@fractaal/pi-ai 0.85.4 → 0.86.1

package/dist/auth/oauth/load.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAa7C,KAAK,gBAAgB,GAAG;IACvB,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,WAAW,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,GAAG,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACvF,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED,eAAO,MAAM,kBAAkB,0BAG9B,CAAC;AAEF,eAAO,MAAM,oBAAoB,0BAGhC,CAAC;AAEF,eAAO,MAAM,sBAAsB,0BAGlC,CAAC;AAEF,eAAO,MAAM,mBAAmB,0BAG/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,0BAG/B,CAAC;AAEF,eAAO,MAAM,YAAY,0BAGxB,CAAC;AAEF,eAAO,MAAM,eAAe;;;wBAO3B,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiCodex: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\topenrouter: () => OAuthAuth | Promise<OAuthAuth>;\n\tkimiCoding: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadOpenAICodexOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiCodex();\n\treturn ((await importOAuthModule(\"./openai-codex.ts\")) as { openaiCodexOAuth: OAuthAuth }).openaiCodexOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadOpenRouterOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openrouter();\n\treturn ((await importOAuthModule(\"./openrouter.ts\")) as { openRouterOAuth: OAuthAuth }).openRouterOAuth;\n};\n\nexport const loadKimiCodingOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.kimiCoding();\n\treturn ((await importOAuthModule(\"./kimi-coding.ts\")) as { kimiCodingOAuth: OAuthAuth }).kimiCodingOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAa7C,KAAK,gBAAgB,GAAG;IACvB,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,WAAW,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,GAAG,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACvF,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,SAAS,CAG5D,CAAC;AAEF,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,SAAS,CAG9D,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,SAAS,CAGhE,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,SAAS,CAGhE,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,aAAa,QAAa,OAAO,CAAC,SAAS,CAGvD,CAAC;AAEF,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,SAAS,CAGtD,CAAC;AAEF,eAAO,MAAM,eAAe,YAAmB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,SAAS,CAOnG,CAAC"}

package/dist/auth/oauth/load.js

@@ -31,6 +31,11 @@ export const loadOpenAICodexOAuth = async () => {
         return bundledLoaders.openaiCodex();
     return (await importOAuthModule("./openai-codex.ts")).openaiCodexOAuth;
 };
+export const loadOpenAIChatGPTOAuth = async () => {
+    if (bundledLoaders)
+        return bundledLoaders.openaiChatGPT();
+    return (await importOAuthModule("./openai-chatgpt.ts")).openaiChatGPTOAuth;
+};
 export const loadGitHubCopilotOAuth = async () => {
     if (bundledLoaders)
         return bundledLoaders.githubCopilot();
@@ -46,6 +51,11 @@ export const loadKimiCodingOAuth = async () => {
         return bundledLoaders.kimiCoding();
     return (await importOAuthModule("./kimi-coding.ts")).kimiCodingOAuth;
 };
+export const loadMetaOAuth = async () => {
+    if (bundledLoaders)
+        return bundledLoaders.meta();
+    return (await importOAuthModule("./meta.ts")).metaOAuth;
+};
 export const loadXaiOAuth = async () => {
     if (bundledLoaders)
         return bundledLoaders.xai();

package/dist/auth/oauth/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE,CAAC;IAClE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AAAA,CAChC,CAAC;AAYF,IAAI,cAA4C,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAAC,OAAyB,EAAQ;IAChF,cAAc,GAAG,OAAO,CAAC;AAAA,CACzB;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAwB,EAAE,CAAC;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,SAAS,EAAE,CAAC;IACtD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAmC,CAAC,cAAc,CAAC;AAAA,CACrG,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAwB,EAAE,CAAC;IACnE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,WAAW,EAAE,CAAC;IACxD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAqC,CAAC,gBAAgB,CAAC;AAAA,CAC5G,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AAAA,CAClH,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE,CAAC;IAClE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAoC,CAAC,eAAe,CAAC;AAAA,CACxG,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE,CAAC;IAClE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAoC,CAAC,eAAe,CAAC;AAAA,CACzG,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE,CAAC;IAC3D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC;IAChD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAA6B,CAAC,QAAQ,CAAC;AAAA,CACnF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAA0C,EAAsB,EAAE,CAAC;IACxG,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,OACC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAGvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAAA,CAC7B,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiCodex: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\topenrouter: () => OAuthAuth | Promise<OAuthAuth>;\n\tkimiCoding: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadOpenAICodexOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiCodex();\n\treturn ((await importOAuthModule(\"./openai-codex.ts\")) as { openaiCodexOAuth: OAuthAuth }).openaiCodexOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadOpenRouterOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openrouter();\n\treturn ((await importOAuthModule(\"./openrouter.ts\")) as { openRouterOAuth: OAuthAuth }).openRouterOAuth;\n};\n\nexport const loadKimiCodingOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.kimiCoding();\n\treturn ((await importOAuthModule(\"./kimi-coding.ts\")) as { kimiCodingOAuth: OAuthAuth }).kimiCodingOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE;IACjE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AACjC,CAAC,CAAC;AAcF,IAAI,cAA4C,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAAC,OAAyB;IACxE,cAAc,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAwB,EAAE;IAChE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,SAAS,EAAE,CAAC;IACtD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAmC,CAAC,cAAc,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAwB,EAAE;IAClE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,WAAW,EAAE,CAAC;IACxD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAqC,CAAC,gBAAgB,CAAC;AAC7G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE;IACpE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE;IACpE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAoC,CAAC,eAAe,CAAC;AACzG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAoC,CAAC,eAAe,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,IAAwB,EAAE;IAC3D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAA8B,CAAC,SAAS,CAAC;AACvF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE;IAC1D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC;IAChD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAA6B,CAAC,QAAQ,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAA0C,EAAsB,EAAE;IACvG,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,OACC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAGvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiCodex: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiChatGPT: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\topenrouter: () => OAuthAuth | Promise<OAuthAuth>;\n\tkimiCoding: () => OAuthAuth | Promise<OAuthAuth>;\n\tmeta: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadOpenAICodexOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiCodex();\n\treturn ((await importOAuthModule(\"./openai-codex.ts\")) as { openaiCodexOAuth: OAuthAuth }).openaiCodexOAuth;\n};\n\nexport const loadOpenAIChatGPTOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiChatGPT();\n\treturn ((await importOAuthModule(\"./openai-chatgpt.ts\")) as { openaiChatGPTOAuth: OAuthAuth }).openaiChatGPTOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadOpenRouterOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openrouter();\n\treturn ((await importOAuthModule(\"./openrouter.ts\")) as { openRouterOAuth: OAuthAuth }).openRouterOAuth;\n};\n\nexport const loadKimiCodingOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.kimiCoding();\n\treturn ((await importOAuthModule(\"./kimi-coding.ts\")) as { kimiCodingOAuth: OAuthAuth }).kimiCodingOAuth;\n};\n\nexport const loadMetaOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.meta();\n\treturn ((await importOAuthModule(\"./meta.ts\")) as { metaOAuth: OAuthAuth }).metaOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}

package/dist/auth/oauth/meta.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Meta Model API OAuth flow
+ *
+ * RFC 8628 device authorization grant against https://auth.meta.com (JSON
+ * responses). Meta splits identity from API access: the resulting identity
+ * token is not accepted for inference, so it is exchanged for a Model API
+ * key via the Muse Code key-mint endpoint (minted keys live about a day).
+ * The identity token is stored as `refresh` and the minted key as `access`,
+ * so the standard OAuth scheduler re-mints the key when it expires with no
+ * bespoke renewal machinery. The identity token itself is not renewable
+ * (auth.meta.com answers grant_type=refresh_token with 404 and issues no
+ * refresh_token), so a 401/403 from mint means the session is dead and the
+ * user must sign in again.
+ */
+import type { OAuthAuth } from "../types.ts";
+export declare const metaOAuth: OAuthAuth;
+//# sourceMappingURL=meta.d.ts.map

package/dist/auth/oauth/meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAA4C,MAAM,aAAa,CAAC;AAoLvF,eAAO,MAAM,SAAS,EAAE,SAYvB,CAAC"}

package/dist/auth/oauth/meta.js

@@ -0,0 +1,190 @@
+/**
+ * Meta Model API OAuth flow
+ *
+ * RFC 8628 device authorization grant against https://auth.meta.com (JSON
+ * responses). Meta splits identity from API access: the resulting identity
+ * token is not accepted for inference, so it is exchanged for a Model API
+ * key via the Muse Code key-mint endpoint (minted keys live about a day).
+ * The identity token is stored as `refresh` and the minted key as `access`,
+ * so the standard OAuth scheduler re-mints the key when it expires with no
+ * bespoke renewal machinery. The identity token itself is not renewable
+ * (auth.meta.com answers grant_type=refresh_token with 404 and issues no
+ * refresh_token), so a 401/403 from mint means the session is dead and the
+ * user must sign in again.
+ */
+import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+// Muse Code CLI client id.
