@calliopelabs/cli 3.7.0 → 3.8.0

package/README.md

@@ -125,10 +125,23 @@ One file, 16 keys. Credentials live in a per-provider map with environment-varia
 
 Docs: [getting started](docs/getting-started.md) · [commands](docs/commands.md) · [configuration](docs/configuration.md) · [model preferences](docs/model-preferences.md) · [providers](docs/providers.md) · [features](docs/features.md) · [fleet mode](docs/fleet.md)
 
+### ChatGPT plan access
+
+Run `calliope auth chatgpt login` to select subscription-backed OpenAI access.
+Use `calliope auth chatgpt status` to inspect accounts, and `api-key` to return to
+Platform API billing. See [ChatGPT plan access](docs/chatgpt-plan.md) for account
+management, output/budget restrictions and live-validation requirements.
+
 ## Editors
 
 Run Calliope as an [Agent Client Protocol](https://agentclientprotocol.com) agent (`calliope acp`) inside Zed, JetBrains, Neovim, and other ACP editors — client-side file edits, per-tool permissions, and the same audit trail. See [docs/acp.md](docs/acp.md).
 
+### Local Claude plan access
+
+Run `calliope claude status`, then `calliope claude -- <prompt>` to delegate to your
+installed, signed-in Claude agent. Claude owns permissions and plan usage in this
+mode. See [local Claude delegation](docs/claude-plan.md).
+
 ## Fleet mode
 
 Coordinate a fleet of agents and human operators over a self-hosted IRC channel that doubles as an audit trail. Off by default, zero cost when disabled. See [docs/fleet.md](docs/fleet.md).

package/dist/approvals/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/approvals/request.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAAyD,CAAC;AAChG,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcpD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAIpF;AACD,eAAO,MAAM,mBAAmB,UAAW,MAAM,WAAuK,CAAC;AAEzN,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CAoB7E"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/approvals/request.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAAyD,CAAC;AAChG,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcpD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAelD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAIpF;AACD,eAAO,MAAM,mBAAmB,UAAW,MAAM,WAAuK,CAAC;AAEzN,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CA4B7E"}

package/dist/approvals/request.js

@@ -95,6 +95,16 @@ export function describeApproval(call, cwd) {
         details.push(`Operation: ${approvalDisplayText(call.arguments.operation)}`);
     if (typeof call.arguments.content === 'string')
         details.push(`Content: ${Buffer.byteLength(call.arguments.content)} bytes; SHA-256 ${digest(call.arguments.content)}`);
+    if (call.name === 'orchestration_budget' && call.arguments.providerTargets !== undefined) {
+        const targets = call.arguments.providerTargets;
+        if (!targets || typeof targets !== 'object' || Array.isArray(targets) || Object.keys(targets).length > 32)
+            throw new ApprovalError('invalid reviewed provider targets.');
+        for (const [provider, target] of Object.entries(targets).sort()) {
+            if (!/^[a-z][a-z0-9-]{0,63}$/.test(provider) || typeof target !== 'string' || !/^[a-f0-9]{64}$/.test(target))
+                throw new ApprovalError('invalid reviewed provider target.');
+            details.push(`Provider target: ${provider} SHA-256 ${target}`);
+        }
+    }
     details.push(`Arguments: SHA-256 ${digest(args)} (${Buffer.byteLength(args)} bytes)`);
     return { version: 1, ...{ project, projectKey }, key: digest(canonicalJson({ projectKey, tool: call.name, args, path: path ?? null, policy })),
         tool: call.name, risk: risk.level, reason: approvalDisplayText(risk.reason), details, reusable };

package/dist/approvals/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/approvals/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAwB,MAAM,YAAY,CAAC;AAEjE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChG,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;QACvD,IAAI,EAAE,KAAK,GAAG,MAAM,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAC;QACpG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACvK,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;QACnK,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,KAAiC,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;aACrH,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;IACrG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACrF,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,MAAM,GAAa,EAAE,CAAC;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAAC,CAAC;QAChF,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;YACtH,uDAAuD;YACvD,IAAI,CAAC;gBAAC,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,aAAa,CAAC,uCAAuC,CAAC,CAAC;YAAC,CAAC;YACrH,OAAO,GAAG,EAAE,CAAC;gBAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAAC,CAAC;YAChF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM;YAC/D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,MAAM,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,0DAA0D,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAEzN,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,GAAW;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC/F,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,0EAA0E;IAC1E,mFAAmF;IACnF,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI;QACnG,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAO,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC;IAC1G,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI;QAC/F,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,CAAC,YAAY,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxH,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9H,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvK,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5I,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrG,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/approvals/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAwB,MAAM,YAAY,CAAC;AAEjE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChG,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;QACvD,IAAI,EAAE,KAAK,GAAG,MAAM,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAC;QACpG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACvK,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;QACnK,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,KAAiC,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;aACrH,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,aAAa,CAAC,2BAA2B,CAAC,CAAC;IACrG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACrF,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,MAAM,GAAa,EAAE,CAAC;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QAAC,CAAC;QAChF,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;YACtH,uDAAuD;YACvD,IAAI,CAAC;gBAAC,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,aAAa,CAAC,uCAAuC,CAAC,CAAC;YAAC,CAAC;YACrH,OAAO,GAAG,EAAE,CAAC;gBAAC,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAAC,CAAC;YAChF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM;YAC/D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAAC,OAAO,GAAG,MAAM,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,2CAA2C,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC;AACD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,0DAA0D,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAEzN,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAAE,GAAW;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC/F,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,0EAA0E;IAC1E,mFAAmF;IACnF,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI;QACnG,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAO,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC;IAC1G,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI;QAC/F,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,CAAC,YAAY,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxH,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9H,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvK,IAAG,IAAI,CAAC,IAAI,KAAG,sBAAsB,IAAE,IAAI,CAAC,SAAS,CAAC,eAAe,KAAG,SAAS,EAAC,CAAC;QACjF,MAAM,OAAO,GAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;QAC7C,IAAG,CAAC,OAAO,IAAE,OAAO,OAAO,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAC,EAAE;YAAC,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAC7J,KAAI,MAAM,CAAC,QAAQ,EAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAC,CAAC;YAC7D,IAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAE,OAAO,MAAM,KAAG,QAAQ,IAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,aAAa,CAAC,mCAAmC,CAAC,CAAC;YACnK,OAAO,CAAC,IAAI,CAAC,oBAAoB,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5I,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrG,CAAC"}

