@vymalo/opencode-oauth2 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vymalo contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,213 @@
+# @vymalo/opencode-oauth2
+
+OAuth2/OIDC model sync plugin for OpenCode. This is the canonical configuration reference for the plugin. Long-form usage guides (CI cookbooks, Kubernetes manifests, troubleshooting) live in [`/docs/`](../../docs/) at the repo root.
+
+## What It Does
+
+- Registers OpenAI-compatible providers into OpenCode config
+- Supports five OAuth2 grants:
+  - `authorization_code` — interactive PKCE login (default)
+  - `device_code` — RFC 8628, for browserless user auth
+  - `client_credentials` — machine-to-machine via `clientSecret`
+  - `jwt_bearer` — RFC 7523, federated identity (e.g. GitHub Actions OIDC, K8s SA tokens) — no long-lived secret in CI
+  - `token_exchange` — RFC 8693, federated identity with explicit audience targeting
+- Stores and refreshes provider access tokens
+- Fetches and normalizes provider model catalogs
+- Injects `Authorization` headers at chat request time
+
+## Install
+
+Add plugin package to OpenCode:
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["@vymalo/opencode-oauth2"]
+}
+```
+
+## Configuration
+
+### Option A: Provider-embedded OAuth config (recommended)
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["@vymalo/opencode-oauth2"],
+  "provider": {
+    "example-ai": {
+      "name": "Example AI",
+      "options": {
+        "baseURL": "https://api.example.com/v1",
+        "oauth2": {
+          "issuer": "https://auth.example.com",
+          "clientId": "opencode-client",
+          "scopes": ["openid", "profile", "offline_access"],
+          "syncIntervalMinutes": 60,
+          "nameOverrides": {
+            "glm-5": "GLM 5"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+### Option B: `pluginConfig.oauth2ModelSync.servers`
+
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "plugin": ["@vymalo/opencode-oauth2"],
+  "pluginConfig": {
+    "oauth2ModelSync": {
+      "servers": [
+        {
+          "id": "example-ai",
+          "name": "Example AI",
+          "issuer": "https://auth.example.com",
+          "baseURL": "https://api.example.com/v1",
+          "clientId": "opencode-client",
+          "scopes": ["openid", "profile", "offline_access"],
+          "syncIntervalMinutes": 60,
+          "nameOverrides": {
+            "glm-5": "GLM 5"
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+### Optional fields
+
+These apply to both config shapes above.
+
+| Field | Default | Notes |
+| --- | --- | --- |
+| `clientSecret` | _(unset)_ | For confidential clients. Sent as `client_secret` on every token-endpoint POST. Never logged. Required for `authFlow: "client_credentials"`. Optional but commonly required for `jwt_bearer` / `token_exchange` with confidential clients. PKCE is still required for `authorization_code`. |
+| `authFlow` | `"authorization_code"` | One of `"authorization_code"`, `"device_code"`, `"client_credentials"`, `"jwt_bearer"`, `"token_exchange"`. |
+| `subjectTokenSource` | _(required for `jwt_bearer` / `token_exchange`)_ | Where to read the platform JWT to present as the subject token. See [Federated identity](#federated-identity-no-long-lived-secrets-in-ci) below. |
+| `tokenExchangeAudience` | _(unset)_ | Optional `audience` parameter for the `token_exchange` grant. |
+| `deviceAuthorizationEndpoint` | discovered | Override for the device authorization endpoint. Otherwise discovered from `device_authorization_endpoint` in the OIDC metadata. Only used when `authFlow === "device_code"`. |
+| `authorizationEndpoint` | discovered | Override for the authorization endpoint. |
+| `tokenEndpoint` | discovered | Override for the token endpoint. |
+| `redirectPort` | random | Fixed port for the local callback server (authorization-code only). |
+| `nameOverrides` | `{}` | Map of model id → friendly display name. Applied during catalog normalization. |
+| `syncIntervalMinutes` | `60` | Per-server scheduler interval. Failures preserve the last-known-good model list. |
+| `jwksUri` | _(unset)_ | Reserved; not currently used at runtime. |
+
+Plus the top-level `pluginConfig.oauth2ModelSync` block accepts:
+
+| Field | Default | Notes |
+| --- | --- | --- |
+| `cacheNamespace` | `"opencode-oauth2-model-sync"` (OpenCode-hosted) / `"oauth2-model-sync"` (standalone) | Subdirectory under the OS cache root. See [architecture.md](../../docs/architecture.md#cache-layout) for the path table per OS. |
+| `httpTimeoutMs` | `15000` | Timeout for token-endpoint / `/models` round trips. |
+| `tokenExpirySkewMs` | `30000` | Treat a token as expired this many ms before its real `expiresAt`. |
+
+## Federated identity (no long-lived secrets in CI)
+
+For CI runners and Kubernetes workloads, the modern best practice is to skip stored client secrets entirely and use the platform's own short-lived OIDC token to authenticate. `@vymalo/opencode-oauth2` supports this via the **`jwt_bearer`** (RFC 7523) and **`token_exchange`** (RFC 8693) grants.
