@vymalo/opencode-oauth2 0.12.0 → 0.14.1

package/dist/oauth/local-callback.js

@@ -1,82 +1,84 @@
 import { createServer } from "node:http";
 function writeHtml(response, statusCode, body) {
-    response.statusCode = statusCode;
-    response.setHeader("Content-Type", "text/html; charset=utf-8");
-    response.end(body);
+	response.statusCode = statusCode;
+	response.setHeader("Content-Type", "text/html; charset=utf-8");
+	response.end(body);
 }
 function parseCallback(request) {
-    if (!request.url) {
-        return undefined;
-    }
-    const url = new URL(request.url, "http://127.0.0.1");
-    const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (!code || !state) {
-        return undefined;
-    }
-    return { code, state };
+	if (!request.url) {
+		return undefined;
+	}
+	const url = new URL(request.url, "http://127.0.0.1");
+	const code = url.searchParams.get("code");
+	const state = url.searchParams.get("state");
+	if (!code || !state) {
+		return undefined;
+	}
+	return {
+		code,
+		state
+	};
 }
 export async function startLocalCallbackServer(callbackPath = "/oauth2/callback", port) {
-    let resolver;
-    let rejecter;
-    const promise = new Promise((resolve, reject) => {
-        resolver = resolve;
-        rejecter = reject;
-    });
-    const server = createServer((request, response) => {
-        const requestUrl = request.url ?? "";
-        const parsed = new URL(requestUrl, "http://127.0.0.1");
-        if (parsed.pathname !== callbackPath) {
-            writeHtml(response, 404, "<h1>Not Found</h1>");
-            return;
-        }
-        const payload = parseCallback(request);
-        if (!payload) {
-            writeHtml(response, 400, "<h1>Invalid OAuth callback</h1>");
-            rejecter?.(new Error("invalid oauth callback payload"));
-            return;
-        }
-        writeHtml(response, 200, "<h1>Login complete</h1><p>You can close this tab.</p>");
-        resolver?.(payload);
-    });
-    const listenPort = typeof port === "number" && port >= 0 ? port : 0;
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(listenPort, "127.0.0.1", () => resolve());
-    });
-    const address = server.address();
-    if (!address || typeof address === "string") {
-        throw new Error("failed to allocate local callback port");
-    }
-    return {
-        redirectUri: `http://127.0.0.1:${address.port}${callbackPath}`,
-        waitForCode(timeoutMs = 120_000) {
-            return new Promise((resolve, reject) => {
-                const timeout = setTimeout(() => {
-                    reject(new Error("timed out waiting for OAuth callback"));
-                }, timeoutMs);
-                promise
-                    .then((value) => {
-                    clearTimeout(timeout);
-                    resolve(value);
-                })
-                    .catch((error) => {
-                    clearTimeout(timeout);
-                    reject(error);
-                });
-            });
-        },
-        close() {
-            return new Promise((resolve, reject) => {
-                server.close((error) => {
-                    if (error) {
-                        reject(error);
-                        return;
-                    }
-                    resolve();
-                });
-            });
-        }
-    };
+	let resolver;
+	let rejecter;
+	const promise = new Promise((resolve, reject) => {
+		resolver = resolve;
+		rejecter = reject;
+	});
+	const server = createServer((request, response) => {
+		const requestUrl = request.url ?? "";
+		const parsed = new URL(requestUrl, "http://127.0.0.1");
+		if (parsed.pathname !== callbackPath) {
+			writeHtml(response, 404, "<h1>Not Found</h1>");
+			return;
+		}
+		const payload = parseCallback(request);
+		if (!payload) {
+			writeHtml(response, 400, "<h1>Invalid OAuth callback</h1>");
+			rejecter?.(new Error("invalid oauth callback payload"));
+			return;
+		}
+		writeHtml(response, 200, "<h1>Login complete</h1><p>You can close this tab.</p>");
+		resolver?.(payload);
+	});
+	const listenPort = typeof port === "number" && port >= 0 ? port : 0;
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(listenPort, "127.0.0.1", () => resolve());
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") {
+		throw new Error("failed to allocate local callback port");
+	}
+	return {
+		redirectUri: `http://127.0.0.1:${address.port}${callbackPath}`,
+		waitForCode(timeoutMs = 12e4) {
+			return new Promise((resolve, reject) => {
+				const timeout = setTimeout(() => {
+					reject(new Error("timed out waiting for OAuth callback"));
+				}, timeoutMs);
+				promise.then((value) => {
+					clearTimeout(timeout);
+					resolve(value);
+				}).catch((error) => {
+					clearTimeout(timeout);
+					reject(error);
+				});
+			});
+		},
+		close() {
+			return new Promise((resolve, reject) => {
+				server.close((error) => {
+					if (error) {
+						reject(error);
+						return;
+					}
+					resolve();
+				});
+			});
+		}
+	};
 }
+
 //# sourceMappingURL=local-callback.js.map

