@vymalo/opencode-oauth2 0.14.0 → 0.15.0

package/dist/plugin.js

@@ -1,9 +1,8 @@
+import { createJsonConsoleLogger, TokenRuntime } from "@vymalo/opencode-auth-core/lib";
 import { FileCacheStore, resolveCacheDir } from "./cache.js";
 import { validateConfig } from "./config.js";
-import { createJsonConsoleLogger } from "./logging.js";
 import { fetchModels } from "./model-discovery.js";
 import { diffModels, normalizeModelList } from "./model-normalization.js";
-import { OAuthClient } from "./oauth/client.js";
 import { startScheduler } from "./scheduler.js";
 export class OAuth2ModelSyncPlugin {
 	configInput;
@@ -21,6 +20,58 @@ export class OAuth2ModelSyncPlugin {
 		this.logger = options.logger ?? createJsonConsoleLogger(this.config.logLevel);
 		this.cacheStore = new FileCacheStore(options.cacheDir ?? resolveCacheDir(this.config.cacheNamespace), this.logger);
 	}
+	buildTokenRuntime(serverId) {
+		const server = this.requireServerConfig(serverId);
+		const runtime = this.runtimeByServer.get(serverId);
+		const authConfig = {
+			id: server.id,
+			issuer: server.issuer,
+			clientId: server.clientId,
+			clientSecret: server.clientSecret,
+			scopes: server.scopes,
+			authorizationEndpoint: server.authorizationEndpoint,
+			tokenEndpoint: server.tokenEndpoint,
+			deviceAuthorizationEndpoint: server.deviceAuthorizationEndpoint,
+			jwksUri: server.jwksUri,
+			redirectPort: server.redirectPort,
+			authFlow: server.authFlow,
+			pkce: server.pkce,
+			subjectTokenSource: server.subjectTokenSource,
+			tokenExchangeAudience: server.tokenExchangeAudience
+		};
+		return new TokenRuntime(server.id, authConfig, {
+			logger: this.logger,
+			fetchImpl: this.options.fetchImpl,
+			timeoutMs: this.config.httpTimeoutMs,
+			onAuthorizationUrl: this.options.onAuthorizationUrl,
+			tokenExpirySkewMs: this.config.tokenExpirySkewMs,
+			// Delegate the token cache to oauth2's fused CachedServerState so the
+			// on-disk location and shape are preserved (tests + existing installs).
+			getCached: async () => runtime?.state.token,
+			setCached: async (token) => {
+				if (!runtime) {
+					return;
+				}
+				const next = {
+					...runtime.state,
+					updatedAt: Date.now(),
+					token
+				};
+				await this.cacheStore.saveServerState(next);
+				runtime.state = next;
+			}
+		});
+	}
+	ensureTokenRuntime(serverId) {
+		const runtime = this.runtimeByServer.get(serverId);
+		if (!runtime) {
+			throw new Error(`runtime not initialized for server: ${serverId}`);
+		}
+		if (!runtime.tokenRuntime) {
+			runtime.tokenRuntime = this.buildTokenRuntime(serverId);
+		}
+		return runtime.tokenRuntime;
+	}
 	async initialize() {
 		if (this.initialized) {
 			return;
@@ -107,7 +158,6 @@ export class OAuth2ModelSyncPlugin {
 		return snapshots;
 	}
 	async syncServer(serverId, options = {}) {
-		const server = this.requireServerConfig(serverId);
 		const runtime = this.runtimeByServer.get(serverId);
 		if (!runtime) {
 			throw new Error(`runtime not initialized for server: ${serverId}`);
@@ -116,13 +166,7 @@ export class OAuth2ModelSyncPlugin {
 			serverId,
 			interactive: options.interactive !== false
 		});
-		const oauth = new OAuthClient(server, {
-			fetchImpl: this.options.fetchImpl,
-			logger: this.logger,
-			timeoutMs: this.config.httpTimeoutMs,
-			onAuthorizationUrl: this.options.onAuthorizationUrl,
-			tokenExpirySkewMs: this.config.tokenExpirySkewMs
-		});
+		const tokenRuntime = this.ensureTokenRuntime(serverId);
 		const previousState = runtime.state;
 		try {
 			this.logger.trace("oauth2_sync_ensure_token", {
@@ -131,13 +175,13 @@ export class OAuth2ModelSyncPlugin {
 				hadRefreshToken: Boolean(previousState.token?.refreshToken),
 				interactive: options.interactive !== false
 			});
-			const token = await oauth.ensureToken(previousState.token, { interactive: options.interactive });
+			const token = await tokenRuntime.ensure({ interactive: options.interactive });
 			this.logger.trace("oauth2_model_discovery_fetch_start", {
 				serverId,
-				baseURL: server.baseURL,
+				baseURL: this.requireServerConfig(serverId).baseURL,
 				tokenChanged: token.accessToken !== previousState.token?.accessToken
 			});
-			const rawModels = await fetchModels(server.baseURL, token, {
+			const rawModels = await fetchModels(this.requireServerConfig(serverId).baseURL, token, {
 				fetchImpl: this.options.fetchImpl,
 				timeoutMs: this.config.httpTimeoutMs,
 				logger: this.logger
@@ -146,7 +190,7 @@ export class OAuth2ModelSyncPlugin {
 				serverId,
 				rawModelCount: rawModels.length
 			});
-			const normalizedModels = normalizeModelList(rawModels, server.nameOverrides);
+			const normalizedModels = normalizeModelList(rawModels, this.requireServerConfig(serverId).nameOverrides);
 			const diff = diffModels(previousState.models, normalizedModels);
 			this.logger.trace("oauth2_model_discovery_normalized", {
 				serverId,
@@ -195,18 +239,11 @@ export class OAuth2ModelSyncPlugin {
 		}
 	}
 	async ensureAccessToken(serverId, options = {}) {
-		const server = this.requireServerConfig(serverId);
 		const runtime = this.runtimeByServer.get(serverId);
 		if (!runtime) {
 			throw new Error(`runtime not initialized for server: ${serverId}`);
 		}
-		const oauth = new OAuthClient(server, {
-			fetchImpl: this.options.fetchImpl,
-			logger: this.logger,
-			timeoutMs: this.config.httpTimeoutMs,
-			onAuthorizationUrl: this.options.onAuthorizationUrl,
-			tokenExpirySkewMs: this.config.tokenExpirySkewMs
-		});
+		const tokenRuntime = this.ensureTokenRuntime(serverId);
 		// `interactive` is forwarded so config-time callers can ask for a
 		// refresh-only ensure (`interactive: false`): a valid cached token is
 		// returned as-is, a stale-but-refreshable one is refreshed, and anything
@@ -218,20 +255,14 @@ export class OAuth2ModelSyncPlugin {
 			hadRefreshToken: Boolean(runtime.state.token?.refreshToken),
 			interactive: options.interactive !== false
 		});
-		const token = await oauth.ensureToken(runtime.state.token, { interactive: options.interactive });
-		if (token.accessToken !== runtime.state.token?.accessToken) {
+		const previousToken = runtime.state.token;
+		const token = await tokenRuntime.ensure({ interactive: options.interactive });
+		if (token.accessToken !== previousToken?.accessToken) {
 			this.logger.trace("oauth2_ensure_access_token_refreshed", {
 				serverId,
 				present: Boolean(token.accessToken),
 				expiresInSeconds: typeof token.expiresAt === "number" ? Math.max(0, Math.round((token.expiresAt - Date.now()) / 1e3)) : undefined
 			});
-			const nextState = {
-				...runtime.state,
-				updatedAt: Date.now(),
-				token
-			};
-			await this.cacheStore.saveServerState(nextState);
-			runtime.state = nextState;
 		} else {
 			this.logger.trace("oauth2_ensure_access_token_reused_cached", {
 				serverId,

