@demicodes/provider-codex 0.1.0

package/dist/index.mjs

@@ -0,0 +1,1279 @@
+import { delay, errorMessage, isRecord, nonEmptyString, numberOrNull, numberOrZero, parseJsonObject, parseJsonOrString, shortHash, stringOrNull } from "@demicodes/utils";
+import { Buffer } from "node:buffer";
+import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { applyModelPolicy, clampPromptCacheKey, defineProvider, httpErrorCode } from "@demicodes/provider";
+//#region src/auth.ts
+async function codexAuthStatus(options = {}) {
+	return new FileCodexAuthStore(options).status();
+}
+const TOKEN_REFRESH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const TOKEN_REFRESH_URL = "https://auth.openai.com/oauth/token";
+const REFRESH_EXPIRY_SKEW_MS = 300 * 1e3;
+const REFRESH_STALENESS_MS = 11520 * 60 * 1e3;
+var FileCodexAuthStore = class {
+	codexHome;
+	authFile;
+	refreshImpl;
+	now;
+	lockRetryDelayMs;
+	lockTimeoutMs;
+	constructor(options = {}) {
+		this.codexHome = options.codexHome ?? defaultCodexHome();
+		this.authFile = join(this.codexHome, "auth.json");
+		this.refreshImpl = options.refresh ?? refreshCodexToken;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.lockRetryDelayMs = options.lockRetryDelayMs ?? 25;
+		this.lockTimeoutMs = options.lockTimeoutMs ?? 5e3;
+	}
+	async status() {
+		try {
+			const auth = await this.resolveAuth();
+			if (auth.kind === "chatgpt") return {
+				status: "authenticated",
+				accountLabel: auth.email ?? auth.accountId
+			};
+			if (auth.kind === "apiKey") return {
+				status: "authenticated",
+				accountLabel: "OPENAI_API_KEY"
+			};
+			if (auth.kind === "personalAccessToken") return {
+				status: "authenticated",
+				accountLabel: auth.accountId ?? "personal access token"
+			};
+			return {
+				status: "authenticated",
+				accountLabel: auth.accountId
+			};
+		} catch (error) {
+			if (error instanceof CodexAuthError && error.code === "auth_missing") return {
+				status: "unauthenticated",
+				message: error.message
+			};
+			if (error instanceof CodexAuthError && error.code === "auth_unsupported") return {
+				status: "error",
+				message: error.message
+			};
+			return {
+				status: "error",
+				message: redactSecretText(error instanceof Error ? error.message : String(error))
+			};
+		}
+	}
+	async resolveAuth(options = {}) {
+		const auth = await this.readAuthFile();
+		const mode = resolvedAuthMode(auth);
+		if (mode === "bedrockApiKey") throw new CodexAuthError("auth_unsupported", "Codex provider does not support Bedrock auth");
+		if (mode === "apiKey") {
+			const key = nonEmptyString(auth.OPENAI_API_KEY);
+			if (!key) throw new CodexAuthError("auth_missing", `No OPENAI_API_KEY found in ${this.authFile}`);
+			return {
+				kind: "apiKey",
+				mode,
+				apiKey: key,
+				authFile: this.authFile
+			};
+		}
+		if (mode === "personalAccessToken") {
+			const token = nonEmptyString(auth.personal_access_token);
+			if (!token) throw new CodexAuthError("auth_missing", `No personal access token found in ${this.authFile}`);
+			return {
+				kind: "personalAccessToken",
+				mode,
+				accessToken: token,
+				accountId: parseChatGptClaims(token).accountId,
+				authFile: this.authFile
+			};
+		}
+		if (mode === "agentIdentity") return resolveAgentIdentity(auth, this.authFile);
+		const tokens = auth.tokens;
+		if (!tokens || typeof tokens !== "object") throw new CodexAuthError("auth_missing", `No ChatGPT tokens found in ${this.authFile}`);
+		const accessToken = nonEmptyString(tokens.access_token);
+		if (!accessToken) throw new CodexAuthError("auth_missing", `No ChatGPT access token found in ${this.authFile}`);
+		const refreshToken = nonEmptyString(tokens.refresh_token) ?? null;
+		const claims = parseChatGptClaims(accessToken);
+		const idClaims = parseIdTokenClaims(tokens.id_token);
+		const accountId = nonEmptyString(tokens.account_id) ?? claims.accountId ?? idClaims.accountId;
+		if (!accountId) throw new CodexAuthError("auth_missing", `No ChatGPT account id found in ${this.authFile}`);
+		const expiresAt = parseJwtExpiration(accessToken);
+		const lastRefresh = parseDate(auth.last_refresh);
+		if ((options.forceRefresh === true || expiresWithin(expiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS) || olderThan(lastRefresh, this.now(), REFRESH_STALENESS_MS)) && refreshToken) return this.refreshAndResolve(auth, refreshToken);
+		return {
+			kind: "chatgpt",
+			mode,
+			accessToken,
+			refreshToken,
+			accountId,
+			email: idClaims.email ?? claims.email,
+			isFedrampAccount: idClaims.isFedrampAccount || claims.isFedrampAccount,
+			expiresAt,
+			authFile: this.authFile
+		};
+	}
+	async refreshAndResolve(auth, refreshToken) {
+		return this.withAuthFileLock(async () => {
+			const latest = await this.readAuthFile();
+			const latestTokens = latest.tokens;
+			const latestRefreshToken = latestTokens && typeof latestTokens === "object" ? nonEmptyString(latestTokens.refresh_token) ?? refreshToken : refreshToken;
+			const response = await this.refreshImpl(latestRefreshToken);
+			const nextTokens = {
+				...latestTokens && typeof latestTokens === "object" ? latestTokens : {},
+				...response.id_token ? { id_token: response.id_token } : {},
+				...response.access_token ? { access_token: response.access_token } : {},
+				...response.refresh_token ? { refresh_token: response.refresh_token } : {}
+			};
+			const nextAuth = {
+				...latest,
+				auth_mode: latest.auth_mode ?? auth.auth_mode ?? "chatgpt",
+				tokens: nextTokens,
+				last_refresh: this.now().toISOString()
+			};
+			await writeAuthJsonAtomic(this.authFile, nextAuth);
+			return resolveChatGptAuthFromFile(nextAuth, this.authFile);
+		});
+	}
+	async readAuthFile() {
+		try {
+			return JSON.parse(await readFile(this.authFile, "utf8"));
+		} catch (error) {
