@slkiser/opencode-quota 2.14.0 → 2.16.0

package/README.md

@@ -5,7 +5,7 @@
 - Automatic quota toasts after assistant responses
 - Manual `/quota`, `/pricing_refresh`, and `/tokens_*` commands for deeper local reporting with zero context window pollution
 
-**Quota providers**: Anthropic (Claude), GitHub Copilot, OpenAI (Plus/Pro), Cursor, Qwen Code, Alibaba Coding Plan, MiniMax Coding Plan, Chutes AI, Firmware AI, Google Antigravity, Z.ai coding plan, and NanoGPT.
+**Quota providers**: Anthropic (Claude), GitHub Copilot, OpenAI (Plus/Pro), Cursor, Qwen Code, Alibaba Coding Plan, MiniMax Coding Plan, Chutes AI, Firmware AI, Google Antigravity, Z.ai Coding Plan, NanoGPT, and OpenCode Go.
 
 **Token reports**: All models and providers in [models.dev](https://models.dev), plus deterministic local pricing for Cursor Auto/Composer and Cursor model aliases that are not on models.dev.
 
@@ -76,20 +76,21 @@ That is enough for most installs. Providers are auto-detected from your existing
 
 ### Provider Setup At A Glance
 
-| Provider | Auto setup | How it works |
-| --- | --- | --- |
-| **Anthropic (Claude)** | Needs [quick setup](#anthropic-quick-setup) | Local Claude CLI auth/status probe. |
-| **GitHub Copilot** | Usually | OpenCode auth; PAT only for managed billing. |
-| **OpenAI** | Yes | OpenCode auth. |
-| **Cursor** | Needs [quick setup](#cursor-quick-setup) | Companion auth plugin + `provider.cursor`. |
-| **Qwen Code** | Needs [quick setup](#qwen-code-quick-setup) | Companion auth plugin. |
-| **Alibaba Coding Plan** | Yes | OpenCode auth + local request estimation. |
-| **Firmware AI** | Usually | OpenCode auth, OpenCode config, or env. |
-| **Chutes AI** | Usually | OpenCode auth, OpenCode config, or env. |
-| **NanoGPT** | Usually | OpenCode auth, OpenCode config, or env. |
-| **Google Antigravity** | Needs [quick setup](#google-antigravity-quick-setup) | Companion auth plugin. |
-| **Z.ai** | Yes | OpenCode auth. |
-| **MiniMax Coding Plan** | Yes | OpenCode auth, OpenCode config, or env. |
+| Provider | Auto setup | Authentication | Quota |
+| --- | --- | --- | --- |
+| **Anthropic (Claude)** | Needs [quick setup](#anthropic-quick-setup) | Local CLI auth | Local CLI report |
+| **GitHub Copilot** | Usually | OpenCode auth or PAT | Remote API |
+| **OpenAI** | Yes | OpenCode auth | Remote API |
+| **Cursor** | Needs [quick setup](#cursor-quick-setup) | Companion auth | Local runtime accounting |
+| **Qwen Code** | Needs [quick setup](#qwen-code-quick-setup) | Companion auth | Local estimation |
+| **Alibaba Coding Plan** | Yes | OpenCode auth/global config/env | Local estimation |
+| **Firmware AI** | Usually | OpenCode auth/global config/env | Remote API |
+| **Chutes AI** | Usually | OpenCode auth/global config/env | Remote API |
+| **Google Antigravity** | Needs [quick setup](#google-antigravity-quick-setup) | Companion auth | Remote API |
+| **Z.ai** | Yes | OpenCode auth/global config/env | Remote API |
+| **NanoGPT** | Usually | OpenCode auth/global config/env | Remote API |
+| **MiniMax Coding Plan** | Yes | OpenCode auth/global config/env | Remote API |
+| **OpenCode Go** | Needs [quick setup](#opencode-go-quick-setup) | Env/config auth | Dashboard scraping |
 
 <a id="anthropic-quick-setup"></a>
 <details>
@@ -178,6 +179,37 @@ For behavior details and troubleshooting, see [Qwen Code notes](#qwen-code-notes
 
