@alvin0/ai-agent-sdk-auth-node 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 alvin0 (chaulamdinhai) <chaulamdinhai@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,60 @@
+# @alvin0/ai-agent-sdk-auth-node
+
+Runtime: **Node 22.12+**.
+
+Node-owned environment credentials and project-local Codex OAuth storage. The
+package root and `/env` entrypoint are environment-only: installing either does
+not require or load a model provider.
+
+For an OpenAI agent whose key comes from the environment:
+
+```sh
+pnpm add @alvin0/ai-agent-sdk-core @alvin0/ai-agent-sdk-provider-openai @alvin0/ai-agent-sdk-auth-node
+```
+
+```ts
+import { envCredential } from '@alvin0/ai-agent-sdk-auth-node'
+import { createAgentRuntime } from '@alvin0/ai-agent-sdk-core'
+import { openAiPlugin } from '@alvin0/ai-agent-sdk-provider-openai'
+
+const runtime = await createAgentRuntime({
+  providers: [openAiPlugin({ apiKey: envCredential('OPENAI_API_KEY') })],
+})
+```
+
+`envCredential()` is lazy, receives the model-operation cancellation signal and
+remains callable for compatibility. It is borrowed by the provider and has no
+close lifecycle.
+
+Codex support is an explicit optional closure:
+
+```sh
+pnpm add @alvin0/ai-agent-sdk-core @alvin0/ai-agent-sdk-provider-codex @alvin0/ai-agent-sdk-auth-node
+```
+
+```ts
+import { createAgentRuntime } from '@alvin0/ai-agent-sdk-core'
+import { codexNodeProviderPlugin } from '@alvin0/ai-agent-sdk-auth-node/codex'
+
+const runtime = await createAgentRuntime({
+  providers: [codexNodeProviderPlugin()],
+})
+```
+
+`codexNodeProviderPlugin()` uses the revisioned `fileCodexCredentialStore()` by
+default. The store is borrowed and remains caller-owned; the runtime closes the
+provider registration, not the store. Codex defaults to
+`.providers/.codex/auth.json` below `process.cwd()` and never uses the Codex
+CLI's global credential file. Writes use compare-and-swap under a cross-process
+writer lock, a private same-directory temporary file, file sync, atomic rename,
+mode `0600`, and directory sync. Credential-file symlinks are rejected.
+
+The deprecated `fileCodexAuthStore()` and `codexNodePlugin()` retain the former
+`read/write` compatibility contract. New runtime composition should use the
+revisioned factory above.
+
+Run `ai-agent-sdk-codex-login` after installation to authenticate this project.
+
+Composition: `provider-factory.credentials`. Lifecycle: `borrowed-caller-owned`;
+`envCredential()` and file-backed stores are resolved lazily by the selected
+provider and are never closed by core.

package/bin/ai-agent-sdk-codex-login.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import '../dist/cli.mjs'

package/dist/cli.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/cli.mjs

@@ -0,0 +1,139 @@
+import { C as shouldRefresh, E as fileCodexAuthStore, O as resolveCodexAuthPath, S as runDeviceCodeLogin, _ as readJwtClaims } from "./codex-CBvNhtAh.mjs";
+
+//#region src/cli.ts
+/**
+* `npm run provider:codex:login-device`
+*
+* Signs in to Codex with the OAuth device-code flow and stores the tokens in this
+* PROJECT, at `.providers/.codex/auth.json`, rather than touching the Codex CLI's
+* own `~/.codex/auth.json`.
+*
+* The isolation is deliberate. OAuth refresh tokens are single-use and rotate on
+* every refresh, so two programs sharing one credential file will eventually race:
+* the second one to refresh replays a spent token, gets `refresh_token_reused`, and
+* the user is silently logged out of their real Codex CLI. A separate store cannot
+* cause that.
+*
+* Flags:
+*   --force          sign in again even if valid credentials already exist
+*   --status         report the current credential state and exit
+*   --path <file>    write somewhere other than the default
+*   --issuer <url>   use a non-production auth issuer
+*/
+const BLUE = "\x1B[94m";
+const GRAY = "\x1B[90m";
+const BOLD = "\x1B[1m";
+const RESET = "\x1B[0m";
+function parseFlags(argv) {
+	const flags = {
+		force: false,
+		status: false,
+		path: void 0,
+		issuer: void 0
+	};
+	for (let index = 0; index < argv.length; index++) {
+		const arg = argv[index];
+		switch (arg) {
+			case "--force":
+				flags.force = true;
+				break;
+			case "--status":
+				flags.status = true;
+				break;
+			case "--path":
+				flags.path = argv[++index];
+				break;
+			case "--issuer":
+				flags.issuer = argv[++index];
+				break;
+			default: if (arg !== void 0 && arg.startsWith("-")) throw new Error(`unknown flag "${arg}"`);
+		}
+	}
+	return flags;
+}
+function renderPrompt(code) {
+	process.stdout.write(`\n${BOLD}Sign in to Codex${RESET} ${GRAY}(device authorization)${RESET}\n\n  1. Open this URL and sign in:\n     ${BLUE}${code.verificationUrl}${RESET}\n\n  2. Enter this one-time code ${GRAY}(expires in 15 minutes)${RESET}:\n     ${BOLD}${BLUE}${code.userCode}${RESET}\n\n${GRAY}Only continue if YOU started this login. If someone sent you this code, stop.${RESET}\n\n`);
+}
+/** Best-effort browser launch; failure is fine because the URL is printed anyway. */
+async function openBrowser(url) {
+	try {
+		const { spawn } = await import("node:child_process");
+		const command = process.platform === "win32" ? {
+			file: "cmd",
+			args: [
+				"/c",
+				"start",
+				"",
+				url
+			]
+		} : process.platform === "darwin" ? {
+			file: "open",
+			args: [url]
+		} : {
+			file: "xdg-open",
+			args: [url]
+		};
+		spawn(command.file, command.args, {
+			stdio: "ignore",
+			detached: true
+		}).unref();
+	} catch {}
+}
+async function main() {
+	const flags = parseFlags(process.argv.slice(2));
+	const location = resolveCodexAuthPath(flags.path);
+	const store = fileCodexAuthStore(location);
+	const existing = await store.read();
+	if (flags.status) {
+		if (existing?.tokens === void 0 || existing.tokens === null) {
+			process.stdout.write(`codex: not signed in ${GRAY}(${location})${RESET}\n`);
+			return 1;
+		}
+		const claims = readJwtClaims(existing.tokens.id_token);
+		const stale = shouldRefresh(existing);
+		process.stdout.write(`codex: signed in ${GRAY}(${location})${RESET}\n  account : ${claims?.accountId ?? existing.tokens.account_id ?? "<none>"}\n  email   : ${claims?.email ?? "<undisclosed>"}\n  plan    : ${claims?.planType ?? "<undisclosed>"}\n  token   : ${stale ? "needs refresh" : "valid"}\n`);
+		return 0;
+	}
+	if (!flags.force && existing?.tokens !== void 0 && existing.tokens !== null && !shouldRefresh(existing)) {
+		const claims = readJwtClaims(existing.tokens.id_token);
+		process.stdout.write(`codex: already signed in as ${claims?.email ?? claims?.accountId ?? "this account"}\n${GRAY}  ${location}\n  pass --force to sign in again${RESET}\n`);
+		return 0;
+	}
+	const cancel = new AbortController();
+	const onSigint = () => {
+		cancel.abort();
+		process.stdout.write("\ncodex: login cancelled\n");
+	};
+	process.once("SIGINT", onSigint);
+	let lastReport = 0;
+	try {
+		const result = await runDeviceCodeLogin(store, {
+			signal: cancel.signal,
+			...flags.issuer === void 0 ? {} : { issuer: flags.issuer }
+		}, {
+			onPrompt: (code) => {
+				renderPrompt(code);
+				openBrowser(code.verificationUrl);
+			},
+			onPoll: (elapsedMs) => {
+				if (elapsedMs - lastReport < 15e3 && elapsedMs !== 0) return;
+				lastReport = elapsedMs;
+				process.stdout.write(`${GRAY}  waiting for approval… ${Math.round(elapsedMs / 1e3)}s${RESET}\n`);
+			}
+		});
+		process.stdout.write(`\n${BOLD}codex: signed in${RESET}\n  account : ${result.accountId ?? "<none>"}\n  email   : ${result.email ?? "<undisclosed>"}\n  plan    : ${result.planType ?? "<undisclosed>"}\n  stored  : ${result.location} ${GRAY}(git-ignored)${RESET}\n`);
+		return 0;
+	} finally {
+		process.removeListener("SIGINT", onSigint);
+	}
+}
+try {
+	process.exitCode = await main();
+} catch (error) {
+	process.stdout.write(`\ncodex: login failed — ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exitCode = 1;
+}
+
+//#endregion
+export {  };
+//# sourceMappingURL=cli.mjs.map

