@dsh-cove/dsh-web-all 0.0.0-stage → 0.4.3

package/lib/types/host/services/codex-bridge/bridge.js

@@ -0,0 +1,321 @@
+/**
+ * dsh-api-proxy process management for the codex-bridge service domain.
+ *
+ * Spawns (or adopts) the standalone dsh-api-proxy node service, keeps its
+ * generated config.yaml in the proxy directory, and exposes health / models /
+ * accounts / verification probes. The client api key is minted once and
+ * persisted next to the config (0600), so it stays stable across restarts.
+ * All HTTP calls target 127.0.0.1 only.
+ *
+ * Ported verbatim from the pre-merge @dsh-cove/dsh-codex-bridge package
+ * (src/bridge.ts) into the dsh-web-all host services.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { exchangeDeviceCode, idTokenIdentity, pollDeviceCode, requestDeviceCode, writeCodexAuthFile, } from "./codex-auth.js";
+/** Where the proxy stores its runtime state; under $DSH_HOME by default. */
+function runtimeAuthDir() {
+    return join(process.env.DSH_HOME ?? join(process.env.HOME ?? '/root', '.dsh'), 'dsh-api-proxy');
+}
+export class ApiProxyBridge {
+    port;
+    host;
+    authFile;
+    baseURL;
+    proxyDir;
+    configuredKey;
+    child;
+    adopted = false;
+    lastError;
+    loginState = { phase: 'idle' };
+    loginAbort;
+    constructor(options) {
+        this.proxyDir = options.proxyDir;
+        this.host = options.host ?? '127.0.0.1';
+        this.port = options.port ?? 8317;
+        this.authFile = options.authFile ?? '~/.codex/auth.json';
+        this.configuredKey = options.apiKey;
+        this.baseURL = `http://${this.host}:${this.port}`;
+    }
+    keyFilePath() {
+        return join(this.proxyDir, '.api-key');
+    }
+    /**
+     * Stable client api key, resolved in order: configured value, the key an
+     * existing (adopted) service's config.yaml carries, the persisted key file,
+     * or a fresh mint.
+     */
+    apiKey() {
+        if (this.configuredKey)
+            return this.configuredKey;
+        const fromConfig = this.readKeyFromProxyConfig();
+        if (fromConfig)
+            return fromConfig;
+        const keyFile = this.keyFilePath();
+        if (existsSync(keyFile)) {
+            try {
+                const existing = readFileSync(keyFile, 'utf8').trim();
+                if (existing)
+                    return existing;
+            }
+            catch {
+                /* fall through to mint */
+            }
+        }
+        const key = `sk-${randomBytes(24).toString('hex')}`;
+        mkdirSync(this.proxyDir, { recursive: true });
+        writeFileSync(keyFile, `${key}\n`, { mode: 0o600 });
+        return key;
+    }
+    /** Extract the first api key from an existing dsh-api-proxy config.yaml. */
+    readKeyFromProxyConfig() {
+        const configPath = this.proxyConfigPath();
+        if (!existsSync(configPath))
+            return undefined;
+        try {
+            const text = readFileSync(configPath, 'utf8');
+            const match = text.match(/^\s*-\s+"(sk-[^"]+)"\s*$/m);
+            return match?.[1];
+        }
+        catch {
+            return undefined;
+        }
+    }
+    proxyConfigPath() {
+        return join(this.proxyDir, 'config.yaml');
+    }
+    /** Ensure the proxy config.yaml exists with our endpoint, the codex auth
+     *  file, and the stable api key. */
+    ensureConfig() {
+        mkdirSync(this.proxyDir, { recursive: true });
+        const key = this.apiKey();
+        const config = {
+            host: this.host,
+            port: this.port,
+            'auth-dir': runtimeAuthDir(),
+            'codex-auth-file': this.authFile,
+            'api-keys': [key],
+            'body-limit': '200mb',
+            timeouts: {
+                'messages-ms': 120000,
+                'stream-messages-ms': 600000,
+                'count-tokens-ms': 30000,
+            },
+            stats: { enabled: true },
+            debug: 'errors',
+        };
+        writeFileSync(this.proxyConfigPath(), toYaml(config), { mode: 0o600 });
+        return { key, configPath: this.proxyConfigPath() };
+    }
+    /** True when a service already answers on our endpoint (adopt mode). */
+    async detectExisting(signal) {
+        try {
+            const resp = await fetch(`${this.baseURL}/health`, { signal, headers: { Accept: 'application/json' } });
+            return resp.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Spawn the proxy service and wait for /health; adopt an existing one. */
+    async start() {
+        if (this.child)
+            return;
+        if (await this.detectExisting()) {
+            this.adopted = true;
+            return;
+        }
+        const { configPath } = this.ensureConfig();
+        const entry = join(this.proxyDir, 'dist', 'index.js');
+        if (!existsSync(entry)) {