+const CLIENT_ID = "1031625952748946";
+const AUTH_HOST = "https://auth.meta.com";
+const DEVICE_AUTHORIZATION_URL = `${AUTH_HOST}/oidc/device/authorization/`;
+const DEVICE_TOKEN_URL = `${AUTH_HOST}/oidc/device/token/`;
+const API_KEY_MINT_URL = "https://api.meta.ai/muse-code/key";
+const API_KEY_LIFETIME_MS = 24 * 60 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 30 * 1000;
+function requestSignal(signal) {
+    return AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);
+}
+async function readJson(response) {
+    try {
+        const json = await response.json();
+        return json && typeof json === "object" ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+function errorDetail(json) {
+    for (const key of ["error_description", "detail", "message", "error"]) {
+        const value = json?.[key];
+        if (typeof value === "string" && value.trim())
+            return `: ${value.trim()}`;
+    }
+    return "";
+}
+/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */
+function trustedHttpUrl(value) {
+    if (typeof value !== "string" || !value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" && url.protocol !== "http:")
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+function positiveNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
+async function startDeviceAuthorization(signal) {
+    const response = await fetch(DEVICE_AUTHORIZATION_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams({ client_id: CLIENT_ID }).toString(),
+        signal: requestSignal(signal),
+    });
+    const json = await readJson(response);
+    if (!response.ok) {
+        throw new Error(`Meta device authorization failed with status ${response.status}${errorDetail(json)}`);
+    }
+    const deviceCode = json?.device_code;
+    const userCode = json?.user_code;
+    const verificationUri = trustedHttpUrl(json?.verification_uri_complete) ?? trustedHttpUrl(json?.verification_uri);
+    if (typeof deviceCode !== "string" || !deviceCode || typeof userCode !== "string" || !userCode || !verificationUri) {
+        throw new Error(`Invalid Meta device authorization response: ${JSON.stringify(json)}`);
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        intervalSeconds: positiveNumber(json?.interval),
+        expiresInSeconds: positiveNumber(json?.expires_in),
+    };
+}
+async function pollForIdentityToken(device, signal) {
+    return pollOAuthDeviceCodeFlow({
+        intervalSeconds: device.intervalSeconds,
+        expiresInSeconds: device.expiresInSeconds,
+        waitBeforeFirstPoll: true,
+        signal,
+        poll: async () => {
+            const response = await fetch(DEVICE_TOKEN_URL, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                },
+                body: new URLSearchParams({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: device.deviceCode,
+                    client_id: CLIENT_ID,
+                }).toString(),
+                signal: requestSignal(signal),
+            });
+            const json = await readJson(response);
+            if (response.ok && typeof json?.access_token === "string" && json.access_token) {
+                return { status: "complete", value: json.access_token };
+            }
+            switch (json?.error) {
+                case "authorization_pending":
+                    return { status: "pending" };
+                case "slow_down":
+                    return { status: "slow_down", intervalSeconds: positiveNumber(json?.interval) };
+                case "access_denied":
+                    return { status: "failed", message: "Meta login was denied." };
+                case "expired_token":
+                    return { status: "failed", message: "Meta device authorization expired. Please restart login." };
+                default:
+                    return {
+                        status: "failed",
+                        message: `Meta device token request failed with status ${response.status}${errorDetail(json)}`,
+                    };
+            }
+        },
+    });
+}
+/** Exchange an identity token for a Model API key. Keys are valid for about a day. */
+async function mintApiKey(identityToken, signal) {
+    const response = await fetch(API_KEY_MINT_URL, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${identityToken}`,
+            "Content-Type": "application/json",
+            "x-api-version": "1.0.0",
+        },
+        body: "{}",
+        signal: requestSignal(signal),
+    });
+    const json = await readJson(response);
+    if (response.status === 401 || response.status === 403) {
+        // Identity token is not renewable (see file header); only a fresh device flow helps.
+        throw new Error(`Meta session expired (status ${response.status}). Run \`/login meta\` to sign in again.${errorDetail(json)}`);
+    }
+    if (!response.ok) {
+        throw new Error(`Meta API key mint failed with status ${response.status}${errorDetail(json)}`);
+    }
+    const apiKey = json?.api_key;
+    if (typeof apiKey !== "string" || !apiKey) {
+        const actionUrl = trustedHttpUrl(json?.action_url);
+        throw new Error(`Meta did not issue an API key.${actionUrl ? ` Complete setup at ${actionUrl}` : ""}`);
+    }
+    return { type: "oauth", refresh: identityToken, access: apiKey, expires: Date.now() + API_KEY_LIFETIME_MS };
+}
+async function loginMeta(interaction) {
+    try {
+        const device = await startDeviceAuthorization(interaction.signal);
+        interaction.notify({
+            type: "device_code",
+            userCode: device.userCode,
+            verificationUri: device.verificationUri,
+            intervalSeconds: device.intervalSeconds,
+            expiresInSeconds: device.expiresInSeconds,
+        });
+        const identityToken = await pollForIdentityToken(device, interaction.signal);
+        interaction.notify({ type: "progress", message: "Enabling Meta Model API access..." });
+        return await mintApiKey(identityToken, interaction.signal);
+    }
+    catch (e) {
+        // An in-flight fetch rejects with a DOMException on abort; the login UI matches on this message.