 </details>
 
+<a id="opencode-go-quick-setup"></a>
+<details>
+<summary><strong>Quick setup: OpenCode Go</strong></summary>
+
+OpenCode Go quota scrapes the OpenCode Go dashboard. It requires a workspace ID and an auth cookie.
+
+**Option A — Environment variables:**
+
+```sh
+export OPENCODE_GO_WORKSPACE_ID="your-workspace-id"
+export OPENCODE_GO_AUTH_COOKIE="your-auth-cookie"
+```
+
+**Option B — Config file** (for example, `~/.config/opencode/opencode-quota/opencode-go.json` on Linux or legacy macOS installs):
+
+```json
+{
+  "workspaceId": "your-workspace-id",
+  "authCookie": "your-auth-cookie"
+}
+```
+
+To find these values:
+
+1. **workspaceId** — Visit [opencode.ai](https://opencode.ai), open your workspace, and copy the workspace ID from the URL: `https://opencode.ai/workspace/<workspaceId>/go`.
+2. **authCookie** — Open your browser DevTools on `opencode.ai`, go to Application → Cookies, and copy the value of the `auth` cookie.
+
+Environment variables take precedence over the config file. Run `/quota_status` to see the exact config paths checked on your machine. For behavior details and troubleshooting, see [OpenCode Go notes](#opencode-go-notes).
+
+</details>
+
 ## Commands
 
 | Command | What it shows |
@@ -257,7 +289,7 @@ Example `copilot-quota-token.json`:
 <details>
 <summary><strong>Cursor</strong></summary>
 
-See [Cursor quick setup](#cursor-quick-setup) for auth. Quota and token reporting stays local to OpenCode history and local pricing data.
+See [Cursor quick setup](#cursor-quick-setup) for companion-plugin OAuth auth. Quota and token reporting stays local to OpenCode history and local pricing data.
 
 - Detects Cursor usage when the provider is `cursor` or the stored/current model id is `cursor/*`.
 - `/tokens_*` maps Cursor API-pool models to official pricing and uses bundled static pricing for `auto` and `composer*`.
@@ -280,6 +312,18 @@ Example override:
 
 </details>
 
+<a id="openai-notes"></a>
+<details>
+<summary><strong>OpenAI</strong></summary>
+
+OpenAI uses native OpenCode OAuth from `auth.json`. The canonical auth family is OpenCode auth, not companion-plugin auth.
+
+- Quota is fetched from the OpenAI usage API using the native OpenCode OAuth token stored under `openai` in `auth.json`.
+- Older OpenCode installs may still have compatible OpenAI OAuth entries under `codex`, `chatgpt`, or `opencode`. Those remain supported for backward compatibility.
+- `/quota_status` includes an `openai` section with the detected auth source, token status, expiry, and account details derived from the token when available.
+
+</details>
+
 <a id="qwen-code-notes"></a>
 <details>
 <summary><strong>Qwen Code</strong></summary>
@@ -287,9 +331,10 @@ Example override:
 See [Qwen Code quick setup](#qwen-code-quick-setup) for auth. Usage is local-only estimation for the free plan; the plugin does not call an Alibaba quota API.
 
 - Free tier limits: `1000` requests per UTC day and `60` requests per rolling minute.
+- The canonical companion auth key is `qwen-code`. Older installs may still use `opencode-qwencode-auth`, which remains a supported fallback.
 - Counters increment on successful question-tool completions while the current model is `qwen-code/*`.
 - State file: `.../opencode/opencode-quota/qwen-local-quota.json`.
-- Check `/quota_status` for auth detection, `qwen_local_plan`, and local counter state.
+- Check `/quota_status` for auth detection, `qwen_oauth_source`, `qwen_local_plan`, and local counter state.
 
 </details>
 
@@ -297,11 +342,14 @@ See [Qwen Code quick setup](#qwen-code-quick-setup) for auth. Usage is local-onl
 <details>
 <summary><strong>Alibaba Coding Plan</strong></summary>
 
-Uses native OpenCode auth from `alibaba` or `alibaba-coding-plan`. Quota is local request-count estimation with rolling windows.
+Alibaba Coding Plan uses trusted env vars or trusted user/global OpenCode config first, then native OpenCode auth from `alibaba-coding-plan` or `alibaba` in `auth.json`. Quota is local request-count estimation with rolling windows.
 
 - `lite`: `1200 / 5h`, `9000 / week`, `18000 / month`
 - `pro`: `6000 / 5h`, `45000 / week`, `90000 / month`
-- If auth omits `tier`, the plugin uses `experimental.quotaToast.alibabaCodingPlanTier`, which defaults to `lite`.
+- API key sources are `ALIBABA_CODING_PLAN_API_KEY`, `ALIBABA_API_KEY`, trusted user/global `provider["alibaba-coding-plan"].options.apiKey` or `provider.alibaba.options.apiKey`, then `auth.json`.
+- Repo-local `opencode.json` / `opencode.jsonc` is ignored for Alibaba secrets.
+- Allowed env templates are limited to `{env:ALIBABA_CODING_PLAN_API_KEY}` and `{env:ALIBABA_API_KEY}`.
+- If auth fallback wins and omits `tier`, or if env/config wins, the plugin uses `experimental.quotaToast.alibabaCodingPlanTier`, which defaults to `lite`.
 - Counters increment on successful question-tool completions while the current model is `alibaba/*` or `alibaba-cn/*`.
 - State file: `.../opencode/opencode-quota/alibaba-coding-plan-local-quota.json`.
 - `/quota_status` shows auth detection, resolved tier, state-file path, and current 5h/weekly/monthly usage.
@@ -325,23 +373,28 @@ Example fallback tier:
 <details>
 <summary><strong>MiniMax Coding Plan</strong></summary>
 
