@vymalo/opencode-oauth2 0.11.0 → 0.14.0

package/dist/cache.d.ts

@@ -2,10 +2,10 @@ import type { Logger } from "./logging.js";
 import type { CachedServerState } from "./types.js";
 export declare function resolveCacheDir(namespace: string): string;
 export declare class FileCacheStore {
-    private readonly baseDir;
-    private readonly logger?;
-    constructor(baseDir: string, logger?: Logger | undefined);
-    ensureReady(): Promise<void>;
-    loadServerState(serverId: string): Promise<CachedServerState | undefined>;
-    saveServerState(state: CachedServerState): Promise<void>;
+	private readonly baseDir;
+	private readonly logger?;
+	constructor(baseDir: string, logger?: Logger | undefined);
+	ensureReady(): Promise<void>;
+	loadServerState(serverId: string): Promise<CachedServerState | undefined>;
+	saveServerState(state: CachedServerState): Promise<void>;
 }

package/dist/cache.js

@@ -4,117 +4,113 @@ import { randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 function resolveDefaultCacheRoot() {
-    if (process.platform === "win32") {
-        return process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local");
-    }
-    if (process.platform === "darwin") {
-        return join(homedir(), "Library", "Caches");
-    }
-    return process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
+	if (process.platform === "win32") {
+		return process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local");
+	}
+	if (process.platform === "darwin") {
+		return join(homedir(), "Library", "Caches");
+	}
+	return process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
 }
 export function resolveCacheDir(namespace) {
-    return join(resolveDefaultCacheRoot(), "opencode-oauth2", namespace);
+	return join(resolveDefaultCacheRoot(), "opencode-oauth2", namespace);
 }
 function statePath(baseDir, serverId) {
-    return join(baseDir, `${serverId}.json`);
+	return join(baseDir, `${serverId}.json`);
 }
 function hasValidTokenShape(token) {
-    if (!token || typeof token !== "object" || Array.isArray(token)) {
-        return false;
-    }
-    const candidate = token;
-    if (typeof candidate.accessToken !== "string" ||
-        candidate.accessToken.length === 0 ||
-        typeof candidate.tokenType !== "string" ||
-        candidate.tokenType.length === 0) {
-        return false;
-    }
-    // refreshToken is optional: client_credentials grant never returns one.
-    // When present, it must be a non-empty string.
-    if (candidate.refreshToken !== undefined) {
-        return typeof candidate.refreshToken === "string" && candidate.refreshToken.length > 0;
-    }
-    return true;
+	if (!token || typeof token !== "object" || Array.isArray(token)) {
+		return false;
+	}
+	const candidate = token;
+	if (typeof candidate.accessToken !== "string" || candidate.accessToken.length === 0 || typeof candidate.tokenType !== "string" || candidate.tokenType.length === 0) {
+		return false;
+	}
+	// refreshToken is optional: client_credentials grant never returns one.
+	// When present, it must be a non-empty string.
+	if (candidate.refreshToken !== undefined) {
+		return typeof candidate.refreshToken === "string" && candidate.refreshToken.length > 0;
+	}
+	return true;
 }
 export class FileCacheStore {
-    baseDir;
-    logger;
-    constructor(baseDir, logger) {
-        this.baseDir = baseDir;
-        this.logger = logger;
-    }
-    async ensureReady() {
-        await mkdir(this.baseDir, { recursive: true, mode: 0o700 });
-    }
-    async loadServerState(serverId) {
-        const filePath = statePath(this.baseDir, serverId);
-        try {
-            const content = await readFile(filePath, "utf8");
-            const parsed = JSON.parse(content);
-            if (!parsed || parsed.serverId !== serverId) {
-                return undefined;
-            }
-            if (!Array.isArray(parsed.models) || !Array.isArray(parsed.rawModels)) {
-                return undefined;
-            }
-            if (parsed.token && !hasValidTokenShape(parsed.token)) {
-                this.logger?.trace("oauth2_cache_token_dropped_invalid_shape", { serverId });
-                parsed.token = undefined;
-            }
-            this.logger?.trace("oauth2_cache_file_read", {
-                serverId,
-                modelCount: Array.isArray(parsed.models) ? parsed.models.length : 0,
-                hasToken: Boolean(parsed.token)
-            });
-            return parsed;
-        }
-        catch (error) {
-            if (typeof error === "object" &&
-                error &&
-                "code" in error &&
-                error.code === "ENOENT") {
-                this.logger?.trace("oauth2_cache_file_missing", { serverId });
-                return undefined;
-            }
-            throw error;
-        }
-    }
-    async saveServerState(state) {
-        const filePath = statePath(this.baseDir, state.serverId);
-        // Unique per-write temp name. A shared `${filePath}.tmp` collides when
-        // several opencode instances boot at once (the desktop app restores every
-        // project window in parallel) and all sync the same provider: one process'
-        // rename consumes the temp file the other is about to rename, surfacing as
-        // `sync_failed … ENOENT … rename '<serverId>.json.tmp' -> '<serverId>.json'`.