+        if (interaction.signal.aborted)
+            throw new Error("Login cancelled");
+        throw e;
+    }
+}
+export const metaOAuth = {
+    name: "Meta (Muse subscription)",
+    isSubscription: true,
+    loginLabel: "Sign in with Meta",
+    login: loginMeta,
+    refresh: (credential, signal) => mintApiKey(credential.refresh, signal),
+    async toAuth(credential) {
+        return { apiKey: credential.access };
+    },
+};
+//# sourceMappingURL=meta.js.map

package/dist/auth/oauth/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/auth/oauth/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,2BAA2B;AAC3B,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,wBAAwB,GAAG,GAAG,SAAS,6BAA6B,CAAC;AAC3E,MAAM,gBAAgB,GAAG,GAAG,SAAS,qBAAqB,CAAC;AAC3D,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAC7D,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAUrC,SAAS,aAAa,CAAC,MAAmB;IACzC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAAoC;IACxD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAmB;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9D,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,WAAW,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;IACjC,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAClH,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACN,UAAU;QACV,QAAQ;QACR,eAAe;QACf,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC/C,gBAAgB,EAAE,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC;KAClD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAA2B,EAAE,MAAmB;IACnF,OAAO,uBAAuB,CAAS;QACtC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACzB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,SAAS,EAAE,SAAS;iBACpB,CAAC,CAAC,QAAQ,EAAE;gBACb,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACzD,CAAC;YACD,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC;gBACrB,KAAK,uBAAuB;oBAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,KAAK,WAAW;oBACf,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACjF,KAAK,eAAe;oBACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;gBAChE,KAAK,eAAe;oBACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC;gBAClG;oBACC,OAAO;wBACN,MAAM,EAAE,QAAQ;wBAChB,OAAO,EAAE,gDAAgD,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE;qBAC9F,CAAC;YACJ,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,UAAU,CAAC,aAAqB,EAAE,MAAmB;IACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,aAAa,EAAE;YACxC,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,OAAO;SACxB;QACD,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxD,qFAAqF;QACrF,MAAM,IAAI,KAAK,CACd,gCAAgC,QAAQ,CAAC,MAAM,2CAA2C,WAAW,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,CAAC,CAAC,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,WAAoC;IAC5D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClE,WAAW,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SACzC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7E,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,UAAU,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,iGAAiG;QACjG,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,CAAC,CAAC;IACT,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAc;IACnC,IAAI,EAAE,0BAA0B;IAChC,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,mBAAmB;IAE/B,KAAK,EAAE,SAAS;IAEhB,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;IAEvE,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;CACD,CAAC","sourcesContent":["/**\n * Meta Model API OAuth flow\n *\n * RFC 8628 device authorization grant against https://auth.meta.com (JSON\n * responses). Meta splits identity from API access: the resulting identity\n * token is not accepted for inference, so it is exchanged for a Model API\n * key via the Muse Code key-mint endpoint (minted keys live about a day).\n * The identity token is stored as `refresh` and the minted key as `access`,\n * so the standard OAuth scheduler re-mints the key when it expires with no\n * bespoke renewal machinery. The identity token itself is not renewable\n * (auth.meta.com answers grant_type=refresh_token with 404 and issues no\n * refresh_token), so a 401/403 from mint means the session is dead and the\n * user must sign in again.\n */\n\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\n\n// Muse Code CLI client id.\nconst CLIENT_ID = \"1031625952748946\";\nconst AUTH_HOST = \"https://auth.meta.com\";\nconst DEVICE_AUTHORIZATION_URL = `${AUTH_HOST}/oidc/device/authorization/`;\nconst DEVICE_TOKEN_URL = `${AUTH_HOST}/oidc/device/token/`;\nconst API_KEY_MINT_URL = \"https://api.meta.ai/muse-code/key\";\nconst API_KEY_LIFETIME_MS = 24 * 60 * 60 * 1000;\nconst REQUEST_TIMEOUT_MS = 30 * 1000;\n\ntype DeviceAuthorization = {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tintervalSeconds?: number;\n\texpiresInSeconds?: number;\n};\n\nfunction requestSignal(signal: AbortSignal): AbortSignal {\n\treturn AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);\n}\n\nasync function readJson(response: Response): Promise<Record<string, unknown> | null> {\n\ttry {\n\t\tconst json = await response.json();\n\t\treturn json && typeof json === \"object\" ? (json as Record<string, unknown>) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction errorDetail(json: Record<string, unknown> | null): string {\n\tfor (const key of [\"error_description\", \"detail\", \"message\", \"error\"]) {\n\t\tconst value = json?.[key];\n\t\tif (typeof value === \"string\" && value.trim()) return `: ${value.trim()}`;\n\t}\n\treturn \"\";\n}\n\n/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */\nfunction trustedHttpUrl(value: unknown): string | null {\n\tif (typeof value !