+
+The plugin reads the platform JWT at token-acquisition time (never caches it) and presents it to your OAuth server as proof of identity. The OAuth server validates the JWT signature against the platform's JWKS, applies your IdP's policy, and returns an access token.
+
+`subjectTokenSource` tells the plugin where to read the JWT:
+
+| `type` | Reads from | Required fields |
+| --- | --- | --- |
+| `github_actions` | `ACTIONS_ID_TOKEN_REQUEST_URL` + `ACTIONS_ID_TOKEN_REQUEST_TOKEN` env vars | `audience` |
+| `kubernetes_sa` | Projected service-account token file (default `/var/run/secrets/tokens/oauth2/token`) | _(optional `tokenPath`)_ |
+| `file` | Arbitrary file path | `path` |
+| `env` | Environment variable (dev/test only) | `var` |
+
+End-to-end recipes:
+
+- **GitHub Actions** — see [`docs/github-actions.md`](../../docs/github-actions.md) for the Keycloak / Auth0 / Okta setup walkthroughs, the reusable workflow at [`.github/workflows/opencode-run.yml`](../../.github/workflows/opencode-run.yml), matrix builds, audience pinning, and fork-PR limitations.
+- **Kubernetes** — see [`docs/kubernetes.md`](../../docs/kubernetes.md) for the `CronJob` (headline), `Job`, and `Deployment` manifests, multi-provider pods, IdP setup with Keycloak/Dex, and RBAC notes (spoiler: you need almost none).
+
+### Quick GHA reference
+
+```jsonc
+{
+  "provider": {
+    "example-ai": {
+      "options": {
+        "baseURL": "https://api.example.com/v1",
+        "oauth2": {
+          "issuer": "https://auth.example.com/realms/example",
+          "clientId": "ci-runner",
+          "scopes": ["openid"],
+          "authFlow": "jwt_bearer",
+          "subjectTokenSource": {
+            "type": "github_actions",
+            "audience": "https://auth.example.com/realms/example"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+Workflow needs `permissions: { id-token: write }`. No `clientSecret` anywhere.
+
+### Quick Kubernetes reference
+
+```jsonc
+{
+  "provider": {
+    "example-ai": {
+      "options": {
+        "baseURL": "https://api.example.com/v1",
+        "oauth2": {
+          "issuer": "https://auth.example.com/realms/example",
+          "clientId": "k8s-runner",
+          "scopes": ["openid"],
+          "authFlow": "jwt_bearer",
+          "subjectTokenSource": {
+            "type": "kubernetes_sa"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The pod must mount a projected `serviceAccountToken` at `/var/run/secrets/tokens/oauth2/token` with the IdP's expected `audience`. The projected token rotates automatically (kubelet refreshes it); the plugin re-reads on every access-token expiry, so rotation is transparent. Full manifests in [`docs/kubernetes.md`](../../docs/kubernetes.md).
+
+### Choosing between `jwt_bearer` and `token_exchange`
+
+- **`jwt_bearer`** is the standard federated grant. Single POST: `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`, `assertion=<JWT>`. Keycloak, Auth0, Okta all support it. **Start here.**
+- **`token_exchange`** (RFC 8693) is more general — supports `subject_token_type`, `actor_token`, `requested_token_type`, and an explicit `audience` claim. Use only when your IdP requires it or when you need the audience targeting (set `tokenExchangeAudience`).
+
+## OAuth Token Requirements
+
+Refresh tokens are mandatory for the flows that issue them (`authorization_code`, `device_code`).
