@agentorg/cli 0.0.5 → 0.0.7

package/dist/node_modules/assistant/dist/src/tools.js

@@ -0,0 +1,102 @@
+/**
+ * The assistant's tools, gathered afresh for each model request. A `tools@1` slot gives whatever
+ * it lists now, with its server's own input schemas. Each is offered as
+ * `<slot>__<name>`, and a call runs through the slot, so the Hub checks and audits it like any
+ * other.
+ */
+import { tools as toolsInterface } from "@agentorg/interfaces";
+import { Refusal } from "@agentorg/looper";
+import { describeInterface, NotConnected, OutcomeUnknown, Refused, } from "@agentorg/sdk";
+/** What a request can carry: its tools count, and, with the record and instructions, one frame. */
+export const MAX_TOOLS = 128;
+export const TOOLS_BUDGET = 256 * 1024;
+const MAX_NAME = 64;
+const MAX_DESCRIPTION = 1024;
+const encoder = new TextEncoder();
+const TOOLS_ID = describeInterface(toolsInterface).id;
+/** The first `length` UTF-16 units of `text`, never ending inside a surrogate pair. */
+export function head(text, length) {
+    const cut = text.slice(0, length);
+    return /[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut;
+}
+/** The code and message of what a call through a slot threw. */
+export function codeOf(error) {
+    if (error instanceof Refused)
+        return { code: error.code, message: error.message };
+    if (error instanceof NotConnected)
+        return { code: "not_connected", message: `${error.target} is not connected.` };
+    if (error instanceof OutcomeUnknown)
+        return { code: "outcome_unknown", message: error.message };
+    return { code: "failed", message: "The call failed." };
+}
+/**
+ * A call through a slot, as the looper is told how it went: what the slot refuses is the looper's
+ * `Refusal`, with the code to show and the slot's own error as its cause.
+ */
+export const relayed = (call) => call.catch((error) => {
+    const { code, message } = codeOf(error);
+    throw code === "failed" && !(error instanceof Refused)
+        ? error
+        : new Refusal(code, message, { cause: error });
+});
+/** Whether a slot is a `tools@1`, whose tools are whatever it lists. */
+export const listsTools = (described) => described.id === TOOLS_ID;
+/**
+ * What a `tools@1` slot lists now. A slot that can't answer gives no tools and says why, and is
+ * asked again at the next request.
+ */
+export async function listedBy(name, slot) {
+    const list = slot.call.list;
+    const call = slot.call.call;
+    let entries;
+    try {
+        ({ tools: entries } = (await list({})));
+    }
+    catch (error) {
+        return { candidates: [], leftOut: [{ slot: name, reason: codeOf(error).code }] };
+    }
+    const candidates = entries.map((entry) => ({
+        slot: name,
+        name: entry.name,
+        ...(entry.description ? { description: entry.description } : {}),
+        parameters: entry.inputSchema,
+        run: async (args) => {
+            const { output, failed } = (await call({ name: entry.name, arguments: args }));
+            return failed ? { output, ok: false, code: "failed" } : { output, ok: true };
+        },
+    }));
+    return { candidates, leftOut: [] };
+}
+/**
+ * The tools one request offers, by function name, and what it can't. A character a function name
+ * can't have becomes `_`. Candidates are taken in order, so the first ones given are the ones kept
+ * when a request is full; what doesn't fit is reported, never sent.
+ */
+export function offered(candidates) {
+    const tools = new Map();
+    const leftOut = [];
+    let bytes = 0;
+    for (const { slot, name, description, parameters, run } of candidates) {
+        const toolName = `${slot}__${name}`.replace(/[^A-Za-z0-9_-]/g, "_");
+        const tool = {
+            name: toolName,
+            ...(description ? { description: head(description, MAX_DESCRIPTION) } : {}),
+            parameters,
+        };
+        const size = encoder.encode(JSON.stringify(tool)).byteLength;
+        const reason = toolName.length > MAX_NAME
+            ? "name"
+            : tools.has(toolName)
+                ? "duplicate"
+                : tools.size >= MAX_TOOLS || bytes + size > TOOLS_BUDGET
+                    ? "limit"
+                    : undefined;
+        if (reason) {
+            leftOut.push({ slot, tool: name, reason });
+            continue;
+        }
+        bytes += size;
+        tools.set(toolName, { ...tool, run: (input) => relayed(run(input)) });
+    }
+    return { tools: [...tools.values()], leftOut };
+}