package/dist/plugin.js.map

@@ -1 +1 @@
-{"mappings":"AAAA,SAAS,gBAAgB,uBAAuB;AAChD,SAA0C,sBAAsB;AAChE,SAAS,+BAA4C;AACrD,SAAS,mBAAmB;AAC5B,SAAS,YAAY,0BAA0B;AAC/C,SAAS,mBAAmB;AAC5B,SAAS,sBAA4C;AA2BrD,OAAO,MAAM,sBAAsB;CASd;CACA;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB,kBAAkB,IAAI,IAA2B;CAClE,AAAQ,cAAc;CACtB,AAAQ,UAAU;CAElB,YACE,AAAiB,aACjB,AAAiB,UAAyB,CAAC,GAC3C;EAFiB;EACA;EAEjB,KAAK,SAAS,eAAe,KAAK,WAAW;EAC7C,KAAK,SAAS,QAAQ,UAAU,wBAAwB,KAAK,OAAO,QAAQ;EAC5E,KAAK,aAAa,IAAI,eACpB,QAAQ,YAAY,gBAAgB,KAAK,OAAO,cAAc,GAC9D,KAAK,MACP;CACF;CAEA,MAAM,aAA4B;EAChC,IAAI,KAAK,aAAa;GACpB;EACF;EAEA,MAAM,KAAK,WAAW,YAAY;EAElC,KAAK,MAAM,UAAU,KAAK,OAAO,SAAS;GACxC,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB,OAAO,EAAE;GAC9D,KAAK,OAAO,MAAM,qBAAqB;IACrC,UAAU,OAAO;IACjB,KAAK,QAAQ,MAAM;IACnB,kBAAkB,QAAQ,OAAO,UAAU;IAC3C,gBAAgB,QAAQ,QAAQ,KAAK;GACvC,CAAC;GACD,MAAM,eAAkC,UAAU;IAChD,UAAU,OAAO;IACjB,WAAW,KAAK,IAAI;IACpB,QAAQ,CAAC;IACT,WAAW,CAAC;GACd;GAEA,KAAK,gBAAgB,IAAI,OAAO,IAAI,EAAE,OAAO,aAAa,CAAC;EAC7D;EAEA,KAAK,OAAO,MAAM,sBAAsB,EACtC,aAAa,KAAK,OAAO,QAAQ,OACnC,CAAC;EAED,KAAK,cAAc;CACrB;CAEA,MAAM,MAAM,UAAwB,CAAC,GAAkB;EACrD,IAAI,KAAK,SAAS;GAChB;EACF;EAEA,MAAM,KAAK,WAAW;EACtB,MAAM,SAAS,QAAQ,UAAU;;;;;;;EAOjC,MAAM,oBACJ,QAAQ,eAAe,QAAQ,QAAQ,OAAO,SAAS,QAAQ,QAAQ,KAAK;EAE9E,KAAK,OAAO,MAAM,gBAAgB;GAChC,aAAa,KAAK,OAAO,QAAQ;GACjC;GACA;EACF,CAAC;EAED,KAAK,MAAM,UAAU,KAAK,OAAO,SAAS;GACxC,IAAI,QAAQ;IACV,IAAI;KACF,MAAM,KAAK,WAAW,OAAO,IAAI,EAAE,aAAa,kBAAkB,CAAC;IACrE,SAAS,OAAO;KACd,KAAK,OAAO,KAAK,uBAAuB;MACtC,UAAU,OAAO;MACjB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC9D,CAAC;IACH;GACF;GAEA,KAAK,OAAO,MAAM,+BAA+B;IAC/C,UAAU,OAAO;IACjB,iBAAiB,OAAO;GAC1B,CAAC;GACD,MAAM,SAAS,eAAe;IAC5B,YAAY,KAAK,MAAM,OAAO,sBAAsB,GAAM;IAC1D,QAAQ,KAAK;IACb,UAAU,QAAQ,OAAO;IACzB,KAAK,YAAY;KACf,MAAM,KAAK,WAAW,OAAO,EAAE;IACjC;GACF,CAAC;GAED,MAAM,UAAU,KAAK,gBAAgB,IAAI,OAAO,EAAE;GAClD,IAAI,SAAS;IACX,QAAQ,YAAY;GACtB;EACF;EAEA,KAAK,UAAU;CACjB;CAEA,OAAa;EACX,KAAK,MAAM,WAAW,KAAK,gBAAgB,OAAO,GAAG;GACnD,QAAQ,WAAW,KAAK;EAC1B;EAEA,KAAK,UAAU;CACjB;CAEA,MAAM,UAAqC;EACzC,MAAM,YAA8B,CAAC;EACrC,KAAK,MAAM,UAAU,KAAK,OAAO,SAAS;GACxC,UAAU,KAAK,MAAM,KAAK,WAAW,OAAO,EAAE,CAAC;EACjD;EACA,OAAO;CACT;CAEA,MAAM,WACJ,UACA,UAAqC,CAAC,GACb;EACzB,MAAM,SAAS,KAAK,oBAAoB,QAAQ;EAEhD,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