+
+- Initial token exchange for those flows must return `refresh_token`; missing → rejected.
+- Cached tokens missing `refreshToken` are invalidated on load (unless the flow doesn't issue one — `client_credentials`, `jwt_bearer`, `token_exchange`).
+- Refresh flow preserves the previous refresh token when providers omit it in refresh responses.
+
+## Hooks Used
+
+- `config`: register/patch provider config and merge cached discovered models
+- `chat.headers`: ensure valid token and set `Authorization` header
+
+See [architecture.md](../../docs/architecture.md#the-two-hooks) for the full hook semantics.
+
+## Development
+
+```sh
+pnpm --filter @vymalo/opencode-oauth2 typecheck
+pnpm --filter @vymalo/opencode-oauth2 test
+pnpm --filter @vymalo/opencode-oauth2 build
+```
+
+## Exports
+
+- `OpencodeOauth2Plugin` (default OpenCode plugin export)
+- `createOpencodeOauth2Plugin()` (factory for testing / custom wiring)
+- `OAuth2ModelSyncPlugin` (runtime orchestrator — useful for embedding outside OpenCode)

package/dist/cache.d.ts

@@ -0,0 +1,9 @@
+import type { CachedServerState } from "./types.js";
+export declare function resolveCacheDir(namespace: string): string;
+export declare class FileCacheStore {
+    private readonly baseDir;
+    constructor(baseDir: string);
+    ensureReady(): Promise<void>;
+    loadServerState(serverId: string): Promise<CachedServerState | undefined>;
+    saveServerState(state: CachedServerState): Promise<void>;
+}

package/dist/cache.js

@@ -0,0 +1,91 @@
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+function resolveDefaultCacheRoot() {
+    if (process.platform === "win32") {
+        return process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local");
+    }
+    if (process.platform === "darwin") {
+        return join(homedir(), "Library", "Caches");
+    }
+    return process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
+}
+export function resolveCacheDir(namespace) {
+    return join(resolveDefaultCacheRoot(), "opencode-oauth2", namespace);
+}
+function statePath(baseDir, serverId) {
+    return join(baseDir, `${serverId}.json`);
+}
+function hasValidTokenShape(token) {
+    if (!token || typeof token !== "object" || Array.isArray(token)) {
+        return false;
+    }
+    const candidate = token;
+    if (typeof candidate.accessToken !== "string" ||
+        candidate.accessToken.length === 0 ||
+        typeof candidate.tokenType !== "string" ||
+        candidate.tokenType.length === 0) {
+        return false;
+    }
+    // refreshToken is optional: client_credentials grant never returns one.
+    // When present, it must be a non-empty string.
+    if (candidate.refreshToken !== undefined) {
+        return typeof candidate.refreshToken === "string" && candidate.refreshToken.length > 0;
+    }
+    return true;
+}
+export class FileCacheStore {
+    baseDir;
+    constructor(baseDir) {
+        this.baseDir = baseDir;
+    }
+    async ensureReady() {
+        await mkdir(this.baseDir, { recursive: true, mode: 0o700 });
+    }
+    async loadServerState(serverId) {
+        const filePath = statePath(this.baseDir, serverId);
+        try {
+            const content = await readFile(filePath, "utf8");
+            const parsed = JSON.parse(content);
+            if (!parsed || parsed.serverId !== serverId) {
+                return undefined;
+            }
+            if (!Array.isArray(parsed.models) || !Array.isArray(parsed.rawModels)) {
+                return undefined;
+            }
+            if (parsed.token && !hasValidTokenShape(parsed.token)) {
+                parsed.token = undefined;
+            }
+            return parsed;
+        }
+        catch (error) {
+            if (typeof error === "object" &&
+                error &&
+                "code" in error &&
+                error.code === "ENOENT") {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    async saveServerState(state) {
+        const filePath = statePath(this.baseDir, state.serverId);
+        const tempPath = `${filePath}.tmp`;
+        await mkdir(dirname(filePath), { recursive: true, mode: 0o700 });
+        const serialized = JSON.stringify(state, null, 2);
+        await writeFile(tempPath, serialized, {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: fsConstants.O_CREAT | fsConstants.O_TRUNC | fsConstants.O_WRONLY
+        });
+        await rename(tempPath, filePath);
+        try {
+            await chmod(filePath, 0o600);
+        }
+        catch {
+            // Some filesystems may ignore chmod semantics; keep operation non-fatal.