package/dist/cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.mjs","names":[],"sources":["../src/cli.ts"],"sourcesContent":["/**\n * `npm run provider:codex:login-device`\n *\n * Signs in to Codex with the OAuth device-code flow and stores the tokens in this\n * PROJECT, at `.providers/.codex/auth.json`, rather than touching the Codex CLI's\n * own `~/.codex/auth.json`.\n *\n * The isolation is deliberate. OAuth refresh tokens are single-use and rotate on\n * every refresh, so two programs sharing one credential file will eventually race:\n * the second one to refresh replays a spent token, gets `refresh_token_reused`, and\n * the user is silently logged out of their real Codex CLI. A separate store cannot\n * cause that.\n *\n * Flags:\n *   --force          sign in again even if valid credentials already exist\n *   --status         report the current credential state and exit\n *   --path <file>    write somewhere other than the default\n *   --issuer <url>   use a non-production auth issuer\n */\n\nimport {\n  fileCodexAuthStore,\n  readJwtClaims,\n  resolveCodexAuthPath,\n  runDeviceCodeLogin,\n  shouldRefresh,\n  type CodexDeviceCode,\n} from './codex.ts'\n\nconst BLUE = '\\u001B[94m'\nconst GRAY = '\\u001B[90m'\nconst BOLD = '\\u001B[1m'\nconst RESET = '\\u001B[0m'\n\ninterface Flags {\n  force: boolean\n  status: boolean\n  path: string | undefined\n  issuer: string | undefined\n}\n\nfunction parseFlags(argv: readonly string[]): Flags {\n  const flags: Flags = { force: false, status: false, path: undefined, issuer: undefined }\n  for (let index = 0; index < argv.length; index++) {\n    const arg = argv[index]\n    switch (arg) {\n      case '--force': flags.force = true; break\n      case '--status': flags.status = true; break\n      case '--path': flags.path = argv[++index]; break\n      case '--issuer': flags.issuer = argv[++index]; break\n      default:\n        if (arg !== undefined && arg.startsWith('-')) {\n          throw new Error(`unknown flag \"${arg}\"`)\n        }\n    }\n  }\n  return flags\n}\n\nfunction renderPrompt(code: CodexDeviceCode): void {\n  process.stdout.write(\n    `\\n${BOLD}Sign in to Codex${RESET} ${GRAY}(device authorization)${RESET}\\n`\n    + `\\n  1. Open this URL and sign in:\\n     ${BLUE}${code.verificationUrl}${RESET}\\n`\n    + `\\n  2. Enter this one-time code ${GRAY}(expires in 15 minutes)${RESET}:\\n     ${BOLD}${BLUE}${code.userCode}${RESET}\\n`\n    + `\\n${GRAY}Only continue if YOU started this login. If someone sent you this code, stop.${RESET}\\n\\n`,\n  )\n}\n\n/** Best-effort browser launch; failure is fine because the URL is printed anyway. */\nasync function openBrowser(url: string): Promise<void> {\n  try {\n    const { spawn } = await import('node:child_process')\n    const command = process.platform === 'win32'\n      ? { file: 'cmd', args: ['/c', 'start', '', url] }\n      : process.platform === 'darwin'\n        ? { file: 'open', args: [url] }\n        : { file: 'xdg-open', args: [url] }\n    spawn(command.file, command.args, { stdio: 'ignore', detached: true }).unref()\n  } catch {\n    // The printed URL is the real interface; auto-open is a convenience.\n  }\n}\n\nasync function main(): Promise<number> {\n  const flags = parseFlags(process.argv.slice(2))\n  const location = resolveCodexAuthPath(flags.path)\n  const store = fileCodexAuthStore(location)\n  const existing = await store.read()\n\n  if (flags.status) {\n    if (existing?.tokens === undefined || existing.tokens === null) {\n      process.stdout.write(`codex: not signed in ${GRAY}(${location})${RESET}\\n`)\n      return 1\n    }\n    const claims = readJwtClaims(existing.tokens.id_token)\n    const stale = shouldRefresh(existing)\n    process.stdout.write(\n      `codex: signed in ${GRAY}(${location})${RESET}\\n`\n      + `  account : ${claims?.accountId ?? existing.tokens.account_id ?? '<none>'}\\n`\n      + `  email   : ${claims?.email ?? '<undisclosed>'}\\n`\n      + `  plan    : ${claims?.planType ?? '<undisclosed>'}\\n`\n      + `  token   : ${stale ? 'needs refresh' : 'valid'}\\n`,\n    )\n    return 0\n  }\n\n  if (!flags.force && existing?.tokens !== undefined && existing.tokens !== null\n    && !shouldRefresh(existing)) {\n    const claims = readJwtClaims(existing.tokens.id_token)\n    process.stdout.write(\n      `codex: already signed in as ${claims?.email ?? claims?.accountId ?? 'this account'}\\n`\n      + `${GRAY}  ${location}\\n  pass --force to sign in again${RESET}\\n`,\n    )\n    return 0\n  }\n\n  // Ctrl-C during a 15-minute poll should exit promptly rather than wait.\n  const cancel = new AbortController()\n  const onSigint = (): void => {\n    cancel.abort()\n    process.stdout.write('\\ncodex: login cancelled\\n')\n  }\n  process.once('SIGINT', onSigint)\n\n  let lastReport = 0\n  try {\n    const result = await runDeviceCodeLogin(\n      store,\n      { signal: cancel.signal, ...flags.issuer === undefined ? {} : { issuer: flags.issuer } },\n      {\n        onPrompt: (code) => {\n          renderPrompt(code)\n          void openBrowser(code.verificationUrl)\n        },\n        onPoll: (elapsedMs) => {\n          // Throttle to one line per 15s so a long wait does not spam the log.\n          if (elapsedMs - lastReport < 15_000 && elapsedMs !== 0) return\n          lastReport = elapsedMs\n          process.stdout.write(`${GRAY}  waiting for approval… ${Math.round(elapsedMs / 1000)}s${RESET}\\n`)\n        },\n      },\n    )\n    process.stdout.write(\n      `\\n${BOLD}codex: signed in${RESET}\\n`\n      + `  account : ${result.accountId ?? '<none>'}\\n`\n      + `  email   : ${result.email ?? '<undisclosed>'}\\n`\n      + `  plan    : ${result.planType ?? '<undisclosed>'}\\n`\n      + `  stored  : ${result.location} ${GRAY}(git-ignored)${RESET}\\n`,\n    )\n    return 0\n  } finally {\n    process.removeListener('SIGINT', onSigint)\n  }\n}\n\ntry {\n  process.exitCode = await main()\n} catch (error: unknown) {\n  process.stdout.write(`\\ncodex: login failed — ${error instanceof Error ? error.message : String(error)}\\n`)\n  process.exitCode = 1\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,QAAQ;AASd,SAAS,WAAW,MAAgC;CAClD,MAAM,QAAe;EAAE,OAAO;EAAO,QAAQ;EAAO,MAAM;EAAW,QAAQ;CAAU;CACvF,KAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;EAChD,MAAM,MAAM,KAAK;EACjB,QAAQ,KAAR;GACE,KAAK;IAAW,MAAM,QAAQ;IAAM;GACpC,KAAK;IAAY,MAAM,SAAS;IAAM;GACtC,KAAK;IAAU,MAAM,OAAO,KAAK,EAAE;IAAQ;GAC3C,KAAK;IAAY,MAAM,SAAS,KAAK,EAAE;IAAQ;GAC/C,SACE,IAAI,QAAQ,UAAa,IAAI,WAAW,GAAG,GACzC,MAAM,IAAI,MAAM,iBAAiB,IAAI,EAAE;EAE7C;CACF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,MAA6B;CACjD,QAAQ,OAAO,MACb,KAAK,KAAK,kBAAkB,MAAM,GAAG,KAAK,wBAAwB,MAAM,4CAC3B,OAAO,KAAK,kBAAkB,MAAM,oCAC5C,KAAK,yBAAyB,MAAM,UAAU,OAAO,OAAO,KAAK,WAAW,MAAM,MAChH,KAAK,+EAA+E,MAAM,KACnG;AACF;;AAGA,eAAe,YAAY,KAA4B;CACrD,IAAI;EACF,MAAM,EAAE,UAAU,MAAM,OAAO;EAC/B,MAAM,UAAU,QAAQ,aAAa,UACjC;GAAE,MAAM;GAAO,MAAM;IAAC;IAAM;IAAS;IAAI;GAAG;EAAE,IAC9C,QAAQ,aAAa,WACnB;GAAE,MAAM;GAAQ,MAAM,CAAC,GAAG;EAAE,IAC5B;GAAE,MAAM;GAAY,MAAM,CAAC,GAAG;EAAE;EACtC,MAAM,QAAQ,MAAM,QAAQ,MAAM;GAAE,OAAO;GAAU,UAAU;EAAK,CAAC,CAAC,CAAC,MAAM;CAC/E,QAAQ,CAER;AACF;AAEA,eAAe,OAAwB;CACrC,MAAM,QAAQ,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC;CAC9C,MAAM,WAAW,qBAAqB,MAAM,IAAI;CAChD,MAAM,QAAQ,mBAAmB,QAAQ;CACzC,MAAM,WAAW,MAAM,MAAM,KAAK;CAElC,IAAI,MAAM,QAAQ;EAChB,IAAI,UAAU,WAAW,UAAa,SAAS,WAAW,MAAM;GAC9D,QAAQ,OAAO,MAAM,wBAAwB,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG;GAC1E,OAAO;EACT;EACA,MAAM,SAAS,cAAc,SAAS,OAAO,QAAQ;EACrD,MAAM,QAAQ,cAAc,QAAQ;EACpC,QAAQ,OAAO,MACb,oBAAoB,KAAK,GAAG,SAAS,GAAG,MAAM,gBAC7B,QAAQ,aAAa,SAAS,OAAO,cAAc,SAAS,gBAC5D,QAAQ,SAAS,gBAAgB,gBACjC,QAAQ,YAAY,gBAAgB,gBACpC,QAAQ,kBAAkB,QAAQ,GACrD;EACA,OAAO;CACT;CAEA,IAAI,CAAC,MAAM,SAAS,UAAU,WAAW,UAAa,SAAS,WAAW,QACrE,CAAC,cAAc,QAAQ,GAAG;EAC7B,MAAM,SAAS,cAAc,SAAS,OAAO,QAAQ;EACrD,QAAQ,OAAO,MACb,+BAA+B,QAAQ,SAAS,QAAQ,aAAa,eAAe,IAC/E,KAAK,IAAI,SAAS,mCAAmC,MAAM,GAClE;EACA,OAAO;CACT;CAGA,MAAM,SAAS,IAAI,gBAAgB;CACnC,MAAM,iBAAuB;EAC3B,OAAO,MAAM;EACb,QAAQ,OAAO,MAAM,4BAA4B;CACnD;CACA,QAAQ,KAAK,UAAU,QAAQ;CAE/B,IAAI,aAAa;CACjB,IAAI;EACF,MAAM,SAAS,MAAM,mBACnB,OACA;GAAE,QAAQ,OAAO;GAAQ,GAAG,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;EAAE,GACvF;GACE,WAAW,SAAS;IAClB,aAAa,IAAI;IACjB,AAAK,YAAY,KAAK,eAAe;GACvC;GACA,SAAS,cAAc;IAErB,IAAI,YAAY,aAAa,QAAU,cAAc,GAAG;IACxD,aAAa;IACb,QAAQ,OAAO,MAAM,GAAG,KAAK,0BAA0B,KAAK,MAAM,YAAY,GAAI,EAAE,GAAG,MAAM,GAAG;GAClG;EACF,CACF;EACA,QAAQ,OAAO,MACb,KAAK,KAAK,kBAAkB,MAAM,gBACjB,OAAO,aAAa,SAAS,gBAC7B,OAAO,SAAS,gBAAgB,gBAChC,OAAO,YAAY,gBAAgB,gBACnC,OAAO,SAAS,GAAG,KAAK,eAAe,MAAM,GAChE;EACA,OAAO;CACT,UAAU;EACR,QAAQ,eAAe,UAAU,QAAQ;CAC3C;AACF;AAEA,IAAI;CACF,QAAQ,WAAW,MAAM,KAAK;AAChC,SAAS,OAAgB;CACvB,QAAQ,OAAO,MAAM,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GAAG;CAC1G,QAAQ,WAAW;AACrB"}