,KAAK,OAAO,MAAM,cAAc;GAAE;GAAU,aAAa,QAAQ,gBAAgB;EAAM,CAAC;EACxF,MAAM,QAAQ,IAAI,YAAY,QAAQ;GACpC,WAAW,KAAK,QAAQ;GACxB,QAAQ,KAAK;GACb,WAAW,KAAK,OAAO;GACvB,oBAAoB,KAAK,QAAQ;GACjC,mBAAmB,KAAK,OAAO;EACjC,CAAC;EAED,MAAM,gBAAgB,QAAQ;EAE9B,IAAI;GACF,KAAK,OAAO,MAAM,4BAA4B;IAC5C;IACA,gBAAgB,QAAQ,cAAc,KAAK;IAC3C,iBAAiB,QAAQ,cAAc,OAAO,YAAY;IAC1D,aAAa,QAAQ,gBAAgB;GACvC,CAAC;GACD,MAAM,QAAQ,MAAM,MAAM,YAAY,cAAc,OAAO,EACzD,aAAa,QAAQ,YACvB,CAAC;GACD,KAAK,OAAO,MAAM,sCAAsC;IACtD;IACA,SAAS,OAAO;IAChB,cAAc,MAAM,gBAAgB,cAAc,OAAO;GAC3D,CAAC;GACD,MAAM,YAAY,MAAM,YAAY,OAAO,SAAS,OAAO;IACzD,WAAW,KAAK,QAAQ;IACxB,WAAW,KAAK,OAAO;IACvB,QAAQ,KAAK;GACf,CAAC;GACD,KAAK,OAAO,MAAM,yCAAyC;IACzD;IACA,eAAe,UAAU;GAC3B,CAAC;GAED,MAAM,mBAAmB,mBAAmB,WAAW,OAAO,aAAa;GAC3E,MAAM,OAAO,WAAW,cAAc,QAAQ,gBAAgB;GAC9D,KAAK,OAAO,MAAM,qCAAqC;IACrD;IACA,YAAY,iBAAiB;IAC7B,OAAO,KAAK,MAAM;IAClB,SAAS,KAAK,QAAQ;IACtB,SAAS,KAAK,QAAQ;GACxB,CAAC;GAED,MAAM,YAA+B;IACnC,GAAG;IACH,WAAW,KAAK,IAAI;IACpB,YAAY,KAAK,IAAI;IACrB;IACA;IACA,QAAQ;GACV;GAEA,MAAM,KAAK,WAAW,gBAAgB,SAAS;GAC/C,QAAQ,QAAQ;;;;GAKhB,MAAM,UAAU,KAAK,MAAM,SAAS,KAAK,QAAQ,SAAS,KAAK,QAAQ,SAAS;GAChF,KAAK,OAAO,UAAU,SAAS,QAAQ,CAAC,gBAAgB;IACtD;IACA,YAAY,iBAAiB;IAC7B,OAAO,KAAK,MAAM;IAClB,SAAS,KAAK,QAAQ;IACtB,SAAS,KAAK,QAAQ;GACxB,CAAC;GAED,OAAO;IACL;IACA,QAAQ;IACR,YAAY,UAAU;GACxB;EACF,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,eAAe;IAC/B;IACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;;GAGD,OAAO;IACL;IACA,QAAQ,cAAc;IACtB,YAAY,cAAc;GAC5B;EACF;CACF;CAEA,MAAM,kBACJ,UACA,UAAqC,CAAC,GACnB;EACnB,MAAM,SAAS,KAAK,oBAAoB,QAAQ;EAChD,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,MAAM,QAAQ,IAAI,YAAY,QAAQ;GACpC,WAAW,KAAK,QAAQ;GACxB,QAAQ,KAAK;GACb,WAAW,KAAK,OAAO;GACvB,oBAAoB,KAAK,QAAQ;GACjC,mBAAmB,KAAK,OAAO;EACjC,CAAC;;;;;;EAOD,KAAK,OAAO,MAAM,oCAAoC;GACpD;GACA,gBAAgB,QAAQ,QAAQ,MAAM,KAAK;GAC3C,iBAAiB,QAAQ,QAAQ,MAAM,OAAO,YAAY;GAC1D,aAAa,QAAQ,gBAAgB;EACvC,CAAC;EACD,MAAM,QAAQ,MAAM,MAAM,YAAY,QAAQ,MAAM,OAAO,EACzD,aAAa,QAAQ,YACvB,CAAC;EACD,IAAI,MAAM,gBAAgB,QAAQ,MAAM,OAAO,aAAa;GAC1D,KAAK,OAAO,MAAM,wCAAwC;IACxD;IACA,SAAS,QAAQ,MAAM,WAAW;IAClC,kBACE,OAAO,MAAM,cAAc,WACvB,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC,IAC7D;GACR,CAAC;GACD,MAAM,YAA+B;IACnC,GAAG,QAAQ;IACX,WAAW,KAAK,IAAI;IACpB;GACF;GACA,MAAM,KAAK,WAAW,gBAAgB,SAAS;GAC/C,QAAQ,QAAQ;EAClB,OAAO;GACL,KAAK,OAAO,MAAM,4CAA4C;IAC5D;IACA,SAAS,QAAQ,MAAM,WAAW;GACpC,CAAC;EACH;EAEA,OAAO;CACT;CAEA,MAAM,kBAAkB,UAA2C;EACjE,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,IAAI,CAAC,QAAQ,MAAM,cAAc,QAAQ,MAAM,OAAO,WAAW,GAAG;GAClE,OAAO,KAAK,WAAW,QAAQ;EACjC;EAEA,OAAO;GACL;GACA,QAAQ,QAAQ,MAAM;GACtB,YAAY,QAAQ,MAAM;EAC5B;CACF;CAEA,gBAAgB,UAAqC;EACnD,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,OAAO,CAAC,GAAG,QAAQ,MAAM,MAAM;CACjC;CAEA,oBAAoB,UAAoD;EACtE,MAAM,SAAS,KAAK,gBAAgB,QAAQ;EAC5C,OAAO,OAAO,YAAY,OAAO,KAAK,UAAU,CAAC,MAAM,IAAI,EAAE,MAAM,MAAM,YAAY,CAAC,CAAC,CAAC;CAC1F;CAEA,eAAe,UAAwC;EACrD,OAAO,KAAK,gBAAgB,IAAI,QAAQ,CAAC,EAAE,MAAM;CACnD;CAEA,AAAQ,oBAAoB,UAAkB;EAC5C,MAAM,SAAS,KAAK,OAAO,QAAQ,MAAM,SAAS,KAAK,OAAO,QAAQ;EACtE,IAAI,CAAC,QAAQ;GACX,MAAM,IAAI,MAAM,sBAAsB,UAAU;EAClD;EAEA,OAAO;CACT;AACF","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}
+{"mappings":"AAAA,SACE,yBACA,oBAIK;AACP,SAAS,gBAAgB,uBAAuB;AAChD,SAA0C,sBAAsB;AAChE,SAAS,mBAAmB;AAC5B,SAAS,YAAY,0BAA0B;AAC/C,SAAS,sBAA4C;AA4BrD,OAAO,MAAM,sBAAsB;CASd;CACA;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB,kBAAkB,IAAI,IAA2B;CAClE,AAAQ,cAAc;CACtB,AAAQ,UAAU;CAElB,YACE,AAAiB,aACjB,AAAiB,UAAyB,CAAC,GAC3C;EAFiB;EACA;EAEjB,KAAK,SAAS,eAAe,KAAK,WAAW;EAC7C,KAAK,SAAS,QAAQ,UAAU,wBAAwB,KAAK,OAAO,QAAQ;EAC5E,KAAK,aAAa,IAAI,eACpB,QAAQ,YAAY,gBAAgB,KAAK,OAAO,cAAc,GAC9D,KAAK,MACP;CACF;CAEA,AAAQ,kBAAkB,UAAgC;EACxD,MAAM,SAAS,KAAK,oBAAoB,QAAQ;EAChD,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,MAAM,aAA+B;GACnC,IAAI,OAAO;GACX,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,cAAc,OAAO;GACrB,QAAQ,OAAO;GACf,uBAAuB,OAAO;GAC9B,eAAe,OAAO;GACtB,6BAA6B,OAAO;GACpC,SAAS,OAAO;GAChB,cAAc,OAAO;GACrB,UAAU,OAAO;GACjB,MAAM,OAAO;GACb,oBAAoB,OAAO;GAC3B,uBAAuB,OAAO;EAChC;EAEA,OAAO,IAAI,aAAa,OAAO,IAAI,YAAY;GAC7C,QAAQ,KAAK;GACb,WAAW,KAAK,QAAQ;GACxB,WAAW,KAAK,OAAO;GACvB,oBAAoB,KAAK,QAAQ;GACjC,mBAAmB,KAAK,OAAO;;;GAG/B,WAAW,YAAY,SAAS,MAAM;GACtC,WAAW,OAAO,UAAU;IAC1B,IAAI,CAAC,SAAS;KACZ;IACF;IACA,MAAM,OAA0B;KAC9B,GAAG,QAAQ;KACX,WAAW,KAAK,IAAI;KACpB;IACF;IACA,MAAM,KAAK,WAAW,gBAAgB,IAAI;IAC1C,QAAQ,QAAQ;GAClB;EACF,CAAC;CACH;CAEA,AAAQ,mBAAmB,UAAgC;EACzD,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EACA,IAAI,CAAC,QAAQ,cAAc;GACzB,QAAQ,eAAe,KAAK,kBAAkB,QAAQ;EACxD;EACA,OAAO,QAAQ;CACjB;CAEA,MAAM,aAA4B;EAChC,IAAI,KAAK,aAAa;GACpB;EACF;EAEA,MAAM,KAAK,WAAW,YAAY;EAElC,KAAK,MAAM,UAAU,KAAK,OAAO,SAAS;GACxC,MAAM,SAAS,MAAM,KAAK,WAAW,gBAAgB,OAAO,EAAE;GAC9D,KAAK,OAAO,MAAM,qBAAqB;IACrC,UAAU,OAAO;IACjB,KAAK,QAAQ,MAAM;IACnB,kBAAkB,QAAQ,OAAO,UAAU;IAC3C,gBAAgB,QAAQ,QAAQ,KAAK;GACvC,CAAC;GACD,MAAM,eAAkC,UAAU;IAChD,UAAU,OAAO;IACjB,WAAW,KAAK,IAAI;IACpB,QAAQ,CAAC;IACT,WAAW,CAAC;GACd;GAEA,KAAK,gBAAgB,IAAI,OAAO,IAAI,EAAE,OAAO,aAAa,CAAC;EAC7D;EAEA,KAAK,OAAO,MAAM,sBAAsB,EACtC,aAAa,KAAK,OAAO,QAAQ,OACnC,CAAC;EAED,KAAK,cAAc;CACrB;CAEA,MAAM,MAAM,UAAwB,CAAC,GAAkB;EACrD,IAAI,KAAK,SAAS;GAChB;EACF;EAEA,MAAM,KAAK,WAAW;EACtB,MAAM,SAAS,QAAQ,UAAU;;;;;;;EAOjC,MAAM,oBACJ,QAAQ,eAAe,QAAQ,QAAQ,OAAO,SAAS,QAAQ,QAAQ,KAAK;EAE9E,KAAK,OAAO,MAAM,gBAAgB;GAChC,aAAa,KAAK,OAAO,QAAQ;GACjC;GACA;EACF,CAAC;EAED,KAAK,MAAM,UAAU,KAAK,OAAO,SAAS;GACxC,IAAI,QAAQ;IACV,IAAI;KACF,MAAM,KAAK,WAAW,OAAO,IAAI,EAAE,aAAa,kBAAkB,CAAC;IACrE,SAAS,OAAO;KACd,KAAK,OAAO,KAAK,uBAAuB;MACtC,UAAU,OAAO;MACjB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC9D,CAAC;IACH;GACF;GAEA,KAAK,OAAO,MAAM,+BAA+B;IAC/C,UAAU,OAAO;IACjB,iBAAiB,OAAO;GAC1B,CAAC;GACD,MAAM,SAAS,eAAe;IAC5B,YAAY,KAAK,MAAM,OAAO,sBAAsB,GAAM;IAC1D,QAAQ,KAAK;IACb,UAAU,QAAQ,OAAO;IACzB,KAAK,YAAY;KACf,MAAM,KAAK,WAAW,OAAO,EAAE;IACjC;GACF,CAAC;GAED,MAAM,UAAU,KAAK,gBAAgB,IAAI,OAAO,EAAE;GAClD,IAAI,SAAS;IACX,QAAQ,YAAY;GACtB;EACF;EAEA,KAAK,UAAU;CACjB;CAEA,OAAa;EACX,KAAK,MAAM,WAAW,KAAK,gBAAgB,OAAO,GAAG;GACnD,QAAQ,WAAW,KAAK;EAC1B;EAEA,KAAK,UAAU;CACjB;CAEA,MAAM,UAAqC;EACzC,MAAM,YAA8B,CAAC;EACrC,KAAK,MAAM,UAAU,KAAK,OAAO,SAAS;GACxC,UAAU,KAAK,MAAM,KAAK,WAAW,OAAO,EAAE,CAAC;EACjD;EACA,OAAO;CACT;CAEA,MAAM,WACJ,UACA,UAAqC,CAAC,GACb;EACzB,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,KAAK,OAAO,MAAM,cAAc;GAAE;GAAU,aAAa,QAAQ,gBAAgB;EAAM,CAAC;EACxF,MAAM,eAAe,KAAK,mBAAmB,QAAQ;EAErD,MAAM,gBAAgB,QAAQ;EAE9B,IAAI;GACF,KAAK,OAAO,MAAM,4BAA4B;IAC5C;IACA,gBAAgB,QAAQ,cAAc,KAAK;IAC3C,iBAAiB,QAAQ,cAAc,OAAO,YAAY;IAC1D,aAAa,QAAQ,gBAAgB;GACvC,CAAC;GACD,MAAM,QAAQ,MAAM,aAAa,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;GAC5E,KAAK,OAAO,MAAM,sCAAsC;IACtD;IACA,SAAS,KAAK,oBAAoB,QAAQ,CAAC,CAAC;IAC5C,cAAc,MAAM,gBAAgB,cAAc,OAAO;GAC3D,CAAC;GACD,MAAM,YAAY,MAAM,YAAY,KAAK,oBAAoB,QAAQ,CAAC,CAAC,SAAS,OAAO;IACrF,WAAW,KAAK,QAAQ;IACxB,WAAW,KAAK,OAAO;IACvB,QAAQ,KAAK;GACf,CAAC;GACD,KAAK,OAAO,MAAM,yCAAyC;IACzD;IACA,eAAe,UAAU;GAC3B,CAAC;GAED,MAAM,mBAAmB,mBACvB,WACA,KAAK,oBAAoB,QAAQ,CAAC,CAAC,aACrC;GACA,MAAM,OAAO,WAAW,cAAc,QAAQ,gBAAgB;GAC9D,KAAK,OAAO,MAAM,qCAAqC;IACrD;IACA,YAAY,iBAAiB;IAC7B,OAAO,KAAK,MAAM;IAClB,SAAS,KAAK,QAAQ;IACtB,SAAS,KAAK,QAAQ;GACxB,CAAC;GAED,MAAM,YAA+B;IACnC,GAAG;IACH,WAAW,KAAK,IAAI;IACpB,YAAY,KAAK,IAAI;IACrB;IACA;IACA,QAAQ;GACV;GAEA,MAAM,KAAK,WAAW,gBAAgB,SAAS;GAC/C,QAAQ,QAAQ;;;;GAKhB,MAAM,UAAU,KAAK,MAAM,SAAS,KAAK,QAAQ,SAAS,KAAK,QAAQ,SAAS;GAChF,KAAK,OAAO,UAAU,SAAS,QAAQ,CAAC,gBAAgB;IACtD;IACA,YAAY,iBAAiB;IAC7B,OAAO,KAAK,MAAM;IAClB,SAAS,KAAK,QAAQ;IACtB,SAAS,KAAK,QAAQ;GACxB,CAAC;GAED,OAAO;IACL;IACA,QAAQ;IACR,YAAY,UAAU;GACxB;EACF,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,eAAe;IAC/B;IACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;;GAGD,OAAO;IACL;IACA,QAAQ,cAAc;IACtB,YAAY,cAAc;GAC5B;EACF;CACF;CAEA,MAAM,kBACJ,UACA,UAAqC,CAAC,GACnB;EACnB,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,MAAM,eAAe,KAAK,mBAAmB,QAAQ;;;;;;EAOrD,KAAK,OAAO,MAAM,oCAAoC;GACpD;GACA,gBAAgB,QAAQ,QAAQ,MAAM,KAAK;GAC3C,iBAAiB,QAAQ,QAAQ,MAAM,OAAO,YAAY;GAC1D,aAAa,QAAQ,gBAAgB;EACvC,CAAC;EACD,MAAM,gBAAgB,QAAQ,MAAM;EACpC,MAAM,QAAQ,MAAM,aAAa,OAAO,EAAE,aAAa,QAAQ,YAAY,CAAC;EAC5E,IAAI,MAAM,gBAAgB,eAAe,aAAa;GACpD,KAAK,OAAO,MAAM,wCAAwC;IACxD;IACA,SAAS,QAAQ,MAAM,WAAW;IAClC,kBACE,OAAO,MAAM,cAAc,WACvB,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC,IAC7D;GACR,CAAC;EACH,OAAO;GACL,KAAK,OAAO,MAAM,4CAA4C;IAC5D;IACA,SAAS,QAAQ,MAAM,WAAW;GACpC,CAAC;EACH;EAEA,OAAO;CACT;CAEA,MAAM,kBAAkB,UAA2C;EACjE,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,IAAI,CAAC,QAAQ,MAAM,cAAc,QAAQ,MAAM,OAAO,WAAW,GAAG;GAClE,OAAO,KAAK,WAAW,QAAQ;EACjC;EAEA,OAAO;GACL;GACA,QAAQ,QAAQ,MAAM;GACtB,YAAY,QAAQ,MAAM;EAC5B;CACF;CAEA,gBAAgB,UAAqC;EACnD,MAAM,UAAU,KAAK,gBAAgB,IAAI,QAAQ;EACjD,IAAI,CAAC,SAAS;GACZ,MAAM,IAAI,MAAM,uCAAuC,UAAU;EACnE;EAEA,OAAO,CAAC,GAAG,QAAQ,MAAM,MAAM;CACjC;CAEA,oBAAoB,UAAoD;EACtE,MAAM,SAAS,KAAK,gBAAgB,QAAQ;EAC5C,OAAO,OAAO,YAAY,OAAO,KAAK,UAAU,CAAC,MAAM,IAAI,EAAE,MAAM,MAAM,YAAY,CAAC,CAAC,CAAC;CAC1F;CAEA,eAAe,UAAwC;EACrD,OAAO,KAAK,gBAAgB,IAAI,QAAQ,CAAC,EAAE,MAAM;CACnD;CAEA,AAAQ,oBAAoB,UAAkB;EAC5C,MAAM,SAAS,KAAK,OAAO,QAAQ,MAAM,SAAS,KAAK,OAAO,QAAQ;EACtE,IAAI,CAAC,QAAQ;GACX,MAAM,IAAI,MAAM,sBAAsB,UAAU;EAClD;EAEA,OAAO;CACT;AACF","names":[],"sources":["../src/plugin.ts"],"version":3,"file":"plugin.js","sourceRoot":""}