+			if (isNodeError(error) && error.code === "ENOENT") throw new CodexAuthError("auth_missing", `Codex auth file not found: ${this.authFile}`);
+			throw new CodexAuthError("auth_invalid", `Failed to read Codex auth file ${this.authFile}: ${redactSecretText(errorMessage(error))}`);
+		}
+	}
+	async withAuthFileLock(fn) {
+		const lockFile = `${this.authFile}.lock`;
+		await mkdir(dirname(this.authFile), { recursive: true });
+		const started = Date.now();
+		let handle = null;
+		while (!handle) try {
+			handle = await open(lockFile, "wx", 384);
+		} catch (error) {
+			if (!isNodeError(error) || error.code !== "EEXIST" || Date.now() - started > this.lockTimeoutMs) throw new CodexAuthError("auth_lock_failed", `Failed to lock Codex auth file: ${redactSecretText(errorMessage(error))}`);
+			await delay(this.lockRetryDelayMs);
+		}
+		try {
+			return await fn();
+		} finally {
+			await handle.close().catch(() => void 0);
+			await rm(lockFile, { force: true }).catch(() => void 0);
+		}
+	}
+};
+var CodexAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "CodexAuthError";
+	}
+};
+function defaultCodexHome() {
+	return process.env.CODEX_HOME && process.env.CODEX_HOME.trim() ? process.env.CODEX_HOME : join(homedir(), ".codex");
+}
+function resolvedAuthMode(auth) {
+	if (auth.auth_mode) return auth.auth_mode;
+	if (auth.personal_access_token) return "personalAccessToken";
+	if (auth.bedrock_api_key) return "bedrockApiKey";
+	if (auth.OPENAI_API_KEY) return "apiKey";
+	if (auth.agent_identity) return "agentIdentity";
+	return "chatgpt";
+}
+function parseJwtExpiration(jwt) {
+	const exp = decodeJwtPayload(jwt)?.exp;
+	return typeof exp === "number" ? /* @__PURE__ */ new Date(exp * 1e3) : null;
+}
+function parseChatGptClaims(jwt) {
+	const payload = decodeJwtPayload(jwt);
+	const auth = isRecord(payload?.["https://api.openai.com/auth"]) ? payload["https://api.openai.com/auth"] : null;
+	const profile = isRecord(payload?.["https://api.openai.com/profile"]) ? payload["https://api.openai.com/profile"] : null;
+	return {
+		accountId: stringOrNull(auth?.chatgpt_account_id),
+		email: stringOrNull(payload?.email) ?? stringOrNull(profile?.email),
+		isFedrampAccount: auth?.chatgpt_account_is_fedramp === true
+	};
+}
+function parseIdTokenClaims(idToken) {
+	if (typeof idToken === "string") return parseChatGptClaims(idToken);
+	if (!isRecord(idToken)) return {
+		accountId: null,
+		email: null,
+		isFedrampAccount: false
+	};
+	return {
+		accountId: stringOrNull(idToken.chatgpt_account_id),
+		email: stringOrNull(idToken.email),
+		isFedrampAccount: idToken.chatgpt_account_is_fedramp === true
+	};
+}
+async function refreshCodexToken(refreshToken, signal) {
+	const response = await fetch(TOKEN_REFRESH_URL, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			client_id: process.env.CODEX_APP_SERVER_LOGIN_CLIENT_ID || TOKEN_REFRESH_CLIENT_ID,
+			grant_type: "refresh_token",
+			refresh_token: refreshToken
+		}),
+		signal
+	});
+	if (!response.ok) throw new CodexAuthError("auth_refresh_failed", `Codex token refresh failed with HTTP ${response.status}`);
+	return await response.json();
+}
+function redactSecretText(text) {
+	return text.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/g, "Bearer [REDACTED]").replace(/(access_token|refresh_token|id_token|OPENAI_API_KEY)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, "$1=[REDACTED]");
+}
+function resolveChatGptAuthFromFile(auth, authFile) {
+	const tokens = auth.tokens;
+	if (!tokens || typeof tokens !== "object") throw new CodexAuthError("auth_missing", `No ChatGPT tokens found in ${authFile}`);
+	const accessToken = nonEmptyString(tokens.access_token);
+	if (!accessToken) throw new CodexAuthError("auth_missing", `No ChatGPT access token found in ${authFile}`);
+	const claims = parseChatGptClaims(accessToken);
+	const idClaims = parseIdTokenClaims(tokens.id_token);
+	const accountId = nonEmptyString(tokens.account_id) ?? claims.accountId ?? idClaims.accountId;
+	if (!accountId) throw new CodexAuthError("auth_missing", `No ChatGPT account id found in ${authFile}`);
+	return {
+		kind: "chatgpt",
+		mode: resolvedAuthMode(auth) === "chatgptAuthTokens" ? "chatgptAuthTokens" : "chatgpt",
+		accessToken,
+		refreshToken: nonEmptyString(tokens.refresh_token) ?? null,
+		accountId,
+		email: idClaims.email ?? claims.email,
+		isFedrampAccount: idClaims.isFedrampAccount || claims.isFedrampAccount,
+		expiresAt: parseJwtExpiration(accessToken),
+		authFile
+	};
+}
+function resolveAgentIdentity(auth, authFile) {
+	const value = auth.agent_identity;
+	if (!isRecord(value)) throw new CodexAuthError("auth_unsupported", "Codex agent identity auth requires an auth record");
+	const authorization = nonEmptyString(value.authorization);
+	const accountId = nonEmptyString(value.account_id);
+	if (!authorization || !accountId) throw new CodexAuthError("auth_unsupported", "Codex agent identity auth requires an authorization header generated by official Codex");
+	return {
+		kind: "agentIdentity",
+		mode: "agentIdentity",
+		authorization,
+		accountId,
+		isFedrampAccount: value.chatgpt_account_is_fedramp === true,
+		authFile
+	};
+}
+async function writeAuthJsonAtomic(authFile, auth) {
+	await mkdir(dirname(authFile), { recursive: true });
+	const temp = `${authFile}.${process.pid}.${Date.now()}.tmp`;
+	await writeFile(temp, `${JSON.stringify(auth, null, 2)}\n`, { mode: 384 });
+	await chmod(temp, 384);
+	await rename(temp, authFile);
+}
+function decodeJwtPayload(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length !== 3 || !parts[1]) return null;
+	try {
+		const normalized = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+		const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+		return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function expiresWithin(expiresAt, now, skewMs) {
+	return expiresAt !== null && expiresAt.getTime() - now.getTime() <= skewMs;
