";
+        expiresAt: number;
+    }>;
+}>;
 export {};
 //# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,oBAAoB,mCAAmC,CAAC;AACrE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAC7C,eAAO,MAAM,UAAU,UAMtB,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,UAW7B,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,QAAgB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,YAAY,GAAG,KAAK,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,UAAU,aAAa;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9E;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,kBAAkB,CAAC;CAC7B,GAAG,IAAI,CAAC,CAkCR;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAED,wBAAsB,gBAAgB,CACpC,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,YAAY,GAAG,KAAK,GAAG,SAAS,GAC3C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6D/D"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,oBAAoB,mCAAmC,CAAC;AACrE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAC7C,eAAO,MAAM,UAAU,UAMtB,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,UAW7B,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,QAAgB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;CACzD;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,UAAU,aAAa;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9E;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,kBAAkB,CAAC;CAC7B,GAAG,IAAI,CAAC,CAkCR;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAED,wBAAsB,gBAAgB,CACpC,kBAAkB,EAAE,MAAM,EAC1B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GACtD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAgG/D;AAuXD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,OAAO,CAAC;QAChC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ,CAAC,CA8ID"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AA2BlC,wBAAgB,aAAa,IAAI,MAAM,CAA0C;AAEjF,kDAAkD;AAClD,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuCrD;AAsBD,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAc,QAQnE;AAwBD,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAobzE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AA2BlC,wBAAgB,aAAa,IAAI,MAAM,CAA0C;AAEjF,kDAAkD;AAClD,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA+DrD;AAsBD,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,SAAc,QAQnE;AAwBD,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAU,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CA8dzE"}

package/dist/stream.d.ts

@@ -9,21 +9,5 @@ import { AssistantMessageEventStream } from "./types";
  * time.
  */
 export declare const HIDDEN_REASONING_COUNTDOWN_MS = 2000;
-/**
- * Reset cache state. Pass `skipResolution: true` to disable profileArn lookup
- * entirely (useful for tests that don't mock ListAvailableProfiles).
- * Production code should never pass true — cache is reset on logout/refresh
- * without disabling resolution.
- */
-export declare function resetProfileArnCache(skipResolution?: boolean): void;
-/**
- * Pre-seed the profileArn cache for a given endpoint. When set,
- * `resolveProfileArn` returns the seeded value without hitting the
- * management endpoint. Use this to inject a known profileArn from
- * external sources (e.g. Kiro CLI auth.json) as a fallback when the
- * management API returns 400.
- */
-export declare function seedProfileArn(endpoint: string, arn: string): void;
-export declare function resolveProfileArn(accessToken: string, endpoint: string): Promise<string | undefined>;
 export declare function streamKiro(model: Model<Api>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream;
 //# sourceMappingURL=stream.d.ts.map

package/dist/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../src/stream.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,GAAG,EAEH,OAAO,EAEP,KAAK,EACL,mBAAmB,EAKpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,2BAA2B,EAAiB,MAAM,SAAS,CAAC;AA6FrE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAgDlD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,UAAQ,GAAG,IAAI,CAGjE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAElE;AAED,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuC1G;AA2DD,wBAAgB,UAAU,CACxB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,2BAA2B,CAg0B7B"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../src/stream.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,GAAG,EAEH,OAAO,EAEP,KAAK,EACL,mBAAmB,EAKpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,2BAA2B,EAAiB,MAAM,SAAS,CAAC;AA6FrE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAkGlD,wBAAgB,UAAU,CACxB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,2BAA2B,CAm0B7B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@javargasm/opencode-kiro-auth",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Kiro provider plugin for OpenCode: AWS Builder ID / Identity Center login and OpenAI compatible local gateway for CodeWhisperer streaming.",
   "type": "module",
   "license": "MIT",
@@ -45,9 +45,10 @@
     "build:types": "tsc -p tsconfig.build.json",
     "build": "bun run clean && bun run build:js && bun run build:types",
     "typecheck": "tsc --noEmit",
-    "test": "bun test",
-    "test:watch": "bun test --watch",
-    "check": "bun run typecheck && bun run test",
+    "test": "vitest run",
+    "test:bun": "bun test test/gateway.test.ts",
+    "test:watch": "vitest",
+    "check": "bun run typecheck && bun run test && bun run test:bun",
     "changeset": "changeset",
     "version": "changeset version",
     "prepack": "bun run build",