package/dist/codex-CBvNhtAh.mjs

@@ -0,0 +1,269 @@
+import { AgentSdkError } from "@alvin0/ai-agent-sdk-core";
+import { defineCredentialStore } from "@alvin0/ai-agent-sdk-core/provider";
+import { ACCESS_TOKEN_REFRESH_WINDOW_MS, CODEX_BASE_URL, CODEX_CLIENT_ID, CODEX_CLIENT_VERSION, CODEX_ORIGINATOR, CodexRefreshError, DEFAULT_CODEX_ISSUER, LAST_REFRESH_MAX_AGE_MS, codexAdapter, codexPlugin, isFedrampAccount, memoryCodexAuthStore, memoryCodexCredentialStore, readJwtClaims, refreshCodexTokens, requestDeviceCode, requireTokens, resolveAccountId, runDeviceCodeLogin, shouldRefresh } from "@alvin0/ai-agent-sdk-provider-codex";
+import { createHash, randomUUID } from "node:crypto";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+
+//#region src/common/credential-file.ts
+const MAX_CREDENTIAL_FILE_BYTES = 1048576;
+const LOCK_RETRY_MS = 10;
+const LOCK_TIMEOUT_MS = 3e4;
+/** Read one stable regular file without following its final symlink. */
+async function readCredentialText(location, signal) {
+	signal?.throwIfAborted();
+	let handle;
+	try {
+		handle = await openNoFollow(location, constants.O_RDONLY);
+		signal?.throwIfAborted();
+		const [opened, linked] = await Promise.all([handle.stat(), lstat(location)]);
+		if (!opened.isFile() || linked.isSymbolicLink() || opened.dev !== linked.dev || opened.ino !== linked.ino) throw credentialFileError("Codex credential path must be a stable regular file");
+		if (opened.size > 1048576) throw credentialFileError("Codex credential file exceeds the 1 MiB limit");
+		const raw = await handle.readFile({
+			encoding: "utf8",
+			...signal === void 0 ? {} : { signal }
+		});
+		signal?.throwIfAborted();
+		return raw;
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return void 0;
+		throw error;
+	} finally {
+		await handle?.close().catch(() => void 0);
+	}
+}
+/** Serialize cross-process compare-and-swap writers with an exclusive sidecar lock. */
+async function withCredentialFileLock(location, signal, task) {
+	await prepareDirectory(dirname(location), signal);
+	const lockPath = `${location}.lock`;
+	const startedAt = Date.now();
+	let handle;
+	while (handle === void 0) {
+		signal?.throwIfAborted();
+		try {
+			handle = await openNoFollow(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+		} catch (error) {
+			if (errorCode(error) !== "EEXIST") throw error;
+			await rejectSymlink(lockPath);
+			if (Date.now() - startedAt >= LOCK_TIMEOUT_MS) throw credentialFileError("Codex credential writer lock did not become available", void 0, "CODEX_CREDENTIAL_LOCK_TIMEOUT");
+			await abortableDelay(LOCK_RETRY_MS, signal);
+		}
+	}
+	try {
+		signal?.throwIfAborted();
+		return await task();
+	} finally {
+		await handle.close().catch(() => void 0);
+		await unlink(lockPath).catch(() => void 0);
+	}
+}
+/** Atomically replace one credential file while preserving private modes. */
+async function replaceCredentialText(location, payload, signal) {
+	signal?.throwIfAborted();
+	if (Buffer.byteLength(payload, "utf8") > 1048576) throw credentialFileError("Codex credential file exceeds the 1 MiB limit");
+	const directory = dirname(location);
+	await prepareDirectory(directory, signal);
+	await rejectSymlink(location);
+	const temporary = join(directory, `.auth-${process.pid}-${randomUUID()}.tmp`);
+	let handle;
+	try {
+		handle = await openNoFollow(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+		signal?.throwIfAborted();
+		await handle.writeFile(payload, {
+			encoding: "utf8",
+			...signal === void 0 ? {} : { signal }
+		});
+		await handle.sync();
+		await handle.close();
+		handle = void 0;
+		signal?.throwIfAborted();
+		await chmod(temporary, 384);
+		await rejectSymlink(location);
+		await rename(temporary, location);
+		await chmod(location, 384);
+		await syncDirectory(directory);
+	} catch (error) {
+		await handle?.close().catch(() => void 0);
+		await unlink(temporary).catch(() => void 0);
+		throw error;
+	}
+}
+function credentialFileError(message, cause, code = "INVALID_CREDENTIAL") {
+	return new AgentSdkError(message, code, cause === void 0 ? {} : { cause });
+}
+function openNoFollow(path, flags, mode) {
+	const noFollow = "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0;
+	return mode === void 0 ? open(path, flags | noFollow) : open(path, flags | noFollow, mode);
+}
+async function prepareDirectory(directory, signal) {
+	signal?.throwIfAborted();
+	if (await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	}) !== void 0) await chmod(directory, 448);
+	signal?.throwIfAborted();
+}
+async function rejectSymlink(path) {
+	try {
+		if ((await lstat(path)).isSymbolicLink()) throw credentialFileError("Codex credential path must not be a symbolic link");
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return;
+		throw error;
+	}
+}
+async function syncDirectory(directory) {
+	let handle;
+	try {
+		handle = await open(directory, constants.O_RDONLY);
+		await handle.sync();
+	} catch (error) {
+		const code = errorCode(error);
+		if (process.platform === "win32" && (code === "EISDIR" || code === "EPERM" || code === "EINVAL")) return;
+		throw error;
+	} finally {
+		await handle?.close().catch(() => void 0);
+	}
+}
+function abortableDelay(ms, signal) {
+	if (signal?.aborted === true) return Promise.reject(signal.reason);
+	return new Promise((resolve, reject) => {
+		const finish = () => {
+			signal?.removeEventListener("abort", abort);
+			resolve();
+		};
+		const abort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason ?? /* @__PURE__ */ new Error("operation aborted"));
+		};
+		const timer = setTimeout(finish, ms);
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+function errorCode(error) {
+	if (typeof error !== "object" || error === null) return void 0;
+	const descriptor = Object.getOwnPropertyDescriptor(error, "code");
+	return descriptor !== void 0 && "value" in descriptor ? descriptor.value : void 0;
+}
+
+//#endregion
+//#region src/codex-store.ts
+/** Symlink-safe, atomic Node filesystem store for Codex OAuth credentials. */
+const DEFAULT_CODEX_AUTH_PATH = ".providers/.codex/auth.json";
+const CODEX_AUTH_PATH_ENV = "AI_AGENT_SDK_CODEX_AUTH";
+function resolveCodexAuthPath(explicitPath, options = {}) {
+	const env = options.env ?? process.env;
+	const selected = nonEmptyPath(explicitPath) ?? nonEmptyPath(env["AI_AGENT_SDK_CODEX_AUTH"]) ?? ".providers/.codex/auth.json";
+	const cwd = resolve(options.cwd ?? process.cwd());
+	return isAbsolute(selected) ? resolve(selected) : resolve(cwd, selected);
+}
+/** @deprecated Use the revisioned {@link fileCodexCredentialStore}. */
+function fileCodexAuthStore(path, options = {}) {
+	const location = resolveCodexAuthPath(path, options);
+	return {
+		location,
+		async read() {
+			return (await readAuthFile(location))?.file;
+		},
+		async write(file) {
+			const payload = authPayload(file);
+			await withCredentialFileLock(location, void 0, async () => {
+				await replaceCredentialText(location, payload);
+			});
+		}
+	};
+}
+/** Revisioned compare-and-swap store used by normal Node provider composition. */
+function fileCodexCredentialStore(path, options = {}) {
+	const location = resolveCodexAuthPath(path, options);
+	return defineCredentialStore({
+		id: "codex-file-credentials",
+		label: "Codex file credential store",
+		async read({ signal }) {
+			const snapshot = await readAuthFile(location, signal);
+			return snapshot === void 0 ? void 0 : Object.freeze({
+				value: snapshot.file,
+				revision: revisionOf(snapshot.raw)
+			});
+		},
+		async commit(input, { signal }) {
+			validateExpectedRevision(input.expectedRevision);
+			const payload = authPayload(input.value);
+			return await withCredentialFileLock(location, signal, async () => {
+				const current = await readAuthFile(location, signal);
+				if ((current === void 0 ? null : revisionOf(current.raw)) !== input.expectedRevision) throw credentialFileError("Codex credential revision changed before commit", void 0, "CODEX_CREDENTIAL_REVISION_CONFLICT");
+				await replaceCredentialText(location, payload, signal);
+				return Object.freeze({ revision: revisionOf(payload) });
+			});
+		}
+	});
+}
+function nonEmptyPath(value) {
+	if (value === void 0 || value.trim().length === 0) return void 0;
+	if (value.includes("\0")) throw new TypeError("Codex credential path must not contain NUL");
+	return value;
+}
+async function readAuthFile(location, signal) {
+	const raw = await readCredentialText(location, signal);
+	if (raw === void 0) return void 0;
+	try {
+		return Object.freeze({
+			file: JSON.parse(raw),
+			raw
+		});
+	} catch (error) {
+		throw credentialFileError("Codex credential file is not valid JSON; delete it and log in again", error);
+	}
+}
+function authPayload(file) {
+	try {
+		const encoded = JSON.stringify(file, null, 2);
+		if (encoded === void 0) throw new TypeError("credential value is not JSON");
+		return `${encoded}\n`;
+	} catch (error) {
+		throw credentialFileError("Codex credential value could not be serialized", error);
+	}
+}
+function revisionOf(raw) {
+	return createHash("sha256").update(raw, "utf8").digest("hex");
+}
+function validateExpectedRevision(value) {
+	if (value !== null && (typeof value !== "string" || value.length === 0 || value.length > 256)) throw credentialFileError("Codex expected credential revision is invalid");
+}
+
+//#endregion
+//#region src/codex.ts
+/** @deprecated Use {@link codexNodeProviderPlugin} for normal runtime composition. */
+function codexNodeAdapter(options = {}) {
+	return codexAdapter({
+		...options,
+		authStore: options.authStore ?? fileCodexAuthStore()
+	});
+}
+/** @deprecated Use {@link codexNodeProviderPlugin}. */
+function codexNodePlugin(options = {}) {
+	const routes = Object.freeze([...options.routes ?? ["codex"]]);
+	const adapter = codexNodeAdapter(options);
+	return Object.freeze({
+		id: "codex",
+		displayName: "Codex",
+		setup: (registrar) => {
+			registrar.registerAdapter(routes, adapter);
+		}
+	});
+}
+/** Preferred Node composition plugin backed by revision-safe file credentials by default. */
+function codexNodeProviderPlugin(options = {}) {
+	return codexPlugin({
+		...options,
+		authStore: options.authStore ?? fileCodexCredentialStore()
+	});
+}
+/** Compatibility alias for the former `ai-agent-sdk/codex` entry. */
+const codexAdapter$1 = codexNodeAdapter;
+/** Compatibility alias for the former `ai-agent-sdk/codex` entry. */
+const codexPlugin$1 = codexNodePlugin;
+
+//#endregion
+export { shouldRefresh as C, fileCodexCredentialStore as D, fileCodexAuthStore as E, resolveCodexAuthPath as O, runDeviceCodeLogin as S, DEFAULT_CODEX_AUTH_PATH as T, readJwtClaims as _, CODEX_ORIGINATOR as a, requireTokens as b, LAST_REFRESH_MAX_AGE_MS as c, codexNodePlugin as d, codexNodeProviderPlugin as f, memoryCodexCredentialStore as g, memoryCodexAuthStore as h, CODEX_CLIENT_VERSION as i, codexAdapter$1 as l, isFedrampAccount as m, CODEX_BASE_URL as n, CodexRefreshError as o, codexPlugin$1 as p, CODEX_CLIENT_ID as r, DEFAULT_CODEX_ISSUER as s, ACCESS_TOKEN_REFRESH_WINDOW_MS as t, codexNodeAdapter as u, refreshCodexTokens as v, CODEX_AUTH_PATH_ENV as w, resolveAccountId as x, requestDeviceCode as y };
+//# sourceMappingURL=codex-CBvNhtAh.mjs.map