+}
+function olderThan(value, now, ageMs) {
+	return value !== null && now.getTime() - value.getTime() >= ageMs;
+}
+function parseDate(value) {
+	if (typeof value !== "string" || !value) return null;
+	const ms = Date.parse(value);
+	return Number.isFinite(ms) ? new Date(ms) : null;
+}
+function isNodeError(error) {
+	return error instanceof Error && "code" in error;
+}
+//#endregion
+//#region src/models.ts
+const DEFAULT_CHATGPT_CODEX_BASE_URL$1 = "https://chatgpt.com/backend-api";
+const DEFAULT_CODEX_MODEL_CATALOG_CLIENT_VERSION = "0.130.0";
+const CODEX_MODEL_CACHE_TTL_MS = 900 * 1e3;
+const codexCatalogCache = /* @__PURE__ */ new Map();
+async function listCodexModels(options = {}) {
+	const fetchImpl = options.fetch ?? fetch;
+	const nowDate = (options.now ?? (() => /* @__PURE__ */ new Date()))();
+	const authStore = options.authStore ?? new FileCodexAuthStore({ codexHome: options.codexHome });
+	const clientVersion = options.clientVersion ?? DEFAULT_CODEX_MODEL_CATALOG_CLIENT_VERSION;
+	const auth = await authStore.resolveAuth();
+	assertCodexBackendModelCatalogAuth(auth);
+	const cacheKey = codexModelCatalogCacheKey(auth, options.baseUrl, clientVersion);
+	const cached = codexCatalogCache.get(cacheKey);
+	if (cached && nowDate.getTime() - cached.fetchedAtMs < CODEX_MODEL_CACHE_TTL_MS) return cloneModelList(markModelListCache(cached.list, false));
+	try {
+		const list = await requestCodexModels({
+			auth,
+			clientVersion,
+			fetch: fetchImpl,
+			now: nowDate,
+			baseUrl: options.baseUrl,
+			headers: options.headers,
+			userAgent: options.userAgent
+		});
+		codexCatalogCache.set(cacheKey, {
+			fetchedAtMs: nowDate.getTime(),
+			list
+		});
+		return cloneModelList(list);
+	} catch (error) {
+		if (isUnauthorized(error)) {
+			const refreshed = await authStore.resolveAuth({ forceRefresh: true });
+			assertCodexBackendModelCatalogAuth(refreshed);
+			const list = await requestCodexModels({
+				auth: refreshed,
+				clientVersion,
+				fetch: fetchImpl,
+				now: nowDate,
+				baseUrl: options.baseUrl,
+				headers: options.headers,
+				userAgent: options.userAgent
+			});
+			codexCatalogCache.set(codexModelCatalogCacheKey(refreshed, options.baseUrl, clientVersion), {
+				fetchedAtMs: nowDate.getTime(),
+				list
+			});
+			return cloneModelList(list);
+		}
+		if (cached && !isAuthCatalogError(error)) {
+			const stale = markModelListCache(cached.list, true);
+			return {
+				...cloneModelList(stale),
+				warnings: [...stale.warnings, `Using stale Codex model catalog: ${errorMessage(error)}`]
+			};
+		}
+		throw error;
+	}
+}
+function codexBackendModelsToModelList(value, options = {}) {
+	if (!isRecord(value) || !Array.isArray(value.models)) throw new Error("Codex models response does not contain a models array");
+	const sourceFetchedAt = options.sourceFetchedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+	const warnings = [...options.warnings ?? []];
+	const models = [];
+	for (const raw of value.models) {
+		if (!isRecord(raw)) {
+			warnings.push("Skipped Codex model with invalid metadata");
+			continue;
+		}
+		const id = nonEmptyString(raw.slug);
+		if (!id) {
+			warnings.push("Skipped Codex model without slug");
+			continue;
+		}
+		if (nonEmptyString(raw.visibility) === "hide") continue;
+		models.push(codexModelFromBackendEntry(id, raw, sourceFetchedAt, options.stale === true));
+	}
+	return {
+		providerId: "codex",
+		models,
+		defaultModelId: null,
+		warnings,
+		sourceFetchedAt,
+		stale: options.stale === true
+	};
+}
+async function requestCodexModels(options) {
+	const response = await options.fetch(codexModelsUrl(options.baseUrl ?? DEFAULT_CHATGPT_CODEX_BASE_URL$1, options.clientVersion), { headers: buildCodexModelCatalogHeaders(options.auth, options.headers, options.userAgent) });
+	if (!response.ok) throw new CodexModelCatalogHttpError(response.status, `Codex models request failed with HTTP ${response.status}`);
+	return codexBackendModelsToModelList(await response.json(), {
+		sourceFetchedAt: options.now.toISOString(),
+		stale: false
+	});
+}
+function codexModelFromBackendEntry(id, raw, sourceFetchedAt, stale) {
+	const supportedReasoningEfforts = supportedReasoningLevels(raw.supported_reasoning_levels);
+	const tiers = serviceTiers(raw.service_tiers);
+	return {
+		providerId: "codex",
+		id,
+		displayName: nonEmptyString(raw.display_name) ?? id,
+		description: nonEmptyString(raw.description),
+		contextWindow: numberOrNull(raw.context_window),
+		outputLimit: null,
+		supportsTools: supportsCodexTools(raw),
+		supportsAttachments: Array.isArray(raw.input_modalities) ? raw.input_modalities.includes("image") : null,
+		supportsReasoning: supportedReasoningEfforts ? supportedReasoningEfforts.length > 0 : null,
+		supportedThinkingEfforts: supportedReasoningEfforts,
+		defaultThinkingEffort: null,
+		serviceTiers: tiers,
+		defaultServiceTierId: null,
+		sourceFetchedAt,
+		stale
+	};
+}
+function buildCodexModelCatalogHeaders(auth, configuredHeaders, userAgent) {
+	const headers = new Headers(configuredHeaders);
+	if (auth.kind === "agentIdentity") headers.set("Authorization", auth.authorization);
+	else headers.set("Authorization", `Bearer ${auth.accessToken}`);
+	if (auth.accountId) headers.set("ChatGPT-Account-ID", auth.accountId);
+	if ("isFedrampAccount" in auth && auth.isFedrampAccount) headers.set("X-OpenAI-Fedramp", "true");
+	headers.set("accept", "application/json");
+	headers.set("User-Agent", userAgent ?? defaultModelCatalogUserAgent());
+	return headers;
+}
+function codexModelsUrl(baseUrl, clientVersion) {
+	const normalized = baseUrl.replace(/\/+$/, "");
+	return `${normalized.endsWith("/codex/models") ? normalized : normalized.endsWith("/codex") ? `${normalized}/models` : `${normalized}/codex/models`}?client_version=${encodeURIComponent(clientVersion)}`;