package/dist/scheduler.d.ts

@@ -1,4 +1,4 @@
-import type { Logger } from "./logging.js";
+import type { Logger } from "@vymalo/opencode-auth-core/lib";
 export interface SchedulerHandle {
 	stop(): void;
 }

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import type { TokenSet } from "@vymalo/opencode-auth-core/lib";
 export interface RawModel {
 	id: string;
 	[key: string]: unknown;
@@ -15,13 +16,6 @@ export interface ModelDiff {
 		after: string;
 	}>;
 }
-export interface TokenSet {
-	accessToken: string;
-	tokenType: string;
-	refreshToken?: string;
-	scope?: string;
-	expiresAt?: number;
-}
 export interface CachedServerState {
 	serverId: string;
 	updatedAt: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vymalo/opencode-oauth2",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "OpenCode plugin for OAuth2/OIDC-secured, OpenAI-compatible model providers with periodic model sync.",
   "license": "MIT",
   "author": "vymalo contributors",
@@ -47,7 +47,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@opencode-ai/plugin": "1.15.10"
+    "@opencode-ai/plugin": "1.15.10",
+    "@vymalo/opencode-auth-core": "0.15.0"
   },
   "devDependencies": {
     "@ai-sdk/openai": "^2.0.106",

package/dist/logging.d.ts

@@ -1,13 +0,0 @@
-export type LogLevel = "trace" | "debug" | "info" | "warn" | "error";
-export declare const LOG_LEVEL_PRIORITY: Record<LogLevel, number>;
-export interface LogFields {
-	[key: string]: unknown;
-}
-export interface Logger {
-	trace(event: string, fields?: LogFields): void;
-	debug(event: string, fields?: LogFields): void;
-	info(event: string, fields?: LogFields): void;
-	warn(event: string, fields?: LogFields): void;
-	error(event: string, fields?: LogFields): void;
-}
-export declare function createJsonConsoleLogger(minLevel?: LogLevel): Logger;

package/dist/logging.js

@@ -1,64 +0,0 @@
-export const LOG_LEVEL_PRIORITY = {
-	trace: 5,
-	debug: 10,
-	info: 20,
-	warn: 30,
-	error: 40
-};
-function redactFields(fields) {
-	if (!fields) {
-		return undefined;
-	}
-	const redacted = {};
-	for (const [key, value] of Object.entries(fields)) {
-		if (/token|secret|password/i.test(key)) {
-			redacted[key] = "[redacted]";
-			continue;
-		}
-		redacted[key] = value;
-	}
-	return redacted;
-}
-export function createJsonConsoleLogger(minLevel = "info") {
-	const minPriority = LOG_LEVEL_PRIORITY[minLevel];
-	const log = (level, event, fields) => {
-		if (LOG_LEVEL_PRIORITY[level] < minPriority) {
-			return;
-		}
-		const payload = {
-			ts: new Date().toISOString(),
-			level,
-			event,
-			...redactFields(fields) ?? {}
-		};
-		const line = JSON.stringify(payload);
-		if (level === "error") {
-			console.error(line);
-			return;
-		}
-		if (level === "warn") {
-			console.warn(line);
-			return;
-		}
-		console.log(line);
-	};
-	return {
-		trace(event, fields) {
-			log("trace", event, fields);
-		},
-		debug(event, fields) {
-			log("debug", event, fields);
-		},
-		info(event, fields) {
-			log("info", event, fields);
-		},
-		warn(event, fields) {
-			log("warn", event, fields);
-		},
-		error(event, fields) {
-			log("error", event, fields);
-		}
-	};
-}
-
-//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -1 +0,0 @@
-{"mappings":"AAEA,OAAO,MAAM,qBAA+C;CAC1D,OAAO;CACP,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;AACT;AAcA,SAAS,aAAa,QAA2C;CAC/D,IAAI,CAAC,QAAQ;EACX,OAAO;CACT;CAEA,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EACjD,IAAI,yBAAyB,KAAK,GAAG,GAAG;GACtC,SAAS,OAAO;GAChB;EACF;EACA,SAAS,OAAO;CAClB;CAEA,OAAO;AACT;AAEA,OAAO,SAAS,wBAAwB,WAAqB,QAAgB;CAC3E,MAAM,cAAc,mBAAmB;CAEvC,MAAM,OAAO,OAAiB,OAAe,WAA6B;EACxE,IAAI,mBAAmB,SAAS,aAAa;GAC3C;EACF;EAEA,MAAM,UAAU;GACd,IAAI,IAAI,KAAK,CAAC,CAAC,YAAY;GAC3B;GACA;GACA,GAAI,aAAa,MAAM,KAAK,CAAC;EAC/B;EAEA,MAAM,OAAO,KAAK,UAAU,OAAO;EACnC,IAAI,UAAU,SAAS;GACrB,QAAQ,MAAM,IAAI;GAClB;EACF;EAEA,IAAI,UAAU,QAAQ;GACpB,QAAQ,KAAK,IAAI;GACjB;EACF;EAEA,QAAQ,IAAI,IAAI;CAClB;CAEA,OAAO;EACL,MAAM,OAAO,QAAQ;GACnB,IAAI,SAAS,OAAO,MAAM;EAC5B;EACA,MAAM,OAAO,QAAQ;GACnB,IAAI,SAAS,OAAO,MAAM;EAC5B;EACA,KAAK,OAAO,QAAQ;GAClB,IAAI,QAAQ,OAAO,MAAM;EAC3B;EACA,KAAK,OAAO,QAAQ;GAClB,IAAI,QAAQ,OAAO,MAAM;EAC3B;EACA,MAAM,OAAO,QAAQ;GACnB,IAAI,SAAS,OAAO,MAAM;EAC5B;CACF;AACF","names":[],"sources":["../src/logging.ts"],"version":3,"file":"logging.js","sourceRoot":""}