package/dist/auth/chatgpt/fallback.d.ts

@@ -0,0 +1,31 @@
+import { StreamProtocolError } from '../../errors.js';
+import type { Message } from '../../types.js';
+import { ChatGPTStore } from './store.js';
+export declare const apiKeyAccessActive: () => boolean;
+export declare const withAPIKeyAccess: <T>(action: () => T) => T;
+export interface ChatGPTFallbackPolicy {
+    model: string;
+    maxProjectCostUsd: number;
+    maxOutputTokens: number;
+    cooldownSeconds: number;
+}
+export declare class ChatGPTQuotaError extends StreamProtocolError {
+    readonly reason: 'quota' | 'rate-limit';
+    readonly partial: boolean;
+    constructor(reason: 'quota' | 'rate-limit', partial?: boolean);
+}
+export declare function fallbackPolicy(): ChatGPTFallbackPolicy | undefined;
+export declare function validateFallbackPolicy(p: ChatGPTFallbackPolicy): ChatGPTFallbackPolicy;
+export declare function quotaCircuit(store?: ChatGPTStore, now?: number): {
+    reason: 'quota' | 'rate-limit';
+    until: number;
+} | undefined;
+export declare function openQuotaCircuit(clientId: string, reason: 'quota' | 'rate-limit', store?: ChatGPTStore): Promise<void>;
+export declare function fallbackHistory(messages: Message[]): {
+    clientId: string;
+    model: string;
+} | undefined;
+/** Preserve visible conversation and completed tool pairs; never send encrypted plan state to an API key. */
+export declare function publicFallbackHistory(messages: Message[], clientId: string, model: string): Message[];
+export declare function runFallbackCommand(args: string[], signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=fallback.d.ts.map

package/dist/auth/chatgpt/fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback.d.ts","sourceRoot":"","sources":["../../../src/auth/chatgpt/fallback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI1C,eAAO,MAAM,kBAAkB,eAAsC,CAAC;AACtE,eAAO,MAAM,gBAAgB,GAAI,CAAC,UAAU,MAAM,CAAC,KAAG,CAAgC,CAAC;AACvF,MAAM,WAAW,qBAAqB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE;AACrI,qBAAa,iBAAkB,SAAQ,mBAAmB;IAC5C,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY;IAAE,QAAQ,CAAC,OAAO;IAArE,YAAqB,MAAM,EAAE,OAAO,GAAG,YAAY,EAAW,OAAO,UAAQ,EAG5E;CACF;AACD,wBAAgB,cAAc,IAAI,qBAAqB,GAAG,SAAS,CAGlE;AACD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,qBAAqB,GAAG,qBAAqB,CAQtF;AACD,wBAAgB,YAAY,CAAC,KAAK,eAAqB,EAAE,GAAG,SAAa;;;cAGxE;AACD,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,YAAY,EAAE,KAAK,eAAqB,iBAOlH;AACD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAWpG;AACD,6GAA6G;AAC7G,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,CAiBrG;AACD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5F"}