package/dist/oauth/local-callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-callback.js","sourceRoot":"","sources":["../../src/oauth/local-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAapF,SAAS,SAAS,CAAC,QAAwB,EAAE,UAAkB,EAAE,IAAY;IAC3E,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC/D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,YAAY,GAAG,kBAAkB,EACjC,IAAa;IAEb,IAAI,QAA4D,CAAC;IACjE,IAAI,QAAkD,CAAC;IAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,QAAQ,GAAG,OAAO,CAAC;QACnB,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC5D,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,uDAAuD,CAAC,CAAC;QAClF,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO;QACL,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,GAAG,YAAY,EAAE;QAC9D,WAAW,CAAC,SAAS,GAAG,OAAO;YAC7B,OAAO,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;gBAC5D,CAAC,EAAE,SAAS,CAAC,CAAC;gBAEd,OAAO;qBACJ,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBACd,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK;YACH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrB,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,CAAC,CAAC;wBACd,OAAO;oBACT,CAAC;oBACD,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"mappings":"AAAA,SAAS,oBAA+D;AAaxE,SAAS,UAAU,UAA0B,YAAoB,MAAoB;CACnF,SAAS,aAAa;CACtB,SAAS,UAAU,gBAAgB,0BAA0B;CAC7D,SAAS,IAAI,IAAI;AACnB;AAEA,SAAS,cAAc,SAA2D;CAChF,IAAI,CAAC,QAAQ,KAAK;EAChB,OAAO;CACT;CAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,KAAK,kBAAkB;CACnD,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;CACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;CAE1C,IAAI,CAAC,QAAQ,CAAC,OAAO;EACnB,OAAO;CACT;CAEA,OAAO;EAAE;EAAM;CAAM;AACvB;AAEA,OAAO,eAAe,yBACpB,eAAe,oBACf,MAC8B;CAC9B,IAAI;CACJ,IAAI;CAEJ,MAAM,UAAU,IAAI,SAA8B,SAAS,WAAW;EACpE,WAAW;EACX,WAAW;CACb,CAAC;CAED,MAAM,SAAS,cAAc,SAAS,aAAa;EACjD,MAAM,aAAa,QAAQ,OAAO;EAClC,MAAM,SAAS,IAAI,IAAI,YAAY,kBAAkB;EAErD,IAAI,OAAO,aAAa,cAAc;GACpC,UAAU,UAAU,KAAK,oBAAoB;GAC7C;EACF;EAEA,MAAM,UAAU,cAAc,OAAO;EACrC,IAAI,CAAC,SAAS;GACZ,UAAU,UAAU,KAAK,iCAAiC;GAC1D,WAAW,IAAI,MAAM,gCAAgC,CAAC;GACtD;EACF;EAEA,UAAU,UAAU,KAAK,uDAAuD;EAChF,WAAW,OAAO;CACpB,CAAC;CAED,MAAM,aAAa,OAAO,SAAS,YAAY,QAAQ,IAAI,OAAO;CAClE,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO,YAAY,mBAAmB,QAAQ,CAAC;CACxD,CAAC;CAED,MAAM,UAAU,OAAO,QAAQ;CAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;EAC3C,MAAM,IAAI,MAAM,wCAAwC;CAC1D;CAEA,OAAO;EACL,aAAa,oBAAoB,QAAQ,OAAO;EAChD,YAAY,YAAY,MAAS;GAC/B,OAAO,IAAI,SAA8B,SAAS,WAAW;IAC3D,MAAM,UAAU,iBAAiB;KAC/B,OAAO,IAAI,MAAM,sCAAsC,CAAC;IAC1D,GAAG,SAAS;IAEZ,QACG,MAAM,UAAU;KACf,aAAa,OAAO;KACpB,QAAQ,KAAK;IACf,CAAC,CAAC,CACD,OAAO,UAAU;KAChB,aAAa,OAAO;KACpB,OAAO,KAAK;IACd,CAAC;GACL,CAAC;EACH;EACA,QAAQ;GACN,OAAO,IAAI,SAAe,SAAS,WAAW;IAC5C,OAAO,OAAO,UAAU;KACtB,IAAI,OAAO;MACT,OAAO,KAAK;MACZ;KACF;KACA,QAAQ;IACV,CAAC;GACH,CAAC;EACH;CACF;AACF","names":[],"sources":["../../src/oauth/local-callback.ts"],"version":3,"file":"local-callback.js","sourceRoot":""}