-If OpenCode is already configured with the `minimax-coding-plan` provider and your `auth.json` has a `minimax-coding-plan` entry, quota detection works automatically. No additional plugin is required.
+MiniMax Coding Plan uses trusted env vars or trusted user/global OpenCode config first, then native OpenCode auth from `auth.json["minimax-coding-plan"]`. No additional plugin is required.
 
-The plugin reads `key` first and falls back to `access` from that auth entry. Quota is fetched from the MiniMax API using those stored credentials.
+- `MiniMax-M*` models — rolling 5-hour interval + weekly
+- API key sources are `MINIMAX_CODING_PLAN_API_KEY`, `MINIMAX_API_KEY`, trusted user/global `provider["minimax-coding-plan"].options.apiKey` or `provider.minimax.options.apiKey`, then `auth.json`.
+- Repo-local `opencode.json` / `opencode.jsonc` is ignored for MiniMax secrets.
+- Allowed env templates are limited to `{env:MINIMAX_CODING_PLAN_API_KEY}` and `{env:MINIMAX_API_KEY}`.
+- When `auth.json` fallback wins, the plugin reads `key` first and falls back to `access`.
+- `/quota_status` shows auth detection, API-key diagnostics, live quota state, and endpoint errors
 
-Example `auth.json` entry:
+</details>
 
-```json
-{
-  "minimax-coding-plan": {
-    "type": "api",
-    "key": "YOUR_MINIMAX_API_KEY"
-  }
-}
-```
+<a id="zai-notes"></a>
+<details>
+<summary><strong>Z.ai</strong></summary>
 
-- `MiniMax-M*` models — rolling 5-hour interval + weekly
-- `/quota_status` shows auth detection, API-key diagnostics, live quota state, and endpoint errors
+Z.ai uses trusted env vars or trusted user/global OpenCode config first, then native OpenCode auth from `auth.json["zai-coding-plan"]`.
+
+- API key sources are `ZAI_API_KEY`, `ZAI_CODING_PLAN_API_KEY`, trusted user/global `provider.zai.options.apiKey`, `provider["zai-coding-plan"].options.apiKey`, or `provider.glm.options.apiKey`, then `auth.json`.
+- Repo-local `opencode.json` / `opencode.jsonc` is ignored for Z.ai secrets.
+- Allowed env templates are limited to `{env:ZAI_API_KEY}` and `{env:ZAI_CODING_PLAN_API_KEY}`.
+- `/quota_status` shows auth diagnostics plus live 5-hour, weekly, and MCP quota windows when the Z.ai API reports them.
+- Malformed `zai-coding-plan` fallback auth is surfaced as an auth error instead of being silently treated as missing.
 
 </details>
 
@@ -401,9 +454,10 @@ Example user/global config (`~/.config/opencode/opencode.jsonc` on Linux/macOS):
 <details>
 <summary><strong>Google Antigravity</strong></summary>
 
-See [Google Antigravity quick setup](#google-antigravity-quick-setup). Credentials live under the OpenCode runtime config directory.
+See [Google Antigravity quick setup](#google-antigravity-quick-setup). This companion auth flow does not use `auth.json`; it reads `antigravity-accounts.json` from the OpenCode runtime directories.
 
-If detection looks wrong, `/quota_status` prints the candidate paths checked for `antigravity-accounts.json`.
+- `/quota_status` includes a `google_antigravity` section with the selected accounts path, all present/candidate paths, account counts, valid refresh-token counts, and the Google token-cache path.
+- If detection looks wrong, start with the `google_antigravity` section in `/quota_status`.
 
