@atomic-chat/core 0.5.1

package/dist/credentials/api-keys.js

@@ -0,0 +1,156 @@
+/**
+ * `<data>/atomic-core/credentials.json`: cloud provider API keys, kept out of `settings.json` so the
+ * settings file can be read, diffed and shown without exposing a secret (PLAN.md §3.4).
+ *
+ * `{version: 1, providers: {<id>: {api_key, updated_at, bound_to?}}}`, owner-readable only (0600 on Unix; on
+ * Windows the file inherits the per-user ACL of the data folder). Written through `.tmp` + rename,
+ * with the mode set when the temporary file is created, so the key is never on disk under a wider
+ * mode even for an instant.
+ */
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { AtomicCoreError } from '../contracts/index.js';
+export const CREDENTIALS_VERSION = 1;
+export class ApiKeyStore {
+    path;
+    now;
+    doc;
+    chain = Promise.resolve();
+    constructor(path, doc, now) {
+        this.path = path;
+        this.now = now;
+        this.doc = doc;
+    }
+    /**
+     * Read the file, or start empty when it is absent. A file that cannot be parsed is refused rather
+     * than silently replaced: overwriting it would throw away every key the user entered.
+     */
+    static async open(path, options = {}) {
+        const now = options.now ?? Date.now;
+        let text;
+        try {
+            text = await readFile(path, 'utf8');
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return new ApiKeyStore(path, { version: CREDENTIALS_VERSION, providers: {} }, now);
+            throw new AtomicCoreError('IO_ERROR', `cannot read ${path}`, e.message);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (e) {
+            throw new AtomicCoreError('IO_ERROR', `${path} is not valid JSON; fix or remove it`, e.message);
+        }
+        return new ApiKeyStore(path, normalize(parsed), now);
+    }
+    get(provider) {
+        return Object.prototype.hasOwnProperty.call(this.doc.providers, provider)
+            ? this.doc.providers[provider]?.api_key
+            : undefined;
+    }
+    has(provider) {
+        return this.get(provider) !== undefined;
+    }
+    record(provider) {
+        const record = this.doc.providers[provider];
+        return record ? { ...record } : undefined;
+    }
+    /** Store a key; an empty or absent key removes the entry, the way the app's registration clears one. */
+    set(provider, apiKey) {
+        return this.mutate((doc) => {
+            if (apiKey === undefined || apiKey === null || apiKey === '') {
+                if (!Object.prototype.hasOwnProperty.call(doc.providers, provider))
+                    return false;
+                delete doc.providers[provider];
+                return true;
+            }
+            if (doc.providers[provider]?.api_key === apiKey)
+                return false;
+            doc.providers[provider] = { api_key: apiKey, updated_at: new Date(this.now()).toISOString() };
+            return true;
+        });
+    }
+    remove(provider) {
+        return this.set(provider, undefined);
+    }
+    /** Persist a key and its destination binding as one credentials-file update. */
+    setBound(provider, apiKey, binding) {
+        return this.mutate((doc) => {
+            if (apiKey === undefined || apiKey === null || apiKey === '') {
+                if (!Object.prototype.hasOwnProperty.call(doc.providers, provider))
+                    return false;
+                delete doc.providers[provider];
+                return true;
+            }
+            const old = doc.providers[provider];
+            if (old?.api_key === apiKey && old.bound_to === binding)
+                return false;
+            doc.providers[provider] = {
+                api_key: apiKey,
+                updated_at: old?.api_key === apiKey ? old.updated_at : new Date(this.now()).toISOString(),
+                bound_to: binding,
+            };
+            return true;
+        });
+    }
+    /** Restore the exact previous record after a failed settings write. */
+    restore(provider, record) {
+        return this.mutate((doc) => {
+            const old = doc.providers[provider];
+            if (JSON.stringify(old) === JSON.stringify(record))
+                return false;
+            if (record)
+                doc.providers[provider] = { ...record };
+            else
+                delete doc.providers[provider];
+            return true;
+        });
+    }
+    mutate(change) {
+        const next = this.chain.then(async () => {
+            const draft = structuredClone(this.doc);
+            if (!change(draft))
+                return;
+            await persist(this.path, draft);
+            this.doc = draft;
+        });
+        this.chain = next.catch(() => { });
+        return next;
+    }
+}
+function normalize(raw) {
+    const doc = { version: CREDENTIALS_VERSION, providers: {} };
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return doc;
+    const providers = raw.providers;
+    if (typeof providers !== 'object' || providers === null || Array.isArray(providers))
+        return doc;
+    for (const [id, entry] of Object.entries(providers)) {
+        const key = entry?.api_key;
+        const updated = entry?.updated_at;
+        const bound = entry?.bound_to;
+        if (typeof key === 'string' && key !== '')
+            doc.providers[id] = {
+                api_key: key,
+                updated_at: typeof updated === 'string' ? updated : '',
+                ...(typeof bound === 'string' ? { bound_to: bound } : {}),
+            };
+    }
+    return doc;
+}
+async function persist(path, doc) {
+    const tmp = `${path}.tmp`;
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(tmp, `${JSON.stringify(doc, null, 2)}\n`, { mode: 0o600 });
+        // `writeFile` keeps the mode of a leftover temporary file; restate it before the rename.
