@agentorg/cli 0.0.5 → 0.0.6

package/dist/node_modules/chatgpt/dist/src/file-store.js

@@ -0,0 +1,68 @@
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+/**
+ * The sign-in, in one private file, read each time so nothing is held that the file no longer says.
+ * Each change is on disk before it is acknowledged, since a refresh token that rotated can't be had
+ * again. A file that can't be read is removed, and the person signs in again; nothing of it is ever
+ * logged, a parse error's text included.
+ */
+export function fileStore(dir, log) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const path = join(dir, "sign-in.json");
+    const read = () => {
+        const values = new Map();
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return values;
+            throw error;
+        }
+        try {
+            for (const [key, value] of Object.entries(JSON.parse(raw)))
+                values.set(key, value);
+        }
+        catch {
+            rmSync(path);
+            log.error("The sign-in file couldn't be read, so it was removed: sign in again.");
+        }
+        return values;
+    };
+    const save = (values) => {
+        const temporary = `${path}.tmp`;
+        writeFileSync(temporary, JSON.stringify(Object.fromEntries(values)), {
+            mode: 0o600,
+            flush: true,
+        });
+        renameSync(temporary, path);
+        const folder = openSync(dir, "r");
+        try {
+            fsyncSync(folder);
+        }
+        finally {
+            closeSync(folder);
+        }
+    };
+    return {
+        get: async ({ key }) => {
+            const values = read();
+            return values.has(key) ? { value: values.get(key) } : {};
+        },
+        set: async ({ key, value }) => {
+            const values = read();
+            values.set(key, value);
+            save(values);
+            return {};
+        },
+        delete: async ({ key }) => {
+            const values = read();
+            const deleted = values.delete(key);
+            if (deleted)
+                save(values);
+            return { deleted };
+        },
+    };
+}

package/dist/node_modules/chatgpt/dist/src/index.d.ts

@@ -0,0 +1 @@
+export { type ChatGPT, type ChatGPTOptions, startChatGPT } from "./program.js";

package/dist/node_modules/chatgpt/dist/src/index.js

@@ -0,0 +1 @@
+export { startChatGPT } from "./program.js";

package/dist/node_modules/chatgpt/dist/src/jwt.d.ts

@@ -0,0 +1,15 @@
+import type { webcrypto } from "node:crypto";
+export type Claims = Record<string, unknown>;
+export type Jwk = webcrypto.JsonWebKey & {
+    kid?: string;
+};
+/**
+ * An id_token's claims, once its RS256 signature checks against one of the issuer's keys and its
+ * issuer, audience, expiry and (when given) nonce are right. Anything else throws.
+ */
+export declare function verifyIdToken(token: string, keys: Jwk[], expect: {
+    issuer: string;
+    audience: string;
+    nonce?: string;
+    now: number;
+}): Promise<Claims>;

package/dist/node_modules/chatgpt/dist/src/jwt.js

@@ -0,0 +1,37 @@
+import { fromBase64url } from "./encoding.js";
+function part(text) {
+    if (!text)
+        throw new Error("malformed token");
+    const value = JSON.parse(new TextDecoder().decode(fromBase64url(text)));
+    if (typeof value !== "object" || value === null)
+        throw new Error("malformed token");
+    return value;
+}
+/**
+ * An id_token's claims, once its RS256 signature checks against one of the issuer's keys and its
+ * issuer, audience, expiry and (when given) nonce are right. Anything else throws.
+ */
+export async function verifyIdToken(token, keys, expect) {
+    const [header, payload, signature] = token.split(".");
+    const head = part(header);
+    if (head.alg !== "RS256")
+        throw new Error("unexpected signing algorithm");
+    const jwk = keys.find((key) => key.kty === "RSA" && (head.kid === undefined || key.kid === head.kid));
+    if (!jwk || signature === undefined)
+        throw new Error("no matching signing key");
+    const key = await crypto.subtle.importKey("jwk", { kty: jwk.kty, n: jwk.n, e: jwk.e, alg: "RS256", ext: true }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    const signed = new TextEncoder().encode(`${header}.${payload}`);
+    if (!(await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, fromBase64url(signature), signed)))
+        throw new Error("bad signature");
+    const claims = part(payload);
+    const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (claims.iss !== expect.issuer)
+        throw new Error("unexpected issuer");
+    if (!audience.includes(expect.audience))
+        throw new Error("unexpected audience");
+    if (typeof claims.exp !== "number" || claims.exp * 1000 < expect.now - 60_000)
+        throw new Error("expired");
+    if (expect.nonce !== undefined && claims.nonce !== expect.nonce)
+        throw new Error("unexpected nonce");
+    return claims;
+}