package/dist/auth/chatgpt/fallback.js

@@ -0,0 +1,111 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import * as config from '../../config.js';
+import { StreamProtocolError } from '../../errors.js';
+import { ChatGPTStore } from './store.js';
+import { ChatGPTAuthError } from './protocol.js';
+const apiAccess = new AsyncLocalStorage();
+export const apiKeyAccessActive = () => apiAccess.getStore() === true;
+export const withAPIKeyAccess = (action) => apiAccess.run(true, action);
+export class ChatGPTQuotaError extends StreamProtocolError {
+    reason;
+    partial;
+    constructor(reason, partial = false) {
+        super(reason === 'quota' ? 'ChatGPT plan usage limit reached. Subscription inference is paused; configure API-key fallback or wait for the cooldown.' : 'ChatGPT rate limit reached. Subscription inference is paused until the cooldown.');
+        this.reason = reason;
+        this.partial = partial;
+        this.name = 'ChatGPTQuotaError';
+    }
+}
+export function fallbackPolicy() {
+    const p = config.get('chatgptFallback');
+    return p == null ? undefined : validateFallbackPolicy(p);
+}
+export function validateFallbackPolicy(p) {
+    if (!p || typeof p.model !== 'string' || !p.model.trim() || p.model.length > 512 || /[\x00-\x20\x7f]/.test(p.model) ||
+        !Number.isFinite(p.maxProjectCostUsd) || p.maxProjectCostUsd <= 0 || p.maxProjectCostUsd > 1000000 ||
+        !Number.isSafeInteger(p.maxOutputTokens) || p.maxOutputTokens < 1 || p.maxOutputTokens > 100000000 ||
+        !Number.isSafeInteger(p.cooldownSeconds) || p.cooldownSeconds < 1 || p.cooldownSeconds > 86400 ||
+        Object.keys(p).some(k => !['model', 'maxProjectCostUsd', 'maxOutputTokens', 'cooldownSeconds'].includes(k)))
+        throw new ChatGPTAuthError('Invalid ChatGPT fallback configuration. Configure it again before using paid fallback.');
+    return { ...p };
+}
+export function quotaCircuit(store = new ChatGPTStore(), now = Date.now()) {
+    const breaker = store.active()?.quotaCircuit;
+    return breaker && breaker.until > now ? { ...breaker } : undefined;
+}
+export async function openQuotaCircuit(clientId, reason, store = new ChatGPTStore()) {
+    const configured = config.get('chatgptFallback')?.cooldownSeconds;
+    const seconds = reason === 'rate-limit' ? 60 : Number.isSafeInteger(configured) && configured >= 1 && configured <= 86400 ? configured : 3600;
+    await store.update(state => {
+        const a = state.accounts[clientId];
+        if (a)
+            a.quotaCircuit = { reason, until: Date.now() + seconds * 1000 };
+    });
+}
+export function fallbackHistory(messages) {
+    let found;
+    for (const m of messages) {
+        const marker = m.providerMetadata?.openai?.chatgptFallback;
+        if (!marker)
+            continue;
+        if (!/^oaiapp_[\w-]+$/.test(marker.clientId) || typeof marker.model !== 'string' || !marker.model ||
+            found && (found.clientId !== marker.clientId || found.model !== marker.model))
+            throw new ChatGPTAuthError('Inconsistent API-key fallback history. Start a new session.');
+        found = { clientId: marker.clientId, model: marker.model };
+    }
+    return found;
+}
+/** Preserve visible conversation and completed tool pairs; never send encrypted plan state to an API key. */
+export function publicFallbackHistory(messages, clientId, model) {
+    const existing = fallbackHistory(messages);
+    if (existing && (existing.clientId !== clientId || existing.model !== model))
+        throw new ChatGPTAuthError('Fallback account or model changed. Start a new session.');
+    const result = messages.map(m => {
+        const metadata = m.providerMetadata;
+        if (metadata && Object.keys(metadata).some(k => k !== 'openai' && k !== 'calliopeRouting'))
+            throw new ChatGPTAuthError('Other provider state cannot be converted to API-key fallback. Start a new session.');
+        if (metadata?.openai && Object.keys(metadata.openai).some(k => k !== 'chatgpt' && k !== 'chatgptFallback'))
+            throw new ChatGPTAuthError('Unknown OpenAI state cannot be converted to API-key fallback. Start a new session.');
+        const saved = metadata?.openai?.chatgpt;
+        if (saved && saved.clientId !== clientId)
+            throw new ChatGPTAuthError('ChatGPT history belongs to a different account. Start a new session.');
+        const { providerMetadata: _opaque, ...publicMessage } = m;
+        return structuredClone(publicMessage);
+    });
+    const last = result.at(-1);
+    if (last)
+        last.providerMetadata = { openai: { chatgptFallback: { clientId, model } }, calliopeRouting: { provider: 'openai', model } };
+    return result;
+}
+export async function runFallbackCommand(args, signal) {
+    const store = new ChatGPTStore();
+    if (args.length === 1 && args[0] === 'models') {
+        if (!config.getApiKey('openai'))
+            throw new ChatGPTAuthError('Configure an OpenAI API key before listing paid fallback models.');
+        const { getAvailableModels } = await import('../../model-detection.js');
+        const { providerTarget } = await import('../../health/index.js');
+        const result = await withAPIKeyAccess(async () => ({ target: providerTarget('openai').key, models: await getAvailableModels('openai', { signal, quiet: true, throwOnError: true }) }));
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else if (args[0] === 'enable' && (args.length === 3 || args.length === 4)) {
+        if (!config.getApiKey('openai'))
+            throw new ChatGPTAuthError('Configure an OpenAI API key before enabling paid fallback.');
+        config.set('chatgptFallback', validateFallbackPolicy({ model: args[1], maxProjectCostUsd: Number(args[2]), maxOutputTokens: Number(args[3] ?? 4096), cooldownSeconds: 3600 }));
+        console.log('Paid OpenAI API-key fallback enabled. Each request requires live model discovery, verified billing bounds and a shared project-budget reservation. Existing project spend counts toward this cap.');
+    }
+    else if (args.length === 1 && args[0] === 'disable') {
+        config.set('chatgptFallback', null);
+        console.log('Automatic paid fallback disabled.');
+    }
+    else if (args.length === 1 && args[0] === 'reset') {
+        await store.update(s => { if (s.active)
+            delete s.accounts[s.active].quotaCircuit; });
+        console.log('Subscription quota circuit reset. Existing API-key fallback sessions stay on the paid route; start a new session to try the plan again.');
+    }
+    else if (args.length === 1 && args[0] === 'status') {
+        console.log(JSON.stringify({ enabled: !!fallbackPolicy(), policy: fallbackPolicy() ?? null, circuit: quotaCircuit(store) ?? null }, null, 2));
+    }
+    else
+        throw new ChatGPTAuthError('Usage: calliope auth chatgpt fallback enable <api-model> <max-project-cost-usd> [max-output-tokens] | models | disable | status | reset');
+}
+//# sourceMappingURL=fallback.js.map