+        await chmod(tmp, 0o600);
+        await rename(tmp, path);
+    }
+    catch (e) {
+        throw new AtomicCoreError('IO_ERROR', `cannot write ${path}`, e.message);
+    }
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/credentials/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/credentials/api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAcpC,MAAM,OAAO,WAAW;IAKX;IAEQ;IANX,GAAG,CAAqB;IACxB,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;IAEnD,YACW,IAAY,EACrB,GAAwB,EACP,GAAiB;QAFzB,SAAI,GAAJ,IAAI,CAAQ;QAEJ,QAAG,GAAH,GAAG,CAAc;QAElC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,UAAkC,EAAE;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QACnC,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAChD,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YACpF,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,EAAG,CAAW,CAAC,OAAO,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CACvB,UAAU,EACV,GAAG,IAAI,sCAAsC,EAC5C,CAAW,CAAC,OAAO,CACrB,CAAA;QACH,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACtD,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;YACvE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO;YACvC,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAA;IACzC,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3C,CAAC;IAED,wGAAwG;IACxG,GAAG,CAAC,QAAgB,EAAE,MAAiC;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAA;gBAChF,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBAC9B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;YAC7D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;YAC7F,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACtC,CAAC;IAED,gFAAgF;IAChF,QAAQ,CAAC,QAAgB,EAAE,MAAiC,EAAE,OAAe;QAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAA;gBAChF,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBAC9B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,GAAG,EAAE,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAA;YACrE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBACxB,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACzF,QAAQ,EAAE,OAAO;aAClB,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,OAAO,CAAC,QAAgB,EAAE,MAAgC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;YAChE,IAAI,MAAM;gBAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;;gBAC9C,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnC,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,MAAM,CAAC,MAA6C;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,KAAK,GAAwB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAM;YAC1B,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,GAAG,GAAG,KAAK,CAAA;QAClB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,GAAG,GAAwB,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;IAChF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IAC7E,MAAM,SAAS,GAAI,GAA+B,CAAC,SAAS,CAAA;IAC5D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAA;IAC/F,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAI,KAAsC,EAAE,OAAO,CAAA;QAC5D,MAAM,OAAO,GAAI,KAAyC,EAAE,UAAU,CAAA;QACtE,MAAM,KAAK,GAAI,KAAuC,EAAE,QAAQ,CAAA;QAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;YACvC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;gBAClB,OAAO,EAAE,GAAG;gBACZ,UAAU,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;gBACtD,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAA;IACL,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,GAAwB;IAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,yFAAyF;QACzF,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACvB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gBAAgB,IAAI,EAAE,EAAG,CAAW,CAAC,OAAO,CAAC,CAAA;IACrF,CAAC;AACH,CAAC"}

package/dist/credentials/chatgpt-auth.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The ChatGPT subscription session: status, sign-in, sign-out and a usable access token, with
+ * refresh serialised.
+ *
+ * Ported from: src-tauri/src/core/auth/{state,commands}.rs.