+            throw new Error(`dsh-api-proxy build not found at ${entry}; run npm ci && npm run build in ${this.proxyDir}`);
+        }
+        this.adopted = false;
+        this.lastError = undefined;
+        this.child = spawn(process.execPath, [entry, `--config=${configPath}`], {
+            cwd: this.proxyDir,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        this.child.stdout?.on('data', () => { });
+        this.child.stderr?.on('data', (chunk) => {
+            const text = chunk.toString().trim();
+            if (text)
+                this.lastError = text;
+        });
+        this.child.on('exit', (code) => {
+            if (this.child) {
+                this.lastError = `proxy exited with code ${code}`;
+                this.child = undefined;
+            }
+        });
+        await this.waitForHealth(15_000);
+    }
+    async waitForHealth(timeoutMs) {
+        const startedAt = Date.now();
+        for (;;) {
+            if (await this.detectExisting())
+                return;
+            if (Date.now() - startedAt >= timeoutMs) {
+                throw new Error(this.lastError ?? 'proxy did not become healthy in time');
+            }
+            await new Promise((resolve) => setTimeout(resolve, 500));
+        }
+    }
+    /** Stop a child we spawned (adopted services are left alone). */
+    stop() {
+        if (!this.child)
+            return;
+        const child = this.child;
+        this.child = undefined;
+        child.kill('SIGTERM');
+    }
+    async restart() {
+        this.stop();
+        await new Promise((resolve) => setTimeout(resolve, 300));
+        await this.start();
+    }
+    /** Current device-login state. */
+    deviceLoginState() {
+        return this.loginState;
+    }
+    /**
+     * Start a device-code login: request the one-time code, surface it, then
+     * poll in the background, exchange and persist tokens on success. The
+     * returned grant is what the UI shows the user.
+     */
+    async startDeviceLogin(fetchImpl = fetch) {
+        if (this.loginState.phase === 'waiting') {
+            throw new Error('a device login is already in progress');
+        }
+        const grant = await requestDeviceCode(fetchImpl);
+        this.loginAbort = new AbortController();
+        this.loginState = { phase: 'waiting', grant };
+        void this.runDevicePoll(grant, this.loginAbort.signal, fetchImpl);
+        return grant;
+    }
+    async runDevicePoll(grant, signal, fetchImpl) {
+        try {
+            const success = await pollDeviceCode(grant.deviceAuthId, grant.userCode, grant.intervalSec, fetchImpl, undefined, signal);
+            if (!success) {
+                this.loginState = { ...this.loginState, phase: 'timeout' };
+                return;
+            }
+            const tokens = await exchangeDeviceCode(success.authorizationCode, success.codeVerifier, fetchImpl);
+            writeCodexAuthFile(this.authFile, tokens);
+            const identity = idTokenIdentity(tokens.idToken);
+            this.loginState = {
+                phase: 'success',
+                grant,
+                email: identity.email,
+            };
+            // Token file changed: force the proxy to reload (or start it).
+            await this.restart();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.loginState = {
+                ...this.loginState,
+                phase: error instanceof DOMException && error.name === 'AbortError' ? 'cancelled' : 'failed',
+                error: message,
+            };
+        }
+    }
+    cancelDeviceLogin() {
+        this.loginAbort?.abort();
+        this.loginState = { ...this.loginState, phase: 'cancelled' };
+    }
+    async authedFetch(path, init) {
+        return fetch(`${this.baseURL}${path}`, {
+            ...init,
+            headers: { Authorization: `Bearer ${this.apiKey()}`, ...(init?.headers ?? {}) },
+        });
+    }
+    async listModels() {
+        try {
+            const resp = await this.authedFetch('/v1/models');
+            if (!resp.ok)
+                return [];
+            const data = (await resp.json());
+            return (data.data ?? []).map((m) => m.id).filter((id) => id !== 'gpt-reserve');
+        }
+        catch {
+            return [];
+        }
+    }
+    async accounts() {
+        try {
+            const resp = await this.authedFetch('/admin/accounts');
+            if (!resp.ok)
+                return undefined;
+            const data = (await resp.json());
+            const account = data.providers?.codex?.accounts?.[0];
+            return account ? { email: account.email, planType: account.planType } : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Verify the whole chain end to end: models endpoint plus one minimal
+     * chat completion through the codex backend.