-        // pid + uuid makes each writer's temp file private; rename stays atomic so
-        // last-writer-wins on the final path. See docs/troubleshooting.md.
-        const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
-        await mkdir(dirname(filePath), { recursive: true, mode: 0o700 });
-        const serialized = JSON.stringify(state, null, 2);
-        try {
-            await writeFile(tempPath, serialized, {
-                encoding: "utf8",
-                mode: 0o600,
-                flag: fsConstants.O_CREAT | fsConstants.O_TRUNC | fsConstants.O_WRONLY
-            });
-            await rename(tempPath, filePath);
-            this.logger?.trace("oauth2_cache_file_written", {
-                serverId: state.serverId,
-                modelCount: Array.isArray(state.models) ? state.models.length : 0,
-                hasToken: Boolean(state.token)
-            });
-        }
-        catch (error) {
-            // Best-effort cleanup so a failed write never strands an orphan temp file.
-            await unlink(tempPath).catch(() => { });
-            throw error;
-        }
-        try {
-            await chmod(filePath, 0o600);
-        }
-        catch {
-            // Some filesystems may ignore chmod semantics; keep operation non-fatal.
-        }
-    }
+	baseDir;
+	logger;
+	constructor(baseDir, logger) {
+		this.baseDir = baseDir;
+		this.logger = logger;
+	}
+	async ensureReady() {
+		await mkdir(this.baseDir, {
+			recursive: true,
+			mode: 448
+		});
+	}
+	async loadServerState(serverId) {
+		const filePath = statePath(this.baseDir, serverId);
+		try {
+			const content = await readFile(filePath, "utf8");
+			const parsed = JSON.parse(content);
+			if (!parsed || parsed.serverId !== serverId) {
+				return undefined;
+			}
+			if (!Array.isArray(parsed.models) || !Array.isArray(parsed.rawModels)) {
+				return undefined;
+			}
+			if (parsed.token && !hasValidTokenShape(parsed.token)) {
+				this.logger?.trace("oauth2_cache_token_dropped_invalid_shape", { serverId });
+				parsed.token = undefined;
+			}
+			this.logger?.trace("oauth2_cache_file_read", {
+				serverId,
+				modelCount: Array.isArray(parsed.models) ? parsed.models.length : 0,
+				hasToken: Boolean(parsed.token)
+			});
+			return parsed;
+		} catch (error) {
+			if (typeof error === "object" && error && "code" in error && error.code === "ENOENT") {
+				this.logger?.trace("oauth2_cache_file_missing", { serverId });
+				return undefined;
+			}
+			throw error;
+		}
+	}
+	async saveServerState(state) {
+		const filePath = statePath(this.baseDir, state.serverId);
+		// Unique per-write temp name. A shared `${filePath}.tmp` collides when
+		// several opencode instances boot at once (the desktop app restores every
+		// project window in parallel) and all sync the same provider: one process'
+		// rename consumes the temp file the other is about to rename, surfacing as
+		// `sync_failed … ENOENT … rename '<serverId>.json.tmp' -> '<serverId>.json'`.
+		// pid + uuid makes each writer's temp file private; rename stays atomic so
+		// last-writer-wins on the final path. See docs/troubleshooting.md.