package/dist/node_modules/assistant/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "assistant",
+  "version": "0.0.1",
+  "private": true,
+  "description": "The agent engine, and the bundled provider that runs it",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    "./provider": {
+      "types": "./dist/src/provider.d.ts",
+      "default": "./dist/src/provider.js"
+    }
+  },
+  "files": [
+    "dist/src"
+  ],
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
+    "test": "node --test \"dist/test/**/*.test.js\""
+  },
+  "dependencies": {
+    "@agentorg/interfaces": "0.0.0",
+    "@agentorg/looper": "0.0.0",
+    "@agentorg/sdk": "0.0.0",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@agentorg/hub": "0.0.0"
+  }
+}

package/dist/node_modules/chatgpt/dist/src/account.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The ChatGPT sign-in this Actor owns: its registration, its tokens and their refresh. The tokens
+ * stay inside, apart from where they are kept: nothing here returns, emits or logs one.
+ */
+import type { kv, LoginState } from "@agentorg/interfaces";
+import { Refused, type Slot } from "@agentorg/sdk";
+import type { z } from "zod";
+import { type Fetch } from "./oauth.js";
+type State = z.output<typeof LoginState>;
+/** Where the sign-in is kept: the program's own file. */
+export type Store = Pick<Slot<typeof kv>["call"], "get" | "set" | "delete">;
+export declare const notSignedIn: () => Refused;
+export declare const notEligible: () => Refused;
+export declare function createAccount(options: {
+    fetch: Fetch;
+    store: Store;
+    changed(state: State): void;
+    now?: () => number;
+}): {
+    status(): Promise<{
+        state: "ineligible" | "signed_in" | "signed_out";
+        account: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        };
+    } | {
+        account?: undefined;
+        state: "ineligible" | "signed_in" | "signed_out";
+    }>;
+    start({ redirectUri }: {
+        redirectUri: string;
+    }): Promise<{
+        authorizeUrl: string;
+    }>;
+    complete({ callbackUrl }: {
+        callbackUrl: string;
+    }): Promise<{
+        account: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        };
+    }>;
+    logout(): Promise<{
+        revoked: boolean;
+    }>;
+    /** A usable access token, refreshed when it's near expiry or when `stale`. */
+    token(stale?: boolean): Promise<string>;
+    /** OpenAI said the account isn't eligible: say so until the next sign-in. */
+    ineligible(): Promise<void>;
+};
+export type Account = ReturnType<typeof createAccount>;
+export {};