package/dist/codex-CBvNhtAh.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-CBvNhtAh.mjs","names":["universalCodexAdapter","universalCodexPlugin","codexAdapter","codexPlugin"],"sources":["../src/common/credential-file.ts","../src/codex-store.ts","../src/codex.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto'\nimport { constants } from 'node:fs'\nimport {\n  chmod,\n  lstat,\n  mkdir,\n  open,\n  rename,\n  unlink,\n  type FileHandle,\n} from 'node:fs/promises'\nimport { dirname, join } from 'node:path'\nimport { AgentSdkError } from '@alvin0/ai-agent-sdk-core'\n\nexport const MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024\nconst LOCK_RETRY_MS = 10\nconst LOCK_TIMEOUT_MS = 30_000\n\n/** Read one stable regular file without following its final symlink. */\nexport async function readCredentialText(\n  location: string,\n  signal?: AbortSignal,\n): Promise<string | undefined> {\n  signal?.throwIfAborted()\n  let handle: FileHandle | undefined\n  try {\n    handle = await openNoFollow(location, constants.O_RDONLY)\n    signal?.throwIfAborted()\n    const [opened, linked] = await Promise.all([handle.stat(), lstat(location)])\n    if (!opened.isFile() || linked.isSymbolicLink()\n      || opened.dev !== linked.dev || opened.ino !== linked.ino) {\n      throw credentialFileError('Codex credential path must be a stable regular file')\n    }\n    if (opened.size > MAX_CREDENTIAL_FILE_BYTES) {\n      throw credentialFileError('Codex credential file exceeds the 1 MiB limit')\n    }\n    const raw = await handle.readFile({ encoding: 'utf8', ...(signal === undefined ? {} : { signal }) })\n    signal?.throwIfAborted()\n    return raw\n  } catch (error: unknown) {\n    if (errorCode(error) === 'ENOENT') return undefined\n    throw error\n  } finally {\n    await handle?.close().catch(() => undefined)\n  }\n}\n\n/** Serialize cross-process compare-and-swap writers with an exclusive sidecar lock. */\nexport async function withCredentialFileLock<T>(\n  location: string,\n  signal: AbortSignal | undefined,\n  task: () => Promise<T>,\n): Promise<T> {\n  const directory = dirname(location)\n  await prepareDirectory(directory, signal)\n  const lockPath = `${location}.lock`\n  const startedAt = Date.now()\n  let handle: FileHandle | undefined\n  while (handle === undefined) {\n    signal?.throwIfAborted()\n    try {\n      handle = await openNoFollow(\n        lockPath,\n        constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,\n        0o600,\n      )\n    } catch (error: unknown) {\n      if (errorCode(error) !== 'EEXIST') throw error\n      await rejectSymlink(lockPath)\n      if (Date.now() - startedAt >= LOCK_TIMEOUT_MS) {\n        throw credentialFileError(\n          'Codex credential writer lock did not become available',\n          undefined,\n          'CODEX_CREDENTIAL_LOCK_TIMEOUT',\n        )\n      }\n      await abortableDelay(LOCK_RETRY_MS, signal)\n    }\n  }\n  try {\n    signal?.throwIfAborted()\n    return await task()\n  } finally {\n    await handle.close().catch(() => undefined)\n    await unlink(lockPath).catch(() => undefined)\n  }\n}\n\n/** Atomically replace one credential file while preserving private modes. */\nexport async function replaceCredentialText(\n  location: string,\n  payload: string,\n  signal?: AbortSignal,\n): Promise<void> {\n  signal?.throwIfAborted()\n  if (Buffer.byteLength(payload, 'utf8') > MAX_CREDENTIAL_FILE_BYTES) {\n    throw credentialFileError('Codex credential file exceeds the 1 MiB limit')\n  }\n  const directory = dirname(location)\n  await prepareDirectory(directory, signal)\n  await rejectSymlink(location)\n  const temporary = join(directory, `.auth-${process.pid}-${randomUUID()}.tmp`)\n  let handle: FileHandle | undefined\n  try {\n    handle = await openNoFollow(\n      temporary,\n      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,\n      0o600,\n    )\n    signal?.throwIfAborted()\n    await handle.writeFile(payload, { encoding: 'utf8', ...(signal === undefined ? {} : { signal }) })\n    await handle.sync()\n    await handle.close()\n    handle = undefined\n    signal?.throwIfAborted()\n    await chmod(temporary, 0o600)\n    await rejectSymlink(location)\n    await rename(temporary, location)\n    await chmod(location, 0o600)\n    await syncDirectory(directory)\n  } catch (error: unknown) {\n    await handle?.close().catch(() => undefined)\n    await unlink(temporary).catch(() => undefined)\n    throw error\n  }\n}\n\nexport function credentialFileError(\n  message: string,\n  cause?: unknown,\n  code = 'INVALID_CREDENTIAL',\n): AgentSdkError {\n  return new AgentSdkError(message, code, cause === undefined ? {} : { cause })\n}\n\nfunction openNoFollow(path: string, flags: number, mode?: number): Promise<FileHandle> {\n  const noFollow = 'O_NOFOLLOW' in constants ? constants.O_NOFOLLOW : 0\n  return mode === undefined ? open(path, flags | noFollow) : open(path, flags | noFollow, mode)\n}\n\nasync function prepareDirectory(directory: string, signal?: AbortSignal): Promise<void> {\n  signal?.throwIfAborted()\n  const created = await mkdir(directory, { recursive: true, mode: 0o700 })\n  if (created !== undefined) await chmod(directory, 0o700)\n  signal?.throwIfAborted()\n}\n\nasync function rejectSymlink(path: string): Promise<void> {\n  try {\n    if ((await lstat(path)).isSymbolicLink()) {\n      throw credentialFileError('Codex credential path must not be a symbolic link')\n    }\n  } catch (error: unknown) {\n    if (errorCode(error) === 'ENOENT') return\n    throw error\n  }\n}\n\nasync function syncDirectory(directory: string): Promise<void> {\n  let handle: FileHandle | undefined\n  try {\n    handle = await open(directory, constants.O_RDONLY)\n    await handle.sync()\n  } catch (error: unknown) {\n    const code = errorCode(error)\n    if (process.platform === 'win32' && (code === 'EISDIR' || code === 'EPERM' || code === 'EINVAL')) return\n    throw error\n  } finally {\n    await handle?.close().catch(() => undefined)\n  }\n}\n\nfunction abortableDelay(ms: number, signal?: AbortSignal): Promise<void> {\n  if (signal?.aborted === true) return Promise.reject(signal.reason)\n  return new Promise((resolve, reject) => {\n    const finish = () => { signal?.removeEventListener('abort', abort); resolve() }\n    const abort = () => { clearTimeout(timer); reject(signal?.reason ?? new Error('operation aborted')) }\n    const timer = setTimeout(finish, ms)\n    signal?.addEventListener('abort', abort, { once: true })\n  })\n}\n\nfunction errorCode(error: unknown): unknown {\n  if (typeof error !== 'object' || error === null) return undefined\n  const descriptor = Object.getOwnPropertyDescriptor(error, 'code')\n  return descriptor !