package/dist/oauth/pkce.d.ts

@@ -1,5 +1,5 @@
 export declare function generatePkcePair(): {
-    verifier: string;
-    challenge: string;
+	verifier: string;
+	challenge: string;
 };
 export declare function generateStateToken(): string;

package/dist/oauth/pkce.js

@@ -1,13 +1,17 @@
 import { createHash, randomBytes } from "node:crypto";
 function toBase64Url(buffer) {
-    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+	return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 export function generatePkcePair() {
-    const verifier = toBase64Url(randomBytes(32));
-    const challenge = toBase64Url(createHash("sha256").update(verifier).digest());
-    return { verifier, challenge };
+	const verifier = toBase64Url(randomBytes(32));
+	const challenge = toBase64Url(createHash("sha256").update(verifier).digest());
+	return {
+		verifier,
+		challenge
+	};
 }
 export function generateStateToken() {
-    return toBase64Url(randomBytes(24));
+	return toBase64Url(randomBytes(24));
 }
+
 //# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAE9E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC"}
+{"mappings":"AAAA,SAAS,YAAY,mBAAmB;AAExC,SAAS,YAAY,QAAwB;CAC3C,OAAO,OAAO,SAAS,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC7F;AAEA,OAAO,SAAS,mBAA4D;CAC1E,MAAM,WAAW,YAAY,YAAY,EAAE,CAAC;CAC5C,MAAM,YAAY,YAAY,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,CAAC;CAE5E,OAAO;EAAE;EAAU;CAAU;AAC/B;AAEA,OAAO,SAAS,qBAA6B;CAC3C,OAAO,YAAY,YAAY,EAAE,CAAC;AACpC","names":[],"sources":["../../src/oauth/pkce.ts"],"version":3,"file":"pkce.js","sourceRoot":""}

package/dist/oauth/subject-token.d.ts

@@ -1,20 +1,20 @@
 import { type SubjectTokenSource } from "../config.js";
 export interface ResolveSubjectTokenOptions {
-    fetchImpl?: typeof fetch;
-    timeoutMs?: number;
-    /**
-     * Override process.env. Lets tests inject GHA-style env vars without
-     * mutating the real environment.
-     */
-    env?: Record<string, string | undefined>;
+	fetchImpl?: typeof fetch;
+	timeoutMs?: number;
+	/**
+	* Override process.env. Lets tests inject GHA-style env vars without
+	* mutating the real environment.
+	*/
+	env?: Record<string, string | undefined>;
 }
 /**
- * Read the platform-supplied JWT that the plugin will present as the subject
- * token (or assertion) for the `jwt_bearer` and `token_exchange` flows.
- *
- * Each source resolves fresh on every call — we never cache the JWT itself,
- * only the OIDC access token it gets exchanged for. K8s projected SA tokens
- * rotate; GHA OIDC tokens are short-lived (~10 min); both are cheap to
- * re-fetch on demand.
- */
+* Read the platform-supplied JWT that the plugin will present as the subject
+* token (or assertion) for the `jwt_bearer` and `token_exchange` flows.
+*
+* Each source resolves fresh on every call — we never cache the JWT itself,
+* only the OIDC access token it gets exchanged for. K8s projected SA tokens
+* rotate; GHA OIDC tokens are short-lived (~10 min); both are cheap to
+* re-fetch on demand.
+*/
 export declare function resolveSubjectToken(source: SubjectTokenSource, options?: ResolveSubjectTokenOptions): Promise<string>;