package/dist/node_modules/chatgpt/dist/src/account.js

@@ -0,0 +1,270 @@
+import { Refused } from "@agentorg/sdk";
+import { challengeOf, random } from "./encoding.js";
+import { verifyIdToken } from "./jwt.js";
+import { AGENT_NAME, AUTHORIZE, DYNAMIC_CLIENT, discover, GrantError, grant, ISSUER, PLAN_SCOPE, RESOURCE, revoke, SCOPES, TERMINAL, } from "./oauth.js";
+/** How long a started sign-in can be completed, how many can wait, and how early to refresh. */
+const PENDING_FOR = 10 * 60_000;
+const MAX_PENDING = 16;
+const REFRESH_BEFORE = 5 * 60_000;
+export const notSignedIn = () => new Refused("not_signed_in", "Not signed in to ChatGPT. Continue with ChatGPT to sign in.");
+export const notEligible = () => new Refused("ineligible", "This ChatGPT account isn't eligible to use its plan in this app. Signing in again won't change that.");
+const unreachable = () => new Refused("unavailable", "OpenAI couldn't be reached. Try again later.");
+const address = (url) => `${url.origin}${url.pathname}`;
+/** Who signed in, from verified id_token claims; the plan claim isn't documented, so optional. */
+function identity(claims) {
+    const auth = claims["https://api.openai.com/auth"];
+    return {
+        ...(typeof claims.sub === "string" ? { sub: claims.sub } : {}),
+        ...(typeof claims.email === "string" ? { email: claims.email.slice(0, 320) } : {}),
+        ...(typeof auth?.chatgpt_plan_type === "string"
+            ? { plan: auth.chatgpt_plan_type.slice(0, 64) }
+            : {}),
+    };
+}
+const tokensOf = ({ accessToken, refreshToken, expiresAt, scopes }) => ({
+    accessToken,
+    refreshToken,
+    expiresAt,
+    scopes,
+});
+export function createAccount(options) {
+    const { fetch, store, changed } = options;
+    const now = options.now ?? Date.now;
+    const pending = new Map();
+    let issuer;
+    let refreshing;
+    /** Bumped by every sign-in and sign-out, so a refresh that lands after one is dropped. */
+    let generation = 0;
+    const issuerOf = () => {
+        issuer ??= discover(fetch).catch((error) => {
+            issuer = undefined;
+            throw error;
+        });
+        return issuer;
+    };
+    /** Verify an id_token; on a key the issuer no longer has, read its keys once more. */
+    const verify = async (token, expect) => {
+        const check = async () => verifyIdToken(token, (await issuerOf()).keys, { issuer: ISSUER, ...expect, now: now() });
+        try {
+            return await check();
+        }
+        catch (error) {
+            if (!(error instanceof Error && error.message === "no matching signing key"))
+                throw error;
+            issuer = undefined;
+            return check();
+        }
+    };
+    const read = async (key) => (await store.get({ key })).value;
+    const write = (key, value) => store.set({ key, value: value });
+    const credential = () => read("credential");
+    const registration = async () => {
+        const kept = await read("registration");
+        if (kept)
+            return kept;
+        const fresh = { hostId: `urn:uuid:${crypto.randomUUID()}` };
+        await write("registration", fresh);
+        return fresh;
+    };
+    const stateOf = (held) => !held ? "signed_out" : held.ineligible ? "ineligible" : "signed_in";
+    const accountOf = (held) => ({
+        ...(held.email === undefined ? {} : { email: held.email }),
+        ...(held.plan === undefined ? {} : { plan: held.plan }),
+    });
+    const clear = async () => {
+        generation++;
+        await store.delete({ key: "credential" });
+        changed("signed_out");
+    };
+    /** Revoke tokens that won't be kept, as well as we can; nothing waits for it. */
+    const discard = (clientId, refreshToken) => void issuerOf()
+        .then((found) => revoke(fetch, found, clientId, refreshToken))
+        .catch(() => false);
+    /** Refresh the tokens, one refresh at a time; the refresh token rotates each time. */
+    const refresh = () => {
+        refreshing ??= (async () => {
+            const started = generation;
+            try {
+                const held = await credential();
+                if (!held)
+                    throw notSignedIn();
+                const next = await grant(fetch, {
+                    grant_type: "refresh_token",
+                    client_id: held.clientId,
+                    refresh_token: held.refreshToken,
+                }, now());
+                let kept = { ...held, ...tokensOf(next) };
+                if (next.idToken) {
+                    const claims = await verify(next.idToken, { audience: held.clientId }).catch(() => undefined);
+                    if (claims)
+                        kept = { ...kept, ...identity(claims) };
+                }
+                // Signed out or in again meanwhile: these tokens belong to nothing now.
+                if (started !== generation) {
+                    discard(held.clientId, next.refreshToken);
+                    throw notSignedIn();
+                }
+                await write("credential", kept);
+                return kept;
+            }
+            catch (error) {
+                if (error instanceof GrantError) {
+                    if (!TERMINAL.has(error.code))
+                        throw new Refused("failed", `OpenAI refused to refresh the sign-in (${error.code}).`);
+                    if (started === generation)
+                        await clear();
+                    throw notSignedIn();
+                }
+                if (error instanceof Refused)
+                    throw error;
+                throw unreachable();
+            }
+            finally {
+                refreshing = undefined;
+            }
+        })();
+        return refreshing;
+    };
+    return {
+        async status() {
+            const held = await credential();
+            return held ? { state: stateOf(held), account: accountOf(held) } : { state: stateOf(held) };
+        },
+        async start({ redirectUri }) {
+            const { hostId, clientId = DYNAMIC_CLIENT } = await registration();
+            for (const [state, attempt] of pending)
+                if (now() - attempt.at > PENDING_FOR || pending.size >= MAX_PENDING)