+		const tempPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+		await mkdir(dirname(filePath), {
+			recursive: true,
+			mode: 448
+		});
+		const serialized = JSON.stringify(state, null, 2);
+		try {
+			await writeFile(tempPath, serialized, {
+				encoding: "utf8",
+				mode: 384,
+				flag: fsConstants.O_CREAT | fsConstants.O_TRUNC | fsConstants.O_WRONLY
+			});
+			await rename(tempPath, filePath);
+			this.logger?.trace("oauth2_cache_file_written", {
+				serverId: state.serverId,
+				modelCount: Array.isArray(state.models) ? state.models.length : 0,
+				hasToken: Boolean(state.token)
+			});
+		} catch (error) {
+			// Best-effort cleanup so a failed write never strands an orphan temp file.
+			await unlink(tempPath).catch(() => {});
+			throw error;
+		}
+		try {
+			await chmod(filePath, 384);
+		} catch {}
+	}
 }
+
 //# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKlC,SAAS,uBAAuB;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,IAAI,CAAC,uBAAuB,EAAE,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,QAAgB;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IACE,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAClC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAc;IAEN;IACA;IAFnB,YACmB,OAAe,EACf,MAAe;QADf,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;YAExD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,0CAA0C,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7E,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;YAC3B,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,wBAAwB,EAAE;gBAC3C,QAAQ;gBACR,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK;gBACL,MAAM,IAAI,KAAK;gBACd,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAC7C,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAwB;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,2EAA2E;QAC3E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QAElE,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE;gBACpC,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ;aACvE,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,2BAA2B,EAAE;gBAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2EAA2E;YAC3E,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}
+{"mappings":"AAAA,SAAS,OAAO,OAAO,UAAU,QAAQ,QAAQ,iBAAiB;AAClE,SAAS,aAAa,mBAAmB;AACzC,SAAS,kBAAkB;AAC3B,SAAS,SAAS,YAAY;AAC9B,SAAS,eAAe;AAKxB,SAAS,0BAAkC;CACzC,IAAI,QAAQ,aAAa,SAAS;EAChC,OAAO,QAAQ,IAAI,gBAAgB,KAAK,QAAQ,GAAG,WAAW,OAAO;CACvE;CAEA,IAAI,QAAQ,aAAa,UAAU;EACjC,OAAO,KAAK,QAAQ,GAAG,WAAW,QAAQ;CAC5C;CAEA,OAAO,QAAQ,IAAI,kBAAkB,KAAK,QAAQ,GAAG,QAAQ;AAC/D;AAEA,OAAO,SAAS,gBAAgB,WAA2B;CACzD,OAAO,KAAK,wBAAwB,GAAG,mBAAmB,SAAS;AACrE;AAEA,SAAS,UAAU,SAAiB,UAA0B;CAC5D,OAAO,KAAK,SAAS,GAAG,SAAS,MAAM;AACzC;AAEA,SAAS,mBAAmB,OAAyB;CACnD,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;EAC/D,OAAO;CACT;CAEA,MAAM,YAAY;CAClB,IACE,OAAO,UAAU,gBAAgB,YACjC,UAAU,YAAY,WAAW,KACjC,OAAO,UAAU,cAAc,YAC/B,UAAU,UAAU,WAAW,GAC/B;EACA,OAAO;CACT;;;CAIA,IAAI,UAAU,iBAAiB,WAAW;EACxC,OAAO,OAAO,UAAU,iBAAiB,YAAY,UAAU,aAAa,SAAS;CACvF;CACA,OAAO;AACT;AAEA,OAAO,MAAM,eAAe;CAEP;CACA;CAFnB,YACE,AAAiB,SACjB,AAAiB,QACjB;EAFiB;EACA;CAChB;CAEH,MAAM,cAA6B;EACjC,MAAM,MAAM,KAAK,SAAS;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;CAC5D;CAEA,MAAM,gBAAgB,UAA0D;EAC9E,MAAM,WAAW,UAAU,KAAK,SAAS,QAAQ;EAEjD,IAAI;GACF,MAAM,UAAU,MAAM,SAAS,