package/dist/oauth/subject-token.js

@@ -2,85 +2,80 @@ import { readFile } from "node:fs/promises";
 import { DEFAULT_K8S_SA_TOKEN_PATH } from "../config.js";
 import { readResponseBodyPreview, scrubSecrets } from "./http-utils.js";
 /**
- * Read the platform-supplied JWT that the plugin will present as the subject
- * token (or assertion) for the `jwt_bearer` and `token_exchange` flows.
- *
- * Each source resolves fresh on every call — we never cache the JWT itself,
- * only the OIDC access token it gets exchanged for. K8s projected SA tokens
- * rotate; GHA OIDC tokens are short-lived (~10 min); both are cheap to
- * re-fetch on demand.
- */
+* Read the platform-supplied JWT that the plugin will present as the subject
+* token (or assertion) for the `jwt_bearer` and `token_exchange` flows.
+*
+* Each source resolves fresh on every call — we never cache the JWT itself,
+* only the OIDC access token it gets exchanged for. K8s projected SA tokens
+* rotate; GHA OIDC tokens are short-lived (~10 min); both are cheap to
+* re-fetch on demand.
+*/
 export async function resolveSubjectToken(source, options = {}) {
-    switch (source.type) {
-        case "github_actions":
-            return resolveGithubActionsToken(source.audience, options);
-        case "kubernetes_sa":
-            return readJwtFile(source.tokenPath ?? DEFAULT_K8S_SA_TOKEN_PATH, "kubernetes_sa");
-        case "file":
-            return readJwtFile(source.path, "file");
-        case "env":
-            return resolveEnvToken(source.var, options.env ?? process.env);
-    }
+	switch (source.type) {
+		case "github_actions": return resolveGithubActionsToken(source.audience, options);
+		case "kubernetes_sa": return readJwtFile(source.tokenPath ?? DEFAULT_K8S_SA_TOKEN_PATH, "kubernetes_sa");
+		case "file": return readJwtFile(source.path, "file");
+		case "env": return resolveEnvToken(source.var, options.env ?? process.env);
+	}
 }
 async function readJwtFile(path, sourceLabel) {
-    let raw;
-    try {
-        raw = await readFile(path, "utf8");
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT") {
-            throw new Error(`subjectTokenSource (${sourceLabel}): no file at ${path} — check the mount/path`);
-        }
-        throw new Error(`subjectTokenSource (${sourceLabel}): failed to read ${path}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    const trimmed = raw.trim();
-    if (trimmed.length === 0) {
-        throw new Error(`subjectTokenSource (${sourceLabel}): file at ${path} is empty`);
-    }
-    return trimmed;
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch (error) {
+		const code = error.code;
+		if (code === "ENOENT") {
+			throw new Error(`subjectTokenSource (${sourceLabel}): no file at ${path} — check the mount/path`);
+		}
+		throw new Error(`subjectTokenSource (${sourceLabel}): failed to read ${path}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) {
+		throw new Error(`subjectTokenSource (${sourceLabel}): file at ${path} is empty`);
+	}
+	return trimmed;
 }
 function resolveEnvToken(name, env) {
-    const value = env[name];
-    if (typeof value !== "string" || value.trim().length === 0) {
-        throw new Error(`subjectTokenSource (env): ${name} is not set or is empty`);
-    }
-    return value.trim();
+	const value = env[name];
+	if (typeof value !== "string" || value.trim().length === 0) {
+		throw new Error(`subjectTokenSource (env): ${name} is not set or is empty`);
+	}
+	return value.trim();
 }
 async function resolveGithubActionsToken(audience, options) {
-    const env = options.env ?? process.env;
-    const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
-    const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-    if (!requestUrl || !requestToken) {
-        throw new Error(`subjectTokenSource (github_actions): ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN must be set — this only works inside a GitHub Actions job with \`permissions: { id-token: write }\``);
-    }
-    const url = new URL(requestUrl);
-    url.searchParams.set("audience", audience);
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 15_000);
-    let response;
-    try {
-        response = await fetchImpl(url.toString(), {
-            method: "GET",
-            headers: {
-                Authorization: `Bearer ${requestToken}`,
-                Accept: "application/json"
-            },
-            signal: controller.signal
-        });
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    if (!response.ok) {
-        const preview = await readResponseBodyPreview(response, 500);
-        throw new Error(`subjectTokenSource (github_actions): OIDC token request failed (${response.status})${preview ? `: ${scrubSecrets(preview)}` : ""}`);
-    }
-    const payload = (await response.json());
-    if (typeof payload.value !== "string" || payload.value.length === 0) {
-        throw new Error("subjectTokenSource (github_actions): response had no `value` field — GitHub may have changed the API shape");
-    }
-    return payload.value;
+	const env = options.env ?? process.env;
+	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	if (!requestUrl || !requestToken) {
+		throw new Error(`subjectTokenSource (github_actions): ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN must be set — this only works inside a GitHub Actions job with \`permissions: { id-token: write }\``);
+	}
+	const url = new URL(requestUrl);
+	url.searchParams.set("audience", audience);
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 15e3);
+	let response;
+	try {
+		response = await fetchImpl(url.toString(), {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${requestToken}`,
+				Accept: "application/json"
+			},
+			signal: controller.signal
+		});
+	} finally {
+		clearTimeout(timer);
+	}
+	if (!response.ok) {
+		const preview = await readResponseBodyPreview(response, 500);
+		throw new Error(`subjectTokenSource (github_actions): OIDC token request failed (${response.status})${preview ? `: ${scrubSecrets(preview)}` : ""}`);
+	}
+	const payload = await response.json();
+	if (typeof payload.value !== "string" || payload.value.length === 0) {
+		throw new Error("subjectTokenSource (github_actions): response had no `value` field — GitHub may have changed the API shape");
+	}
+	return payload.value;
 }
+
 //# sourceMappingURL=subject-token.js.map