+                    pending.delete(state);
+            const verifier = random(48);
+            const state = random();
+            const nonce = random();
+            const redirect = address(new URL(redirectUri));
+            pending.set(state, { verifier, nonce, redirectUri, redirect, clientId, at: now() });
+            const url = new URL(AUTHORIZE);
+            url.search = new URLSearchParams({
+                response_type: "code",
+                client_id: clientId,
+                redirect_uri: redirectUri,
+                scope: SCOPES,
+                resource: RESOURCE,
+                code_challenge: await challengeOf(verifier),
+                code_challenge_method: "S256",
+                state,
+                nonce,
+                ext_agent_host_id: hostId,
+                ...(clientId === DYNAMIC_CLIENT ? { agent_name_hint: AGENT_NAME } : {}),
+            }).toString();
+            return { authorizeUrl: url.toString() };
+        },
+        async complete({ callbackUrl }) {
+            let url;
+            try {
+                url = new URL(callbackUrl);
+            }
+            catch {
+                throw new Refused("invalid", "callbackUrl isn't an address.");
+            }
+            const params = url.searchParams;
+            const state = params.get("state");
+            const attempt = state === null ? undefined : pending.get(state);
+            if (state === null || !attempt || now() - attempt.at > PENDING_FOR)
+                throw new Refused("expired", "This sign-in wasn't started here, or it expired. Start again.");
+            if (address(url) !== attempt.redirect)
+                throw new Refused("invalid", "The callback isn't the address this sign-in redirects to.");
+            pending.delete(state);
+            const error = params.get("error");
+            if (error === "access_denied")
+                throw new Refused("denied", "Sign-in was declined.");
+            if (error !== null)
+                throw new Refused("failed", "OpenAI returned an error to the sign-in.");
+            const code = params.get("code");
+            if (!code)
+                throw new Refused("failed", "The callback carries no code.");
+            const issued = params.get("client_id");
+            let clientId = attempt.clientId;
+            if (clientId === DYNAMIC_CLIENT) {
+                if (!issued || issued === DYNAMIC_CLIENT)
+                    throw new Refused("failed", "OpenAI didn't issue a client id; registration isn't complete.");
+                clientId = issued;
+            }
+            else if (issued !== null && issued !== clientId)
+                throw new Refused("failed", "The callback names another client, so it was refused.");
+            let granted;
+            try {
+                granted = await grant(fetch, {
+                    grant_type: "authorization_code",
+                    client_id: clientId,
+                    code,
+                    code_verifier: attempt.verifier,
+                    redirect_uri: attempt.redirectUri,
+                }, now());
+            }
+            catch (error) {
+                if (error instanceof GrantError)
+                    throw new Refused("failed", `OpenAI refused the sign-in (${error.code}). Start again.`);
+                throw unreachable();
+            }
+            if (!granted.scopes.includes(PLAN_SCOPE)) {
+                discard(clientId, granted.refreshToken);
+                throw new Refused("failed", "The sign-in wasn't granted ChatGPT plan usage.");
+            }
+            try {
+                await issuerOf();
+            }
+            catch {
+                discard(clientId, granted.refreshToken);
+                throw unreachable();
+            }
+            let claims;
+            try {
+                if (!granted.idToken)
+                    throw new Error("no id_token");
+                claims = await verify(granted.idToken, { audience: clientId, nonce: attempt.nonce });
+            }
+            catch {
+                discard(clientId, granted.refreshToken);
+                throw new Refused("failed", "OpenAI's identity token didn't verify.");
+            }
+            // A refresh still running belongs to the sign-in this one replaces, which is revoked.
+            await refreshing?.catch(() => { });
+            generation++;
+            const replaced = await credential();
+            if (replaced)
+                discard(replaced.clientId, replaced.refreshToken);
+            const held = { clientId, ...tokensOf(granted), ...identity(claims) };
+            await write("registration", { ...(await registration()), clientId });
+            await write("credential", held);
+            changed("signed_in");
+            return { account: accountOf(held) };
+        },
+        async logout() {
+            // A refresh still running would write its tokens back after the sign-out.
+            await refreshing?.catch(() => { });
+            const held = await credential();
+            if (!held)
+                return { revoked: true };
+            await clear();
+            const revoked = await issuerOf().then((found) => revoke(fetch, found, held.clientId, held.refreshToken), () => false);
+            return { revoked };
+        },
+        /** A usable access token, refreshed when it's near expiry or when `stale`. */
+        async token(stale = false) {
+            const held = await credential();
+            if (!held)
+                throw notSignedIn();
+            if (held.ineligible)
+                throw notEligible();
+            if (!stale && held.expiresAt - REFRESH_BEFORE > now())
+                return held.accessToken;
+            return (await refresh()).accessToken;
+        },
+        /** OpenAI said the account isn't eligible: say so until the next sign-in. */
+        async ineligible() {
+            const held = await credential();
+            if (!held || held.ineligible)
+                return;
+            await write("credential", { ...held, ineligible: true });
+            changed("ineligible");
+        },
+    };
+}