== \"string\" || !value) return null;\n\ttry {\n\t\tconst url = new URL(value);\n\t\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") return null;\n\t\treturn url.href;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction positiveNumber(value: unknown): number | undefined {\n\treturn typeof value === \"number\" && Number.isFinite(value) && value > 0 ? value : undefined;\n}\n\nasync function startDeviceAuthorization(signal: AbortSignal): Promise<DeviceAuthorization> {\n\tconst response = await fetch(DEVICE_AUTHORIZATION_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\tAccept: \"application/json\",\n\t\t},\n\t\tbody: new URLSearchParams({ client_id: CLIENT_ID }).toString(),\n\t\tsignal: requestSignal(signal),\n\t});\n\tconst json = await readJson(response);\n\tif (!response.ok) {\n\t\tthrow new Error(`Meta device authorization failed with status ${response.status}${errorDetail(json)}`);\n\t}\n\tconst deviceCode = json?.device_code;\n\tconst userCode = json?.user_code;\n\tconst verificationUri = trustedHttpUrl(json?.verification_uri_complete) ?? trustedHttpUrl(json?.verification_uri);\n\tif (typeof deviceCode !== \"string\" || !deviceCode || typeof userCode !== \"string\" || !userCode || !verificationUri) {\n\t\tthrow new Error(`Invalid Meta device authorization response: ${JSON.stringify(json)}`);\n\t}\n\treturn {\n\t\tdeviceCode,\n\t\tuserCode,\n\t\tverificationUri,\n\t\tintervalSeconds: positiveNumber(json?.interval),\n\t\texpiresInSeconds: positiveNumber(json?.expires_in),\n\t};\n}\n\nasync function pollForIdentityToken(device: DeviceAuthorization, signal: AbortSignal): Promise<string> {\n\treturn pollOAuthDeviceCodeFlow<string>({\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst response = await fetch(DEVICE_TOKEN_URL, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t\tdevice_code: device.deviceCode,\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t}).toString(),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\t\t\tconst json = await readJson(response);\n\t\t\tif (response.ok && typeof json?.access_token === \"string\" && json.access_token) {\n\t\t\t\treturn { status: \"complete\", value: json.access_token };\n\t\t\t}\n\t\t\tswitch (json?.error) {\n\t\t\t\tcase \"authorization_pending\":\n\t\t\t\t\treturn { status: \"pending\" };\n\t\t\t\tcase \"slow_down\":\n\t\t\t\t\treturn { status: \"slow_down\", intervalSeconds: positiveNumber(json?.interval) };\n\t\t\t\tcase \"access_denied\":\n\t\t\t\t\treturn { status: \"failed\", message: \"Meta login was denied.\" };\n\t\t\t\tcase \"expired_token\":\n\t\t\t\t\treturn { status: \"failed\", message: \"Meta device authorization expired. Please restart login.\" };\n\t\t\t\tdefault:\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"failed\",\n\t\t\t\t\t\tmessage: `Meta device token request failed with status ${response.status}${errorDetail(json)}`,\n\t\t\t\t\t};\n\t\t\t}\n\t\t},\n\t});\n}\n\n/** Exchange an identity token for a Model API key. Keys are valid for about a day. */\nasync function mintApiKey(identityToken: string, signal: AbortSignal): Promise<OAuthCredential> {\n\tconst response = await fetch(API_KEY_MINT_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\tAccept: \"application/json\",\n\t\t\tAuthorization: `Bearer ${identityToken}`,\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\"x-api-version\": \"1.0.0\",\n\t\t},\n\t\tbody: \"{}\",\n\t\tsignal: requestSignal(signal),\n\t});\n\tconst json = await readJson(response);\n\tif (response.status === 401 || response.status === 403) {\n\t\t// Identity token is not renewable (see file header); only a fresh device flow helps.\n\t\tthrow new Error(\n\t\t\t`Meta session expired (status ${response.status}). Run \\`/login meta\\` to sign in again.${errorDetail(json)}`,\n\t\t);\n\t}\n\tif (!response.ok) {\n\t\tthrow new Error(`Meta API key mint failed with status ${response.status}${errorDetail(json)}`);\n\t}\n\tconst apiKey = json?.api_key;\n\tif (typeof apiKey !== \"string\" || !apiKey) {\n\t\tconst actionUrl = trustedHttpUrl(json?.action_url);\n\t\tthrow new Error(`Meta did not issue an API key.${actionUrl ? ` Complete setup at ${actionUrl}` : \"\"}`);\n\t}\n\treturn { type: \"oauth\", refresh: identityToken, access: apiKey, expires: Date.now() + API_KEY_LIFETIME_MS };\n}\n\nasync function loginMeta(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\ttry {\n\t\tconst device = await startDeviceAuthorization(interaction.signal);\n\t\tinteraction.notify({\n\t\t\ttype: \"device_code\",\n\t\t\tuserCode: device.userCode,\n\t\t\tverificationUri: device.verificationUri,\n\t\t\tintervalSeconds: device.intervalSeconds,\n\t\t\texpiresInSeconds: device.expiresInSeconds,\n\t\t});\n\t\tconst identityToken = await pollForIdentityToken(device, interaction.signal);\n\t\tinteraction.notify({ type: \"progress\", message: \"Enabling Meta Model API access...\" });\n\t\treturn await mintApiKey(identityToken, interaction.signal);\n\t} catch (e) {\n\t\t// An in-flight fetch rejects with a DOMException on abort; the login UI matches on this message.\n\t\tif (interaction.signal.aborted) throw new Error(\"Login cancelled\");\n\t\tthrow e;\n\t}\n}\n\nexport const metaOAuth: OAuthAuth = {\n\tname: \"Meta (Muse subscription)\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with Meta\",\n\n\tlogin: loginMeta,\n\n\trefresh: (credential, signal) => mintApiKey(credential.refresh, signal),\n\n\tasync toAuth(credential) {\n\t\treturn { apiKey: credential.access };\n\t},\n};\n"]}

package/dist/auth/oauth/openai-chatgpt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OpenAI Responses API token sharing through Sign in with ChatGPT.