package/dist/oauth/subject-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"subject-token.js","sourceRoot":"","sources":["../../src/oauth/subject-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAYxE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA0B,EAC1B,UAAsC,EAAE;IAExC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,gBAAgB;YACnB,OAAO,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,KAAK,eAAe;YAClB,OAAO,WAAW,CAAC,MAAM,CAAC,SAAS,IAAI,yBAAyB,EAAE,eAAe,CAAC,CAAC;QACrF,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,KAAK,KAAK;YACR,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,WAAmB;IAC1D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,uBAAuB,WAAW,iBAAiB,IAAI,yBAAyB,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uBAAuB,WAAW,qBAAqB,IAAI,KACzD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,WAAW,cAAc,IAAI,WAAW,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,GAAuC;IAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAgB,EAChB,OAAmC;IAEnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,4BAA4B,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,8BAA8B,CAAC;IAExD,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,0MAA0M,CAC3M,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAEhF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,YAAY,EAAE;gBACvC,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,mEAAmE,QAAQ,CAAC,MAAM,IAChF,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC3C,EAAE,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IAC/D,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC"}
+{"mappings":"AAAA,SAAS,gBAAgB;AAEzB,SAAS,iCAA0D;AACnE,SAAS,yBAAyB,oBAAoB;;;;;;;;;;AAqBtD,OAAO,eAAe,oBACpB,QACA,UAAsC,CAAC,GACtB;CACjB,QAAQ,OAAO,MAAf;EACE,KAAK,kBACH,OAAO,0BAA0B,OAAO,UAAU,OAAO;EAC3D,KAAK,iBACH,OAAO,YAAY,OAAO,aAAa,2BAA2B,eAAe;EACnF,KAAK,QACH,OAAO,YAAY,OAAO,MAAM,MAAM;EACxC,KAAK,OACH,OAAO,gBAAgB,OAAO,KAAK,QAAQ,OAAO,QAAQ,GAAG;CACjE;AACF;AAEA,eAAe,YAAY,MAAc,aAAsC;CAC7E,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,SAAS,MAAM,MAAM;CACnC,SAAS,OAAO;EACd,MAAM,OAAQ,MAAgC;EAC9C,IAAI,SAAS,UAAU;GACrB,MAAM,IAAI,MACR,uBAAuB,YAAY,gBAAgB,KAAK,wBAC1D;EACF;EACA,MAAM,IAAI,MACR,uBAAuB,YAAY,oBAAoB,KAAK,IAC1D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;CACF;CACA,MAAM,UAAU,IAAI,KAAK;CACzB,IAAI,QAAQ,WAAW,GAAG;EACxB,MAAM,IAAI,MAAM,uBAAuB,YAAY,aAAa,KAAK,UAAU;CACjF;CACA,OAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,KAAiD;CACtF,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,6BAA6B,KAAK,wBAAwB;CAC5E;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,eAAe,0BACb,UACA,SACiB;CACjB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,aAAa,IAAI;CACvB,MAAM,eAAe,IAAI;CAEzB,IAAI,CAAC,cAAc,CAAC,cAAc;EAChC,MAAM,IAAI,MACR,0MACF;CACF;CAEA,MAAM,MAAM,IAAI,IAAI,UAAU;CAC9B,IAAI,aAAa,IAAI,YAAY,QAAQ;CAEzC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,GAAG,QAAQ,aAAa,IAAM;CAE9E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,UAAU,IAAI,SAAS,GAAG;GACzC,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,QAAQ;GACV;GACA,QAAQ,WAAW;EACrB,CAAC;CACH,UAAU;EACR,aAAa,KAAK;CACpB;CAEA,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,UAAU,MAAM,wBAAwB,UAAU,GAAG;EAC3D,MAAM,IAAI,MACR,mEAAmE,SAAS,OAAO,GACjF,UAAU,KAAK,aAAa,OAAO,MAAM,IAE7C;CACF;CAEA,MAAM,UAAW,MAAM,SAAS,KAAK;CACrC,IAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,WAAW,GAAG;EACnE,MAAM,IAAI,MACR,4GACF;CACF;CACA,OAAO,QAAQ;AACjB","names":[],"sources":["../../src/oauth/subject-token.ts"],"version":3,"file":"subject-token.js","sourceRoot":""}

