@vymalo/opencode-oauth2 0.2.0

package/dist/logging.d.ts

@@ -0,0 +1,11 @@
+export type LogLevel = "debug" | "info" | "warn" | "error";
+export interface LogFields {
+    [key: string]: unknown;
+}
+export interface Logger {
+    debug(event: string, fields?: LogFields): void;
+    info(event: string, fields?: LogFields): void;
+    warn(event: string, fields?: LogFields): void;
+    error(event: string, fields?: LogFields): void;
+}
+export declare function createJsonConsoleLogger(minLevel?: LogLevel): Logger;

package/dist/logging.js

@@ -0,0 +1,59 @@
+const LOG_LEVEL_PRIORITY = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40
+};
+function redactFields(fields) {
+    if (!fields) {
+        return undefined;
+    }
+    const redacted = {};
+    for (const [key, value] of Object.entries(fields)) {
+        if (/token|secret|password/i.test(key)) {
+            redacted[key] = "[redacted]";
+            continue;
+        }
+        redacted[key] = value;
+    }
+    return redacted;
+}
+export function createJsonConsoleLogger(minLevel = "info") {
+    const minPriority = LOG_LEVEL_PRIORITY[minLevel];
+    const log = (level, event, fields) => {
+        if (LOG_LEVEL_PRIORITY[level] < minPriority) {
+            return;
+        }
+        const payload = {
+            ts: new Date().toISOString(),
+            level,
+            event,
+            ...(redactFields(fields) ?? {})
+        };
+        const line = JSON.stringify(payload);
+        if (level === "error") {
+            console.error(line);
+            return;
+        }
+        if (level === "warn") {
+            console.warn(line);
+            return;
+        }
+        console.log(line);
+    };
+    return {
+        debug(event, fields) {
+            log("debug", event, fields);
+        },
+        info(event, fields) {
+            log("info", event, fields);
+        },
+        warn(event, fields) {
+            log("warn", event, fields);
+        },
+        error(event, fields) {
+            log("error", event, fields);
+        }
+    };
+}
+//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAEA,MAAM,kBAAkB,GAA6B;IACnD,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAaF,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,WAAqB,MAAM;IACjE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,GAAG,GAAG,CAAC,KAAe,EAAE,KAAa,EAAE,MAAkB,EAAQ,EAAE;QACvE,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,KAAK;YACL,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAChC,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,EAAE,MAAM;YACjB,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,MAAM;YAChB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,MAAM;YAChB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,MAAM;YACjB,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/model-discovery.d.ts

@@ -0,0 +1,9 @@
+import type { Logger } from "./logging.js";
+import type { RawModel, TokenSet } from "./types.js";
+export interface ModelDiscoveryOptions {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+    logger?: Logger;
+}
+export declare function buildModelsUrl(baseURL: string): string;
+export declare function fetchModels(baseURL: string, token: TokenSet, options?: ModelDiscoveryOptions): Promise<RawModel[]>;

package/dist/model-discovery.js

@@ -0,0 +1,74 @@
+import { readResponseBodyPreview, redactUrl, scrubSecrets } from "./oauth/http-utils.js";
+export function buildModelsUrl(baseURL) {
+    const url = new URL(baseURL);
+    const path = url.pathname.replace(/\/+$/, "");
+    if (path.endsWith("/v1")) {
+        url.pathname = `${path}/models`;
+    }
+    else {
+        url.pathname = `${path}/v1/models`;
+    }
+    return url.toString();
+}
+function parseModelsResponse(payload) {
+    const candidates = Array.isArray(payload)
+        ? payload
+        : payload && typeof payload === "object" && Array.isArray(payload.data)
+            ? payload.data
+            : [];
+    const models = [];
+    for (const item of candidates) {
+        if (!item || typeof item !== "object") {
+            continue;
+        }
+        const id = item.id;
+        if (typeof id !== "string" || id.length === 0) {
+            continue;
+        }
+        models.push(item);
+    }
+    return models;
+}
+export async function fetchModels(baseURL, token, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 15_000;
+    const modelsUrl = buildModelsUrl(baseURL);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(modelsUrl, {
+            method: "GET",
+            headers: {
+                Accept: "application/json",
+                Authorization: `${token.tokenType || "Bearer"} ${token.accessToken}`
+            },
+            signal: controller.signal
+        });
+        if (!response.ok) {
+            const safeUrl = redactUrl(modelsUrl);
+            // Log the body separately at warn-level so the structured logger's
+            // redaction filter has a chance to scrub matching keys, and so the body
+            // never lands inside a thrown error.message (which callers like
+            // syncServer log verbatim).
+            const preview = await readResponseBodyPreview(response, 500);
+            if (preview) {
+                options.logger?.warn("model_discovery_error_body", {
+                    modelsUrl: safeUrl,
+                    status: response.status,
+                    bodyPreview: scrubSecrets(preview)
+                });
+            }
+            throw new Error(`model discovery failed (${response.status}) at ${safeUrl}`);
+        }
+        const payload = (await response.json());
+        const models = parseModelsResponse(payload);
+        if (models.length === 0) {
+            options.logger?.warn("model_discovery_empty", { modelsUrl: redactUrl(modelsUrl) });
+        }
+        return models;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=model-discovery.js.map