+ *
+ * This public-client flow uses no client secret and sends the resulting user
+ * access token directly to api.openai.com.
+ */
+import type { OAuthAuth } from "../types.ts";
+export declare const openaiChatGPTOAuth: OAuthAuth;
+//# sourceMappingURL=openai-chatgpt.d.ts.map

package/dist/auth/oauth/openai-chatgpt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-chatgpt.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/openai-chatgpt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAgB,SAAS,EAA4C,MAAM,aAAa,CAAC;AAgSrG,eAAO,MAAM,kBAAkB,EAAE,SAShC,CAAC"}

package/dist/auth/oauth/openai-chatgpt.js

@@ -0,0 +1,263 @@
+/**
+ * OpenAI Responses API token sharing through Sign in with ChatGPT.
+ *
+ * This public-client flow uses no client secret and sends the resulting user
+ * access token directly to api.openai.com.
+ */
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { oauthErrorHtml, oauthSuccessHtml } from "../../utils/oauth-page.js";
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+import { generatePKCE } from "./pkce.js";
+// every login registers a new client with this ID; OpenAI returns the issued client ID in the callback
+const DYNAMIC_CLIENT_ID = "dynamic_agent_client";
+const AGENT_NAME_HINT = "Pi";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const AUTHORIZE_URL = "https://auth.openai.com/api/accounts/authorize";
+const TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+const RESOURCE = "https://api.openai.com/v1";
+const CALLBACK_HOST = getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const DIRECT_TOKEN_SCOPE = "chatgpt.tokens.use.direct";
+const SCOPE = `openid profile email offline_access resource.invoke ${DIRECT_TOKEN_SCOPE}`;
+// Refresh this long before the real expiry so a request never starts with a token about to expire.
+const EXPIRY_MARGIN_MS = 3 * 60 * 1000;
+function randomValue() {
+    return randomBytes(32).toString("base64url");
+}
+function authorizationResultFromCallback(url, expectedState) {
+    const code = url.searchParams.get("code");
+    if (!code)
+        throw new Error("Missing authorization code");
+    const state = url.searchParams.get("state");
+    if (!state)
+        throw new Error("Missing OAuth state");
+    if (state !== expectedState)
+        throw new Error("OAuth state mismatch");
+    const clientId = url.searchParams.get("client_id")?.trim();
+    if (!clientId)
+        throw new Error("OpenAI OAuth registration callback did not contain an issued client ID");
+    return { code, clientId };
+}
+function authorizationResultFromManualInput(input, expectedState) {
+    let url;
+    try {
+        url = new URL(input.trim());
+    }
+    catch {
+        throw new Error("Paste the full callback URL from the browser");
+    }
+    const expected = new URL(REDIRECT_URI);
+    if (url.origin !== expected.origin || url.pathname !== expected.pathname) {
+        throw new Error(`The pasted callback URL must start with ${REDIRECT_URI}`);
+    }
+    const error = url.searchParams.get("error");
+    if (error)
+        throw new Error(`ChatGPT authorization failed: ${error}`);
+    return authorizationResultFromCallback(url, expectedState);
+}
+function sendHtml(response, status, body) {
+    response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(body);
+}
+function startCallbackServer(expectedState) {
+    return new Promise((resolve, reject) => {
+        let resolveResult;
+        let rejectResult;
+        const result = new Promise((resolveAuthorization, rejectAuthorization) => {
+            resolveResult = resolveAuthorization;
+            rejectResult = rejectAuthorization;
+        });
+        const server = createServer((request, response) => {
+            try {
+                const url = new URL(request.url || "", REDIRECT_URI);
+                if (url.pathname !== CALLBACK_PATH) {
+                    sendHtml(response, 404, oauthErrorHtml("Callback route not found."));
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                if (error) {
+                    sendHtml(response, 400, oauthErrorHtml("ChatGPT was not connected.", `Error: ${error}`));
+                    rejectResult(new Error(`ChatGPT authorization failed: ${error}`));
+                    return;
+                }
+                let authorizationResult;
+                try {
+                    authorizationResult = authorizationResultFromCallback(url, expectedState);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : "Invalid callback";
+                    sendHtml(response, 400, oauthErrorHtml(message));
+                    return;
+                }
+                sendHtml(response, 200, oauthSuccessHtml("ChatGPT authentication completed. You can close this window."));
+                resolveResult(authorizationResult);
+            }
+            catch {
+                sendHtml(response, 500, oauthErrorHtml("Internal error while processing the callback."));
+            }
+        });
+        server.once("error", reject);
+        server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+            server.removeListener("error", reject);
+            server.on("error", rejectResult);
+            resolve({ server, result });
+        });
+    });
+}
+async function requestToken(body, signal) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/x-www-form-urlencoded",
+        },
+        body,
+        signal,
+    });
+    if (!response.ok) {
+        const responseBody = await response.text().catch(() => "");