+     */
+    async verify(model) {
+        const models = await this.listModels();
+        if (models.length === 0)
+            return { ok: false, error: 'no models advertised' };
+        const target = model ?? models[0];
+        const resp = await this.authedFetch('/v1/chat/completions', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                model: target,
+                messages: [{ role: 'user', content: 'Reply with exactly: OK' }],
+                max_tokens: 16,
+            }),
+        });
+        if (!resp.ok) {
+            return { ok: false, model: target, error: `upstream ${resp.status}: ${(await resp.text()).slice(0, 200)}` };
+        }
+        const data = (await resp.json());
+        const reply = data.choices?.[0]?.message?.content;
+        return { ok: Boolean(reply), model: target, reply };
+    }
+    async status(auth) {
+        const running = Boolean(this.child) || (await this.detectExisting().catch(() => false));
+        const models = running ? await this.listModels() : [];
+        const account = running ? await this.accounts() : undefined;
+        return {
+            proxy: running ? 'running' : this.lastError ? 'failed' : 'stopped',
+            port: this.port,
+            baseURL: this.baseURL,
+            apiKeyConfigured: Boolean(this.apiKey()),
+            auth,
+            models,
+            accountEmail: account?.email,
+            accountPlan: account?.planType,
+            lastError: this.lastError,
+            adopted: this.adopted,
+        };
+    }
+}
+function toYaml(config) {
+    const lines = [];
+    lines.push(`host: "${config.host}"`);
+    lines.push(`port: ${config.port}`);
+    lines.push(`auth-dir: "${config['auth-dir']}"`);
+    if (config['codex-auth-file'])
+        lines.push(`codex-auth-file: "${config['codex-auth-file']}"`);
+    lines.push('api-keys:');
+    for (const key of config['api-keys'])
+        lines.push(`  - "${key}"`);
+    lines.push(`body-limit: "${config['body-limit']}"`);
+    lines.push('timeouts:');
+    for (const [k, v] of Object.entries(config.timeouts))
+        lines.push(`  ${k}: ${v}`);
+    lines.push('stats:');
+    lines.push(`  enabled: ${config.stats.enabled}`);
+    lines.push(`debug: "${config.debug}"`);
+    return `${lines.join('\n')}\n`;
+}

package/lib/types/host/services/codex-bridge/codex-auth.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Codex CLI auth primitives for the codex-bridge service domain.
+ *
+ * Pure logic, no cordis/DSH coupling: reading and checking the Codex CLI
+ * auth file (`~/.codex/auth.json`), the ChatGPT device-code login flow
+ * (usercode request, polling, PKCE token exchange), and atomic writes back
+ * into the auth file shape the official Codex CLI owns.
+ *
+ * Endpoints verified against openai/codex (codex-rs/login/src/device_code_auth.rs
+ * and server.rs): the device auth routes live under
+ * `{issuer}/api/accounts/deviceauth/*`, the token exchange is the standard
+ * `{issuer}/oauth/token` authorization-code grant with the device callback
+ * redirect URI.
+ *
+ * Ported verbatim from the pre-merge @dsh-cove/dsh-codex-bridge package
+ * (src/codex-auth.ts) into the dsh-web-all host services.