package/dist/oauth/browser.d.ts

@@ -1 +0,0 @@
-export declare function openExternalUrl(url: string): Promise<void>;

package/dist/oauth/browser.js

@@ -1,33 +0,0 @@
-import { spawn } from "node:child_process";
-export async function openExternalUrl(url) {
-	await new Promise((resolve, reject) => {
-		let command;
-		let args;
-		if (process.platform === "darwin") {
-			command = "open";
-			args = [url];
-		} else if (process.platform === "win32") {
-			command = "cmd";
-			args = [
-				"/c",
-				"start",
-				"",
-				url
-			];
-		} else {
-			command = "xdg-open";
-			args = [url];
-		}
-		const child = spawn(command, args, {
-			stdio: "ignore",
-			detached: true
-		});
-		child.once("error", reject);
-		child.once("spawn", () => {
-			child.unref();
-			resolve();
-		});
-	});
-}
-
-//# sourceMappingURL=browser.js.map

package/dist/oauth/browser.js.map

@@ -1 +0,0 @@
-{"mappings":"AAAA,SAAS,aAAa;AAEtB,OAAO,eAAe,gBAAgB,KAA4B;CAChE,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,IAAI;EACJ,IAAI;EAEJ,IAAI,QAAQ,aAAa,UAAU;GACjC,UAAU;GACV,OAAO,CAAC,GAAG;EACb,OAAO,IAAI,QAAQ,aAAa,SAAS;GACvC,UAAU;GACV,OAAO;IAAC;IAAM;IAAS;IAAI;GAAG;EAChC,OAAO;GACL,UAAU;GACV,OAAO,CAAC,GAAG;EACb;EAEA,MAAM,QAAQ,MAAM,SAAS,MAAM;GACjC,OAAO;GACP,UAAU;EACZ,CAAC;EAED,MAAM,KAAK,SAAS,MAAM;EAC1B,MAAM,KAAK,eAAe;GACxB,MAAM,MAAM;GACZ,QAAQ;EACV,CAAC;CACH,CAAC;AACH","names":[],"sources":["../../src/oauth/browser.ts"],"version":3,"file":"browser.js","sourceRoot":""}

package/dist/oauth/client.d.ts

@@ -1,56 +0,0 @@
-import type { OAuthServerConfig } from "../config.js";
-import type { Logger } from "../logging.js";
-import type { TokenSet } from "../types.js";
-interface OAuthClientOptions {
-	fetchImpl?: typeof fetch;
-	logger: Logger;
-	timeoutMs: number;
-	onAuthorizationUrl?: (url: string) => Promise<void> | void;
-	tokenExpirySkewMs?: number;
-}
-export declare function toTokenSet(payload: Record<string, unknown>, options?: {
-	fallbackRefreshToken?: string;
-	requireRefreshToken?: boolean;
-}): TokenSet;
-export declare class OAuthClient {
-	private readonly server;
-	private readonly fetchImpl;
-	private readonly logger;
-	private readonly timeoutMs;
-	private readonly onAuthorizationUrl?;
-	private readonly tokenExpirySkewMs;
-	constructor(server: OAuthServerConfig, options: OAuthClientOptions);
-	private isTokenValid;
-	/**
-	* POST to a token endpoint with an AbortController-backed timeout. Without
-	* this, a stalled IdP would block the warmup path indefinitely (the plugin
-	* runs token requests at config-hook time for cached/client_credentials
-	* paths).
-	*/
-	private postWithTimeout;
-	ensureToken(current?: TokenSet, options?: {
-		interactive?: boolean;
-	}): Promise<TokenSet>;
-	private loginClientCredentials;
-	private loginJwtBearer;
-	private loginTokenExchange;
-	/**
-	* Shared driver for jwt_bearer and token_exchange. Both grants:
-	*   - resolve a platform-supplied JWT from `subjectTokenSource`
-	*   - POST it to the token endpoint with grant-specific form fields
-	*   - get back an access token (refresh token is NOT expected for either)
-	*/
-	private postFederatedGrant;
-	/**
-	* Resolve endpoints for the configured flow. Skips OIDC discovery entirely
-	* when the explicit endpoints needed for the flow are all present in config
-	* — discovery is unavailable on RFC 8414-only servers and on Keycloak
-	* realms where the well-known doc is locked down.
-	*/
-	private resolveEndpoints;
-	private hasExplicitEndpointsForFlow;
-	private refreshToken;
-	private loginDeviceCode;
-	private loginInteractive;
-}
-export {};