+        }
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIlC,SAAS,uBAAuB;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,IAAI,CAAC,uBAAuB,EAAE,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,QAAgB;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IACE,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAClC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;YAExD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;YAC3B,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK;gBACL,MAAM,IAAI,KAAK;gBACd,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAC7C,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAwB;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,GAAG,QAAQ,MAAM,CAAC;QAEnC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE;YACpC,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ;SACvE,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;CACF"}

package/dist/config.d.ts

@@ -0,0 +1,97 @@
+export declare const DEFAULT_SYNC_INTERVAL_MINUTES = 60;
+export declare const DEFAULT_HTTP_TIMEOUT_MS = 15000;
+export declare const DEFAULT_TOKEN_EXPIRY_SKEW_MS = 30000;
+export type OAuthAuthFlow = "authorization_code" | "device_code" | "client_credentials" | "jwt_bearer" | "token_exchange";
+export declare const DEFAULT_AUTH_FLOW: OAuthAuthFlow;
+/**
+ * Where to read the platform-supplied JWT that the plugin presents as the
+ * subject token / assertion for the `jwt_bearer` and `token_exchange` flows.
+ *
+ * - `github_actions` — fetches the OIDC token from the GitHub Actions runtime
+ *   via `ACTIONS_ID_TOKEN_REQUEST_URL` + `ACTIONS_ID_TOKEN_REQUEST_TOKEN`,
+ *   with the workflow-declared `audience`. The `id-token: write` permission
+ *   is required on the job.
+ * - `kubernetes_sa` — reads a projected service-account token from the pod
+ *   filesystem. Default path `/var/run/secrets/tokens/oauth2/token`; mount a
+ *   `projected.sources.serviceAccountToken` volume with the OIDC issuer as
+ *   the audience.
+ * - `file` — reads any JWT from disk. Useful when an external sidecar
+ *   refreshes the token to a fixed path.
+ * - `env` — reads the JWT from a named environment variable. Mostly useful
+ *   for tests and ad-hoc shells.
+ */
+export type SubjectTokenSource = {
+    type: "github_actions";
+    audience: string;
+} | {
+    type: "kubernetes_sa";
+    tokenPath?: string;
+} | {
+    type: "file";
+    path: string;
+} | {
+    type: "env";
+    var: string;
+};
+export declare const DEFAULT_K8S_SA_TOKEN_PATH = "/var/run/secrets/tokens/oauth2/token";
+export interface OAuthServerConfigInput {
+    id: string;
+    name?: string;
+    issuer: string;
+    baseURL: string;
+    clientId: string;
+    clientSecret?: string;
+    scopes: string[];
+    syncIntervalMinutes?: number;
+    nameOverrides?: Record<string, string>;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    deviceAuthorizationEndpoint?: string;
+    jwksUri?: string;
+    redirectPort?: number;
+    authFlow?: OAuthAuthFlow;
+    /**
+     * Required for `jwt_bearer` and `token_exchange`. Tells the plugin where to
+     * read the platform JWT it should present as the subject token.
+     */
+    subjectTokenSource?: SubjectTokenSource;
+    /**
+     * Optional `audience` parameter for the `token_exchange` grant — the
+     * intended recipient of the resulting access token. Set this when the
+     * OAuth server expects an explicit audience claim distinct from the
+     * issuer.