+ */
+export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/** Browser page where the user confirms the one-time code. */
+export declare const DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
+/** Overall device login budget (matches the Codex CLI's 15 minutes). */
+export declare const DEVICE_POLL_TIMEOUT_MS: number;
+/** Shape of the Codex CLI auth file (`~/.codex/auth.json`). */
+export interface CodexAuthFile {
+    auth_mode?: string;
+    OPENAI_API_KEY?: string | null;
+    tokens?: {
+        id_token?: string;
+        access_token?: string;
+        refresh_token?: string;
+        account_id?: string;
+    };
+    last_refresh?: string;
+}
+/** Result of a structural auth-file check. */
+export interface CodexAuthStatus {
+    /** auth.json exists and parses. */
+    present: boolean;
+    /** ChatGPT-mode tokens (access + refresh) are present. */
+    valid: boolean;
+    /** Whether the access token JWT is still within its `exp` window. */
+    expired?: boolean;
+    email?: string;
+    planType?: string;
+    accountId?: string;
+    reason?: string;
+}
+/** One step of the device-code login. */
+export interface DeviceCodeGrant {
+    deviceAuthId: string;
+    userCode: string;
+    intervalSec: number;
+    verificationUrl: string;
+}
+/** Poll result of the device-auth token endpoint. */
+export interface DeviceCodeSuccess {
+    authorizationCode: string;
+    codeChallenge: string;
+    codeVerifier: string;
+}
+/** Tokens returned by the authorization-code exchange. */
+export interface CodexTokens {
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+    expiresInSec?: number;
+}
+/** Base64url-decode a JWT payload without verifying the signature. */
+export declare function decodeJwtPayload(token: string): Record<string, unknown>;
+/** Identity claims (email / plan / account id) extracted from a ChatGPT id_token. */
+export declare function idTokenIdentity(idToken: string | undefined): {
+    email?: string;
+    planType?: string;
+    accountId?: string;
+};
+/** Read and structurally validate the Codex CLI auth file. */
+export declare function readCodexAuthFile(filePath: string): CodexAuthFile | null;
+/** Structural + expiry check of the auth file (no network). */
+export declare function checkCodexAuth(filePath: string): CodexAuthStatus;
+/** Request a one-time device code and the polling interval. */
+export declare function requestDeviceCode(fetchImpl?: typeof fetch, clientId?: string, issuer?: string): Promise<DeviceCodeGrant>;
+/**
+ * Poll the device-auth token endpoint until the user authorizes or the
+ * budget expires. Resolves to null on timeout.
+ */
+export declare function pollDeviceCode(deviceAuthId: string, userCode: string, intervalSec: number, fetchImpl?: typeof fetch, issuer?: string, signal?: AbortSignal, timeoutMs?: number): Promise<DeviceCodeSuccess | null>;
+/** Exchange the device authorization code for tokens (PKCE, form-urlencoded). */
+export declare function exchangeDeviceCode(code: string, codeVerifier: string, fetchImpl?: typeof fetch, clientId?: string, issuer?: string): Promise<CodexTokens>;
+/**
+ * Persist tokens into the Codex CLI auth.json shape, preserving unrelated
+ * fields and writing atomically (concurrent Codex CLI readers never see a
+ * partial file).
+ */
+export declare function writeCodexAuthFile(filePath: string, tokens: CodexTokens): void;
+/**
+ * Run the whole device-code login: request code, surface it, poll, exchange,
+ * persist. Returns null when the user never authorized within the budget.
+ */
+export declare function runDeviceCodeLogin(options: {
+    onCode: (grant: DeviceCodeGrant) => void;
+    authFile: string;
+    signal?: AbortSignal;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    tokens: CodexTokens;
+    email?: string;
+} | null>;
+//# sourceMappingURL=codex-auth.d.ts.map

package/lib/types/host/services/codex-bridge/codex-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/codex-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,eAAO,MAAM,eAAe,iCAAiC,CAAA;AAC7D,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,yCAA2B,CAAA;AAC/D,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,QAAiB,CAAA;AAKpD,+DAA+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,0DAA0D;IAC1D,KAAK,EAAE,OAAO,CAAA;IACd,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AASD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWvE;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAmBA;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CASxE;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAwBhE;AAED,+DAA+D;AAC/D,wBAAsB,iBAAiB,CACrC,SAAS,GAAE,OAAO,KAAa,EAC/B,QAAQ,SAAkB,EAC1B,MAAM,SAAS,GACd,OAAO,CAAC,eAAe,CAAC,CAyB1B;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,EAC/B,MAAM,SAAS,EACf,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,SAAyB,GACjC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAgCnC;AAED,iFAAiF;AACjF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,OAAO,KAAa,EAC/B,QAAQ,SAAkB,EAC1B,MAAM,SAAS,GACd,OAAO,CAAC,WAAW,CAAC,CA+BtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAClB,IAAI,CA2BN;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE;IACP,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAA;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoBzD"}

package/lib/types/host/services/codex-bridge/codex-auth.js

@@ -0,0 +1,241 @@
+/**
+ * Codex CLI auth primitives for the codex-bridge service domain.