UAAU,MAAM;GAC/C,MAAM,SAAS,KAAK,MAAM,OAAO;GAEjC,IAAI,CAAC,UAAU,OAAO,aAAa,UAAU;IAC3C,OAAO;GACT;GAEA,IAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,SAAS,GAAG;IACrE,OAAO;GACT;GAEA,IAAI,OAAO,SAAS,CAAC,mBAAmB,OAAO,KAAK,GAAG;IACrD,KAAK,QAAQ,MAAM,4CAA4C,EAAE,SAAS,CAAC;IAC3E,OAAO,QAAQ;GACjB;GAEA,KAAK,QAAQ,MAAM,0BAA0B;IAC3C;IACA,YAAY,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,OAAO,SAAS;IAClE,UAAU,QAAQ,OAAO,KAAK;GAChC,CAAC;GACD,OAAO;EACT,SAAS,OAAO;GACd,IACE,OAAO,UAAU,YACjB,SACA,UAAU,SACT,MAA2B,SAAS,UACrC;IACA,KAAK,QAAQ,MAAM,6BAA6B,EAAE,SAAS,CAAC;IAC5D,OAAO;GACT;GACA,MAAM;EACR;CACF;CAEA,MAAM,gBAAgB,OAAyC;EAC7D,MAAM,WAAW,UAAU,KAAK,SAAS,MAAM,QAAQ;;;;;;;;EAQvD,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;EAE5D,MAAM,MAAM,QAAQ,QAAQ,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAE/D,MAAM,aAAa,KAAK,UAAU,OAAO,MAAM,CAAC;EAChD,IAAI;GACF,MAAM,UAAU,UAAU,YAAY;IACpC,UAAU;IACV,MAAM;IACN,MAAM,YAAY,UAAU,YAAY,UAAU,YAAY;GAChE,CAAC;GACD,MAAM,OAAO,UAAU,QAAQ;GAC/B,KAAK,QAAQ,MAAM,6BAA6B;IAC9C,UAAU,MAAM;IAChB,YAAY,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,OAAO,SAAS;IAChE,UAAU,QAAQ,MAAM,KAAK;GAC/B,CAAC;EACH,SAAS,OAAO;;GAEd,MAAM,OAAO,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC;GACrC,MAAM;EACR;EAEA,IAAI;GACF,MAAM,MAAM,UAAU,GAAK;EAC7B,QAAQ,CAER;CACF;AACF","names":[],"sources":["../src/cache.ts"],"version":3,"file":"cache.js","sourceRoot":""}

package/dist/config.d.ts

@@ -1,128 +1,128 @@
 import type { LogLevel } from "./logging.js";
 export declare const DEFAULT_SYNC_INTERVAL_MINUTES = 60;
-export declare const DEFAULT_HTTP_TIMEOUT_MS = 15000;
-export declare const DEFAULT_TOKEN_EXPIRY_SKEW_MS = 30000;
+export declare const DEFAULT_HTTP_TIMEOUT_MS = 15e3;
+export declare const DEFAULT_TOKEN_EXPIRY_SKEW_MS = 3e4;
 export declare const DEFAULT_LOG_LEVEL: LogLevel;
 export type OAuthAuthFlow = "authorization_code" | "device_code" | "client_credentials" | "jwt_bearer" | "token_exchange";
 export declare const DEFAULT_AUTH_FLOW: OAuthAuthFlow;
 /**
- * Where to read the platform-supplied JWT that the plugin presents as the
- * subject token / assertion for the `jwt_bearer` and `token_exchange` flows.
- *
- * - `github_actions` — fetches the OIDC token from the GitHub Actions runtime
- *   via `ACTIONS_ID_TOKEN_REQUEST_URL` + `ACTIONS_ID_TOKEN_REQUEST_TOKEN`,
- *   with the workflow-declared `audience`. The `id-token: write` permission
- *   is required on the job.
- * - `kubernetes_sa` — reads a projected service-account token from the pod
- *   filesystem. Default path `/var/run/secrets/tokens/oauth2/token`; mount a
- *   `projected.sources.serviceAccountToken` volume with the OIDC issuer as
- *   the audience.
- * - `file` — reads any JWT from disk. Useful when an external sidecar
- *   refreshes the token to a fixed path.
- * - `env` — reads the JWT from a named environment variable. Mostly useful
- *   for tests and ad-hoc shells.
- */
+* Where to read the platform-supplied JWT that the plugin presents as the
+* subject token / assertion for the `jwt_bearer` and `token_exchange` flows.
+*
+* - `github_actions` — fetches the OIDC token from the GitHub Actions runtime
+*   via `ACTIONS_ID_TOKEN_REQUEST_URL` + `ACTIONS_ID_TOKEN_REQUEST_TOKEN`,
+*   with the workflow-declared `audience`. The `id-token: write` permission
+*   is required on the job.