+}
+function assertCodexBackendModelCatalogAuth(auth) {
+	if (auth.kind === "apiKey") throw new CodexAuthError("auth_unsupported", "Codex backend model catalog requires official Codex ChatGPT auth, not OPENAI_API_KEY");
+}
+function codexModelCatalogCacheKey(auth, baseUrl, clientVersion) {
+	const account = "accountId" in auth ? auth.accountId ?? "" : "";
+	return [
+		auth.kind,
+		auth.mode,
+		account,
+		baseUrl ?? DEFAULT_CHATGPT_CODEX_BASE_URL$1,
+		clientVersion
+	].join("\0");
+}
+function supportedReasoningLevels(value) {
+	if (!Array.isArray(value)) return null;
+	const efforts = value.map((level) => isRecord(level) ? nonEmptyString(level.effort) : void 0).filter((effort) => effort !== void 0);
+	return efforts.length > 0 ? efforts : [];
+}
+function serviceTiers(value) {
+	if (!Array.isArray(value)) return null;
+	const tiers = value.flatMap((tier) => {
+		if (!isRecord(tier)) return [];
+		const id = nonEmptyString(tier.id);
+		if (!id) return [];
+		return [{
+			id,
+			label: nonEmptyString(tier.name) ?? id,
+			...nonEmptyString(tier.description) ? { description: nonEmptyString(tier.description) } : {}
+		}];
+	});
+	return tiers.length > 0 ? tiers : [];
+}
+function supportsCodexTools(raw) {
+	if (typeof raw.tool_mode === "string" && raw.tool_mode.length > 0) return true;
+	if (Array.isArray(raw.experimental_supported_tools)) return raw.experimental_supported_tools.length > 0;
+	if (raw.apply_patch_tool_type !== void 0 || raw.web_search_tool_type !== void 0) return true;
+	return null;
+}
+function markModelListCache(list, stale) {
+	return {
+		...list,
+		stale,
+		models: list.models.map((model) => ({
+			...model,
+			stale
+		}))
+	};
+}
+function cloneModelList(list) {
+	return {
+		...list,
+		warnings: [...list.warnings],
+		models: list.models.map((model) => ({
+			...model,
+			...model.cost ? { cost: { ...model.cost } } : {},
+			supportedThinkingEfforts: model.supportedThinkingEfforts ? [...model.supportedThinkingEfforts] : null,
+			serviceTiers: model.serviceTiers ? model.serviceTiers.map((tier) => ({ ...tier })) : model.serviceTiers
+		}))
+	};
+}
+function isUnauthorized(error) {
+	return error instanceof CodexModelCatalogHttpError && error.status === 401;
+}
+function isAuthCatalogError(error) {
+	if (error instanceof CodexModelCatalogHttpError && (error.status === 401 || error.status === 403)) return true;
+	return error instanceof CodexAuthError;
+}
+var CodexModelCatalogHttpError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(redactSecretText(message));
+		this.status = status;
+		this.name = "CodexModelCatalogHttpError";
+	}
+};
+function defaultModelCatalogUserAgent() {
+	return `demi-provider-codex/0.0.0`;
+}
+//#endregion
+//#region src/responses.ts
+function buildCodexResponsesRequestBody(request) {
+	const body = {
+		model: request.modelId,
+		instructions: request.systemPrompt,
+		input: request.items.flatMap((item, index) => inferenceItemToResponsesInput(item, index)),
+		tools: request.tools.map(toolToResponsesTool),
+		tool_choice: "auto",
+		parallel_tool_calls: true,
+		store: false,
+		stream: true,
+		include: ["reasoning.encrypted_content"],
+		prompt_cache_key: clampPromptCacheKey(request.sessionId),
+		text: { verbosity: "low" }
+	};
+	const reasoning = thinkingToReasoning(request.thinking);
+	if (reasoning) body.reasoning = reasoning;
+	if (request.serviceTierId) body.service_tier = request.serviceTierId;
+	return body;
+}
+async function* mapCodexResponseEvents(events) {
+	const state = {
+		currentReasoning: null,
+		currentFunctionCall: null,
+		functionArguments: /* @__PURE__ */ new Map(),
+		reasoningDeltaSeen: false,
+		textDeltaSeen: false
+	};
+	for await (const event of events) yield* mapCodexResponseEvent(event, state);
+}
+function* mapCodexResponseEvent(event, state = newStreamState()) {
+	switch (event.type) {
+		case "response.output_item.added": {
+			const item = event.item;
+			if (isReasoningItem(item)) {
+				state.currentReasoning = item;
+				yield { type: "thinking_start" };
+			} else if (isFunctionCallItem(item)) {
+				state.currentFunctionCall = item;
+				if (item.id) state.functionArguments.set(item.id, item.arguments ?? "");
+			}
+			return;
+		}
+		case "response.reasoning_summary_text.delta":
+		case "response.reasoning_text.delta":
+			if (typeof event.delta === "string") {
+				state.reasoningDeltaSeen = true;
+				yield {
+					type: "thinking_delta",
+					text: event.delta
+				};
+			}
+			return;
+		case "response.output_text.delta":
+			if (typeof event.delta === "string") {
+				state.textDeltaSeen = true;
+				yield {
+					type: "text_delta",
+					text: event.delta
+				};
+			}
+			return;
+		case "response.function_call_arguments.delta": {
+			const key = event.item_id ?? state.currentFunctionCall?.id;
+			if (key && typeof event.delta === "string") state.functionArguments.set(key, `${state.functionArguments.get(key) ?? ""}${event.delta}`);
+			return;
+		}
+		case "response.function_call_arguments.done": {
+			const key = event.item_id ?? state.currentFunctionCall?.id;
+			if (key && typeof event.arguments === "string") state.functionArguments.set(key, event.arguments);
+			return;
+		}
+		case "response.output_item.done": {
+			const item = event.item;
+			if (isReasoningItem(item)) {
+				if (!state.reasoningDeltaSeen) {
+					const text = reasoningText(item);
+					if (text) yield {
+						type: "thinking_delta",
+						text
+					};
+				}
+				yield {
+					type: "thinking_signature",
+					signature: JSON.stringify(item)
+				};
+				if (state.currentReasoning === item) state.currentReasoning = null;
+				state.reasoningDeltaSeen = false;
+			} else if (isMessageItem(item)) {
+				if (!state.textDeltaSeen) {
+					const text = messageText(item);
+					if (text) yield {
+						type: "text_delta",
+						text
+					};