+ *
+ * Two deliberate differences from the app, both because the token file can have a second process
+ * behind it while ownership moves between the app and the core (PLAN.md §2 decision 11):
+ * - before refreshing, the file is read again; if another process already rotated the tokens, those
+ *   are used instead of spending the (now possibly revoked) refresh token a second time;
+ * - a terminal refresh error clears the session only if the file still holds the refresh token that
+ *   was refused. Otherwise the refusal was of a token someone else already replaced, and clearing
+ *   the file would sign the user out of a session that is fine.
+ *
+ * Sign-in is two calls instead of the app's one, because a headless core cannot open a browser:
+ * `startLogin` binds the callback listener and returns the URL to open, `waitLogin` resolves once
+ * the browser has come back and the code has been exchanged.
+ */
+import type { TokenEndpoint } from './chatgpt-oauth.js';
+import type { StoredTokens } from './chatgpt-store.js';
+/** Refresh this far ahead of the stated expiry; an upstream 401 still outranks it. */
+export declare const REFRESH_SAFETY_MARGIN_SECS = 120;
+/** What callers may know. Deliberately carries no token. */
+export interface ChatGptStatus {
+    connected: boolean;
+    email: string | null;
+    plan_type: string | null;
+    expires_at: number | null;
+}
+export interface AccessToken {
+    token: string;
+    accountId: string | null;
+}
+export interface ChatGptAuthOptions {
+    /** `<data>/atomic-chatgpt-auth.json` */
+    path: string;
+    endpoint?: TokenEndpoint;
+    now?: () => number;
+    callbackPort?: number;
+    callbackTimeoutMs?: number;
+}
+export declare class ChatGptAuth {
+    private readonly options;
+    private tokens;
+    private hydrated;
+    private chain;
+    private login;
+    constructor(options: ChatGptAuthOptions);
+    private nowUnix;
+    /** Run `task` after every earlier one: the single-flight guarantee for refresh. */
+    private serial;
+    private hydrate;
+    status(): Promise<ChatGptStatus>;
+    /** The legacy app just surrendered ownership of this shared app-scope token file. */
+    reload(): Promise<ChatGptStatus>;
+    set(tokens: StoredTokens): Promise<void>;
+    logout(): Promise<ChatGptStatus>;
+    /**
+     * A token good for the next request, refreshed first when it is close to expiry. `forceRefresh`
+     * skips the expiry check: that is the upstream-401 path, where the server's opinion wins.
+     */
+    accessToken(forceRefresh?: boolean): Promise<AccessToken>;
+    /**
+     * Bind the callback listener and return where to send the browser. A sign-in still waiting is
+     * cancelled: two browser windows racing for the one callback port cannot both win.
+     */
+    startLogin(): Promise<{
+        authorize_url: string;
+    }>;
+    /** Wait for the browser, exchange the code, store the session. */
+    waitLogin(): Promise<ChatGptStatus>;
+    cancelLogin(): void;
+}

package/dist/credentials/chatgpt-auth.js

@@ -0,0 +1,167 @@
+/**
+ * The ChatGPT subscription session: status, sign-in, sign-out and a usable access token, with
+ * refresh serialised.
+ *
+ * Ported from: src-tauri/src/core/auth/{state,commands}.rs.
+ *
+ * Two deliberate differences from the app, both because the token file can have a second process
+ * behind it while ownership moves between the app and the core (PLAN.md §2 decision 11):
+ * - before refreshing, the file is read again; if another process already rotated the tokens, those
+ *   are used instead of spending the (now possibly revoked) refresh token a second time;
+ * - a terminal refresh error clears the session only if the file still holds the refresh token that
+ *   was refused. Otherwise the refusal was of a token someone else already replaced, and clearing
+ *   the file would sign the user out of a session that is fine.
+ *
+ * Sign-in is two calls instead of the app's one, because a headless core cannot open a browser:
+ * `startLogin` binds the callback listener and returns the URL to open, `waitLogin` resolves once
+ * the browser has come back and the code has been exchanged.