+        throw new Error(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`);
+    }
+    const data = await response.json();
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+        throw new Error("OpenAI OAuth token response must be an object");
+    }
+    return data;
+}
+function requireTokenString(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`OpenAI OAuth token response has invalid ${field}`);
+    }
+    return value;
+}
+function credentialFromTokenResponse(token, clientId) {
+    const access = requireTokenString(token.access_token, "access_token");
+    const refresh = requireTokenString(token.refresh_token, "refresh_token");
+    const scope = requireTokenString(token.scope, "scope");
+    if (typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0) {
+        throw new Error("OpenAI OAuth token response has invalid expires_in");
+    }
+    const scopes = scope.trim().split(/\s+/).filter(Boolean);
+    if (!scopes.includes(DIRECT_TOKEN_SCOPE)) {
+        throw new Error(`OpenAI OAuth grant did not include ${DIRECT_TOKEN_SCOPE}`);
+    }
+    return {
+        type: "oauth",
+        access,
+        refresh,
+        expires: Date.now() + token.expires_in * 1000 - EXPIRY_MARGIN_MS,
+        clientId,
+        scopes,
+    };
+}
+async function exchangeAuthorizationCode(code, verifier, clientId, signal) {
+    const token = await requestToken(new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: clientId,
+        code,
+        code_verifier: verifier,
+        redirect_uri: REDIRECT_URI,
+        resource: RESOURCE,
+    }), signal);
+    // Pi does not use the ID token to identify the user or read profile data.
+    // Keep the presence check as part of the token-response contract.
+    if (typeof token.id_token !== "string" || token.id_token.trim().length === 0) {
+        throw new Error("OpenAI OAuth token response did not contain an ID token");
+    }
+    return credentialFromTokenResponse(token, clientId);
+}
+async function refreshAccessToken(credential, signal) {
+    const clientId = credential.clientId;
+    if (typeof clientId !== "string" || clientId.trim().length === 0) {
+        throw new Error("Stored OpenAI OAuth credential does not contain an issued client ID; reconnect ChatGPT");
+    }
+    const token = await requestToken(new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: clientId,
+        refresh_token: credential.refresh,
+        resource: RESOURCE,
+    }), signal);
+    return credentialFromTokenResponse(token, clientId);
+}
+/** OpenAI identifies each installation ("agent host") by a stable URI such as `urn:uuid:<uuid>`. */
+function agentHostId(deviceId) {
+    if (!deviceId || !UUID_PATTERN.test(deviceId)) {
+        throw new Error("Sign in with ChatGPT requires a device ID (UUID) for this installation");
+    }
+    return `urn:uuid:${deviceId.toLowerCase()}`;
+}
+async function loginOpenAIChatGPT(interaction, options) {
+    const hostId = agentHostId(options?.getDeviceId?.());
+    const { verifier, challenge } = await generatePKCE();
+    const state = randomValue();
+    const nonce = randomValue();
+    // Without this server, the browser's callback would reach whatever else holds the port (another
+    // pending login or the Codex CLI), which rejects it as a state mismatch. Fail with a clear error instead.
+    const callback = await startCallbackServer(state).catch((error) => {
+        if (!(error instanceof Error && "code" in error && error.code === "EADDRINUSE"))
+            throw error;
+        throw new Error(`Port ${CALLBACK_PORT} is in use, probably by an unfinished login in another pi session or by the Codex CLI. Cancel that login and try again.`);
+    });
+    const authorizationUrl = new URL(AUTHORIZE_URL);
+    authorizationUrl.search = new URLSearchParams({
+        client_id: DYNAMIC_CLIENT_ID,
+        agent_name_hint: AGENT_NAME_HINT,
+        ext_agent_host_id: hostId,
+        response_type: "code",
+        redirect_uri: REDIRECT_URI,
+        resource: RESOURCE,
+        scope: SCOPE,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        nonce,
+    }).toString();
+    interaction.notify({
+        type: "auth_url",
+        url: authorizationUrl.toString(),
+        instructions: "Complete sign-in in your browser. If the callback does not complete, paste the final redirect URL here.",
+    });
+    const manualAbort = new AbortController();
+    const manualCode = interaction
+        .prompt({
+        type: "manual_code",
+        message: "Complete login in your browser, or paste the final redirect URL here:",
+        placeholder: REDIRECT_URI,
+        signal: AbortSignal.any([manualAbort.signal, interaction.signal]),
+    })
+        .then((input) => authorizationResultFromManualInput(input, state));
+    try {
+        const result = await Promise.race([callback.result, manualCode]);
+        interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
+        return await exchangeAuthorizationCode(result.code, verifier, result.clientId, interaction.signal);
+    }
+    catch (error) {
+        if (interaction.signal.aborted)
+            throw new Error("Login cancelled");
+        throw error;
+    }
+    finally {
+        manualAbort.abort();
+        callback.server.close();
+        // close() only stops accepting new connections. Browsers open spare connections ahead of
+        // time, and one that has not sent a request yet stays open and attached to this server.