package/dist/model-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-discovery.js","sourceRoot":"","sources":["../src/model-discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AASzF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,GAAG,GAAG,IAAI,SAAS,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,QAAQ,GAAG,GAAG,IAAI,YAAY,CAAC;IACrC,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,UAAU,GAAc,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAClD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,OAA8B,CAAC,IAAI,CAAC;YAC7F,CAAC,CAAE,OAA+B,CAAC,IAAI;YACvC,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QAED,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,IAAgB,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,KAAe,EACf,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;YAC1C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE;aACrE;YACD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACrC,mEAAmE;YACnE,wEAAwE;YACxE,gEAAgE;YAChE,4BAA4B;YAC5B,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC7D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,4BAA4B,EAAE;oBACjD,SAAS,EAAE,OAAO;oBAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,QAAQ,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/model-normalization.d.ts

@@ -0,0 +1,4 @@
+import type { ModelDiff, NormalizedModel, RawModel } from "./types.js";
+export declare function normalizeModelId(modelId: string, overrides?: Record<string, string>): string;
+export declare function normalizeModelList(models: RawModel[], overrides?: Record<string, string>): NormalizedModel[];
+export declare function diffModels(previous: NormalizedModel[], next: NormalizedModel[]): ModelDiff;

package/dist/model-normalization.js

@@ -0,0 +1,86 @@
+const TOKEN_OVERRIDES = {
+    ai: "AI",
+    api: "API",
+    cpu: "CPU",
+    gpu: "GPU",
+    glm: "GLM",
+    gpt: "GPT",
+    llm: "LLM",
+    nlp: "NLP",
+    ocr: "OCR",
+    tts: "TTS",
+    stt: "STT"
+};
+function titleCase(token) {
+    if (token.length === 0) {
+        return token;
+    }
+    return token[0].toUpperCase() + token.slice(1).toLowerCase();
+}
+function normalizeToken(token) {
+    const lower = token.toLowerCase();
+    if (TOKEN_OVERRIDES[lower]) {
+        return TOKEN_OVERRIDES[lower];
+    }
+    if (/^\d+$/.test(token)) {
+        return token;
+    }
+    if (/^\d+[a-z]$/i.test(token)) {
+        const suffix = token.at(-1)?.toLowerCase() ?? "";
+        if (["b", "k", "m", "g", "t"].includes(suffix)) {
+            return `${token.slice(0, -1)}${suffix.toUpperCase()}`;
+        }
+        return `${token.slice(0, -1)}${suffix}`;
+    }
+    if (/^[a-z]+\d+[a-z0-9]*$/i.test(token)) {
+        return token[0].toUpperCase() + token.slice(1).toLowerCase();
+    }
+    if (/^\d+[a-z]+$/i.test(token)) {
+        return `${token.match(/^\d+/)?.[0] ?? ""}${token.replace(/^\d+/, "").toLowerCase()}`;
+    }
+    return titleCase(token);
+}
+export function normalizeModelId(modelId, overrides) {
+    if (overrides?.[modelId]) {
+        return overrides[modelId];
+    }
+    const normalizedTokens = modelId
+        .split(/[-_/:]+/g)
+        .map((token) => token.trim())
+        .filter((token) => token.length > 0)
+        .map((token) => normalizeToken(token));
+    if (normalizedTokens.length === 0) {
+        return modelId;
+    }
+    return normalizedTokens.join(" ");
+}
+export function normalizeModelList(models, overrides) {
+    return models.map((model) => ({
+        id: model.id,
+        displayName: normalizeModelId(model.id, overrides)
+    }));
+}
+export function diffModels(previous, next) {
+    const previousMap = new Map(previous.map((model) => [model.id, model.displayName]));
+    const nextMap = new Map(next.map((model) => [model.id, model.displayName]));
+    const added = [];
+    const removed = [];
+    const renamed = [];
+    for (const [id, displayName] of nextMap.entries()) {
+        if (!previousMap.has(id)) {
+            added.push(id);
+            continue;
+        }
+        const previousName = previousMap.get(id);
+        if (previousName && previousName !== displayName) {
+            renamed.push({ id, before: previousName, after: displayName });
+        }
+    }
+    for (const id of previousMap.keys()) {
+        if (!nextMap.has(id)) {
+            removed.push(id);
+        }
+    }
+    return { added, removed, renamed };
+}
+//# sourceMappingURL=model-normalization.js.map