package/dist/auth/chatgpt/fallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback.js","sourceRoot":"","sources":["../../../src/auth/chatgpt/fallback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,SAAS,GAAG,IAAI,iBAAiB,EAAW,CAAC;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAI,MAAe,EAAK,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAEvF,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IACnC,MAAM;IAAmC,OAAO;IAArE,YAAqB,MAA8B,EAAW,OAAO,GAAG,KAAK;QAC3E,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,0HAA0H,CAAC,CAAC,CAAC,kFAAkF,CAAC,CAAC;sBADzN,MAAM;uBAAmC,OAAO;QAEnE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AACD,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,CAAwB;IAC7D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/G,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,CAAC,iBAAiB,GAAG,OAAO;QAClG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,SAAS;QAClG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,CAAC,eAAe,GAAG,KAAK;QAC9F,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAC,mBAAmB,EAAC,iBAAiB,EAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1G,MAAM,IAAI,gBAAgB,CAAC,wFAAwF,CAAC,CAAC;IACvH,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;AAClB,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACvE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC;IAC7C,OAAO,OAAO,IAAI,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAA8B,EAAE,KAAK,GAAG,IAAI,YAAY,EAAE;IACjH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAW,IAAI,CAAC,IAAI,UAAW,IAAI,KAAK,CAAC,CAAC,CAAC,UAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjJ,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,CAAC,CAAC,YAAY,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,QAAmB;IACjD,IAAI,KAAsD,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAI,CAAC,CAAC,gBAAgB,EAAE,MAAgF,EAAE,eAAe,CAAC;QACtI,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YAC7F,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;YAC/E,MAAM,IAAI,gBAAgB,CAAC,6DAA6D,CAAC,CAAC;QAC5F,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,6GAA6G;AAC7G,MAAM,UAAU,qBAAqB,CAAC,QAAmB,EAAE,QAAgB,EAAE,KAAa;IACxF,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,yDAAyD,CAAC,CAAC;IACpK,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC;QACpC,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,iBAAiB,CAAC;YACxF,MAAM,IAAI,gBAAgB,CAAC,oFAAoF,CAAC,CAAC;QACnH,IAAI,QAAQ,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,iBAAiB,CAAC;YACxG,MAAM,IAAI,gBAAgB,CAAC,oFAAoF,CAAC,CAAC;QACnH,MAAM,KAAK,GAAI,QAAQ,EAAE,MAAyD,EAAE,OAAO,CAAC;QAC5F,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,sEAAsE,CAAC,CAAC;QAC7I,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,CAAC;QAC1D,OAAO,eAAe,CAAC,aAAa,CAAY,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI;QAAE,IAAI,CAAC,gBAAgB,GAAG,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IACvI,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAc,EAAE,MAAoB;IAC3E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,kEAAkE,CAAC,CAAC;QAChI,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACxE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,EAAC,MAAM,EAAC,KAAK,EAAC,IAAI,EAAC,YAAY,EAAC,IAAI,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjL,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,4DAA4D,CAAC,CAAC;QAC1H,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChL,OAAO,CAAC,GAAG,CAAC,mMAAmM,CAAC,CAAC;IACnN,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACxF,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACpD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,yIAAyI,CAAC,CAAC;IACzJ,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChJ,CAAC;;QAAM,MAAM,IAAI,gBAAgB,CAAC,yIAAyI,CAAC,CAAC;AAC/K,CAAC"}

package/dist/auth/chatgpt/index.d.ts

@@ -0,0 +1,6 @@
+export * from './protocol.js';
+export * from './store.js';
+export * from './session.js';
+export * from './login.js';
+export * from './fallback.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/chatgpt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/chatgpt/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}