 </details>
 
@@ -436,6 +490,31 @@ Example user/global config (`~/.config/opencode/opencode.jsonc` on Linux/macOS):
 
 </details>
 
+<a id="opencode-go-notes"></a>
+<details>
+<summary><strong>OpenCode Go</strong></summary>
+
+OpenCode Go quota scrapes the OpenCode Go dashboard at `https://opencode.ai/workspace/<workspaceId>/go` using an `auth` cookie. There is no official usage API yet; the plugin parses the SolidJS SSR hydration output for `monthlyUsage` data.
+
+- **Config sources** (checked in order):
+  1. Environment variables: `OPENCODE_GO_WORKSPACE_ID` and `OPENCODE_GO_AUTH_COOKIE`
+  2. Config file: for example `~/.config/opencode/opencode-quota/opencode-go.json` on Linux or legacy macOS installs, with `{ "workspaceId": "...", "authCookie": "..." }`
+- Environment variables take precedence. Both `workspaceId` and `authCookie` must come from the same source.
+- Quota returns a usage percentage and a reset countdown. There is no absolute request count.
+- `/quota_status` shows an `opencode_go` section with config state, config source, checked paths, and live scrape results or errors.
+- Because this is a scraper, it may break if OpenCode changes their dashboard markup. An official API ([opencode#16513](https://github.com/anomalyco/opencode/pull/16513)) is pending.
+
+**Troubleshooting:**
+
+| Problem | Solution |
+| --- | --- |
+| Config not detected | Confirm `OPENCODE_GO_WORKSPACE_ID` and `OPENCODE_GO_AUTH_COOKIE` are set, then use `/quota_status` to inspect the exact config paths checked on your machine |
+| Incomplete config | Both `workspaceId` and `authCookie` are required; check `/quota_status` for which field is missing |
+| Scrape returns no data | The auth cookie may have expired; get a fresh one from your browser |
+| Dashboard format changed | The SolidJS SSR pattern may have changed; file an issue or wait for the official API |
+
+</details>
+
 ## Configuration Reference
 
 All plugin settings live under `experimental.quotaToast`.

package/dist/index.d.ts

@@ -5,6 +5,11 @@
  *
  * @packageDocumentation
  */
+declare const pluginModule: {
+    id: string;
+    server: import("@opencode-ai/plugin").Plugin;
+};
+export default pluginModule;
 export { QuotaToastPlugin } from "./plugin.js";
 export type { QuotaToastConfig, GoogleModelId, PricingSnapshotSource, CopilotEnterpriseUsageResult, CopilotOrganizationUsageResult, CopilotQuotaResult, GoogleQuotaResult, GoogleModelQuota, MiniMaxResult, MiniMaxResultEntry, } from "./lib/types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,QAAA,MAAM,YAAY;;;CAGQ,CAAC;AAE3B,eAAe,YAAY,CAAC;AAI5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,qBAAqB,EACrB,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,kBAAkB,GACnB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -5,11 +5,17 @@
  *
  * @packageDocumentation
  */
-// Main plugin export - ONLY export plugin functions from the main entry point
-// OpenCode's plugin loader iterates over all exports and calls them as functions
+import { QuotaToastPlugin } from "./plugin.js";
+// V1 plugin format: default export with id + server.
+// This avoids the legacy getLegacyPlugins fallback path in OpenCode's plugin
+// loader, which iterates Object.values(mod) and can conflict with other
+// plugins that also use the legacy path.
+const pluginModule = {
+    id: "@slkiser/opencode-quota",
+    server: QuotaToastPlugin,
+};
+export default pluginModule;
+// Keep the named export for backward compatibility with consumers that import
+// { QuotaToastPlugin } directly.
 export { QuotaToastPlugin } from "./plugin.js";
-// NOTE: tool exports are part of the plugin runtime contract and are not
-// exported from the package entrypoint.
-// NOTE: DEFAULT_CONFIG is NOT exported here because OpenCode's plugin loader
-// would try to call it as a function. Import from "./lib/types.js" directly if needed.
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,iFAAiF;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAgB/C,yEAAyE;AACzE,wCAAwC;AAExC,6EAA6E;AAC7E,uFAAuF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAO/C,qDAAqD;AACrD,6EAA6E;AAC7E,wEAAwE;AACxE,yCAAyC;AACzC,MAAM,YAAY,GAAG;IACnB,EAAE,EAAE,yBAAyB;IAC7B,MAAM,EAAE,gBAAgB;CACA,CAAC;AAE3B,eAAe,YAAY,CAAC;AAE5B,8EAA8E;AAC9E,iCAAiC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib/alibaba-auth.d.ts