== undefined && 'value' in descriptor ? descriptor.value : undefined\n}\n","/** Symlink-safe, atomic Node filesystem store for Codex OAuth credentials. */\n\nimport { createHash } from 'node:crypto'\nimport { isAbsolute, resolve } from 'node:path'\nimport { defineCredentialStore } from '@alvin0/ai-agent-sdk-core/provider'\nimport type {\n  CodexAuthFile,\n  CodexAuthStore,\n  CodexCredentialStore,\n} from '@alvin0/ai-agent-sdk-provider-codex'\nimport {\n  credentialFileError,\n  readCredentialText,\n  replaceCredentialText,\n  withCredentialFileLock,\n} from './common/credential-file.ts'\n\nexport const DEFAULT_CODEX_AUTH_PATH = '.providers/.codex/auth.json'\nexport const CODEX_AUTH_PATH_ENV = 'AI_AGENT_SDK_CODEX_AUTH'\n\nexport interface CodexAuthPathOptions {\n  /** Base for relative paths. Defaults to `process.cwd()`. */\n  readonly cwd?: string\n  /** Environment source. Defaults to `process.env`. */\n  readonly env?: Readonly<Record<string, string | undefined>>\n}\n\nexport function resolveCodexAuthPath(\n  explicitPath?: string,\n  options: CodexAuthPathOptions = {},\n): string {\n  const env = options.env ?? process.env\n  const selected = nonEmptyPath(explicitPath)\n    ?? nonEmptyPath(env[CODEX_AUTH_PATH_ENV])\n    ?? DEFAULT_CODEX_AUTH_PATH\n  const cwd = resolve(options.cwd ?? process.cwd())\n  return isAbsolute(selected) ? resolve(selected) : resolve(cwd, selected)\n}\n\n/** @deprecated Use the revisioned {@link fileCodexCredentialStore}. */\nexport function fileCodexAuthStore(\n  path?: string,\n  options: CodexAuthPathOptions = {},\n): CodexAuthStore {\n  const location = resolveCodexAuthPath(path, options)\n  return {\n    location,\n    async read(): Promise<CodexAuthFile | undefined> {\n      return (await readAuthFile(location))?.file\n    },\n    async write(file: CodexAuthFile): Promise<void> {\n      const payload = authPayload(file)\n      await withCredentialFileLock(location, undefined, async () => {\n        await replaceCredentialText(location, payload)\n      })\n    },\n  }\n}\n\n/** Revisioned compare-and-swap store used by normal Node provider composition. */\nexport function fileCodexCredentialStore(\n  path?: string,\n  options: CodexAuthPathOptions = {},\n): CodexCredentialStore {\n  const location = resolveCodexAuthPath(path, options)\n  return defineCredentialStore<CodexAuthFile>({\n    id: 'codex-file-credentials',\n    label: 'Codex file credential store',\n    async read({ signal }) {\n      const snapshot = await readAuthFile(location, signal)\n      return snapshot === undefined ? undefined : Object.freeze({\n        value: snapshot.file,\n        revision: revisionOf(snapshot.raw),\n      })\n    },\n    async commit(input, { signal }) {\n      validateExpectedRevision(input.expectedRevision)\n      const payload = authPayload(input.value)\n      return await withCredentialFileLock(location, signal, async () => {\n        const current = await readAuthFile(location, signal)\n        const actual = current === undefined ? null : revisionOf(current.raw)\n        if (actual !== input.expectedRevision) {\n          throw credentialFileError(\n            'Codex credential revision changed before commit',\n            undefined,\n            'CODEX_CREDENTIAL_REVISION_CONFLICT',\n          )\n        }\n        await replaceCredentialText(location, payload, signal)\n        return Object.freeze({ revision: revisionOf(payload) })\n      })\n    },\n  })\n}\n\nfunction nonEmptyPath(value: string | undefined): string | undefined {\n  if (value === undefined || value.trim().length === 0) return undefined\n  if (value.includes('\\0')) throw new TypeError('Codex credential path must not contain NUL')\n  return value\n}\n\nasync function readAuthFile(\n  location: string,\n  signal?: AbortSignal,\n): Promise<{ readonly file: CodexAuthFile; readonly raw: string } | undefined> {\n  const raw = await readCredentialText(location, signal)\n  if (raw === undefined) return undefined\n  try {\n    return Object.freeze({ file: JSON.parse(raw) as CodexAuthFile, raw })\n  } catch (error: unknown) {\n    throw credentialFileError(\n      'Codex credential file is not valid JSON; delete it and log in again',\n      error,\n    )\n  }\n}\n\nfunction authPayload(file: CodexAuthFile): string {\n  try {\n    const encoded = JSON.stringify(file, null, 2)\n    if (encoded === undefined) throw new TypeError('credential value is not JSON')\n    return `${encoded}\\n`\n  } catch (error: unknown) {\n    throw credentialFileError('Codex credential value could not be serialized', error)\n  }\n}\n\nfunction revisionOf(raw: string): string {\n  return createHash('sha256').update(raw, 'utf8').digest('hex')\n}\n\nfunction validateExpectedRevision(value: string | null): void {\n  if (value !== null && (typeof value !== 'string' || value.length === 0 || value.length > 256)) {\n    throw credentialFileError('Codex expected credential revision is invalid')\n  }\n}\n","/** Node wrapper over the injected-store Universal Codex provider. */\n\nimport type {\n  ComposableModelProviderPlugin,\n  ModelProviderPlugin,\n  ModelProviderRegistrar,\n} from '@alvin0/ai-agent-sdk-core/provider'\nimport {\n  CODEX_BASE_URL,\n  CODEX_CLIENT_VERSION,\n  CODEX_ORIGINATOR,\n  codexAdapter as universalCodexAdapter,\n  codexPlugin as universalCodexPlugin,\n  type CodexAdapterOptions as UniversalCodexAdapterOptions,\n  type CodexAuthStore,\n  type CodexCredentialStore,\n  type CodexProviderOptions,\n} from '@alvin0/ai-agent-sdk-provider-codex'\nimport { fileCodexAuthStore, fileCodexCredentialStore } from './codex-store.ts'\n\nexport { CODEX_BASE_URL, CODEX_CLIENT_VERSION, CODEX_ORIGINATOR }\n\nexport interface CodexNodeAdapterOptions extends Omit<UniversalCodexAdapterOptions, 'authStore'> {\n  /** Omit only in the Node compatibility wrapper to use the project-local file store. */\n  readonly authStore?: CodexAuthStore\n}\n\nexport interface CodexNodePluginOptions extends CodexNodeAdapterOptions {\n  readonly routes?: readonly string[]\n}\n\n/** @deprecated Use {@link codexNodeProviderPlugin} for normal runtime composition. */\nexport function codexNodeAdapter(\n  options: CodexNodeAdapterOptions = {},\n): ReturnType<typeof universalCodexAdapter> {\n  return universalCodexAdapter({\n    ...options,\n    authStore: options.authStore ?? fileCodexAuthStore(),\n  })\n}\n\n/** @deprecated Use {@link codexNodeProviderPlugin}. */\nexport function codexNodePlugin(options: CodexNodePluginOptions = {}): ModelProviderPlugin {\n  const routes = Object.freeze([...