package/dist/auth/chatgpt/index.js

@@ -0,0 +1,6 @@
+export * from './protocol.js';
+export * from './store.js';
+export * from './session.js';
+export * from './login.js';
+export * from './fallback.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/chatgpt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/chatgpt/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC"}

package/dist/auth/chatgpt/login.d.ts

@@ -0,0 +1,4 @@
+import { ChatGPTStore } from './store.js';
+export declare function openBrowser(url: string): Promise<void>;
+export declare function login(store?: ChatGPTStore, clientId?: string, signal?: AbortSignal, launch?: typeof openBrowser): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/chatgpt/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/auth/chatgpt/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI1C,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAStD;AACD,wBAAsB,KAAK,CAAC,KAAK,eAAqB,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,qBAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CpI"}

package/dist/auth/chatgpt/login.js

@@ -0,0 +1,82 @@
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { ChatGPTStore } from './store.js';
+import { prepareAuthorization, ChatGPTAuthError } from './protocol.js';
+import { tokenRequest, validateIdentity, applyTokens } from './session.js';
+export function openBrowser(url) {
+    // argv only; no shell and no user-controlled executable.
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32.exe' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: 'ignore', shell: false });
+        child.once('error', () => reject(new ChatGPTAuthError('Could not open the browser.')));
+        child.once('exit', code => code === 0 ? resolve() : reject(new ChatGPTAuthError('Could not open the browser.')));
+    });
+}
+export async function login(store = new ChatGPTStore(), clientId, signal, launch = openBrowser) {
+    // Persist host identity before opening a browser; failed attempts retain it.
+    await store.update(() => { });
+    const state = store.read();
+    const previous = clientId ? state.accounts[clientId] : undefined;
+    if (clientId && !previous)
+        throw new ChatGPTAuthError('Unknown ChatGPT registration. Use auth chatgpt status.');
+    const server = createServer();
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+    const address = server.address();
+    if (!address || typeof address === 'string')
+        throw new ChatGPTAuthError('Could not start ChatGPT callback listener.');
+    const redirect = `http://127.0.0.1:${address.port}/auth/callback`;
+    const attempt = prepareAuthorization(state.hostId, redirect, previous);
+    let timer;
+    let abort;
+    try {
+        const callback = new Promise((resolve, reject) => {
+            timer = setTimeout(() => reject(new ChatGPTAuthError('ChatGPT sign-in timed out.')), 300000);
+            abort = () => reject(new ChatGPTAuthError('ChatGPT sign-in cancelled.'));
+            signal?.addEventListener('abort', abort, { once: true });
+            if (signal?.aborted) {
+                abort();
+                return;
+            }
+            server.on('request', (req, res) => {
+                res.setHeader('Cache-Control', 'no-store');
+                res.setHeader('Content-Type', 'text/plain');
+                if (req.method !== 'GET' || req.headers.host !== `127.0.0.1:${address.port}` || !req.url?.startsWith('/auth/callback?')) {
+                    res.writeHead(404).end('Not found');
+                    return;
+                }
+                try {
+                    const result = attempt.consume(new URL(req.url, redirect).href);
+                    res.end('Authorization received. Return to your terminal to finish verification.');
+                    resolve(result);
+                }
+                catch (e) {
+                    res.writeHead(400).end('Sign-in rejected. Return to your terminal.');
+                    reject(e);
+                }
+            });
+        });
+        // Attach a rejection handler before browser launch so an immediate abort is handled.
+        const [result] = await Promise.all([callback, launch(attempt.url)]);
+        const tokens = await tokenRequest(result.form, signal);
+        if (!tokens.id_token)
+            throw new ChatGPTAuthError('ChatGPT did not return an identity token.');
+        const identity = await validateIdentity(tokens.id_token, result.clientId, attempt.nonce, previous ?? state.accounts[result.clientId]);
+        signal?.throwIfAborted();
+        await store.update(current => {
+            if (JSON.stringify(current.accounts[result.clientId]) !== JSON.stringify(state.accounts[result.clientId]))
+                throw new ChatGPTAuthError('ChatGPT registration changed during sign-in. Retry.');
+            current.accounts[result.clientId] = applyTokens({ clientId: result.clientId, ...identity, scopes: [] }, tokens);
+            current.active = result.clientId;
+        });
+    }
+    finally {
+        attempt.cancel();
+        clearTimeout(timer);
+        if (abort)
+            signal?.removeEventListener('abort', abort);
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/chatgpt/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/auth/chatgpt/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,yDAAyD;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACpH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,GAAG,IAAI,YAAY,EAAE,EAAE,QAAiB,EAAE,MAAoB,EAAE,MAAM,GAAG,WAAW;IACnH,6EAA6E;IAC7E,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAG,CAAC;IAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,QAAQ,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,wDAAwD,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,oBAAoB,OAAO,CAAC,IAAI,gBAAgB,CAAC;IAClE,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,KAAgD,CAAC;IACrD,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAqC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7F,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACzE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBAAC,KAAK,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;gBACxF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACzK,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;oBAChE,GAAG,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;oBAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACtG,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;YAClG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,qFAAqF;QACrF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,2CAA2C,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtI,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,qDAAqD,CAAC,CAAC;YAC7L,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAChH,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,KAAK;YAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAAC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/auth/chatgpt/protocol.d.ts