package/dist/opencode.d.ts

@@ -1,23 +1,23 @@
 import type { Plugin } from "@opencode-ai/plugin";
 import { type Logger, type LogLevel } from "./logging.js";
 /**
- * Map OpenCode's host-level `config.logLevel` (uppercase `"DEBUG" | "INFO" |
- * "WARN" | "ERROR"`) to this plugin's internal `LogLevel`. Unknown / missing
- * values fall through to `undefined` so the caller can apply its own default —
- * we never throw on the OpenCode-supplied value because the host owns
- * validation of its own field.
- *
- * Note: host `DEBUG` unlocks this plugin's most-verbose `"trace"` tier (there
- * is no separate host `TRACE` level), so running OpenCode with
- * `--log-level DEBUG` surfaces the `oauth2_*` trace events emitted across the
- * runtime hot paths.
- */
+* Map OpenCode's host-level `config.logLevel` (uppercase `"DEBUG" | "INFO" |
+* "WARN" | "ERROR"`) to this plugin's internal `LogLevel`. Unknown / missing
+* values fall through to `undefined` so the caller can apply its own default —
+* we never throw on the OpenCode-supplied value because the host owns
+* validation of its own field.
+*
+* Note: host `DEBUG` unlocks this plugin's most-verbose `"trace"` tier (there
+* is no separate host `TRACE` level), so running OpenCode with
+* `--log-level DEBUG` surfaces the `oauth2_*` trace events emitted across the
+* runtime hot paths.
+*/
 export declare function fromOpenCodeLogLevel(value: unknown): LogLevel | undefined;
 export interface OpenCodePluginFactoryOptions {
-    logger?: Logger;
-    fetchImpl?: typeof fetch;
-    onAuthorizationUrl?: (url: string) => Promise<void> | void;
-    cacheDir?: string;
+	logger?: Logger;
+	fetchImpl?: typeof fetch;
+	onAuthorizationUrl?: (url: string) => Promise<void> | void;
+	cacheDir?: string;
 }
 export declare function createOpencodeOauth2Plugin(factoryOptions?: OpenCodePluginFactoryOptions): Plugin;
 export declare const OpencodeOauth2Plugin: Plugin;