+ *
+ * Pure logic, no cordis/DSH coupling: reading and checking the Codex CLI
+ * auth file (`~/.codex/auth.json`), the ChatGPT device-code login flow
+ * (usercode request, polling, PKCE token exchange), and atomic writes back
+ * into the auth file shape the official Codex CLI owns.
+ *
+ * Endpoints verified against openai/codex (codex-rs/login/src/device_code_auth.rs
+ * and server.rs): the device auth routes live under
+ * `{issuer}/api/accounts/deviceauth/*`, the token exchange is the standard
+ * `{issuer}/oauth/token` authorization-code grant with the device callback
+ * redirect URI.
+ *
+ * Ported verbatim from the pre-merge @dsh-cove/dsh-codex-bridge package
+ * (src/codex-auth.ts) into the dsh-web-all host services.
+ */
+const ISSUER = 'https://auth.openai.com';
+const TOKEN_URL = `${ISSUER}/oauth/token`;
+export const CODEX_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+/** Browser page where the user confirms the one-time code. */
+export const DEVICE_VERIFICATION_URL = `${ISSUER}/codex/device`;
+/** Overall device login budget (matches the Codex CLI's 15 minutes). */
+export const DEVICE_POLL_TIMEOUT_MS = 15 * 60 * 1000;
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+function expandHome(p) {
+    if (p.startsWith('~')) {
+        return `${process.env.HOME ?? '/root'}${p.slice(1)}`;
+    }
+    return p;
+}
+/** Base64url-decode a JWT payload without verifying the signature. */
+export function decodeJwtPayload(token) {
+    const part = token.split('.')[1];
+    if (!part)
+        return {};
+    const normalized = part.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');
+    const raw = Buffer.from(padded, 'base64').toString('utf8');
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+/** Identity claims (email / plan / account id) extracted from a ChatGPT id_token. */
+export function idTokenIdentity(idToken) {
+    if (!idToken)
+        return {};
+    const claims = decodeJwtPayload(idToken);
+    const auth = (claims['https://api.openai.com/auth'] ?? {});
+    return {
+        email: typeof claims.email === 'string' ? claims.email : undefined,
+        planType: typeof auth.chatgpt_plan_type === 'string'
+            ? auth.chatgpt_plan_type
+            : typeof claims.chatgpt_plan_type === 'string'
+                ? claims.chatgpt_plan_type
+                : undefined,
+        accountId: typeof auth.chatgpt_account_id === 'string'
+            ? auth.chatgpt_account_id
+            : typeof claims.chatgpt_account_id === 'string'
+                ? claims.chatgpt_account_id
+                : undefined,
+    };
+}
+/** Read and structurally validate the Codex CLI auth file. */
+export function readCodexAuthFile(filePath) {
+    const resolved = expandHome(filePath);
+    if (!existsSync(resolved))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(resolved, 'utf8'));
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+/** Structural + expiry check of the auth file (no network). */
+export function checkCodexAuth(filePath) {
+    const raw = readCodexAuthFile(filePath);
+    if (!raw)
+        return { present: false, valid: false, reason: 'missing' };
+    const tokens = raw.tokens;
+    if (!tokens?.access_token || !tokens?.refresh_token) {
+        return { present: true, valid: false, reason: 'incomplete-tokens' };
+    }
+    if (raw.auth_mode && raw.auth_mode !== 'chatgpt') {
+        return { present: true, valid: false, reason: `auth-mode:${raw.auth_mode}` };
+    }
+    const identity = idTokenIdentity(tokens.id_token);
+    let expired;
+    const claims = decodeJwtPayload(tokens.access_token);
+    if (typeof claims.exp === 'number') {
+        expired = claims.exp * 1000 <= Date.now();
+    }
+    return {
+        present: true,
+        valid: !expired,
+        expired,
+        email: identity.email,
+        planType: identity.planType,
+        accountId: identity.accountId,
+    };
+}
+/** Request a one-time device code and the polling interval. */
+export async function requestDeviceCode(fetchImpl = fetch, clientId = CODEX_CLIENT_ID, issuer = ISSUER) {
+    const resp = await fetchImpl(`${issuer}/api/accounts/deviceauth/usercode`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ client_id: clientId }),
+    });
+    if (!resp.ok) {
+        throw new Error(`device code request failed (${resp.status}): ${await resp.text()}`);
+    }
+    const data = (await resp.json());
+    if (!data.device_auth_id || !data.user_code) {
+        throw new Error('device code response missing device_auth_id or user_code');
+    }
+    const interval = Number(data.interval ?? 5);
+    return {
+        deviceAuthId: data.device_auth_id,
+        userCode: data.user_code,
+        intervalSec: Number.isFinite(interval) && interval > 0 ? interval : 5,
+        verificationUrl: `${issuer}/codex/device`,
+    };
+}
+/**
+ * Poll the device-auth token endpoint until the user authorizes or the
+ * budget expires. Resolves to null on timeout.