(options.routes ?? ['codex'])])\n  const adapter = codexNodeAdapter(options)\n  return Object.freeze({\n    id: 'codex', displayName: 'Codex',\n    setup: (registrar: ModelProviderRegistrar) => { registrar.registerAdapter(routes, adapter) },\n  })\n}\n\nexport interface CodexNodeProviderOptions extends Omit<CodexProviderOptions, 'authStore'> {\n  readonly authStore?: CodexCredentialStore\n}\n\n/** Preferred Node composition plugin backed by revision-safe file credentials by default. */\nexport function codexNodeProviderPlugin(\n  options: CodexNodeProviderOptions = {},\n): ComposableModelProviderPlugin & { readonly family: 'codex' } {\n  return universalCodexPlugin({\n    ...options,\n    authStore: options.authStore ?? fileCodexCredentialStore(),\n  })\n}\n\n/** Compatibility alias for the former `ai-agent-sdk/codex` entry. */\nexport const codexAdapter = codexNodeAdapter\n/** Compatibility alias for the former `ai-agent-sdk/codex` entry. */\nexport const codexPlugin = codexNodePlugin\nexport type CodexAdapterOptions = CodexNodeAdapterOptions\nexport type CodexPluginOptions = CodexNodePluginOptions\n\nexport {\n  ACCESS_TOKEN_REFRESH_WINDOW_MS,\n  CODEX_CLIENT_ID,\n  CodexRefreshError,\n  DEFAULT_CODEX_ISSUER,\n  LAST_REFRESH_MAX_AGE_MS,\n  isFedrampAccount,\n  memoryCodexAuthStore,\n  memoryCodexCredentialStore,\n  readJwtClaims,\n  refreshCodexTokens,\n  requestDeviceCode,\n  requireTokens,\n  resolveAccountId,\n  runDeviceCodeLogin,\n  shouldRefresh,\n  type CodexAuthFile,\n  type CodexAuthStore,\n  type CodexCredentialStore,\n  type CodexDeviceCode,\n  type CodexJwtClaims,\n  type CodexLoginProgress,\n  type CodexLoginResult,\n  type CodexOAuthOptions,\n  type CodexTokens,\n  type RefreshFailureKind,\n} from '@alvin0/ai-agent-sdk-provider-codex'\nexport {\n  CODEX_AUTH_PATH_ENV,\n  DEFAULT_CODEX_AUTH_PATH,\n  fileCodexAuthStore,\n  fileCodexCredentialStore,\n  resolveCodexAuthPath,\n  type CodexAuthPathOptions,\n} from './codex-store.ts'\n"],"mappings":";;;;;;;;;AAcA,MAAa,4BAA4B;AACzC,MAAM,gBAAgB;AACtB,MAAM,kBAAkB;;AAGxB,eAAsB,mBACpB,UACA,QAC6B;CAC7B,QAAQ,eAAe;CACvB,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,aAAa,UAAU,UAAU,QAAQ;EACxD,QAAQ,eAAe;EACvB,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC;EAC3E,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,eAAe,KACzC,OAAO,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,KACtD,MAAM,oBAAoB,qDAAqD;EAEjF,IAAI,OAAO,gBACT,MAAM,oBAAoB,+CAA+C;EAE3E,MAAM,MAAM,MAAM,OAAO,SAAS;GAAE,UAAU;GAAQ,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;EAAG,CAAC;EACnG,QAAQ,eAAe;EACvB,OAAO;CACT,SAAS,OAAgB;EACvB,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;EAC1C,MAAM;CACR,UAAU;EACR,MAAM,QAAQ,MAAM,CAAC,CAAC,YAAY,MAAS;CAC7C;AACF;;AAGA,eAAsB,uBACpB,UACA,QACA,MACY;CAEZ,MAAM,iBADY,QAAQ,QACK,GAAG,MAAM;CACxC,MAAM,WAAW,GAAG,SAAS;CAC7B,MAAM,YAAY,KAAK,IAAI;CAC3B,IAAI;CACJ,OAAO,WAAW,QAAW;EAC3B,QAAQ,eAAe;EACvB,IAAI;GACF,SAAS,MAAM,aACb,UACA,UAAU,WAAW,UAAU,UAAU,UAAU,QACnD,GACF;EACF,SAAS,OAAgB;GACvB,IAAI,UAAU,KAAK,MAAM,UAAU,MAAM;GACzC,MAAM,cAAc,QAAQ;GAC5B,IAAI,KAAK,IAAI,IAAI,aAAa,iBAC5B,MAAM,oBACJ,yDACA,QACA,+BACF;GAEF,MAAM,eAAe,eAAe,MAAM;EAC5C;CACF;CACA,IAAI;EACF,QAAQ,eAAe;EACvB,OAAO,MAAM,KAAK;CACpB,UAAU;EACR,MAAM,OAAO,MAAM,CAAC,CAAC,YAAY,MAAS;EAC1C,MAAM,OAAO,QAAQ,CAAC,CAAC,YAAY,MAAS;CAC9C;AACF;;AAGA,eAAsB,sBACpB,UACA,SACA,QACe;CACf,QAAQ,eAAe;CACvB,IAAI,OAAO,WAAW,SAAS,MAAM,aACnC,MAAM,oBAAoB,+CAA+C;CAE3E,MAAM,YAAY,QAAQ,QAAQ;CAClC,MAAM,iBAAiB,WAAW,MAAM;CACxC,MAAM,cAAc,QAAQ;CAC5B,MAAM,YAAY,KAAK,WAAW,SAAS,QAAQ,IAAI,GAAG,WAAW,EAAE,KAAK;CAC5E,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,aACb,WACA,UAAU,WAAW,UAAU,UAAU,UAAU,QACnD,GACF;EACA,QAAQ,eAAe;EACvB,MAAM,OAAO,UAAU,SAAS;GAAE,UAAU;GAAQ,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;EAAG,CAAC;EACjG,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO,MAAM;EACnB,SAAS;EACT,QAAQ,eAAe;EACvB,MAAM,MAAM,WAAW,GAAK;EAC5B,MAAM,cAAc,QAAQ;EAC5B,MAAM,OAAO,WAAW,QAAQ;EAChC,MAAM,MAAM,UAAU,GAAK;EAC3B,MAAM,cAAc,SAAS;CAC/B,SAAS,OAAgB;EACvB,MAAM,QAAQ,MAAM,CAAC,CAAC,YAAY,MAAS;EAC3C,MAAM,OAAO,SAAS,CAAC,CAAC,YAAY,MAAS;EAC7C,MAAM;CACR;AACF;AAEA,SAAgB,oBACd,SACA,OACA,OAAO,sBACQ;CACf,OAAO,IAAI,cAAc,SAAS,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM,CAAC;AAC9E;AAEA,SAAS,aAAa,MAAc,OAAe,MAAoC;CACrF,MAAM,WAAW,gBAAgB,YAAY,UAAU,aAAa;CACpE,OAAO,SAAS,SAAY,KAAK,MAAM,QAAQ,QAAQ,IAAI,KAAK,MAAM,QAAQ,UAAU,IAAI;AAC9F;AAEA,eAAe,iBAAiB,WAAmB,QAAqC;CACtF,QAAQ,eAAe;CAEvB,IAAI,MADkB,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC,MACvD,QAAW,MAAM,MAAM,WAAW,GAAK;CACvD,QAAQ,eAAe;AACzB;AAEA,eAAe,cAAc,MAA6B;CACxD,IAAI;EACF,KAAK,MAAM,MAAM,IAAI,EAAC,CAAE,eAAe,GACrC,MAAM,oBAAoB,mDAAmD;CAEjF,SAAS,OAAgB;EACvB,IAAI,UAAU,KAAK,MAAM,UAAU;EACnC,MAAM;CACR;AACF;AAEA,eAAe,cAAc,WAAkC;CAC7D,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ;EACjD,MAAM,OAAO,KAAK;CACpB,SAAS,OAAgB;EACvB,MAAM,OAAO,UAAU,KAAK;EAC5B,IAAI,QAAQ,aAAa,YAAY,SAAS,YAAY,SAAS,WAAW,SAAS,WAAW;EAClG,MAAM;CACR,UAAU;EACR,MAAM,QAAQ,MAAM,CAAC,CAAC,YAAY,MAAS;CAC7C;AACF;AAEA,SAAS,eAAe,IAAY,QAAqC;CACvE,IAAI,QAAQ,YAAY,MAAM,OAAO,QAAQ,OAAO,OAAO,MAAM;CACjE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,eAAe;GAAE,QAAQ,oBAAoB,SAAS,KAAK;GAAG,QAAQ;EAAE;EAC9E,MAAM,cAAc;GAAE,aAAa,KAAK;GAAG,OAAO,QAAQ,0BAAU,IAAI,MAAM,mBAAmB,CAAC;EAAE;EACpG,MAAM,QAAQ,WAAW,QAAQ,EAAE;EACnC,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACzD,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,aAAa,OAAO,yBAAyB,OAAO,MAAM;CAChE,OAAO,eAAe,UAAa,WAAW,aAAa,WAAW,QAAQ;AAChF;;;;;ACzKA,MAAa,0BAA0B;AACvC,MAAa,sBAAsB;AASnC,SAAgB,qBACd,cACA,UAAgC,CAAC,GACzB;CACR,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,WAAW,aAAa,YAAY,KACrC,aAAa,8BAAwB;CAE1C,MAAM,MAAM,QAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;CAChD,OAAO,WAAW,QAAQ,IAAI,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AACzE;;AAGA,SAAgB,mBACd,MACA,UAAgC,CAAC,GACjB;CAChB,MAAM,WAAW,qBAAqB,MAAM,OAAO;CACnD,OAAO;EACL;EACA,MAAM,OAA2C;GAC/C,QAAQ,MAAM,aAAa,QAAQ,EAAC,EAAG;EACzC;EACA,MAAM,MAAM,MAAoC;GAC9C,MAAM,UAAU,YAAY,IAAI;GAChC,MAAM,uBAAuB,UAAU,QAAW,YAAY;IAC5D,MAAM,sBAAsB,UAAU,OAAO;GAC/C,CAAC;EACH;CACF;AACF;;AAGA,SAAgB,yBACd,MACA,UAAgC,CAAC,GACX;CACtB,MAAM,WAAW,qBAAqB,MAAM,OAAO;CACnD,OAAO,sBAAqC;EAC1C,IAAI;EACJ,OAAO;EACP,MAAM,KAAK,EAAE,UAAU;GACrB,MAAM,WAAW,MAAM,aAAa,UAAU,MAAM;GACpD,OAAO,aAAa,SAAY,SAAY,OAAO,OAAO;IACxD,OAAO,SAAS;IAChB,UAAU,WAAW,SAAS,GAAG;GACnC,CAAC;EACH;EACA,MAAM,OAAO,OAAO,EAAE,UAAU;GAC9B,yBAAyB,MAAM,gBAAgB;GAC/C,MAAM,UAAU,YAAY,MAAM,KAAK;GACvC,OAAO,MAAM,uBAAuB,UAAU,QAAQ,YAAY;IAChE,MAAM,UAAU,MAAM,aAAa,UAAU,MAAM;IAEnD,KADe,YAAY,SAAY,OAAO,WAAW,QAAQ,GAAG,OACrD,MAAM,kBACnB,MAAM,oBACJ,mDACA,QACA,oCACF;IAEF,MAAM,sBAAsB,UAAU,SAAS,MAAM;IACrD,OAAO,OAAO,OAAO,EAAE,UAAU,WAAW,OAAO,EAAE,CAAC;GACxD,CAAC;EACH;CACF,CAAC;AACH;AAEA,SAAS,aAAa,OAA+C;CACnE,IAAI,UAAU,UAAa,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,OAAO;CAC7D,IAAI,MAAM,SAAS,IAAI,GAAG,MAAM,IAAI,UAAU,4CAA4C;CAC1F,OAAO;AACT;AAEA,eAAe,aACb,UACA,QAC6E;CAC7E,MAAM,MAAM,MAAM,mBAAmB,UAAU,MAAM;CACrD,IAAI,QAAQ,QAAW,OAAO;CAC9B,IAAI;EACF,OAAO,OAAO,OAAO;GAAE,MAAM,KAAK,MAAM,GAAG;GAAoB;EAAI,CAAC;CACtE,SAAS,OAAgB;EACvB,MAAM,oBACJ,uEACA,KACF;CACF;AACF;AAEA,SAAS,YAAY,MAA6B;CAChD,IAAI;EACF,MAAM,UAAU,KAAK,UAAU,MAAM,MAAM,CAAC;EAC5C,IAAI,YAAY,QAAW,MAAM,IAAI,UAAU,8BAA8B;EAC7E,OAAO,GAAG,QAAQ;CACpB,SAAS,OAAgB;EACvB,MAAM,oBAAoB,kDAAkD,KAAK;CACnF;AACF;AAEA,SAAS,WAAW,KAAqB;CACvC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,OAAO,KAAK;AAC9D;AAEA,SAAS,yBAAyB,OAA4B;CAC5D,IAAI,UAAU,SAAS,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,MACvF,MAAM,oBAAoB,+CAA+C;AAE7E;;;;;ACvGA,SAAgB,iBACd,UAAmC,CAAC,GACM;CAC1C,OAAOA,aAAsB;EAC3B,GAAG;EACH,WAAW,QAAQ,aAAa,mBAAmB;CACrD,CAAC;AACH;;AAGA,SAAgB,gBAAgB,UAAkC,CAAC,GAAwB;CACzF,MAAM,SAAS,OAAO,OAAO,CAAC,GAAI,QAAQ,UAAU,CAAC,OAAO,CAAE,CAAC;CAC/D,MAAM,UAAU,iBAAiB,OAAO;CACxC,OAAO,OAAO,OAAO;EACnB,IAAI;EAAS,aAAa;EAC1B,QAAQ,cAAsC;GAAE,UAAU,gBAAgB,QAAQ,OAAO;EAAE;CAC7F,CAAC;AACH;;AAOA,SAAgB,wBACd,UAAoC,CAAC,GACyB;CAC9D,OAAOC,YAAqB;EAC1B,GAAG;EACH,WAAW,QAAQ,aAAa,yBAAyB;CAC3D,CAAC;AACH;;AAGA,MAAaC,iBAAe;;AAE5B,MAAaC,gBAAc"}