+* - `kubernetes_sa` — reads a projected service-account token from the pod
+*   filesystem. Default path `/var/run/secrets/tokens/oauth2/token`; mount a
+*   `projected.sources.serviceAccountToken` volume with the OIDC issuer as
+*   the audience.
+* - `file` — reads any JWT from disk. Useful when an external sidecar
+*   refreshes the token to a fixed path.
+* - `env` — reads the JWT from a named environment variable. Mostly useful
+*   for tests and ad-hoc shells.
+*/
 export type SubjectTokenSource = {
-    type: "github_actions";
-    audience: string;
+	type: "github_actions";
+	audience: string;
 } | {
-    type: "kubernetes_sa";
-    tokenPath?: string;
+	type: "kubernetes_sa";
+	tokenPath?: string;
 } | {
-    type: "file";
-    path: string;
+	type: "file";
+	path: string;
 } | {
-    type: "env";
-    var: string;
+	type: "env";
+	var: string;
 };
 export declare const DEFAULT_K8S_SA_TOKEN_PATH = "/var/run/secrets/tokens/oauth2/token";
 export interface OAuthServerConfigInput {
-    id: string;
-    name?: string;
-    issuer: string;
-    baseURL: string;
-    clientId: string;
-    clientSecret?: string;
-    scopes: string[];
-    syncIntervalMinutes?: number;
-    nameOverrides?: Record<string, string>;
-    authorizationEndpoint?: string;
-    tokenEndpoint?: string;
-    deviceAuthorizationEndpoint?: string;
-    jwksUri?: string;
-    redirectPort?: number;
-    authFlow?: OAuthAuthFlow;
-    /**
-     * Send PKCE (RFC 7636) on the interactive `authorization_code` and
-     * `device_code` flows: `code_challenge` + `code_challenge_method=S256` on the
-     * authorization/device request, and the matching `code_verifier` on the token
-     * exchange. Defaults to `true` — PKCE is recommended for public clients and
-     * is silently ignored by servers that don't require it, so leave it on unless
-     * a non-compliant IdP rejects the extra parameters. Has no effect on the
-     * machine flows (`client_credentials`, `jwt_bearer`, `token_exchange`).
-     */
-    pkce?: boolean;
-    /**
-     * Required for `jwt_bearer` and `token_exchange`. Tells the plugin where to
-     * read the platform JWT it should present as the subject token.
-     */
-    subjectTokenSource?: SubjectTokenSource;
-    /**
-     * Optional `audience` parameter for the `token_exchange` grant — the
-     * intended recipient of the resulting access token. Set this when the
-     * OAuth server expects an explicit audience claim distinct from the
-     * issuer.
-     */
-    tokenExchangeAudience?: string;
-    /**
-     * Route inference through the OpenAI **Responses API** (`/v1/responses`)
-     * instead of Chat Completions (`/v1/chat/completions`). When `true` the
-     * managed provider is registered with `npm: "@ai-sdk/openai"` (whose default
-     * `languageModel()` targets Responses since AI SDK v5) rather than
-     * `@ai-sdk/openai-compatible`. Only enable it when the gateway implements the
-     * OpenAI Responses contract. Defaults to `false`. This flag affects provider
-     * registration only — it never touches the token lifecycle, so it is read at
-     * the config-synthesis layer and not part of the validated runtime config.
-     */
-    responseApi?: boolean;
+	id: string;
+	name?: string;
+	issuer: string;
+	baseURL: string;
+	clientId: string;
+	clientSecret?: string;
+	scopes: string[];
+	syncIntervalMinutes?: number;
+	nameOverrides?: Record<string, string>;
+	authorizationEndpoint?: string;
+	tokenEndpoint?: string;
+	deviceAuthorizationEndpoint?: string;
+	jwksUri?: string;
+	redirectPort?: number;
+	authFlow?: OAuthAuthFlow;
+	/**
+	* Send PKCE (RFC 7636) on the interactive `authorization_code` and
+	* `device_code` flows: `code_challenge` + `code_challenge_method=S256` on the
+	* authorization/device request, and the matching `code_verifier` on the token
+	* exchange. Defaults to `true` — PKCE is recommended for public clients and
+	* is silently ignored by servers that don't require it, so leave it on unless
+	* a non-compliant IdP rejects the extra parameters. Has no effect on the
+	* machine flows (`client_credentials`, `jwt_bearer`, `token_exchange`).