@@ -1,5 +1,6 @@
 import type { AlibabaCodingPlanTier, AuthData } from "./types.js";
 export declare const DEFAULT_ALIBABA_AUTH_CACHE_MAX_AGE_MS = 5000;
+export type AlibabaCodingPlanKeySource = "env:ALIBABA_CODING_PLAN_API_KEY" | "env:ALIBABA_API_KEY" | "opencode.json" | "opencode.jsonc" | "auth.json";
 export type ResolvedAlibabaCodingPlanAuth = {
     state: "none";
 } | {
@@ -11,11 +12,35 @@ export type ResolvedAlibabaCodingPlanAuth = {
     error: string;
     rawTier?: string;
 };
+export type AlibabaCodingPlanAuthDiagnostics = {
+    state: "none";
+    source: null;
+    checkedPaths: string[];
+    authPaths: string[];
+} | {
+    state: "configured";
+    source: AlibabaCodingPlanKeySource;
+    checkedPaths: string[];
+    authPaths: string[];
+    tier: AlibabaCodingPlanTier;
+} | {
+    state: "invalid";
+    source: "auth.json";
+    checkedPaths: string[];
+    authPaths: string[];
+    error: string;
+    rawTier?: string;
+};
+export { getGlobalOpencodeConfigCandidatePaths as getOpencodeConfigCandidatePaths } from "./api-key-resolver.js";
 export declare function resolveAlibabaCodingPlanAuth(auth: AuthData | null | undefined, fallbackTier?: AlibabaCodingPlanTier): ResolvedAlibabaCodingPlanAuth;
 export declare function resolveAlibabaCodingPlanAuthCached(params?: {
     maxAgeMs?: number;
     fallbackTier?: AlibabaCodingPlanTier;
 }): Promise<ResolvedAlibabaCodingPlanAuth>;
+export declare function getAlibabaCodingPlanAuthDiagnostics(params?: {
+    maxAgeMs?: number;
+    fallbackTier?: AlibabaCodingPlanTier;
+}): Promise<AlibabaCodingPlanAuthDiagnostics>;
 export declare function hasAlibabaAuth(auth: AuthData | null | undefined): boolean;
 export declare function isAlibabaModelId(model?: string): boolean;
 //# sourceMappingURL=alibaba-auth.d.ts.map

package/dist/lib/alibaba-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alibaba-auth.d.ts","sourceRoot":"","sources":["../../src/lib/alibaba-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,qBAAqB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGnF,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAE3D,MAAM,MAAM,6BAA6B,GACrC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,GACpE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA+C1D,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACjC,YAAY,GAAE,qBAAwD,GACrE,6BAA6B,CAkC/B;AAED,wBAAsB,kCAAkC,CAAC,MAAM,CAAC,EAAE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,qBAAqB,CAAC;CACtC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAKzC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEzE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAIxD"}
+{"version":3,"file":"alibaba-auth.d.ts","sourceRoot":"","sources":["../../src/lib/alibaba-auth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAmB,qBAAqB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAM3D,MAAM,MAAM,0BAA0B,GAClC,iCAAiC,GACjC,qBAAqB,GACrB,eAAe,GACf,gBAAgB,GAChB,WAAW,CAAC;AAEhB,MAAM,MAAM,6BAA6B,GACrC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,GACpE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,gCAAgC,GACxC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,GACD;IACE,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,0BAA0B,CAAC;IACnC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,qBAAqB,CAAC;CAC7B,GACD;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,OAAO,EAAE,qCAAqC,IAAI,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AA+CjH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACjC,YAAY,GAAE,qBAAwD,GACrE,6BAA6B,CAkC/B;AAmDD,wBAAsB,kCAAkC,CAAC,MAAM,CAAC,EAAE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,qBAAqB,CAAC;CACtC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAEzC;AAED,wBAAsB,mCAAmC,CAAC,MAAM,CAAC,EAAE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,qBAAqB,CAAC;CACtC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAmC5C;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEzE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAIxD"}