package/dist/node_modules/chatgpt/dist/src/oauth.d.ts

@@ -0,0 +1,43 @@
+/** OpenAI's Sign in with ChatGPT endpoints and grants, for plan usage by an open-source app. */
+import type { Jwk } from "./jwt.js";
+export declare const ISSUER = "https://auth.openai.com";
+export declare const AUTHORIZE = "https://auth.openai.com/api/accounts/authorize";
+export declare const TOKEN = "https://auth.openai.com/api/accounts/oauth/token";
+/** The audience of the tokens: the Responses API. */
+export declare const RESOURCE = "https://api.openai.com/v1";
+/** The scope that lets the tokens draw on the person's ChatGPT plan. */
+export declare const PLAN_SCOPE = "chatgpt.tokens.use.direct";
+export declare const SCOPES = "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct";
+/** The client id of a first sign-in; OpenAI then issues this app's own `oaiapp_…` id. */
+export declare const DYNAMIC_CLIENT = "dynamic_agent_client";
+export declare const AGENT_NAME = "AgentOrg";
+export type Fetch = (request: Request) => Promise<Response>;
+/** What a grant gives. `expiresAt` is in milliseconds. */
+export interface Grant {
+    accessToken: string;
+    refreshToken: string;
+    idToken?: string;
+    expiresAt: number;
+    scopes: string[];
+}
+/** A word from a server, fit to show: at most 64 characters of letters, digits and `_.-[]`. */
+export declare const word: (value: unknown) => string;
+/** The token endpoint refused a grant, with OAuth's error code. */
+export declare class GrantError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number);
+}
+/** Refresh errors after which the refresh token can't be used again. */
+export declare const TERMINAL: Set<string>;
+/** An authorization-code or refresh-token grant, at the token endpoint. */
+export declare function grant(fetch: Fetch, params: Record<string, string>, now: number): Promise<Grant>;
+/** The issuer's signing keys and revocation endpoint, from its OpenID configuration. */
+export interface Issuer {
+    keys: Jwk[];
+    revocation?: string;
+}
+/** Read the issuer's configuration and keys; anything short of a usable key set throws. */
+export declare function discover(fetch: Fetch): Promise<Issuer>;
+/** Revoke a refresh token: true when the issuer confirmed it. Retried on 5xx and network errors. */
+export declare function revoke(fetch: Fetch, issuer: Issuer, clientId: string, refreshToken: string): Promise<boolean>;