@@ -0,0 +1,24 @@
+export declare const ISSUER = "https://auth.openai.com";
+export declare const RESOURCE = "https://api.openai.com/v1";
+export declare const TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+export declare const SCOPES = "openid profile email offline_access resource.invoke chatgpt.tokens.use.direct";
+export declare class ChatGPTAuthError extends Error {
+    readonly code?: 'reauthenticate' | undefined;
+    constructor(message: string, code?: 'reauthenticate' | undefined);
+}
+export interface Registration {
+    clientId: string;
+    subject: string;
+    email?: string;
+    idToken?: string;
+}
+export declare function prepareAuthorization(hostId: string, redirectUri: string, registration?: Registration, now?: number): {
+    url: string;
+    nonce: string;
+    cancel(): void;
+    consume(callback: string, at?: number): {
+        clientId: string;
+        form: import("node:url").URLSearchParams;
+    };
+};
+//# sourceMappingURL=protocol.d.ts.map

package/dist/auth/chatgpt/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/auth/chatgpt/protocol.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,MAAM,4BAA4B,CAAC;AAChD,eAAO,MAAM,QAAQ,8BAA8B,CAAC;AACpD,eAAO,MAAM,SAAS,qDAAuC,CAAC;AAC9D,eAAO,MAAM,MAAM,kFAAkF,CAAC;AACtG,qBAAa,gBAAiB,SAAQ,KAAK;IAAgC,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB;IAA7D,YAAY,OAAO,EAAE,MAAM,EAAW,IAAI,CAAC,EAAE,gBAAgB,YAAA,EAAqD;CAAE;AAElK,MAAM,WAAW,YAAY;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AACrG,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,GAAG,SAAa;;;;sBAejG,MAAM;;;;EAiB3B"}

package/dist/auth/chatgpt/protocol.js

@@ -0,0 +1,71 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+export const ISSUER = 'https://auth.openai.com';
+export const RESOURCE = 'https://api.openai.com/v1';
+export const TOKEN_URL = `${ISSUER}/api/accounts/oauth/token`;
+export const SCOPES = 'openid profile email offline_access resource.invoke chatgpt.tokens.use.direct';
+export class ChatGPTAuthError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'ChatGPTAuthError';
+    }
+}
+const fail = () => new ChatGPTAuthError('ChatGPT callback rejected. Start a new sign-in.');
+export function prepareAuthorization(hostId, redirectUri, registration, now = Date.now()) {
+    const uri = new URL(redirectUri);
+    if (uri.protocol !== 'http:' || uri.hostname !== '127.0.0.1' || uri.pathname !== '/auth/callback' || !uri.port || uri.search || uri.hash || uri.username || uri.password)
+        throw fail();
+    if (!/^urn:uuid:[0-9a-f-]{36}$/i.test(hostId))
+        throw new ChatGPTAuthError('Invalid ChatGPT host identity.');
+    if (registration && !/^oaiapp_[A-Za-z0-9_-]+$/.test(registration.clientId))
+        throw fail();
+    const state = randomBytes(32).toString('base64url'), nonce = randomBytes(32).toString('base64url'), verifier = randomBytes(32).toString('base64url');
+    const params = new URLSearchParams({ client_id: registration?.clientId ?? 'dynamic_agent_client', ext_agent_host_id: hostId,
+        response_type: 'code', redirect_uri: redirectUri, scope: SCOPES, resource: RESOURCE, state, nonce,
+        code_challenge_method: 'S256', code_challenge: createHash('sha256').update(verifier).digest('base64url') });
+    if (!registration)
+        params.set('agent_name_hint', 'Calliope AI CLI');
+    else {
+        if (registration.idToken)
+            params.set('id_token_hint', registration.idToken);
+        if (registration.email)
+            params.set('login_hint', registration.email);
+    }
+    let consumed = false;
+    return {
+        url: `${ISSUER}/api/accounts/authorize?${params}`, nonce,
+        cancel() { consumed = true; },
+        consume(callback, at = Date.now()) {
+            if (consumed)
+                throw fail();
+            consumed = true;
+            if (at < now || at - now > 300000)
+                throw fail();
+            let url;
+            try {
+                url = new URL(callback);
+            }
+            catch {
+                throw fail();
+            }
+            if (url.origin !== uri.origin || url.pathname !== uri.pathname || url.hash || url.username || url.password)
+                throw fail();
+            for (const key of url.searchParams.keys())
+                if (url.searchParams.getAll(key).length !== 1)
+                    throw fail();
+            const received = Buffer.from(url.searchParams.get('state') ?? '');
+            if (received.length !== state.length || !timingSafeEqual(received, Buffer.from(state)))
+                throw fail();
+            if (url.searchParams.has('error'))
+                throw new ChatGPTAuthError('ChatGPT sign-in was denied or failed.');
+            const clientId = url.searchParams.get('client_id') ?? registration?.clientId;
+            const code = url.searchParams.get('code');
+            if (!code || !clientId || !/^oaiapp_[A-Za-z0-9_-]+$/.test(clientId) || registration && clientId !== registration.clientId)
+                throw fail();
+            return { clientId, form: new URLSearchParams({ grant_type: 'authorization_code', client_id: clientId, code,
+                    code_verifier: verifier, redirect_uri: redirectUri, resource: RESOURCE }) };
+        },
+    };
+}
+//# sourceMappingURL=protocol.js.map