+				}
+				state.textDeltaSeen = false;
+			} else if (isFunctionCallItem(item)) {
+				const itemId = item.id ?? event.item_id;
+				const callId = item.call_id ?? event.call_id;
+				if (itemId && callId && item.name) {
+					const rawArgs = state.functionArguments.get(itemId) ?? item.arguments ?? "{}";
+					yield {
+						type: "tool_call_requested",
+						toolUseId: `${callId}|${itemId}`,
+						toolName: item.name,
+						input: parseJsonOrString(rawArgs)
+					};
+				}
+				if (itemId) state.functionArguments.delete(itemId);
+				if (state.currentFunctionCall === item) state.currentFunctionCall = null;
+			}
+			return;
+		}
+		case "response.completed":
+			yield {
+				type: "response",
+				usage: usageFromResponse(event.response)
+			};
+			return;
+		case "response.failed":
+			yield errorEventFromFailedResponse(event.response);
+			return;
+		case "response.incomplete":
+			yield {
+				type: "error",
+				message: `Incomplete response returned, reason: ${incompleteReason(event.response)}`,
+				code: incompleteReason(event.response) === "max_output_tokens" ? "context_length_exceeded" : "incomplete"
+			};
+			return;
+		case "error": {
+			const nested = isRecord(event.error) ? event.error : null;
+			yield {
+				type: "error",
+				message: event.message ?? stringOrNull(nested?.message) ?? "Codex stream error",
+				code: event.code ?? stringOrNull(nested?.code) ?? stringOrNull(nested?.type) ?? null
+			};
+			return;
+		}
+	}
+}
+function splitCodexToolUseId(toolUseId) {
+	const [callId, itemId] = toolUseId.split("|", 2);
+	return {
+		callId,
+		itemId
+	};
+}
+function usageFromResponse(response) {
+	const usage = isRecord(response) && isRecord(response.usage) ? response.usage : {};
+	const inputTokens = numberOrZero(usage.input_tokens);
+	const cachedTokens = isRecord(usage.input_tokens_details) ? numberOrZero(usage.input_tokens_details.cached_tokens) : 0;
+	return {
+		inputTokens: Math.max(0, inputTokens - cachedTokens),
+		outputTokens: numberOrZero(usage.output_tokens),
+		cacheReadTokens: cachedTokens,
+		cacheWriteTokens: 0
+	};
+}
+function inferenceItemToResponsesInput(item, index) {
+	switch (item.type) {
+		case "user_message":
+		case "user_steer": return [{
+			role: "user",
+			content: userContentToResponses(item.content)
+		}];
+		case "assistant_text": return [{
+			type: "message",
+			role: "assistant",
+			content: [{
+				type: "output_text",
+				text: item.text,
+				annotations: []
+			}],
+			id: `msg_${shortHash(`${index}:${item.modelId}:${item.text}`)}`,
+			status: "completed"
+		}];
+		case "assistant_thinking": {
+			const reasoning = parseReasoningSignature(item.signature);
+			return reasoning ? [reasoning] : [];
+		}
+		case "assistant_redacted_thinking": return [];
+		case "tool_use": {
+			const { callId, itemId } = splitCodexToolUseId(item.toolUseId);
+			return [{
+				type: "function_call",
+				id: itemId,
+				call_id: callId,
+				name: item.toolName,
+				arguments: stringifyArguments(item.input)
+			}];
+		}
+		case "tool_result": {
+			const { callId } = splitCodexToolUseId(item.toolUseId);
+			return [{
+				type: "function_call_output",
+				call_id: callId,
+				output: toolResultToResponsesOutput(item.output)
+			}];
+		}
+	}
+}
+function userContentToResponses(content) {
+	return content.flatMap((block) => {
+		if (block.type === "text") return [{
+			type: "input_text",
+			text: block.text
+		}];
+		if (block.type === "reference") return [{
+			type: "input_text",
+			text: block.reference
+		}];
+		if (block.type === "document") return [{
+			type: "input_text",
+			text: `[document:${block.source.fileName} ${block.source.mediaType}]`
+		}];
+		if (block.source.type === "url") return [{
+			type: "input_image",
+			image_url: block.source.url,
+			detail: "auto"
+		}];
+		const base64 = Buffer.from(block.source.data.buffer, block.source.data.byteOffset, block.source.data.byteLength).toString("base64");
+		return [{
+			type: "input_image",
+			image_url: `data:${block.source.mediaType};base64,${base64}`,
+			detail: "auto"
+		}];
+	});
+}
+function toolResultToResponsesOutput(output) {
+	const images = output.filter((block) => block.type === "image");
+	const text = output.filter((block) => block.type === "text").map((block) => block.text).join("\n");
+	if (images.length === 0) return text;
+	const content = [];
+	if (text) content.push({
+		type: "input_text",
+		text
+	});
+	for (const image of images) content.push({
+		type: "input_image",
+		image_url: `data:${image.source.mediaType};base64,${image.source.data}`,
+		detail: "auto"
+	});
+	return content;
+}
+function toolToResponsesTool(tool) {
+	return {
+		type: "function",
+		name: tool.name,
+		description: tool.description,
+		parameters: tool.inputSchema,
+		strict: null
+	};
+}
+function thinkingToReasoning(thinking) {
+	if (!thinking || thinking.type === "disabled" || thinking.type === "budget") return void 0;
+	if (thinking.type === "adaptive") return {
+		effort: thinking.effort,
+		summary: "auto"
+	};
+	if (thinking.effort === "none") return { effort: "none" };
+	return {
+		effort: thinking.effort,
+		summary: thinking.summary && thinking.summary !== "off" ? thinking.summary : "auto"
+	};
+}
+function parseReasoningSignature(signature) {
+	if (!signature) return null;
+	try {
+		const parsed = JSON.parse(signature);
+		return isReasoningItem(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function stringifyArguments(input) {
+	return typeof input === "string" ? input : JSON.stringify(input ?? {});
+}
+function messageText(item) {
+	return item.content?.map((part) => part.type === "output_text" ? part.text : part.type === "refusal" ? part.refusal : "").join("") ?? "";
+}
+function reasoningText(item) {
+	const summary = item.summary?.map((part) => part.text).join("\n\n") ?? "";