package/dist/node_modules/chatgpt/dist/src/oauth.js

@@ -0,0 +1,104 @@
+export const ISSUER = "https://auth.openai.com";
+export const AUTHORIZE = `${ISSUER}/api/accounts/authorize`;
+export const TOKEN = `${ISSUER}/api/accounts/oauth/token`;
+const DISCOVERY = `${ISSUER}/.well-known/openid-configuration`;
+/** The audience of the tokens: the Responses API. */
+export const RESOURCE = "https://api.openai.com/v1";
+/** The scope that lets the tokens draw on the person's ChatGPT plan. */
+export const PLAN_SCOPE = "chatgpt.tokens.use.direct";
+export const SCOPES = `openid profile email offline_access resource.invoke ${PLAN_SCOPE}`;
+/** The client id of a first sign-in; OpenAI then issues this app's own `oaiapp_…` id. */
+export const DYNAMIC_CLIENT = "dynamic_agent_client";
+export const AGENT_NAME = "AgentOrg";
+/** A word from a server, fit to show: at most 64 characters of letters, digits and `_.-[]`. */
+export const word = (value) => typeof value === "string" ? value.replace(/[^A-Za-z0-9_.[\]-]/g, "").slice(0, 64) : "";
+/** The token endpoint refused a grant, with OAuth's error code. */
+export class GrantError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(`The token endpoint refused the grant (${status} ${code}).`);
+        this.code = code;
+        this.status = status;
+    }
+}
+/** Refresh errors after which the refresh token can't be used again. */
+export const TERMINAL = new Set([
+    "invalid_grant",
+    "invalid_refresh_token",
+    "token_expired",
+    "refresh_token_expired",
+    "refresh_token_invalidated",
+    "refresh_token_reused",
+]);
+async function json(response) {
+    try {
+        const value = await response.json();
+        return typeof value === "object" && value !== null ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+const form = (url, params) => new Request(url, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(params),
+});
+/** An authorization-code or refresh-token grant, at the token endpoint. */
+export async function grant(fetch, params, now) {
+    const response = await fetch(form(TOKEN, { ...params, resource: RESOURCE }));
+    const body = await json(response);
+    if (!response.ok)
+        throw new GrantError(word(body.error) || "error", response.status);
+    const { access_token, refresh_token, id_token, expires_in, scope } = body;
+    if (typeof access_token !== "string" || typeof refresh_token !== "string")
+        throw new GrantError("invalid_response", response.status);
+    return {
+        accessToken: access_token,
+        refreshToken: refresh_token,
+        ...(typeof id_token === "string" ? { idToken: id_token } : {}),
+        expiresAt: now + (typeof expires_in === "number" ? expires_in : 3600) * 1000,
+        scopes: typeof scope === "string" ? scope.split(" ").filter(Boolean) : [],
+    };
+}
+/** Read the issuer's configuration and keys; anything short of a usable key set throws. */
+export async function discover(fetch) {
+    const found = await fetch(new Request(DISCOVERY));
+    const config = await json(found);
+    if (!found.ok || config.issuer !== ISSUER || typeof config.jwks_uri !== "string")
+        throw new Error("unexpected OpenID configuration");
+    const fetched = await fetch(new Request(config.jwks_uri));
+    const jwks = await json(fetched);
+    const keys = Array.isArray(jwks.keys) ? jwks.keys : [];
+    if (!fetched.ok || keys.length === 0)
+        throw new Error("no signing keys");
+    return {
+        keys,
+        ...(typeof config.revocation_endpoint === "string"
+            ? { revocation: config.revocation_endpoint }
+            : {}),
+    };
+}
+/** Revoke a refresh token: true when the issuer confirmed it. Retried on 5xx and network errors. */
+export async function revoke(fetch, issuer, clientId, refreshToken) {
+    if (!issuer.revocation)
+        return false;
+    const params = { token: refreshToken, token_type_hint: "refresh_token", client_id: clientId };
+    for (let attempt = 0;; attempt++) {
+        try {
+            const response = await fetch(form(issuer.revocation, params));
+            await response.body?.cancel();
+            if (response.ok)
+                return true;
+            if (response.status < 500)
+                return false;
+        }
+        catch {
+            // A network failure: try again while the token is still in hand.
+        }
+        if (attempt === 2)
+            return false;
+        await new Promise((resolve) => setTimeout(resolve, 250 * 2 ** attempt));
+    }
+}

package/dist/node_modules/chatgpt/dist/src/program.d.ts

@@ -0,0 +1,23 @@
+import type { Log } from "@agentorg/sdk";
+export interface ChatGPTOptions {
+    hubUrl: string;
+    /** Its own Actor. It needs no slots: no `storage`, no `net`. */
+    actorId: string;
+    credential: string;
+    /** A private folder of its own, which holds the sign-in. */
+    dir: string;
+    log?: Log;
+    /** How a request leaves, instead of the network. For tests. */
+    fetch?: (request: Request, init: RequestInit) => Promise<Response>;
+}
+export interface ChatGPT {
+    /** Stop every response under way and leave the Hub. The sign-in stays. */
+    close(): Promise<void>;
+}
+/**
+ * Run ChatGPT as a program: an Actor exporting `account.login@1` as `login` and `llm.session@1` as
+ * `session`, with its sign-in in its own file and the network directly. It uses the person's plan,
+ * never API billing. Only https goes out, and a redirect comes back as it is, never followed with a
+ * request's token or form.
+ */
+export declare function startChatGPT(options: ChatGPTOptions): Promise<ChatGPT>;