+     */
+    tokenExchangeAudience?: string;
+}
+export interface OAuth2ModelSyncConfigInput {
+    servers: OAuthServerConfigInput[];
+    cacheNamespace?: string;
+    httpTimeoutMs?: number;
+    tokenExpirySkewMs?: number;
+}
+export interface OAuthServerConfig {
+    id: string;
+    name: string;
+    issuer: string;
+    baseURL: string;
+    clientId: string;
+    clientSecret?: string;
+    scopes: string[];
+    syncIntervalMinutes: number;
+    nameOverrides: Record<string, string>;
+    authorizationEndpoint?: string;
+    tokenEndpoint?: string;
+    deviceAuthorizationEndpoint?: string;
+    jwksUri?: string;
+    redirectPort?: number;
+    authFlow: OAuthAuthFlow;
+    subjectTokenSource?: SubjectTokenSource;
+    tokenExchangeAudience?: string;
+}
+export interface OAuth2ModelSyncConfig {
+    servers: OAuthServerConfig[];
+    cacheNamespace: string;
+    httpTimeoutMs: number;
+    tokenExpirySkewMs: number;
+}
+export declare function validateConfig(input: OAuth2ModelSyncConfigInput): OAuth2ModelSyncConfig;

package/dist/config.js

@@ -0,0 +1,179 @@
+export const DEFAULT_SYNC_INTERVAL_MINUTES = 60;
+export const DEFAULT_HTTP_TIMEOUT_MS = 15_000;
+export const DEFAULT_TOKEN_EXPIRY_SKEW_MS = 30_000;
+export const DEFAULT_AUTH_FLOW = "authorization_code";
+export const DEFAULT_K8S_SA_TOKEN_PATH = "/var/run/secrets/tokens/oauth2/token";
+function ensureString(value, path) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`${path} must be a non-empty string`);
+    }
+    return value.trim();
+}
+function ensureStringArray(value, path) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new Error(`${path} must be a non-empty array of strings`);
+    }
+    return value.map((item, index) => ensureString(item, `${path}[${index}]`));
+}
+function validateRedirectPort(value, path) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value !== "number" || !Number.isInteger(value) || value <= 0 || value >= 65536) {
+        throw new Error(`${path} must be a positive integer less than 65536`);
+    }
+    return value;
+}
+function validateAuthFlow(value, path) {
+    if (value === undefined || value === null) {
+        return DEFAULT_AUTH_FLOW;
+    }
+    if (value === "authorization_code" ||
+        value === "device_code" ||
+        value === "client_credentials" ||
+        value === "jwt_bearer" ||
+        value === "token_exchange") {
+        return value;
+    }
+    throw new Error(`${path} must be one of "authorization_code" | "device_code" | "client_credentials" | "jwt_bearer" | "token_exchange" (received ${JSON.stringify(value)})`);
+}
+function validateSubjectTokenSource(value, path) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${path} must be an object`);
+    }
+    const record = value;
+    const type = record.type;
+    switch (type) {
+        case "github_actions": {
+            const audience = record.audience;
+            if (typeof audience !== "string" || audience.trim().length === 0) {
+                throw new Error(`${path}.audience must be a non-empty string when type is "github_actions"`);
+            }
+            return { type: "github_actions", audience: audience.trim() };
+        }
+        case "kubernetes_sa": {
+            const tokenPath = record.tokenPath;
+            if (tokenPath !== undefined && tokenPath !== null) {
+                if (typeof tokenPath !== "string" || tokenPath.trim().length === 0) {
+                    throw new Error(`${path}.tokenPath must be a non-empty string when provided`);
+                }
+                return { type: "kubernetes_sa", tokenPath: tokenPath.trim() };
+            }
+            return { type: "kubernetes_sa" };
+        }
+        case "file": {
+            const filePath = record.path;
+            if (typeof filePath !== "string" || filePath.trim().length === 0) {
+                throw new Error(`${path}.path must be a non-empty string when type is "file"`);
+            }
+            return { type: "file", path: filePath.trim() };
+        }
+        case "env": {
+            const varName = record.var;
+            if (typeof varName !== "string" || varName.trim().length === 0) {
+                throw new Error(`${path}.var must be a non-empty string when type is "env"`);
+            }
+            return { type: "env", var: varName.trim() };
+        }
+        default:
+            throw new Error(`${path}.type must be one of "github_actions" | "kubernetes_sa" | "file" | "env" (received ${JSON.stringify(type)})`);
+    }
+}
+function normalizeServerConfig(input, index) {
+    const path = `servers[${index}]`;