+	const content = item.content?.map((part) => part.text).join("\n\n") ?? "";
+	return summary || content;
+}
+function errorEventFromFailedResponse(response) {
+	const error = isRecord(response) && isRecord(response.error) ? response.error : null;
+	const message = stringOrNull(error?.message) ?? "Codex response failed";
+	return {
+		type: "error",
+		message,
+		code: normalizeErrorCode(stringOrNull(error?.code) ?? stringOrNull(error?.type), message)
+	};
+}
+function normalizeErrorCode(code, message) {
+	const value = `${code ?? ""} ${message}`.toLowerCase();
+	if (/context|maximum context|too long|max.*token/.test(value)) return "context_length_exceeded";
+	if (/rate|quota|usage|limit|billing|balance/.test(value)) return "rate_limit";
+	if (/unauth|auth|expired|invalid.*token/.test(value)) return "auth_expired";
+	if (/overload|unavailable|timeout/.test(value)) return "overloaded";
+	return code;
+}
+function incompleteReason(response) {
+	if (isRecord(response) && isRecord(response.incomplete_details) && typeof response.incomplete_details.reason === "string") return response.incomplete_details.reason;
+	return "unknown";
+}
+function newStreamState() {
+	return {
+		currentReasoning: null,
+		currentFunctionCall: null,
+		functionArguments: /* @__PURE__ */ new Map(),
+		reasoningDeltaSeen: false,
+		textDeltaSeen: false
+	};
+}
+function isReasoningItem(item) {
+	return isRecord(item) && item.type === "reasoning";
+}
+function isMessageItem(item) {
+	return isRecord(item) && item.type === "message";
+}
+function isFunctionCallItem(item) {
+	return isRecord(item) && item.type === "function_call";
+}
+//#endregion
+//#region src/sse.ts
+async function* parseSseResponseStream(body) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			buffer += decoder.decode(value, { stream: true });
+			const chunks = buffer.split(/\r?\n\r?\n/);
+			buffer = chunks.pop() ?? "";
+			for (const chunk of chunks) {
+				const event = parseSseChunk(chunk);
+				if (event) yield event;
+			}
+		}
+		buffer += decoder.decode();
+		const final = parseSseChunk(buffer);
+		if (final) yield final;
+	} finally {
+		reader.releaseLock();
+	}
+}
+function parseSseChunk(chunk) {
+	const data = chunk.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n").trim();
+	if (!data || data === "[DONE]") return null;
+	return JSON.parse(data);
+}
+//#endregion
+//#region src/transport.ts
+var FetchCodexResponsesTransport = class {
+	fetchImpl;
+	constructor(options = {}) {
+		this.fetchImpl = options.fetch ?? fetch;
+	}
+	async *stream(request) {
+		const headerTimeout = createAbortTimeout(request.headerTimeoutMs, "Codex SSE response headers timed out");
+		const combined = combineAbortSignals([request.signal, headerTimeout.signal]);
+		let response;
+		try {
+			response = await this.fetchImpl(request.url, {
+				method: "POST",
+				headers: request.headers,
+				body: JSON.stringify(request.body),
+				signal: combined.signal
+			});
+		} finally {
+			headerTimeout.clear();
+			combined.cleanup();
+		}
+		if (!response.ok) throw new CodexHttpError(response.status, response.statusText, await response.text());
+		if (!response.body) throw new Error("Codex response did not include a body");
+		yield* parseSseResponseStream(response.body);
+	}
+};
+var WebSocketCodexResponsesTransport = class {
+	WebSocketCtor;
+	constructor(options = {}) {
+		this.WebSocketCtor = options.WebSocket === void 0 ? defaultWebSocketConstructor() : options.WebSocket;
+	}
+	async *stream(request) {
+		const socket = await connectWebSocket(this.WebSocketCtor, request.websocketUrl, request.headers, request.signal, request.websocketConnectTimeoutMs);
+		const queue = [];
+		const waiters = [];
+		let idleTimer = null;
+		let finished = false;
+		const wake = () => {
+			for (const waiter of waiters.splice(0)) waiter();
+		};
+		const push = (value) => {
+			queue.push(value);
+			wake();
+		};
+		const finish = () => {
+			if (finished) return;
+			finished = true;
+			push(null);
+		};
+		const armIdleTimer = () => {
+			if (!request.streamIdleTimeoutMs) return;
+			if (idleTimer) clearTimeout(idleTimer);
+			idleTimer = setTimeout(() => {
+				push(/* @__PURE__ */ new Error(`Codex WebSocket stream idled for ${request.streamIdleTimeoutMs}ms`));
+				socket.close(1e3, "idle_timeout");
+			}, request.streamIdleTimeoutMs);
+		};
+		const cleanup = () => {
+			if (idleTimer) clearTimeout(idleTimer);
+			socket.removeEventListener("message", onMessage);
+			socket.removeEventListener("error", onError);
+			socket.removeEventListener("close", onClose);
+			request.signal.removeEventListener("abort", onAbort);
+		};
+		const onMessage = (event) => {
+			armIdleTimer();
+			try {
+				const parsed = parseWebSocketMessage(event.data);
+				if (parsed) {
+					push(parsed);
+					if (isTerminalResponseEvent(parsed)) {
+						finish();
+						socket.close(1e3, "response_done");
+					}
+				}
+			} catch (error) {
+				push(error instanceof Error ? error : new Error(String(error)));
+			}
+		};
+		const onError = () => push(/* @__PURE__ */ new Error("Codex WebSocket error"));
+		const onClose = () => finish();
+		const onAbort = () => {
+			socket.close(1e3, "aborted");
+			push(new DOMException("Aborted", "AbortError"));
+		};
+		socket.addEventListener("message", onMessage);
+		socket.addEventListener("error", onError);
+		socket.addEventListener("close", onClose);
+		request.signal.addEventListener("abort", onAbort, { once: true });
+		try {
+			socket.send(JSON.stringify({
+				type: "response.create",
+				...request.body
+			}));
+			armIdleTimer();
+			while (true) {
+				if (queue.length === 0) await new Promise((resolve) => waiters.push(resolve));
+				const next = queue.shift();
+				if (next === void 0) continue;
+				if (next === null) return;
+				if (next instanceof Error) throw next;
+				yield next;
+			}
+		} finally {