package/dist/node_modules/chatgpt/dist/src/program.js

@@ -0,0 +1,41 @@
+import { accountLogin, llmSession } from "@agentorg/interfaces";
+import { connect } from "@agentorg/sdk/client";
+import { fileStore } from "./file-store.js";
+import { serveChatGPT } from "./serve.js";
+const quiet = { info() { }, warn() { }, error() { } };
+/**
+ * Run ChatGPT as a program: an Actor exporting `account.login@1` as `login` and `llm.session@1` as
+ * `session`, with its sign-in in its own file and the network directly. It uses the person's plan,
+ * never API billing. Only https goes out, and a redirect comes back as it is, never followed with a
+ * request's token or form.
+ */
+export async function startChatGPT(options) {
+    const log = options.log ?? quiet;
+    const store = fileStore(options.dir, log);
+    const send = options.fetch ?? ((request, init) => fetch(request, init));
+    const outbound = async (request) => {
+        if (new URL(request.url).protocol !== "https:")
+            throw new Error("Only https addresses are reached.");
+        // Given beside the request, not by a copy of it: a copy's link to its signal can be collected,
+        // and a cancel would then wait for OpenAI's first byte.
+        return send(request, { redirect: "manual" });
+    };
+    let session;
+    const client = await connect({
+        hubUrl: options.hubUrl,
+        actorId: options.actorId,
+        credential: options.credential,
+        exports: { login: accountLogin, session: llmSession },
+        log,
+        start(ctx) {
+            session = serveChatGPT(ctx.exports, { fetch: outbound, store, log });
+        },
+    });
+    return {
+        async close() {
+            session?.stop();
+            client.close();
+            await client.closed;
+        },
+    };
+}

package/dist/node_modules/chatgpt/dist/src/responses.d.ts

@@ -0,0 +1,54 @@
+/** Inference on the person's ChatGPT plan: the Responses API, streamed, with nothing stored. */
+import type { llmSession } from "@agentorg/interfaces";
+import { Refused } from "@agentorg/sdk";
+import type { z } from "zod";
+import { type Account } from "./account.js";
+import { type Fetch } from "./oauth.js";
+export declare const USAGE_SETTINGS = "https://chatgpt.com/settings/usage";
+type RespondInput = z.output<typeof llmSession.methods.respond.input>;
+/**
+ * OpenAI's error, as a refusal: by its code first, then its HTTP status when there is one (an error
+ * inside the stream has none). Only sanitized words of OpenAI's reply are shown.
+ */
+export declare function refusalOf(code: string | undefined, at?: {
+    status?: number;
+    requestId?: string | null;
+    param?: string;
+}): Refused;
+export declare function createSession(options: {
+    fetch: Fetch;
+    account: Account;
+    /** Streamed text, for the one Actor whose request it answers. */
+    delta(caller: string, requestId: string, text: string): void;
+}): {
+    /** Stop every response still running. */
+    stop(): void;
+    /** Forget the model list, so it is read again for the next account. */
+    reset(): void;
+    models(): Promise<{
+        models: {
+            id: string;
+            name: string;
+        }[];
+    }>;
+    cancel({ requestId }: {
+        requestId: string;
+    }, caller: string): {};
+    respond(input: RespondInput, caller: string): Promise<{
+        output: ({
+            type: "message";
+            content: string;
+            role: "assistant";
+        } | {
+            type: "function_call";
+            callId: string;
+            name: string;
+            arguments: string;
+        })[];
+        usage?: {
+            inputTokens: number;
+            outputTokens: number;
+        } | undefined;
+    }>;
+};
+export {};