+ */
+import { AtomicCoreError } from '../contracts/index.js';
+import { exchangeCode, listenForCallback, authorizeUrl, newPkce, newState, refreshTokens, } from './chatgpt-oauth.js';
+import { clearTokens, isExpiredAt, loadTokens, saveTokens } from './chatgpt-store.js';
+/** Refresh this far ahead of the stated expiry; an upstream 401 still outranks it. */
+export const REFRESH_SAFETY_MARGIN_SECS = 120;
+export class ChatGptAuth {
+    options;
+    tokens;
+    hydrated = false;
+    chain = Promise.resolve();
+    login;
+    constructor(options) {
+        this.options = options;
+    }
+    nowUnix() {
+        return Math.floor((this.options.now ?? Date.now)() / 1000);
+    }
+    /** Run `task` after every earlier one: the single-flight guarantee for refresh. */
+    serial(task) {
+        const next = this.chain.then(task, task);
+        this.chain = next.catch(() => { });
+        return next;
+    }
+    async hydrate() {
+        if (this.hydrated)
+            return;
+        this.tokens = await loadTokens(this.options.path);
+        this.hydrated = true;
+    }
+    status() {
+        return this.serial(async () => {
+            await this.hydrate();
+            return statusOf(this.tokens);
+        });
+    }
+    /** The legacy app just surrendered ownership of this shared app-scope token file. */
+    reload() {
+        return this.serial(async () => {
+            this.tokens = await loadTokens(this.options.path);
+            this.hydrated = true;
+            return statusOf(this.tokens);
+        });
+    }
+    set(tokens) {
+        return this.serial(async () => {
+            await saveTokens(this.options.path, tokens);
+            this.tokens = tokens;
+            this.hydrated = true;
+        });
+    }
+    logout() {
+        return this.serial(async () => {
+            this.tokens = undefined;
+            this.hydrated = true;
+            await clearTokens(this.options.path);
+            return statusOf(undefined);
+        });
+    }
+    /**
+     * A token good for the next request, refreshed first when it is close to expiry. `forceRefresh`
+     * skips the expiry check: that is the upstream-401 path, where the server's opinion wins.
+     */
+    accessToken(forceRefresh = false) {
+        return this.serial(async () => {
+            await this.hydrate();
+            const current = this.tokens;
+            if (!current)
+                throw new AtomicCoreError('AUTH_REQUIRED', 'no ChatGPT subscription is connected');
+            if (!forceRefresh && !isExpiredAt(current, this.nowUnix(), REFRESH_SAFETY_MARGIN_SECS))
+                return { token: current.access_token, accountId: current.account_id };
+            // Another process may have rotated the tokens since this one read them.
+            const onDisk = await loadTokens(this.options.path);
+            if (onDisk && onDisk.refresh_token !== current.refresh_token) {
+                this.tokens = onDisk;
+                if (!isExpiredAt(onDisk, this.nowUnix(), REFRESH_SAFETY_MARGIN_SECS))
+                    return { token: onDisk.access_token, accountId: onDisk.account_id };
+            }
+            const spent = this.tokens ?? current;
+            let refreshed;
+            try {
+                refreshed = await refreshTokens(spent.refresh_token, this.nowUnix(), this.options.endpoint);
+            }
+            catch (e) {
+                const error = e;
+                if (error.code === 'AUTH_REQUIRED') {
+                    const latest = await loadTokens(this.options.path);
+                    if (latest && latest.refresh_token !== spent.refresh_token) {
+                        // Someone else rotated it while we were asking; theirs is the live session.
+                        this.tokens = latest;
+                        return { token: latest.access_token, accountId: latest.account_id };
+                    }
+                    this.tokens = undefined;
+                    await clearTokens(this.options.path).catch(() => { });
+                    throw new AtomicCoreError('AUTH_REQUIRED', `ChatGPT sign-in expired: ${error.message}`);
+                }
+                // Unreachable or unrecognised: keep the session, signing out over a blip is worse.
+                throw new AtomicCoreError('UPSTREAM_ERROR', `Could not refresh the ChatGPT session: ${error.message}`);
+            }
+            // A failed write is not fatal for this request, but the next start would need a fresh sign-in.
+            await saveTokens(this.options.path, refreshed).catch(() => { });
+            this.tokens = refreshed;
+            return { token: refreshed.access_token, accountId: refreshed.account_id };
+        });
+    }
+    /**
+     * Bind the callback listener and return where to send the browser. A sign-in still waiting is
+     * cancelled: two browser windows racing for the one callback port cannot both win.