package/dist/model-normalization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-normalization.js","sourceRoot":"","sources":["../src/model-normalization.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAA2B;IAC9C,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAElC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAkC;IAClF,IAAI,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO;SAC7B,KAAK,CAAC,UAAU,CAAC;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAkB,EAClB,SAAkC;IAElC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC;KACnD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAA2B,EAAE,IAAuB;IAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAIR,EAAE,CAAC;IAER,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,YAAY,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC"}

package/dist/oauth/browser.d.ts

@@ -0,0 +1 @@
+export declare function openExternalUrl(url: string): Promise<void>;

package/dist/oauth/browser.js

@@ -0,0 +1,29 @@
+import { spawn } from "node:child_process";
+export async function openExternalUrl(url) {
+    await new Promise((resolve, reject) => {
+        let command;
+        let args;
+        if (process.platform === "darwin") {
+            command = "open";
+            args = [url];
+        }
+        else if (process.platform === "win32") {
+            command = "cmd";
+            args = ["/c", "start", "", url];
+        }
+        else {
+            command = "xdg-open";
+            args = [url];
+        }
+        const child = spawn(command, args, {
+            stdio: "ignore",
+            detached: true
+        });
+        child.once("error", reject);
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+}
+//# sourceMappingURL=browser.js.map

package/dist/oauth/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/oauth/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,IAAc,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,GAAG,KAAK,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,UAAU,CAAC;YACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/oauth/client.d.ts

@@ -0,0 +1,56 @@
+import type { OAuthServerConfig } from "../config.js";
+import type { Logger } from "../logging.js";
+import type { TokenSet } from "../types.js";
+interface OAuthClientOptions {
+    fetchImpl?: typeof fetch;
+    logger: Logger;
+    timeoutMs: number;
+    onAuthorizationUrl?: (url: string) => Promise<void> | void;
+    tokenExpirySkewMs?: number;
+}
+export declare function toTokenSet(payload: Record<string, unknown>, options?: {
+    fallbackRefreshToken?: string;
+    requireRefreshToken?: boolean;
+}): TokenSet;
+export declare class OAuthClient {
+    private readonly server;
+    private readonly fetchImpl;
+    private readonly logger;
+    private readonly timeoutMs;
+    private readonly onAuthorizationUrl?;
+    private readonly tokenExpirySkewMs;
+    constructor(server: OAuthServerConfig, options: OAuthClientOptions);
+    private isTokenValid;
+    /**
+     * POST to a token endpoint with an AbortController-backed timeout. Without
+     * this, a stalled IdP would block the warmup path indefinitely (the plugin
+     * runs token requests at config-hook time for cached/client_credentials
+     * paths).
+     */
+    private postWithTimeout;
+    ensureToken(current?: TokenSet, options?: {
+        interactive?: boolean;
+    }): Promise<TokenSet>;
+    private loginClientCredentials;
+    private loginJwtBearer;
+    private loginTokenExchange;
+    /**
+     * Shared driver for jwt_bearer and token_exchange. Both grants:
+     *   - resolve a platform-supplied JWT from `subjectTokenSource`
+     *   - POST it to the token endpoint with grant-specific form fields
+     *   - get back an access token (refresh token is NOT expected for either)
+     */
+    private postFederatedGrant;
+    /**
+     * Resolve endpoints for the configured flow. Skips OIDC discovery entirely
+     * when the explicit endpoints needed for the flow are all present in config
+     * — discovery is unavailable on RFC 8414-only servers and on Keycloak
+     * realms where the well-known doc is locked down.
+     */
+    private resolveEndpoints;
+    private hasExplicitEndpointsForFlow;
+    private refreshToken;
+    private loginDeviceCode;
+    private loginInteractive;
+}
+export {};