+			cleanup();
+			socket.close(1e3, "done");
+		}
+	}
+};
+var AutoCodexResponsesTransport = class {
+	websocket;
+	sse;
+	constructor(websocket, sse) {
+		this.websocket = websocket;
+		this.sse = sse;
+	}
+	async *stream(request) {
+		let started = false;
+		try {
+			for await (const event of this.websocket.stream(request)) {
+				started = true;
+				yield event;
+			}
+			return;
+		} catch (error) {
+			if (started) throw error;
+		}
+		yield* this.sse.stream(request);
+	}
+};
+var CodexHttpError = class extends Error {
+	status;
+	responseText;
+	constructor(status, statusText, responseText) {
+		super(codexHttpErrorMessage(status, statusText, responseText));
+		this.status = status;
+		this.responseText = responseText;
+		this.name = "CodexHttpError";
+	}
+};
+function codexResponsesUrl(baseUrl) {
+	const normalized = baseUrl.replace(/\/+$/, "");
+	if (normalized.endsWith("/responses")) return normalized;
+	if (normalized.endsWith("/codex")) return `${normalized}/responses`;
+	return `${normalized}/codex/responses`;
+}
+function codexWebSocketUrl(responsesUrl) {
+	return responsesUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
+}
+function createCodexTransport(mode, options = {}) {
+	const sse = new FetchCodexResponsesTransport(options);
+	if (mode === "sse") return sse;
+	const websocket = new WebSocketCodexResponsesTransport(options);
+	if (mode === "websocket") return websocket;
+	return new AutoCodexResponsesTransport(websocket, sse);
+}
+function createAbortTimeout(ms, message) {
+	const controller = new AbortController();
+	if (!ms || ms <= 0) return {
+		signal: controller.signal,
+		clear: () => void 0
+	};
+	const timeout = setTimeout(() => controller.abort(/* @__PURE__ */ new Error(`${message} after ${ms}ms`)), ms);
+	return {
+		signal: controller.signal,
+		clear: () => clearTimeout(timeout)
+	};
+}
+function combineAbortSignals(signals) {
+	const controller = new AbortController();
+	const listeners = [];
+	for (const signal of signals) {
+		const listener = () => controller.abort(signal.reason);
+		listeners.push(() => signal.removeEventListener("abort", listener));
+		if (signal.aborted) controller.abort(signal.reason);
+		else signal.addEventListener("abort", listener, { once: true });
+	}
+	return {
+		signal: controller.signal,
+		cleanup: () => {
+			for (const cleanup of listeners) cleanup();
+		}
+	};
+}
+function connectWebSocket(WebSocketCtor, url, headers, signal, timeoutMs = 1e4) {
+	if (!WebSocketCtor) return Promise.reject(/* @__PURE__ */ new Error("WebSocket transport is not available in this runtime"));
+	const headerRecord = headersToRecord(headers);
+	delete headerRecord.accept;
+	delete headerRecord["content-type"];
+	headerRecord["openai-beta"] = "responses_websockets=2026-02-06";
+	return new Promise((resolve, reject) => {
+		let socket;
+		let settled = false;
+		const timeout = setTimeout(() => fail(/* @__PURE__ */ new Error(`Codex WebSocket connect timed out after ${timeoutMs}ms`)), timeoutMs);
+		const cleanup = () => {
+			clearTimeout(timeout);
+			socket?.removeEventListener("open", onOpen);
+			socket?.removeEventListener("error", onError);
+			socket?.removeEventListener("close", onClose);
+			signal.removeEventListener("abort", onAbort);
+		};
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			try {
+				socket?.close(1e3, "connect_failed");
+			} catch {}
+			reject(error);
+		};
+		const onOpen = () => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(socket);
+		};
+		const onError = () => fail(/* @__PURE__ */ new Error("Codex WebSocket connect error"));
+		const onClose = () => fail(/* @__PURE__ */ new Error("Codex WebSocket closed before opening"));
+		const onAbort = () => fail(new DOMException("Aborted", "AbortError"));
+		try {
+			socket = new WebSocketCtor(url, { headers: headerRecord });
+		} catch (error) {
+			clearTimeout(timeout);
+			reject(error instanceof Error ? error : new Error(String(error)));
+			return;
+		}
+		socket.addEventListener("open", onOpen);
+		socket.addEventListener("error", onError);
+		socket.addEventListener("close", onClose);
+		signal.addEventListener("abort", onAbort, { once: true });
+	});
+}
+function parseWebSocketMessage(data) {
+	if (typeof data === "string") return parseWebSocketJson(data);
+	if (data instanceof ArrayBuffer) return parseWebSocketJson(new TextDecoder().decode(data));
+	if (data instanceof Uint8Array) return parseWebSocketJson(new TextDecoder().decode(data));
+	return null;
+}
+function parseWebSocketJson(text) {
+	const parsed = JSON.parse(text);
+	if (parsed.type === "response.done") return {
+		type: "response.completed",
+		response: parsed.response
+	};
+	if ("event" in parsed && isRecord(parsed.event)) return parsed.event;
+	return parsed;
+}
+function isTerminalResponseEvent(event) {
+	return event.type === "response.completed" || event.type === "response.failed" || event.type === "response.incomplete" || event.type === "error";
+}
+function headersToRecord(headers) {
+	const out = {};
+	headers.forEach((value, key) => {
+		out[key] = value;
+	});
+	return out;
+}
+function codexHttpErrorMessage(status, statusText, responseText) {
+	const body = parseJsonObject(responseText);
+	const error = isRecord(body?.error) ? body.error : null;
+	return typeof error?.message === "string" ? error.message : responseText || statusText || `HTTP ${status}`;
+}
+function defaultWebSocketConstructor() {
+	return typeof globalThis.WebSocket === "function" ? globalThis.WebSocket : null;
+}
+//#endregion
+//#region src/provider.ts
+const DEFAULT_CHATGPT_CODEX_BASE_URL = "https://chatgpt.com/backend-api";
+const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
+const DEFAULT_MAX_RETRIES = 2;
+const DEFAULT_RETRY_BASE_DELAY_MS = 250;
+const DEFAULT_SSE_HEADER_TIMEOUT_MS = 2e4;
+const DEFAULT_WEBSOCKET_CONNECT_TIMEOUT_MS = 1e4;