+     */
+    async startLogin() {
+        this.cancelLogin();
+        const pkce = newPkce();
+        const state = newState();
+        const listener = await listenForCallback(state, {
+            ...(this.options.callbackPort !== undefined ? { port: this.options.callbackPort } : {}),
+            ...(this.options.callbackTimeoutMs !== undefined ? { timeoutMs: this.options.callbackTimeoutMs } : {}),
+        });
+        this.login = { listener, verifier: pkce.verifier, challenge: pkce.challenge };
+        return { authorize_url: authorizeUrl(pkce.challenge, state, this.options.endpoint?.issuer) };
+    }
+    /** Wait for the browser, exchange the code, store the session. */
+    async waitLogin() {
+        const login = this.login;
+        if (!login)
+            throw new AtomicCoreError('INVALID_ARGUMENT', 'no ChatGPT sign-in is in progress');
+        try {
+            const code = await login.listener.code;
+            const tokens = await exchangeCode(code, { verifier: login.verifier, challenge: login.challenge }, this.nowUnix(), this.options.endpoint).catch((e) => {
+                throw e.code === 'AUTH_REQUIRED' ? new AtomicCoreError('AUTH_FAILED', e.message) : e;
+            });
+            await this.set(tokens);
+            return await this.status();
+        }
+        finally {
+            if (this.login === login)
+                this.login = undefined;
+        }
+    }
+    cancelLogin() {
+        const login = this.login;
+        this.login = undefined;
+        login?.listener.cancel();
+    }
+}
+function statusOf(tokens) {
+    return tokens
+        ? { connected: true, email: tokens.email, plan_type: tokens.plan_type, expires_at: tokens.expires_at }
+        : { connected: false, email: null, plan_type: null, expires_at: null };
+}
+//# sourceMappingURL=chatgpt-auth.js.map

package/dist/credentials/chatgpt-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chatgpt-auth.js","sourceRoot":"","sources":["../../src/credentials/chatgpt-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,GACd,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAGrF,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAA;AA8B7C,MAAM,OAAO,WAAW;IAMO;IALrB,MAAM,CAA0B;IAChC,QAAQ,GAAG,KAAK,CAAA;IAChB,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAA;IAC3C,KAAK,CAA0B;IAEvC,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEpD,OAAO;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IAC5D,CAAC;IAED,mFAAmF;IAC3E,MAAM,CAAI,IAAsB;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;YACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,qFAAqF;IACrF,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;YACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,GAAG,CAAC,MAAoB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;YACpB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACtB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;YACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;YACpB,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACpC,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,YAAY,GAAG,KAAK;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAA;YAC3B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAA;YAEhG,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC;gBACpF,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;YAEvE,wEAAwE;YACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;gBACpB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC;oBAClE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAA;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAA;YAEpC,IAAI,SAAuB,CAAA;YAC3B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YAC7F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,CAAoB,CAAA;gBAClC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;oBAClD,IAAI,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;wBAC3D,4EAA4E;wBAC5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;wBACpB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAA;oBACrE,CAAC;oBACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;oBACvB,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBACpD,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBACzF,CAAC;gBACD,mFAAmF;gBACnF,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACxG,CAAC;YACD,+FAA+F;YAC/F,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC9D,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;YACvB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAA;QAC3E,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,WAAW,EAAE,CAAA;QAClB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAA;QACxB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvG,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;QAC7E,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAA;IAC9F,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,CAAA;QAC9F,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,EACJ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EACxD,IAAI,CAAC,OAAO,EAAE,EACd,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtB,CAAC,KAAK,CAAC,CAAC,CAAkB,EAAE,EAAE;gBAC7B,MAAM,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACtF,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACtB,OAAO,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAC5B,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QAClD,CAAC;IACH,CAAC;IAED,WAAW;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAgC;IAChD,OAAO,MAAM;QACX,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;QACtG,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAC1E,CAAC"}

package/dist/credentials/chatgpt-oauth.d.ts

@@ -0,0 +1,97 @@
+/**
+ * OAuth 2.0 + PKCE against `auth.openai.com`, the way the Codex CLI signs in.
+ *
+ * Ported from: src-tauri/src/core/auth/chatgpt.rs. Contract: test/fixtures/app/chatgpt-auth (PKCE,
+ * authorize URL, callback parsing, `state` comparison, JWT claims, token response → session).