package/dist/lib/alibaba-auth.js

@@ -1,5 +1,11 @@
-import { readAuthFileCached } from "./opencode-auth.js";
+import { extractProviderOptionsApiKey, getApiKeyCheckedPaths, getFirstAuthEntryRecord, getGlobalOpencodeConfigCandidatePaths, resolveApiKeyFromEnvAndConfig, } from "./api-key-resolver.js";
+import { getAuthPaths, readAuthFileCached } from "./opencode-auth.js";
 export const DEFAULT_ALIBABA_AUTH_CACHE_MAX_AGE_MS = 5_000;
+const ALIBABA_AUTH_KEYS = ["alibaba-coding-plan", "alibaba"];
+const ALIBABA_PROVIDER_KEYS = ["alibaba-coding-plan", "alibaba"];
+const ALLOWED_ALIBABA_ENV_VARS = ["ALIBABA_CODING_PLAN_API_KEY", "ALIBABA_API_KEY"];
+const DEFAULT_ALIBABA_CODING_PLAN_TIER = "lite";
+export { getGlobalOpencodeConfigCandidatePaths as getOpencodeConfigCandidatePaths } from "./api-key-resolver.js";
 function getFirstString(obj, keys) {
     for (const key of keys) {
         const value = obj[key];
@@ -21,12 +27,12 @@ function normalizeAlibabaTier(value) {
         return "pro";
     return null;
 }
-const DEFAULT_ALIBABA_CODING_PLAN_TIER = "lite";
 function getAlibabaAuth(auth) {
-    for (const key of ["alibaba-coding-plan", "alibaba"]) {
-        const alibaba = auth?.[key];
-        if (!alibaba)
+    for (const key of ALIBABA_AUTH_KEYS) {
+        const entry = getFirstAuthEntryRecord(auth, [key]);
+        if (!entry)
             continue;
+        const alibaba = entry;
         const credential = typeof alibaba.key === "string" && alibaba.key.trim()
             ? alibaba.key.trim()
             : typeof alibaba.access === "string" && alibaba.access.trim()
@@ -74,11 +80,79 @@ export function resolveAlibabaCodingPlanAuth(auth, fallbackTier = DEFAULT_ALIBAB
         tier,
     };
 }
+async function resolveAlibabaCodingPlanAuthWithSource(params) {
+    const fallbackTier = params?.fallbackTier ?? DEFAULT_ALIBABA_CODING_PLAN_TIER;
+    const resolvedFromEnvOrConfig = await resolveApiKeyFromEnvAndConfig({
+        envVars: [
+            {
+                name: "ALIBABA_CODING_PLAN_API_KEY",
+                source: "env:ALIBABA_CODING_PLAN_API_KEY",
+            },
+            { name: "ALIBABA_API_KEY", source: "env:ALIBABA_API_KEY" },
+        ],
+        extractFromConfig: (config) => extractProviderOptionsApiKey(config, {
+            providerKeys: ALIBABA_PROVIDER_KEYS,
+            allowedEnvVars: ALLOWED_ALIBABA_ENV_VARS,
+        }),
+        configJsonSource: "opencode.json",
+        configJsoncSource: "opencode.jsonc",
+        getConfigCandidates: getGlobalOpencodeConfigCandidatePaths,
+    });
+    if (resolvedFromEnvOrConfig) {
+        return {
+            auth: {
+                state: "configured",
+                apiKey: resolvedFromEnvOrConfig.key,
+                tier: fallbackTier,
+            },
+            source: resolvedFromEnvOrConfig.source,
+        };
+    }
+    const maxAgeMs = Math.max(0, params?.maxAgeMs ?? DEFAULT_ALIBABA_AUTH_CACHE_MAX_AGE_MS);
+    const authData = await readAuthFileCached({
+        maxAgeMs,
+    });
+    const auth = resolveAlibabaCodingPlanAuth(authData, fallbackTier);
+    return {
+        auth,
+        source: auth.state === "none" ? null : "auth.json",
+    };
+}
 export async function resolveAlibabaCodingPlanAuthCached(params) {
-    const auth = await readAuthFileCached({
-        maxAgeMs: Math.max(0, params?.maxAgeMs ?? DEFAULT_ALIBABA_AUTH_CACHE_MAX_AGE_MS),
+    return (await resolveAlibabaCodingPlanAuthWithSource(params)).auth;
+}
+export async function getAlibabaCodingPlanAuthDiagnostics(params) {
+    const { auth, source } = await resolveAlibabaCodingPlanAuthWithSource(params);
+    const checkedPaths = getApiKeyCheckedPaths({
+        envVarNames: [...ALLOWED_ALIBABA_ENV_VARS],
+        getConfigCandidates: getGlobalOpencodeConfigCandidatePaths,
     });
-    return resolveAlibabaCodingPlanAuth(auth, params?.fallbackTier);
+    const authPaths = getAuthPaths();
+    if (auth.state === "none") {
+        return {
+            state: "none",
+            source: null,
+            checkedPaths,
+            authPaths,
+        };
+    }
+    if (auth.state === "invalid") {
+        return {
+            state: "invalid",
+            source: "auth.json",
+            checkedPaths,
+            authPaths,
+            error: auth.error,
+            rawTier: auth.rawTier,
+        };
+    }
+    return {
+        state: "configured",
+        source: source ?? "auth.json",
+        checkedPaths,
+        authPaths,
+        tier: auth.tier,
+    };
 }
 export function hasAlibabaAuth(auth) {
     return getAlibabaAuth(auth) !== null;