package/dist/node_modules/chatgpt/dist/src/encoding.d.ts

@@ -0,0 +1,7 @@
+/** Base64url without padding, as PKCE and JWTs use it. */
+export declare function base64url(bytes: Uint8Array): string;
+export declare function fromBase64url(text: string): Uint8Array<ArrayBuffer>;
+/** A fresh random value, base64url: `bytes` of entropy. */
+export declare function random(bytes?: number): string;
+/** The PKCE S256 challenge of a verifier. */
+export declare function challengeOf(verifier: string): Promise<string>;

package/dist/node_modules/chatgpt/dist/src/encoding.js

@@ -0,0 +1,20 @@
+/** Base64url without padding, as PKCE and JWTs use it. */
+export function base64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+export function fromBase64url(text) {
+    const binary = atob(text.replaceAll("-", "+").replaceAll("_", "/"));
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+/** A fresh random value, base64url: `bytes` of entropy. */
+export function random(bytes = 32) {
+    return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+/** The PKCE S256 challenge of a verifier. */
+export async function challengeOf(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64url(new Uint8Array(digest));
+}

package/dist/node_modules/chatgpt/dist/src/file-store.d.ts

@@ -0,0 +1,9 @@
+import type { Log } from "@agentorg/sdk";
+import type { Store } from "./account.js";
+/**
+ * The sign-in, in one private file, read each time so nothing is held that the file no longer says.
+ * Each change is on disk before it is acknowledged, since a refresh token that rotated can't be had
+ * again. A file that can't be read is removed, and the person signs in again; nothing of it is ever
+ * logged, a parse error's text included.
+ */
+export declare function fileStore(dir: string, log: Log): Store;

package/dist/node_modules/chatgpt/dist/src/file-store.js

@@ -0,0 +1,68 @@
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+/**
+ * The sign-in, in one private file, read each time so nothing is held that the file no longer says.
+ * Each change is on disk before it is acknowledged, since a refresh token that rotated can't be had
+ * again. A file that can't be read is removed, and the person signs in again; nothing of it is ever
+ * logged, a parse error's text included.
+ */
+export function fileStore(dir, log) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const path = join(dir, "sign-in.json");
+    const read = () => {
+        const values = new Map();
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return values;
+            throw error;
+        }
+        try {
+            for (const [key, value] of Object.entries(JSON.parse(raw)))
+                values.set(key, value);
+        }
+        catch {
+            rmSync(path);
+            log.error("The sign-in file couldn't be read, so it was removed: sign in again.");
+        }
+        return values;
+    };
+    const save = (values) => {
+        const temporary = `${path}.tmp`;
+        writeFileSync(temporary, JSON.stringify(Object.fromEntries(values)), {
+            mode: 0o600,
+            flush: true,
+        });
+        renameSync(temporary, path);
+        const folder = openSync(dir, "r");
+        try {
+            fsyncSync(folder);
+        }
+        finally {
+            closeSync(folder);
+        }
+    };
+    return {
+        get: async ({ key }) => {
+            const values = read();
+            return values.has(key) ? { value: values.get(key) } : {};
+        },
+        set: async ({ key, value }) => {
+            const values = read();
+            values.set(key, value);
+            save(values);
+            return {};
+        },
+        delete: async ({ key }) => {
+            const values = read();
+            const deleted = values.delete(key);
+            if (deleted)
+                save(values);
+            return { deleted };
+        },
+    };
+}

package/dist/node_modules/chatgpt/dist/src/index.d.ts

@@ -0,0 +1 @@
+export { type ChatGPT, type ChatGPTOptions, startChatGPT } from "./program.js";

package/dist/node_modules/chatgpt/dist/src/index.js

@@ -0,0 +1 @@
+export { startChatGPT } from "./program.js";

package/dist/node_modules/chatgpt/dist/src/jwt.d.ts

@@ -0,0 +1,15 @@
+import type { webcrypto } from "node:crypto";
+export type Claims = Record<string, unknown>;
+export type Jwk = webcrypto.JsonWebKey & {
+    kid?: string;
+};
+/**
+ * An id_token's claims, once its RS256 signature checks against one of the issuer's keys and its
+ * issuer, audience, expiry and (when given) nonce are right. Anything else throws.
+ */
+export declare function verifyIdToken(token: string, keys: Jwk[], expect: {
+    issuer: string;
+    audience: string;
+    nonce?: string;
+    now: number;
+}): Promise<Claims>;