package/dist/codex.d.mts

@@ -0,0 +1,45 @@
+import { ComposableModelProviderPlugin, ModelProviderPlugin } from "@alvin0/ai-agent-sdk-core/provider";
+import { ACCESS_TOKEN_REFRESH_WINDOW_MS, CODEX_BASE_URL, CODEX_CLIENT_ID, CODEX_CLIENT_VERSION, CODEX_ORIGINATOR, CodexAdapterOptions as CodexAdapterOptions$1, CodexAuthFile, CodexAuthStore, CodexAuthStore as CodexAuthStore$1, CodexCredentialStore, CodexCredentialStore as CodexCredentialStore$1, CodexDeviceCode, CodexJwtClaims, CodexLoginProgress, CodexLoginResult, CodexOAuthOptions, CodexProviderOptions, CodexRefreshError, CodexTokens, DEFAULT_CODEX_ISSUER, LAST_REFRESH_MAX_AGE_MS, RefreshFailureKind, codexAdapter as codexAdapter$1, isFedrampAccount, memoryCodexAuthStore, memoryCodexCredentialStore, readJwtClaims, refreshCodexTokens, requestDeviceCode, requireTokens, resolveAccountId, runDeviceCodeLogin, shouldRefresh } from "@alvin0/ai-agent-sdk-provider-codex";
+//#region src/codex-store.d.ts
+declare const DEFAULT_CODEX_AUTH_PATH = ".providers/.codex/auth.json";
+declare const CODEX_AUTH_PATH_ENV = "AI_AGENT_SDK_CODEX_AUTH";
+interface CodexAuthPathOptions {
+  /** Base for relative paths. Defaults to `process.cwd()`. */
+  readonly cwd?: string;
+  /** Environment source. Defaults to `process.env`. */
+  readonly env?: Readonly<Record<string, string | undefined>>;
+}
+declare function resolveCodexAuthPath(explicitPath?: string, options?: CodexAuthPathOptions): string;
+/** @deprecated Use the revisioned {@link fileCodexCredentialStore}. */
+declare function fileCodexAuthStore(path?: string, options?: CodexAuthPathOptions): CodexAuthStore$1;
+/** Revisioned compare-and-swap store used by normal Node provider composition. */
+declare function fileCodexCredentialStore(path?: string, options?: CodexAuthPathOptions): CodexCredentialStore$1;
+//#endregion
+//#region src/codex.d.ts
+interface CodexNodeAdapterOptions extends Omit<CodexAdapterOptions$1, 'authStore'> {
+  /** Omit only in the Node compatibility wrapper to use the project-local file store. */
+  readonly authStore?: CodexAuthStore$1;
+}
+interface CodexNodePluginOptions extends CodexNodeAdapterOptions {
+  readonly routes?: readonly string[];
+}
+/** @deprecated Use {@link codexNodeProviderPlugin} for normal runtime composition. */
+declare function codexNodeAdapter(options?: CodexNodeAdapterOptions): ReturnType<typeof codexAdapter$1>;
+/** @deprecated Use {@link codexNodeProviderPlugin}. */
+declare function codexNodePlugin(options?: CodexNodePluginOptions): ModelProviderPlugin;
+interface CodexNodeProviderOptions extends Omit<CodexProviderOptions, 'authStore'> {
+  readonly authStore?: CodexCredentialStore$1;
+}
+/** Preferred Node composition plugin backed by revision-safe file credentials by default. */
+declare function codexNodeProviderPlugin(options?: CodexNodeProviderOptions): ComposableModelProviderPlugin & {
+  readonly family: 'codex';
+};
+/** Compatibility alias for the former `ai-agent-sdk/codex` entry. */
+declare const codexAdapter: typeof codexNodeAdapter;
+/** Compatibility alias for the former `ai-agent-sdk/codex` entry. */
+declare const codexPlugin: typeof codexNodePlugin;
+type CodexAdapterOptions = CodexNodeAdapterOptions;
+type CodexPluginOptions = CodexNodePluginOptions;
+//#endregion
+export { ACCESS_TOKEN_REFRESH_WINDOW_MS, CODEX_AUTH_PATH_ENV, CODEX_BASE_URL, CODEX_CLIENT_ID, CODEX_CLIENT_VERSION, CODEX_ORIGINATOR, CodexAdapterOptions, type CodexAuthFile, type CodexAuthPathOptions, type CodexAuthStore, type CodexCredentialStore, type CodexDeviceCode, type CodexJwtClaims, type CodexLoginProgress, type CodexLoginResult, CodexNodeAdapterOptions, CodexNodePluginOptions, CodexNodeProviderOptions, type CodexOAuthOptions, CodexPluginOptions, CodexRefreshError, type CodexTokens, DEFAULT_CODEX_AUTH_PATH, DEFAULT_CODEX_ISSUER, LAST_REFRESH_MAX_AGE_MS, type RefreshFailureKind, codexAdapter, codexNodeAdapter, codexNodePlugin, codexNodeProviderPlugin, codexPlugin, fileCodexAuthStore, fileCodexCredentialStore, isFedrampAccount, memoryCodexAuthStore, memoryCodexCredentialStore, readJwtClaims, refreshCodexTokens, requestDeviceCode, requireTokens, resolveAccountId, resolveCodexAuthPath, runDeviceCodeLogin, shouldRefresh };
+//# sourceMappingURL=codex.d.mts.map

package/dist/codex.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.d.mts","names":[],"sources":["../src/codex-store.ts","../src/codex.ts"],"mappings":";;;cAiBa;cACA;UAEI;;WAEN;;WAEA,MAAM,SAAS;;iBAGV,qBACd,uBACA,UAAS;;iBAWK,mBACd,eACA,UAAS,uBACR;;iBAiBa,yBACd,eACA,UAAS,uBACR;;;UCzCc,gCAAgC,KAAK;;WAE3C,YAAY;;UAGN,+BAA+B;WACrC;;;iBAIK,iBACd,UAAS,0BACR,kBAAkB;;iBAQL,gBAAgB,UAAS,yBAA8B;UAStD,iCAAiC,KAAK;WAC5C,YAAY;;;iBAIP,wBACd,UAAS,2BACR;WAA2C;;;cAQjC,qBAAY;;cAEZ,oBAAW;KACZ,sBAAsB;KACtB,qBAAqB"}