+    const id = ensureString(input.id, `${path}.id`);
+    const name = input.name && input.name.trim().length > 0 ? input.name.trim() : id;
+    const issuer = ensureString(input.issuer, `${path}.issuer`);
+    const baseURL = ensureString(input.baseURL, `${path}.baseURL`);
+    const clientId = ensureString(input.clientId, `${path}.clientId`);
+    const scopes = ensureStringArray(input.scopes, `${path}.scopes`);
+    const syncIntervalMinutes = typeof input.syncIntervalMinutes === "number" &&
+        Number.isFinite(input.syncIntervalMinutes) &&
+        input.syncIntervalMinutes > 0
+        ? input.syncIntervalMinutes
+        : DEFAULT_SYNC_INTERVAL_MINUTES;
+    const redirectPort = validateRedirectPort(input.redirectPort, `${path}.redirectPort`);
+    const authFlow = validateAuthFlow(input.authFlow, `${path}.authFlow`);
+    const subjectTokenSource = validateSubjectTokenSource(input.subjectTokenSource, `${path}.subjectTokenSource`);
+    let clientSecret;
+    if (input.clientSecret !== undefined && input.clientSecret !== null) {
+        if (typeof input.clientSecret !== "string" || input.clientSecret.length === 0) {
+            throw new Error(`${path}.clientSecret must be a non-empty string when provided`);
+        }
+        clientSecret = input.clientSecret;
+    }
+    if (authFlow === "client_credentials" && !clientSecret) {
+        throw new Error(`${path}.clientSecret is required when authFlow is "client_credentials"`);
+    }
+    if ((authFlow === "jwt_bearer" || authFlow === "token_exchange") && !subjectTokenSource) {
+        throw new Error(`${path}.subjectTokenSource is required when authFlow is "${authFlow}" — set it to {type: "github_actions" | "kubernetes_sa" | "file" | "env", ...}`);
+    }
+    let tokenExchangeAudience;
+    if (input.tokenExchangeAudience !== undefined && input.tokenExchangeAudience !== null) {
+        if (typeof input.tokenExchangeAudience !== "string" ||
+            input.tokenExchangeAudience.trim().length === 0) {
+            throw new Error(`${path}.tokenExchangeAudience must be a non-empty string when provided`);
+        }
+        tokenExchangeAudience = input.tokenExchangeAudience.trim();
+    }
+    return {
+        id,
+        name,
+        issuer,
+        baseURL,
+        clientId,
+        clientSecret,
+        scopes,
+        syncIntervalMinutes,
+        nameOverrides: input.nameOverrides ?? {},
+        authorizationEndpoint: input.authorizationEndpoint,
+        tokenEndpoint: input.tokenEndpoint,
+        deviceAuthorizationEndpoint: input.deviceAuthorizationEndpoint,
+        jwksUri: input.jwksUri,
+        redirectPort,
+        authFlow,
+        subjectTokenSource,
+        tokenExchangeAudience
+    };
+}
+export function validateConfig(input) {
+    if (!input || typeof input !== "object") {
+        throw new Error("plugin config must be an object");
+    }
+    if (!Array.isArray(input.servers) || input.servers.length === 0) {
+        throw new Error("servers must be a non-empty array");
+    }
+    const normalizedServers = input.servers.map(normalizeServerConfig);
+    const ids = new Set();
+    for (const server of normalizedServers) {
+        if (ids.has(server.id)) {
+            throw new Error(`duplicate server id detected: ${server.id}`);
+        }
+        ids.add(server.id);
+    }
+    let tokenExpirySkewMs = DEFAULT_TOKEN_EXPIRY_SKEW_MS;
+    if (input.tokenExpirySkewMs !== undefined && input.tokenExpirySkewMs !== null) {
+        if (typeof input.tokenExpirySkewMs !== "number" ||
+            !Number.isFinite(input.tokenExpirySkewMs) ||
+            input.tokenExpirySkewMs <= 0) {
+            throw new Error("tokenExpirySkewMs must be a positive number");
+        }
+        tokenExpirySkewMs = input.tokenExpirySkewMs;
+    }
+    return {
+        servers: normalizedServers,
+        cacheNamespace: typeof input.cacheNamespace === "string" && input.cacheNamespace.trim().length > 0
+            ? input.cacheNamespace.trim()
+            : "oauth2-model-sync",
+        httpTimeoutMs: typeof input.httpTimeoutMs === "number" &&
+            Number.isFinite(input.httpTimeoutMs) &&
+            input.httpTimeoutMs > 0
+            ? input.httpTimeoutMs
+            : DEFAULT_HTTP_TIMEOUT_MS,
+        tokenExpirySkewMs