package/dist/auth/chatgpt/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/auth/chatgpt/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,MAAM,CAAC,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAChD,MAAM,CAAC,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AACpD,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,MAAM,2BAA2B,CAAC;AAC9D,MAAM,CAAC,MAAM,MAAM,GAAG,+EAA+E,CAAC;AACtG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAAyC,IAAI;IAA1C,YAAY,OAAe,EAAW,IAAuB;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAA1C,IAAI;QAAuC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAAC,CAAC;CAAE;AAClK,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,iDAAiD,CAAC,CAAC;AAE3F,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB,EAAE,YAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACrH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,EAAE,CAAC;IACvL,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;IAC5G,IAAI,YAAY,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,IAAI,sBAAsB,EAAE,iBAAiB,EAAE,MAAM;QACzH,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK;QACjG,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9G,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;SAC/D,CAAC;QAAC,IAAI,YAAY,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,YAAY,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC3J,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,GAAG,EAAE,GAAG,MAAM,2BAA2B,MAAM,EAAE,EAAE,KAAK;QACxD,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,QAAgB,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YACvC,IAAI,QAAQ;gBAAE,MAAM,IAAI,EAAE,CAAC;YAC3B,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,MAAM;gBAAE,MAAM,IAAI,EAAE,CAAC;YAChD,IAAI,GAAQ,CAAC;YAAC,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,EAAE,CAAC;YAAC,CAAC;YACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;gBAAE,MAAM,IAAI,EAAE,CAAC;YACzH,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;gBAAE,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,EAAE,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,EAAE,CAAC;YACrG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;YACvG,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,YAAY,EAAE,QAAQ,CAAC;YAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,IAAI,QAAQ,KAAK,YAAY,CAAC,QAAQ;gBAAE,MAAM,IAAI,EAAE,CAAC;YACxI,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI;oBACxG,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/chatgpt/session.d.ts

@@ -0,0 +1,24 @@
+import { type JWTVerifyGetKey } from 'jose';
+import { ChatGPTStore, type Account } from './store.js';
+import { type Registration } from './protocol.js';
+export interface Tokens {
+    access_token: string;
+    refresh_token: string;
+    id_token?: string;
+    token_type: string;
+    expires_in: number;
+    scope: string;
+    earliest_refresh_at?: number;
+}
+export declare function tokenRequest(form: URLSearchParams, signal?: AbortSignal): Promise<Tokens>;
+export declare function validateIdentity(token: string, clientId: string, nonce?: string, previous?: Registration, key?: JWTVerifyGetKey): Promise<{
+    subject: string;
+    email?: string | undefined;
+}>;
+export declare function applyTokens(account: Account, tokens: Tokens): Account;
+export declare function accessToken(store?: ChatGPTStore, signal?: AbortSignal): Promise<{
+    token: string;
+    clientId: string;
+}>;
+export declare function logout(store?: ChatGPTStore): Promise<boolean>;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/chatgpt/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/auth/chatgpt/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAiD,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAEjG,MAAM,WAAW,MAAM;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE;AAC/K,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAW/F;AACD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,GAAE,eAAsB;;;GAM3I;AACD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIrE;AACD,wBAAsB,WAAW,CAAC,KAAK,eAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBhI;AACD,wBAAsB,MAAM,CAAC,KAAK,eAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBzE"}