package/dist/codex.mjs

@@ -0,0 +1,3 @@
+import { C as shouldRefresh, D as fileCodexCredentialStore, E as fileCodexAuthStore, O as resolveCodexAuthPath, S as runDeviceCodeLogin, T as DEFAULT_CODEX_AUTH_PATH, _ as readJwtClaims, a as CODEX_ORIGINATOR, b as requireTokens, c as LAST_REFRESH_MAX_AGE_MS, d as codexNodePlugin, f as codexNodeProviderPlugin, g as memoryCodexCredentialStore, h as memoryCodexAuthStore, i as CODEX_CLIENT_VERSION, l as codexAdapter, m as isFedrampAccount, n as CODEX_BASE_URL, o as CodexRefreshError, p as codexPlugin, r as CODEX_CLIENT_ID, s as DEFAULT_CODEX_ISSUER, t as ACCESS_TOKEN_REFRESH_WINDOW_MS, u as codexNodeAdapter, v as refreshCodexTokens, w as CODEX_AUTH_PATH_ENV, x as resolveAccountId, y as requestDeviceCode } from "./codex-CBvNhtAh.mjs";
+
+export { ACCESS_TOKEN_REFRESH_WINDOW_MS, CODEX_AUTH_PATH_ENV, CODEX_BASE_URL, CODEX_CLIENT_ID, CODEX_CLIENT_VERSION, CODEX_ORIGINATOR, CodexRefreshError, DEFAULT_CODEX_AUTH_PATH, DEFAULT_CODEX_ISSUER, LAST_REFRESH_MAX_AGE_MS, codexAdapter, codexNodeAdapter, codexNodePlugin, codexNodeProviderPlugin, codexPlugin, fileCodexAuthStore, fileCodexCredentialStore, isFedrampAccount, memoryCodexAuthStore, memoryCodexCredentialStore, readJwtClaims, refreshCodexTokens, requestDeviceCode, requireTokens, resolveAccountId, resolveCodexAuthPath, runDeviceCodeLogin, shouldRefresh };

package/dist/env-Bsy-tNY9.d.mts

@@ -0,0 +1,9 @@
+import { CredentialSource } from "@alvin0/ai-agent-sdk-core/provider";
+//#region src/env.d.ts
+/** Read a credential lazily while preserving the historical callable view. */
+declare function envCredential(envVar: string): CredentialSource & (() => string);
+/** @deprecated Use {@link envCredential}. */
+declare const apiKeyFromEnv: typeof envCredential;
+//#endregion
+export { envCredential as n, apiKeyFromEnv as t };
+//# sourceMappingURL=env-Bsy-tNY9.d.mts.map

package/dist/env-Bsy-tNY9.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-Bsy-tNY9.d.mts","names":[],"sources":["../src/env.ts"],"mappings":";;;iBAOgB,cAAc,iBAAiB;;cAyBlC,sBAAa"}

package/dist/env-OQOpcank.mjs

@@ -0,0 +1,32 @@
+import { AgentSdkError, MISSING_CREDENTIAL_CODE } from "@alvin0/ai-agent-sdk-core";
+import { defineCredentialSource } from "@alvin0/ai-agent-sdk-core/provider";
+
+//#region src/env.ts
+/** Read a credential lazily while preserving the historical callable view. */
+function envCredential(envVar) {
+	if (envVar.trim().length === 0) throw new TypeError("credential environment variable must not be empty");
+	const read = () => {
+		const value = process.env[envVar];
+		if (value === void 0 || value.length === 0) throw new AgentSdkError(`no credential available; set ${envVar}`, MISSING_CREDENTIAL_CODE);
+		return value;
+	};
+	const source = defineCredentialSource({
+		id: `env:${envVar}`,
+		resolve: ({ signal }) => {
+			signal.throwIfAborted();
+			return read();
+		}
+	});
+	return Object.freeze(Object.assign(read, {
+		kind: source.kind,
+		apiVersion: source.apiVersion,
+		id: source.id,
+		resolve: source.resolve
+	}));
+}
+/** @deprecated Use {@link envCredential}. */
+const apiKeyFromEnv = envCredential;
+
+//#endregion
+export { envCredential as n, apiKeyFromEnv as t };
+//# sourceMappingURL=env-OQOpcank.mjs.map

package/dist/env-OQOpcank.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-OQOpcank.mjs","names":[],"sources":["../src/env.ts"],"sourcesContent":["import { AgentSdkError, MISSING_CREDENTIAL_CODE } from '@alvin0/ai-agent-sdk-core'\nimport {\n  defineCredentialSource,\n  type CredentialSource,\n} from '@alvin0/ai-agent-sdk-core/provider'\n\n/** Read a credential lazily while preserving the historical callable view. */\nexport function envCredential(envVar: string): CredentialSource & (() => string) {\n  if (envVar.trim().length === 0) throw new TypeError('credential environment variable must not be empty')\n  const read = () => {\n    const value = process.env[envVar]\n    if (value === undefined || value.length === 0) {\n      throw new AgentSdkError(`no credential available; set ${envVar}`, MISSING_CREDENTIAL_CODE)\n    }\n    return value\n  }\n  const source = defineCredentialSource({\n    id: `env:${envVar}`,\n    resolve: ({ signal }) => {\n      signal.throwIfAborted()\n      return read()\n    },\n  })\n  return Object.freeze(Object.assign(read, {\n    kind: source.kind,\n    apiVersion: source.apiVersion,\n    id: source.id,\n    resolve: source.resolve,\n  }))\n}\n\n/** @deprecated Use {@link envCredential}. */\nexport const apiKeyFromEnv = envCredential\n"],"mappings":";;;;;AAOA,SAAgB,cAAc,QAAmD;CAC/E,IAAI,OAAO,KAAK,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,UAAU,mDAAmD;CACvG,MAAM,aAAa;EACjB,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,UAAU,UAAa,MAAM,WAAW,GAC1C,MAAM,IAAI,cAAc,gCAAgC,UAAU,uBAAuB;EAE3F,OAAO;CACT;CACA,MAAM,SAAS,uBAAuB;EACpC,IAAI,OAAO;EACX,UAAU,EAAE,aAAa;GACvB,OAAO,eAAe;GACtB,OAAO,KAAK;EACd;CACF,CAAC;CACD,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM;EACvC,MAAM,OAAO;EACb,YAAY,OAAO;EACnB,IAAI,OAAO;EACX,SAAS,OAAO;CAClB,CAAC,CAAC;AACJ;;AAGA,MAAa,gBAAgB"}

package/dist/env.d.mts

@@ -0,0 +1,2 @@
+import { n as envCredential, t as apiKeyFromEnv } from "./env-Bsy-tNY9.mjs";
+export { apiKeyFromEnv, envCredential };

package/dist/env.mjs

@@ -0,0 +1,3 @@
+import { n as envCredential, t as apiKeyFromEnv } from "./env-OQOpcank.mjs";
+
+export { apiKeyFromEnv, envCredential };

package/dist/index.d.mts

@@ -0,0 +1,2 @@
+import { n as envCredential, t as apiKeyFromEnv } from "./env-Bsy-tNY9.mjs";
+export { apiKeyFromEnv, envCredential };

package/dist/index.mjs

@@ -0,0 +1,3 @@
+import { n as envCredential, t as apiKeyFromEnv } from "./env-OQOpcank.mjs";
+
+export { apiKeyFromEnv, envCredential };

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@alvin0/ai-agent-sdk-auth-node",
+  "author": {
+    "name": "alvin0 - chaulamdinhai",
+    "email": "chaulamdinhai@gmail.com"
+  },
+  "version": "0.1.0",
+  "description": "Node environment credentials and project-local Codex authentication for ai-agent-sdk",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alvin0/ai-agent-sdk.git",
+    "directory": "packages/auth-node"
+  },
+  "homepage": "https://github.com/alvin0/ai-agent-sdk/tree/main/packages/auth-node#readme",
+  "bugs": {
+    "url": "https://github.com/alvin0/ai-agent-sdk/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "default": "./dist/index.mjs"
+    },
+    "./env": {
+      "types": "./dist/env.d.mts",
+      "import": "./dist/env.mjs",
+      "default": "./dist/env.mjs"
+    },
+    "./codex": {
+      "types": "./dist/codex.d.mts",
+      "import": "./dist/codex.mjs",
+      "default": "./dist/codex.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "ai-agent-sdk-codex-login": "./bin/ai-agent-sdk-codex-login.mjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "peerDependencies": {
+    "@alvin0/ai-agent-sdk-core": "^0.1.0",
+    "@alvin0/ai-agent-sdk-provider-codex": "^0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@alvin0/ai-agent-sdk-provider-codex": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@alvin0/ai-agent-sdk-core": "^0.1.0",
+    "@alvin0/ai-agent-sdk-provider-codex": "^0.1.0",
+    "@arethetypeswrong/cli": "0.18.5",
+    "@types/node": "26.4.0",
+    "publint": "0.3.24",
+    "tsdown": "0.22.14",
+    "typescript": "7.0.2",
+    "vitest": "4.1.11"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "aiAgentSdk": {
+    "runtime": "node",
+    "coreApi": 1,
+    "roles": [
+      "credential-source",
+      "credential-store"
+    ]
+  },
+  "scripts": {
+    "build": "tsdown",
+    "clean": "node -e \"for(const p of ['dist','artifacts'])require('node:fs').rmSync(p,{recursive:true,force:true})\"",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --config vitest.config.ts",
+    "pack": "pnpm pack --pack-destination artifacts",
+    "test:pack": "node ../../scripts/test-packed-node-capability.mts auth-node",
+    "check:publint": "publint",
+    "check:types": "attw --profile esm-only --pack ."
+  }
+}