+	*/
+	pkce?: boolean;
+	/**
+	* Required for `jwt_bearer` and `token_exchange`. Tells the plugin where to
+	* read the platform JWT it should present as the subject token.
+	*/
+	subjectTokenSource?: SubjectTokenSource;
+	/**
+	* Optional `audience` parameter for the `token_exchange` grant — the
+	* intended recipient of the resulting access token. Set this when the
+	* OAuth server expects an explicit audience claim distinct from the
+	* issuer.
+	*/
+	tokenExchangeAudience?: string;
+	/**
+	* Route inference through the OpenAI **Responses API** (`/v1/responses`)
+	* instead of Chat Completions (`/v1/chat/completions`). When `true` the
+	* managed provider is registered with `npm: "@ai-sdk/openai"` (whose default
+	* `languageModel()` targets Responses since AI SDK v5) rather than
+	* `@ai-sdk/openai-compatible`. Only enable it when the gateway implements the
+	* OpenAI Responses contract. Defaults to `false`. This flag affects provider
+	* registration only — it never touches the token lifecycle, so it is read at
+	* the config-synthesis layer and not part of the validated runtime config.
+	*/
+	responseApi?: boolean;
 }
 export interface OAuth2ModelSyncConfigInput {
-    servers: OAuthServerConfigInput[];
-    cacheNamespace?: string;
-    httpTimeoutMs?: number;
-    tokenExpirySkewMs?: number;
-    /**
-     * Minimum log level the plugin emits. Lower-priority records are dropped.
-     * One of `"trace" | "debug" | "info" | "warn" | "error"`. Defaults to
-     * `"info"`. `"trace"` is the most-verbose tier (host `--log-level DEBUG`).
-     */
-    logLevel?: LogLevel;
+	servers: OAuthServerConfigInput[];
+	cacheNamespace?: string;
+	httpTimeoutMs?: number;
+	tokenExpirySkewMs?: number;
+	/**
+	* Minimum log level the plugin emits. Lower-priority records are dropped.
+	* One of `"trace" | "debug" | "info" | "warn" | "error"`. Defaults to
+	* `"info"`. `"trace"` is the most-verbose tier (host `--log-level DEBUG`).
+	*/
+	logLevel?: LogLevel;
 }
 export interface OAuthServerConfig {
-    id: string;
-    name: string;
-    issuer: string;
-    baseURL: string;
-    clientId: string;
-    clientSecret?: string;
-    scopes: string[];
-    syncIntervalMinutes: number;
-    nameOverrides: Record<string, string>;
-    authorizationEndpoint?: string;
-    tokenEndpoint?: string;
-    deviceAuthorizationEndpoint?: string;
-    jwksUri?: string;
-    redirectPort?: number;
-    authFlow: OAuthAuthFlow;
-    pkce: boolean;
-    subjectTokenSource?: SubjectTokenSource;
-    tokenExchangeAudience?: string;
+	id: string;
+	name: string;
+	issuer: string;
+	baseURL: string;
+	clientId: string;
+	clientSecret?: string;
+	scopes: string[];
+	syncIntervalMinutes: number;
+	nameOverrides: Record<string, string>;
+	authorizationEndpoint?: string;
+	tokenEndpoint?: string;
+	deviceAuthorizationEndpoint?: string;
+	jwksUri?: string;
+	redirectPort?: number;
+	authFlow: OAuthAuthFlow;
+	pkce: boolean;
+	subjectTokenSource?: SubjectTokenSource;
+	tokenExchangeAudience?: string;
 }
 export interface OAuth2ModelSyncConfig {
-    servers: OAuthServerConfig[];
-    cacheNamespace: string;
-    httpTimeoutMs: number;
-    tokenExpirySkewMs: number;
-    logLevel: LogLevel;
+	servers: OAuthServerConfig[];
+	cacheNamespace: string;
+	httpTimeoutMs: number;
+	tokenExpirySkewMs: number;
+	logLevel: LogLevel;
 }
 export declare function validateConfig(input: OAuth2ModelSyncConfigInput): OAuth2ModelSyncConfig;