+ *
+ * The issuer is injectable for tests only; production always talks to `ISSUER`. The client id is
+ * OpenAI's public Codex one (ADR `2026-08-27-connect-a-chatgpt-subscription-as-a-model-provider`),
+ * while `originator` names this client.
+ */
+import type { StoredTokens } from './chatgpt-store.js';
+export declare const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const ISSUER = "https://auth.openai.com";
+export declare const SCOPES = "openid profile email offline_access";
+/** Matched exactly by the authorization server, so there is no fallback port. */
+export declare const CALLBACK_PORT = 1455;
+export declare const CALLBACK_PATH = "/auth/callback";
+export declare const CALLBACK_TIMEOUT_MS = 300000;
+export declare const ORIGINATOR = "atomic_chat";
+/** Token-endpoint errors that mean the refresh credential itself is finished. */
+export declare const TERMINAL_TOKEN_ERRORS: string[];
+export declare const REAUTHORIZATION_REQUIRED = "reauthorization required";
+export declare function redirectUri(): string;
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+}
+export declare function deriveChallenge(verifier: string): string;
+export declare function newPkce(): Pkce;
+export declare function newState(): string;
+/** Constant-time for equal lengths; the callback is reachable by any local process. */
+export declare function stateMatches(expected: string, received: string): boolean;
+export declare function authorizeUrl(challenge: string, state: string, issuer?: string): string;
+export type CallbackParams = {
+    kind: 'code';
+    code: string;
+    state: string;
+} | {
+    kind: 'error';
+    error: string;
+    description: string | null;
+};
+/** `form_urlencoded::parse` into a map: `+` is a space, percent escapes decode, the last repeat wins. */
+export declare function parseCallbackQuery(query: string): CallbackParams;
+export interface IdClaims {
+    account_id: string | null;
+    plan_type: string | null;
+    email: string | null;
+}
+/**
+ * The account fields out of a JWT payload. The signature is not verified: the token arrived over a
+ * TLS connection to a pinned host, and nothing here is a security decision. Anything unparseable
+ * yields empty claims.
+ */
+export declare function decodeJwtClaims(token: string): IdClaims;
+export interface TokenResponse {
+    access_token: string;
+    refresh_token: string | null;
+    id_token: string | null;
+    expires_in: number | null;
+}
+/** serde's derive for the token endpoint's body; `undefined` where serde would refuse it. */
+export declare function parseTokenResponse(raw: unknown): TokenResponse | undefined;
+/**
+ * The session to store from a token response. A refresh may omit `refresh_token` when the provider
+ * does not rotate it, so the previous one is kept. The account id is read from the access token
+ * first (a refresh may carry no id token), the email from the id token first. The lifetime defaults
+ * to an hour and is clamped to [1 minute, 30 days].
+ */
+export declare function toStored(response: TokenResponse, nowUnix: number, previousRefresh: string | null): StoredTokens;
+export interface TokenEndpoint {
+    issuer?: string;
+    fetch?: typeof fetch;
+}
+/**
+ * POST a form to the token endpoint. A spent or revoked refresh credential is terminal and says so
+ * with `REAUTHORIZATION_REQUIRED`; anything else may be transient and carries the provider's words.
+ */
+export declare function postTokenForm(form: Array<[string, string]>, endpoint?: TokenEndpoint): Promise<TokenResponse>;
+/** The OAuth error code: `error` as a string, or `error.code` when `error` is an object. */
+export declare function tokenErrorCode(body: string): string;
+export declare function exchangeCode(code: string, pkce: Pkce, nowUnix: number, endpoint?: TokenEndpoint): Promise<StoredTokens>;
+export declare function refreshTokens(refreshToken: string, nowUnix: number, endpoint?: TokenEndpoint): Promise<StoredTokens>;
+export interface CallbackListener {
+    /** Resolves with the authorization code, or rejects with why the sign-in did not complete. */
+    code: Promise<string>;
+    cancel(): void;
+}
+/**
+ * Bind the loopback listener before the browser opens, so a busy port fails before the user has
+ * signed in. Only the first callback counts; the listener closes as soon as it arrives, on cancel,
+ * or on timeout.
+ */
+export declare function listenForCallback(expectedState: string, options?: {
+    port?: number;
+    timeoutMs?: number;
+}): Promise<CallbackListener>;