+var CodexProvider = class {
+	config;
+	authStore;
+	transport;
+	constructor(options = {}) {
+		this.config = {
+			codexHome: options.codexHome,
+			baseUrl: options.baseUrl,
+			transport: options.transport ?? "auto",
+			headers: options.headers,
+			userAgent: options.userAgent ?? defaultUserAgent(),
+			maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,
+			retryBaseDelayMs: options.retryBaseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS,
+			headerTimeoutMs: options.headerTimeoutMs ?? DEFAULT_SSE_HEADER_TIMEOUT_MS,
+			websocketConnectTimeoutMs: options.websocketConnectTimeoutMs ?? DEFAULT_WEBSOCKET_CONNECT_TIMEOUT_MS,
+			streamIdleTimeoutMs: options.streamIdleTimeoutMs ?? 0,
+			clientVersion: options.clientVersion
+		};
+		this.authStore = options.authStore ?? new FileCodexAuthStore({ codexHome: options.codexHome });
+		this.transport = options.transportImpl ?? createCodexTransport(this.config.transport);
+	}
+	async *run(request) {
+		const body = buildCodexResponsesRequestBody(request);
+		let forceRefresh = false;
+		let retryAttempt = 0;
+		while (retryAttempt <= this.config.maxRetries) try {
+			const auth = await this.authStore.resolveAuth({ forceRefresh });
+			const url = responsesUrlForAuth(auth, this.config.baseUrl);
+			const headers = buildCodexHeaders(auth, request, this.config);
+			yield* mapCodexResponseEvents(this.transport.stream({
+				url,
+				websocketUrl: codexWebSocketUrl(url),
+				headers,
+				body,
+				signal: request.cancel,
+				headerTimeoutMs: this.config.headerTimeoutMs,
+				websocketConnectTimeoutMs: this.config.websocketConnectTimeoutMs,
+				streamIdleTimeoutMs: this.config.streamIdleTimeoutMs || void 0
+			}));
+			return;
+		} catch (error) {
+			if (request.cancel.aborted) {
+				yield { type: "abort" };
+				return;
+			}
+			if (error instanceof CodexHttpError && error.status === 401 && !forceRefresh) {
+				forceRefresh = true;
+				continue;
+			}
+			if (error instanceof CodexHttpError && isRetryableHttpStatus(error.status) && retryAttempt < this.config.maxRetries) {
+				await sleep(this.config.retryBaseDelayMs * 2 ** retryAttempt, request.cancel);
+				retryAttempt += 1;
+				continue;
+			}
+			yield providerErrorFromUnknown(error);
+			return;
+		}
+	}
+};
+function createCodexProvider(options = {}) {
+	const id = options.id ?? "codex";
+	const displayName = options.displayName ?? "Codex";
+	const runtimeOptions = {
+		codexHome: options.codexHome,
+		baseUrl: options.baseUrl,
+		transport: options.transport,
+		headers: options.headers,
+		userAgent: options.userAgent,
+		maxRetries: options.maxRetries,
+		retryBaseDelayMs: options.retryBaseDelayMs,
+		headerTimeoutMs: options.headerTimeoutMs,
+		websocketConnectTimeoutMs: options.websocketConnectTimeoutMs,
+		streamIdleTimeoutMs: options.streamIdleTimeoutMs,
+		clientVersion: options.clientVersion
+	};
+	return defineProvider({
+		id,
+		displayName,
+		auth: { status: () => new FileCodexAuthStore({ codexHome: options.codexHome }).status() },
+		state: () => ({
+			status: "ready",
+			message: "Uses official Codex auth storage"
+		}),
+		listModels: async () => {
+			return applyModelPolicy(await listCodexModels(runtimeOptions), id, options.models);
+		},
+		createRuntime: () => new CodexProvider(runtimeOptions)
+	});
+}
+function buildCodexHeaders(auth, request, config) {
+	const headers = new Headers(config.headers);
+	if (auth.kind === "agentIdentity") headers.set("Authorization", auth.authorization);
+	else headers.set("Authorization", `Bearer ${auth.kind === "apiKey" ? auth.apiKey : auth.accessToken}`);
+	if (auth.kind !== "apiKey" && auth.accountId) headers.set("ChatGPT-Account-ID", auth.accountId);
+	if (auth.kind !== "apiKey" && "isFedrampAccount" in auth && auth.isFedrampAccount) headers.set("X-OpenAI-Fedramp", "true");
+	headers.set("User-Agent", config.userAgent ?? defaultUserAgent());
+	headers.set("OpenAI-Beta", "responses=experimental");
+	headers.set("accept", "text/event-stream");
+	headers.set("content-type", "application/json");
+	const sessionId = clampPromptCacheKey(request.sessionId);
+	headers.set("session-id", sessionId);
+	headers.set("thread-id", sessionId);
+	headers.set("x-client-request-id", request.requestId);
+	return headers;
+}
+function responsesUrlForAuth(auth, baseUrl) {
+	if (auth.kind === "apiKey") return openAiResponsesUrl(baseUrl ?? DEFAULT_OPENAI_BASE_URL);
+	return codexResponsesUrl(baseUrl ?? DEFAULT_CHATGPT_CODEX_BASE_URL);
+}
+function openAiResponsesUrl(baseUrl) {
+	const normalized = baseUrl.replace(/\/+$/, "");
+	return normalized.endsWith("/responses") ? normalized : `${normalized}/responses`;
+}
+function providerErrorFromUnknown(error) {
+	if (error instanceof CodexAuthError) return {
+		type: "error",
+		message: redactSecretText(error.message),
+		code: error.code
+	};
+	if (error instanceof CodexHttpError) return {
+		type: "error",
+		message: redactSecretText(error.message),
+		code: httpErrorCode(error.status, error.message)
+	};
+	return {
+		type: "error",
+		message: redactSecretText(error instanceof Error ? error.message : String(error)),
+		code: null
+	};
+}
+function isRetryableHttpStatus(status) {
+	return status === 408 || status === 409 || status === 425 || status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+function defaultUserAgent() {
+	return `demi-codex-provider/0.0.0 (${process.platform}; ${process.arch})`;
+}
+function sleep(ms, signal) {
+	if (signal.aborted) return Promise.reject(new DOMException("Aborted", "AbortError"));
+	return new Promise((resolve, reject) => {
+		const timeout = setTimeout(resolve, ms);
+		signal.addEventListener("abort", () => {
+			clearTimeout(timeout);
+			reject(new DOMException("Aborted", "AbortError"));
+		}, { once: true });
+	});
+}
+//#endregion
+export { codexAuthStatus, createCodexProvider, listCodexModels };