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAChD,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AASnD,MAAM,CAAC,MAAM,iBAAiB,GAAkB,oBAAoB,CAAC;AAyBrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAkEhF,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAY;IACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,IACE,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,oBAAoB;QAC9B,KAAK,KAAK,YAAY;QACtB,KAAK,KAAK,gBAAgB,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,2HAA2H,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAC3J,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,oEAAoE,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qDAAqD,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;YAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;YAC3B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oDAAoD,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,sFAAsF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CACrH,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA6B,EAAE,KAAa;IACzE,MAAM,IAAI,GAAG,WAAW,KAAK,GAAG,CAAC;IAEjC,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;IAEjE,MAAM,mBAAmB,GACvB,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;QAC7C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC1C,KAAK,CAAC,mBAAmB,GAAG,CAAC;QAC3B,CAAC,CAAC,KAAK,CAAC,mBAAmB;QAC3B,CAAC,CAAC,6BAA6B,CAAC;IAEpC,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IACtE,MAAM,kBAAkB,GAAG,0BAA0B,CACnD,KAAK,CAAC,kBAAkB,EACxB,GAAG,IAAI,qBAAqB,CAC7B,CAAC;IAEF,IAAI,YAAgC,CAAC;IACrC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACpE,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;QACnF,CAAC;QACD,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ,KAAK,oBAAoB,IAAI,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iEAAiE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qDAAqD,QAAQ,gFAAgF,CACrJ,CAAC;IACJ,CAAC;IAED,IAAI,qBAAyC,CAAC;IAC9C,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACtF,IACE,OAAO,KAAK,CAAC,qBAAqB,KAAK,QAAQ;YAC/C,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iEAAiE,CAAC,CAAC;QAC5F,CAAC;QACD,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,EAAE;QACF,IAAI;QACJ,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,mBAAmB;QACnB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;QACxC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY;QACZ,QAAQ;QACR,kBAAkB;QAClB,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiC;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,iBAAiB,GAAG,4BAA4B,CAAC;IACrD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC9E,IACE,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACzC,KAAK,CAAC,iBAAiB,IAAI,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,cAAc,EACZ,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAChF,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;YAC7B,CAAC,CAAC,mBAAmB;QACzB,aAAa,EACX,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;YACvC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC;YACpC,KAAK,CAAC,aAAa,GAAG,CAAC;YACrB,CAAC,CAAC,KAAK,CAAC,aAAa;YACrB,CAAC,CAAC,uBAAuB;QAC7B,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { DEFAULT_HTTP_TIMEOUT_MS, DEFAULT_SYNC_INTERVAL_MINUTES, type OAuth2ModelSyncConfig, type OAuth2ModelSyncConfigInput, type OAuthServerConfig, type OAuthServerConfigInput, validateConfig } from "./config.js";
+export { createJsonConsoleLogger, type LogLevel, type Logger } from "./logging.js";
+export { buildModelsUrl, fetchModels } from "./model-discovery.js";
+export { diffModels, normalizeModelId, normalizeModelList } from "./model-normalization.js";
+export { OAuth2ModelSyncPlugin, type PluginOptions } from "./plugin.js";
+export { resolveCacheDir, FileCacheStore } from "./cache.js";
+export { createOpencodeOauth2Plugin, OpencodeOauth2Plugin, OpencodeOauth2Plugin as default } from "./opencode.js";
+export type { OpenCodePluginFactoryOptions } from "./opencode.js";
+export type { CachedServerState, ModelDiff, NormalizedModel, RawModel, ServerSnapshot, TokenSet } from "./types.js";

package/dist/index.js

@@ -0,0 +1,8 @@
+export { DEFAULT_HTTP_TIMEOUT_MS, DEFAULT_SYNC_INTERVAL_MINUTES, validateConfig } from "./config.js";
+export { createJsonConsoleLogger } from "./logging.js";
+export { buildModelsUrl, fetchModels } from "./model-discovery.js";
+export { diffModels, normalizeModelId, normalizeModelList } from "./model-normalization.js";
+export { OAuth2ModelSyncPlugin } from "./plugin.js";
+export { resolveCacheDir, FileCacheStore } from "./cache.js";
+export { createOpencodeOauth2Plugin, OpencodeOauth2Plugin, OpencodeOauth2Plugin as default } from "./opencode.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAK7B,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,uBAAuB,EAA8B,MAAM,cAAc,CAAC;AAEnF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAE,qBAAqB,EAAsB,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,IAAI,OAAO,EAChC,MAAM,eAAe,CAAC"}