package/dist/lib/alibaba-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"alibaba-auth.js","sourceRoot":"","sources":["../../src/lib/alibaba-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,MAAM,qCAAqC,GAAG,KAAK,CAAC;AAO3D,SAAS,cAAc,CAAC,GAA4B,EAAE,IAAc;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,gCAAgC,GAA0B,MAAM,CAAC;AAEvE,SAAS,cAAc,CAAC,IAAiC;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAU,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,UAAU,GACd,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACpB,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC3D,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;QAEX,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAqB;IACjD,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAW,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAiC,EACjC,eAAsC,gCAAgC;IAEtE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAkC,EAAE;QACjE,MAAM;QACN,UAAU;QACV,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC;YACrC,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,yCAAyC,OAAO,EAAE;YACzD,OAAO;SACR,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC;QACrC,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,MAGxD;IACC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI,qCAAqC,CAAC;KACjF,CAAC,CAAC;IACH,OAAO,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiC;IAC9D,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"alibaba-auth.js","sourceRoot":"","sources":["../../src/lib/alibaba-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,KAAK,CAAC;AAC3D,MAAM,iBAAiB,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAU,CAAC;AACtE,MAAM,qBAAqB,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAU,CAAC;AAC1E,MAAM,wBAAwB,GAAG,CAAC,6BAA6B,EAAE,iBAAiB,CAAU,CAAC;AAC7F,MAAM,gCAAgC,GAA0B,MAAM,CAAC;AAqCvE,OAAO,EAAE,qCAAqC,IAAI,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAEjH,SAAS,cAAc,CAAC,GAA4B,EAAE,IAAc;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAiC;IACvD,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,OAAO,GAAG,KAAwB,CAAC;QAEzC,MAAM,UAAU,GACd,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACnD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACpB,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC3D,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;QAEX,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAqB;IACjD,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAW,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAiC,EACjC,eAAsC,gCAAgC;IAEtE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAkC,EAAE;QACjE,MAAM;QACN,UAAU;QACV,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC;YACrC,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,yCAAyC,OAAO,EAAE;YACzD,OAAO;SACR,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC;QACrC,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sCAAsC,CAAC,MAGrD;IAIC,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,gCAAgC,CAAC;IAC9E,MAAM,uBAAuB,GAAG,MAAM,6BAA6B,CAA6B;QAC9F,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,iCAAiC;aAC1C;YACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,qBAAqB,EAAE;SAC3D;QACD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,4BAA4B,CAAC,MAAM,EAAE;YACnC,YAAY,EAAE,qBAAqB;YACnC,cAAc,EAAE,wBAAwB;SACzC,CAAC;QACJ,gBAAgB,EAAE,eAAe;QACjC,iBAAiB,EAAE,gBAAgB;QACnC,mBAAmB,EAAE,qCAAqC;KAC3D,CAAC,CAAC;IAEH,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE;gBACJ,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,uBAAuB,CAAC,GAAG;gBACnC,IAAI,EAAE,YAAY;aACnB;YACD,MAAM,EAAE,uBAAuB,CAAC,MAAM;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,IAAI,qCAAqC,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;QACxC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,4BAA4B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAElE,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,MAGxD;IACC,OAAO,CAAC,MAAM,sCAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,MAGzD;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,sCAAsC,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,WAAW,EAAE,CAAC,GAAG,wBAAwB,CAAC;QAC1C,mBAAmB,EAAE,qCAAqC;KAC3D,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IAEjC,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,IAAI;YACZ,YAAY;YACZ,SAAS;SACV,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,WAAW;YACnB,YAAY;YACZ,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,MAAM,IAAI,WAAW;QAC7B,YAAY;QACZ,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAiC;IAC9D,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACnF,CAAC"}