package/dist/auth/chatgpt/session.js

@@ -0,0 +1,101 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { ChatGPTStore } from './store.js';
+import { ChatGPTAuthError, ISSUER, TOKEN_URL, RESOURCE } from './protocol.js';
+const jwks = createRemoteJWKSet(new URL(`${ISSUER}/.well-known/jwks.json`));
+export async function tokenRequest(form, signal) {
+    let response;
+    try {
+        response = await fetch(TOKEN_URL, { method: 'POST', redirect: 'error', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: form, signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(30000)]) : AbortSignal.timeout(30000) });
+    }
+    catch {
+        throw new ChatGPTAuthError('ChatGPT token request failed. Retry sign-in or check your connection.');
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new ChatGPTAuthError('Invalid ChatGPT token response.');
+    }
+    if (!response.ok) {
+        const terminal = ['invalid_grant', 'invalid_refresh_token', 'token_expired', 'refresh_token_expired', 'refresh_token_invalidated', 'refresh_token_reused'].includes(String(body.error));
+        throw new ChatGPTAuthError(terminal ? 'ChatGPT session expired or revoked. Sign in again.' : `ChatGPT token request failed (HTTP ${response.status}).`, terminal ? 'reauthenticate' : undefined);
+    }
+    if (typeof body.access_token !== 'string' || !body.access_token || typeof body.refresh_token !== 'string' || !body.refresh_token || body.token_type !== 'Bearer' || typeof body.expires_in !== 'number' || !Number.isFinite(body.expires_in) || body.expires_in <= 0 || typeof body.scope !== 'string')
+        throw new ChatGPTAuthError('Invalid ChatGPT token response.');
+    return body;
+}
+export async function validateIdentity(token, clientId, nonce, previous, key = jwks) {
+    try {
+        const { payload } = await jwtVerify(token, key, { issuer: ISSUER, audience: clientId, algorithms: ['RS256'], requiredClaims: ['exp', 'iat', 'sub'] });
+        if (!payload.sub || nonce !== undefined && payload.nonce !== nonce || previous && payload.sub !== previous.subject)
+            throw Error();
+        return { subject: payload.sub, ...(typeof payload.email === 'string' ? { email: payload.email } : {}) };
+    }
+    catch {
+        throw new ChatGPTAuthError('ChatGPT identity verification failed. Sign in again.');
+    }
+}
+export function applyTokens(account, tokens) {
+    return { ...account, accessToken: tokens.access_token, refreshToken: tokens.refresh_token,
+        ...(tokens.id_token ? { idToken: tokens.id_token } : {}), scopes: tokens.scope.split(/\s+/).filter(Boolean),
+        expiresAt: Date.now() + tokens.expires_in * 1000, earliestRefreshAt: tokens.earliest_refresh_at ? tokens.earliest_refresh_at * 1000 : undefined };
+}
+export async function accessToken(store = new ChatGPTStore(), signal) {
+    const selected = store.active();
+    if (!selected?.accessToken || !selected.refreshToken || !selected.scopes.includes('chatgpt.tokens.use.direct'))
+        throw new ChatGPTAuthError('ChatGPT plan access is unavailable. Run calliope auth chatgpt login.');
+    if ((selected.expiresAt ?? 0) > Date.now() + 60000)
+        return { token: selected.accessToken, clientId: selected.clientId };
+    const result = await store.update(async (state) => {
+        if (state.active !== selected.clientId)
+            throw new ChatGPTAuthError('ChatGPT account changed. Retry the request.');
+        const a = state.accounts[selected.clientId];
+        if ((a.expiresAt ?? 0) > Date.now() + 60000)
+            return { token: a.accessToken, clientId: a.clientId };
+        if (a.earliestRefreshAt && a.earliestRefreshAt > Date.now())
+            throw new ChatGPTAuthError('ChatGPT token cannot refresh yet. Retry later.');
+        let tokens;
+        try {
+            tokens = await tokenRequest(new URLSearchParams({ grant_type: 'refresh_token', client_id: a.clientId, refresh_token: a.refreshToken, resource: RESOURCE }), signal);
+        }
+        catch (error) {
+            if (!(error instanceof ChatGPTAuthError) || error.code !== 'reauthenticate')
+                throw error;
+            state.accounts[a.clientId] = { clientId: a.clientId, subject: a.subject, email: a.email, scopes: [] };
+            return { error };
+        }
+        if (tokens.id_token)
+            await validateIdentity(tokens.id_token, a.clientId, undefined, a);
+        state.accounts[a.clientId] = applyTokens(a, tokens);
+        if (!state.accounts[a.clientId].scopes.includes('chatgpt.tokens.use.direct'))
+            return { error: new ChatGPTAuthError('ChatGPT plan permission was removed. Sign in again.') };
+        return { token: tokens.access_token, clientId: a.clientId };
+    });
+    if ('error' in result)
+        throw result.error;
+    return result;
+}
+export async function logout(store = new ChatGPTStore()) {
+    return store.update(async (state) => {
+        const a = state.active ? state.accounts[state.active] : undefined;
+        if (!a)
+            return true;
+        let revoked = !a.refreshToken;
+        if (a.refreshToken) {
+            try {
+                const discovery = await fetch(`${ISSUER}/.well-known/openid-configuration`, { redirect: 'error', signal: AbortSignal.timeout(10000) });
+                const metadata = await discovery.json();
+                const endpoint = new URL(metadata.revocation_endpoint);
+                if (!discovery.ok || metadata.issuer !== ISSUER || endpoint.origin !== ISSUER || endpoint.username || endpoint.password)
+                    throw Error();
+                const response = await fetch(endpoint, { method: 'POST', redirect: 'error', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ token: a.refreshToken, token_type_hint: 'refresh_token', client_id: a.clientId }), signal: AbortSignal.timeout(10000) });
+                revoked = response.ok;
+            }
+            catch { /* Local sign-out still removes every token. */ }
+        }
+        state.accounts[a.clientId] = { clientId: a.clientId, subject: a.subject, email: a.email, scopes: [] };
+        return revoked;
+    });
+}
+//# sourceMappingURL=session.js.map