package/dist/node_modules/chatgpt/dist/src/jwt.js

@@ -0,0 +1,37 @@
+import { fromBase64url } from "./encoding.js";
+function part(text) {
+    if (!text)
+        throw new Error("malformed token");
+    const value = JSON.parse(new TextDecoder().decode(fromBase64url(text)));
+    if (typeof value !== "object" || value === null)
+        throw new Error("malformed token");
+    return value;
+}
+/**
+ * An id_token's claims, once its RS256 signature checks against one of the issuer's keys and its
+ * issuer, audience, expiry and (when given) nonce are right. Anything else throws.
+ */
+export async function verifyIdToken(token, keys, expect) {
+    const [header, payload, signature] = token.split(".");
+    const head = part(header);
+    if (head.alg !== "RS256")
+        throw new Error("unexpected signing algorithm");
+    const jwk = keys.find((key) => key.kty === "RSA" && (head.kid === undefined || key.kid === head.kid));
+    if (!jwk || signature === undefined)
+        throw new Error("no matching signing key");
+    const key = await crypto.subtle.importKey("jwk", { kty: jwk.kty, n: jwk.n, e: jwk.e, alg: "RS256", ext: true }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+    const signed = new TextEncoder().encode(`${header}.${payload}`);
+    if (!(await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, fromBase64url(signature), signed)))
+        throw new Error("bad signature");
+    const claims = part(payload);
+    const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (claims.iss !== expect.issuer)
+        throw new Error("unexpected issuer");
+    if (!audience.includes(expect.audience))
+        throw new Error("unexpected audience");
+    if (typeof claims.exp !== "number" || claims.exp * 1000 < expect.now - 60_000)
+        throw new Error("expired");
+    if (expect.nonce !== undefined && claims.nonce !== expect.nonce)
+        throw new Error("unexpected nonce");
+    return claims;
+}

package/dist/node_modules/chatgpt/dist/src/oauth.d.ts

@@ -0,0 +1,43 @@
+/** OpenAI's Sign in with ChatGPT endpoints and grants, for plan usage by an open-source app. */
+import type { Jwk } from "./jwt.js";
+export declare const ISSUER = "https://auth.openai.com";
+export declare const AUTHORIZE = "https://auth.openai.com/api/accounts/authorize";
+export declare const TOKEN = "https://auth.openai.com/api/accounts/oauth/token";
+/** The audience of the tokens: the Responses API. */
+export declare const RESOURCE = "https://api.openai.com/v1";
+/** The scope that lets the tokens draw on the person's ChatGPT plan. */
+export declare const PLAN_SCOPE = "chatgpt.tokens.use.direct";
+export declare const SCOPES = "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct";
+/** The client id of a first sign-in; OpenAI then issues this app's own `oaiapp_…` id. */
+export declare const DYNAMIC_CLIENT = "dynamic_agent_client";
+export declare const AGENT_NAME = "AgentOrg";
+export type Fetch = (request: Request) => Promise<Response>;
+/** What a grant gives. `expiresAt` is in milliseconds. */
+export interface Grant {
+    accessToken: string;
+    refreshToken: string;
+    idToken?: string;
+    expiresAt: number;
+    scopes: string[];
+}
+/** A word from a server, fit to show: at most 64 characters of letters, digits and `_.-[]`. */
+export declare const word: (value: unknown) => string;
+/** The token endpoint refused a grant, with OAuth's error code. */
+export declare class GrantError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number);
+}
+/** Refresh errors after which the refresh token can't be used again. */
+export declare const TERMINAL: Set<string>;
+/** An authorization-code or refresh-token grant, at the token endpoint. */
+export declare function grant(fetch: Fetch, params: Record<string, string>, now: number): Promise<Grant>;
+/** The issuer's signing keys and revocation endpoint, from its OpenID configuration. */
+export interface Issuer {
+    keys: Jwk[];
+    revocation?: string;
+}
+/** Read the issuer's configuration and keys; anything short of a usable key set throws. */
+export declare function discover(fetch: Fetch): Promise<Issuer>;
+/** Revoke a refresh token: true when the issuer confirmed it. Retried on 5xx and network errors. */
+export declare function revoke(fetch: Fetch, issuer: Issuer, clientId: string, refreshToken: string): Promise<boolean>;