package/dist/lib/api-key-resolver.d.ts

@@ -43,8 +43,15 @@ export interface EnvVarDef<Source extends string> {
     name: string;
     source: Source;
 }
-/** Configuration for resolving an API key from multiple sources */
-export interface ResolveApiKeyConfig<Source extends string> {
+export declare function getFirstAuthEntryValue(auth: unknown, authKeys: readonly string[]): unknown;
+export declare function getFirstAuthEntryRecord(auth: unknown, authKeys: readonly string[]): Record<string, unknown> | null;
+export declare function extractProviderOptionsApiKey(config: unknown, params: {
+    providerKeys: readonly string[];
+    allowedEnvVars?: readonly string[];
+}): string | null;
+export declare function extractAuthApiKeyEntry(auth: unknown, authKeys: readonly string[]): string | null;
+/** Configuration for resolving an API key from trusted env/config sources */
+export interface ResolveEnvAndConfigApiKeyConfig<Source extends string> {
     /** Environment variables to check (in order) */
     envVars: EnvVarDef<Source>[];
     /** Extract API key from parsed config object. Returns null if not found. */
@@ -53,19 +60,45 @@ export interface ResolveApiKeyConfig<Source extends string> {
     configJsonSource: Source;
     /** Source label for opencode.jsonc */
     configJsoncSource: Source;
+    /**
+     * Candidate config file paths to trust for provider-secret lookup.
+     *
+     * Defaults to trusted user/global OpenCode config paths only.
+     */
+    getConfigCandidates?: () => ConfigCandidate[];
+}
+/** Configuration for resolving an API key from multiple sources */
+export interface ResolveApiKeyConfig<Source extends string> extends ResolveEnvAndConfigApiKeyConfig<Source> {
     /** Extract API key from auth.json data. Returns null if not found. */
     extractFromAuth: (auth: unknown) => string | null;
     /** Source label for auth.json */
     authSource: Source;
-    /** Candidate config file paths to trust for provider-secret lookup. */
+}
+export interface ApiKeyCheckedPathsConfig {
+    /** Environment variable names to check */
+    envVarNames: string[];
+    /**
+     * Candidate config file paths to report for provider-secret lookup.
+     *
+     * Defaults to trusted user/global OpenCode config paths only.
+     */
     getConfigCandidates?: () => ConfigCandidate[];
 }
+/**
+ * Resolve an API key from trusted env vars and config files.
+ *
+ * Priority (first wins):
+ * 1. Environment variables (in order specified)
+ * 2. Trusted user/global opencode.json/opencode.jsonc candidates
+ */
+export declare function resolveApiKeyFromEnvAndConfig<Source extends string>(config: ResolveEnvAndConfigApiKeyConfig<Source>): Promise<ApiKeyResult<Source> | null>;
+export declare function getApiKeyCheckedPaths(config: ApiKeyCheckedPathsConfig): string[];
 /**
  * Resolve an API key from multiple sources with consistent priority.
  *
  * Priority (first wins):
  * 1. Environment variables (in order specified)
- * 2. opencode.json/opencode.jsonc (local first, then global)
+ * 2. Trusted user/global opencode.json/opencode.jsonc
  * 3. auth.json
  *
  * @returns API key and source, or null if not found

package/dist/lib/api-key-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/api-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,eAAe,EAAE,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,IAAI,eAAe,EAAE,CAUzE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CASrE;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,MAAM;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,SAAS,CAAC,MAAM,SAAS,MAAM;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB,CAAC,MAAM,SAAS,MAAM;IACxD,gDAAgD;IAChD,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAE7B,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;IAEtD,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,sCAAsC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAE1B,sEAAsE;IACtE,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;IAElD,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IAEnB,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,eAAe,EAAE,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,MAAM,SAAS,MAAM,EACvD,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,EACnC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GACtC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAgCtC;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,MAAM;IACtD,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpD,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,MAAM,eAAe,EAAE,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,SAAS,MAAM,EAC9D,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAChC,OAAO,CAAC;IACT,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CAyBD"}
+{"version":3,"file":"api-key-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/api-key-resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,eAAe,EAAE,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,IAAI,eAAe,EAAE,CAUzE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CASrE;AAED,mCAAmC;AACnC,MAAM,WAAW,YAAY,CAAC,MAAM,SAAS,MAAM;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yDAAyD;AACzD,MAAM,WAAW,SAAS,CAAC,MAAM,SAAS,MAAM;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAWT;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAEhC;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;IACN,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACA,MAAM,GAAG,IAAI,CAiBf;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,GAAG,IAAI,CAUf;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B,CAAC,MAAM,SAAS,MAAM;IACpE,gDAAgD;IAChD,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAE7B,4EAA4E;IAC5E,iBAAiB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;IAEtD,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,sCAAsC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,eAAe,EAAE,CAAC;CAC/C;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB,CAAC,MAAM,SAAS,MAAM,CACxD,SAAQ,+BAA+B,CAAC,MAAM,CAAC;IAE/C,sEAAsE;IACtE,eAAe,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;IAElD,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,eAAe,EAAE,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,SAAS,MAAM,EACvE,MAAM,EAAE,+BAA+B,CAAC,MAAM,CAAC,GAC9C,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAuBtC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAiBhF;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,MAAM,SAAS,MAAM,EACvD,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,EACnC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GACtC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CActC;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,MAAM;IACtD,0CAA0C;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpD,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,MAAM,eAAe,EAAE,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,SAAS,MAAM,EAC9D,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAChC,OAAO,CAAC;IACT,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC,CASD"}