+ */
+export async function pollDeviceCode(deviceAuthId, userCode, intervalSec, fetchImpl = fetch, issuer = ISSUER, signal, timeoutMs = DEVICE_POLL_TIMEOUT_MS) {
+    const startedAt = Date.now();
+    for (;;) {
+        if (signal?.aborted)
+            throw new Error('device login cancelled');
+        const resp = await fetchImpl(`${issuer}/api/accounts/deviceauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),
+            signal,
+        });
+        if (resp.ok) {
+            const data = (await resp.json());
+            if (!data.authorization_code || !data.code_challenge || !data.code_verifier) {
+                throw new Error('device token response missing authorization fields');
+            }
+            return {
+                authorizationCode: data.authorization_code,
+                codeChallenge: data.code_challenge,
+                codeVerifier: data.code_verifier,
+            };
+        }
+        if (resp.status !== 403 && resp.status !== 404) {
+            throw new Error(`device auth failed (${resp.status}): ${await resp.text()}`);
+        }
+        if (Date.now() - startedAt >= timeoutMs)
+            return null;
+        const wait = Math.min(intervalSec * 1000, timeoutMs - (Date.now() - startedAt));
+        await new Promise((resolve) => setTimeout(resolve, wait));
+    }
+}
+/** Exchange the device authorization code for tokens (PKCE, form-urlencoded). */
+export async function exchangeDeviceCode(code, codeVerifier, fetchImpl = fetch, clientId = CODEX_CLIENT_ID, issuer = ISSUER) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: `${issuer}/deviceauth/callback`,
+        client_id: clientId,
+        code_verifier: codeVerifier,
+    });
+    const resp = await fetchImpl(`${issuer}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    });
+    if (!resp.ok) {
+        throw new Error(`device token exchange failed (${resp.status}): ${await resp.text()}`);
+    }
+    const data = (await resp.json());
+    if (!data.id_token || !data.access_token || !data.refresh_token) {
+        throw new Error('device token exchange response missing tokens');
+    }
+    return {
+        idToken: data.id_token,
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresInSec: data.expires_in,
+    };
+}
+/**
+ * Persist tokens into the Codex CLI auth.json shape, preserving unrelated
+ * fields and writing atomically (concurrent Codex CLI readers never see a
+ * partial file).
+ */
+export function writeCodexAuthFile(filePath, tokens) {
+    const resolved = expandHome(filePath);
+    let existing = {};
+    if (existsSync(resolved)) {
+        try {
+            existing = JSON.parse(readFileSync(resolved, 'utf8'));
+        }
+        catch {
+            existing = {};
+        }
+    }
+    const identity = idTokenIdentity(tokens.idToken);
+    const next = {
+        ...existing,
+        auth_mode: existing.auth_mode || 'chatgpt',
+        tokens: {
+            ...(existing.tokens ?? {}),
+            id_token: tokens.idToken,
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            account_id: identity.accountId ?? existing.tokens?.account_id,
+        },
+        last_refresh: new Date().toISOString(),
+    };
+    mkdirSync(dirname(resolved), { recursive: true, mode: 0o700 });
+    const tmp = `${resolved}.dsh-codex-bridge.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmp, resolved);
+}
+/**
+ * Run the whole device-code login: request code, surface it, poll, exchange,
+ * persist. Returns null when the user never authorized within the budget.
+ */
+export async function runDeviceCodeLogin(options) {
+    const grant = await requestDeviceCode(options.fetchImpl);
+    options.onCode(grant);
+    const success = await pollDeviceCode(grant.deviceAuthId, grant.userCode, grant.intervalSec, options.fetchImpl, ISSUER, options.signal);
+    if (!success)
+        return null;
+    const tokens = await exchangeDeviceCode(success.authorizationCode, success.codeVerifier, options.fetchImpl);
+    writeCodexAuthFile(options.authFile, tokens);
+    const identity = idTokenIdentity(tokens.idToken);
+    return { tokens, email: identity.email };
+}