+        // A later login in the same process starts a new server with a new state, but the browser
+        // may send that login's callback over the spare connection. This server would then handle
+        // it and reject it with "OAuth state mismatch", and the new login would never see it.
+        callback.server.closeAllConnections();
+    }
+}
+export const openaiChatGPTOAuth = {
+    name: "OpenAI (ChatGPT subscription)",
+    isSubscription: true,
+    loginLabel: "Sign in with ChatGPT",
+    login: loginOpenAIChatGPT,
+    refresh: refreshAccessToken,
+    async toAuth(credential) {
+        return { apiKey: credential.access };
+    },
+};
+//# sourceMappingURL=openai-chatgpt.js.map

package/dist/auth/oauth/openai-chatgpt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-chatgpt.js","sourceRoot":"","sources":["../../../src/auth/oauth/openai-chatgpt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAoC,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,uGAAuG;AACvG,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,YAAY,GAAG,iEAAiE,CAAC;AACvF,MAAM,aAAa,GAAG,gDAAgD,CAAC;AACvE,MAAM,SAAS,GAAG,kDAAkD,CAAC;AACrE,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C,MAAM,aAAa,GAAG,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,WAAW,CAAC;AACnF,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,YAAY,GAAG,oBAAoB,aAAa,GAAG,aAAa,EAAE,CAAC;AACzE,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,KAAK,GAAG,uDAAuD,kBAAkB,EAAE,CAAC;AAC1F,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAoBvC,SAAS,WAAW;IACnB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,+BAA+B,CAAC,GAAQ,EAAE,aAAqB;IACvE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IACzG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,kCAAkC,CAAC,KAAa,EAAE,aAAqB;IAC/E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,2CAA2C,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;IACrE,OAAO,+BAA+B,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAY;IACvE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC3E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,aAAqB;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAqC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,OAAO,CAAsB,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,EAAE;YAC7F,aAAa,GAAG,oBAAoB,CAAC;YACrC,YAAY,GAAG,mBAAmB,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACjD,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;gBACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;oBACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,2BAA2B,CAAC,CAAC,CAAC;oBACrE,OAAO;gBACR,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,KAAK,EAAE,CAAC;oBACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,4BAA4B,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC;oBACzF,YAAY,CAAC,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC,CAAC;oBAClE,OAAO;gBACR,CAAC;gBAED,IAAI,mBAAwC,CAAC;gBAC7C,IAAI,CAAC;oBACJ,mBAAmB,GAAG,+BAA+B,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBAC3E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBAC5E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;oBACjD,OAAO;gBACR,CAAC;gBAED,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,8DAA8D,CAAC,CAAC,CAAC;gBAC1G,aAAa,CAAC,mBAAmB,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACR,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,+CAA+C,CAAC,CAAC,CAAC;YAC1F,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACjC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAqB,EAAE,MAAmB;IACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACnD;QACD,IAAI;QACJ,MAAM;KACN,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,MAAM,YAAY,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,IAAqB,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAiD;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAoB,EAAE,QAAgB;IAC1E,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,kBAAkB,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM;QACN,OAAO;QACP,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,GAAG,gBAAgB;QAChE,QAAQ;QACR,MAAM;KACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACvC,IAAY,EACZ,QAAgB,EAChB,QAAgB,EAChB,MAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,YAAY,CAC/B,IAAI,eAAe,CAAC;QACnB,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,QAAQ;QACnB,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,QAAQ;KAClB,CAAC,EACF,MAAM,CACN,CAAC;IACF,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAA2B,EAAE,MAAmB;IACjF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAC/B,IAAI,eAAe,CAAC;QACnB,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,UAAU,CAAC,OAAO;QACjC,QAAQ,EAAE,QAAQ;KAClB,CAAC,EACF,MAAM,CACN,CAAC;IACF,OAAO,2BAA2B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,QAA4B;IAChD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,YAAY,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,WAAoC,EACpC,OAAsB;IAEtB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,gGAAgG;IAChG,0GAA0G;IAC1G,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1E,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;YAAE,MAAM,KAAK,CAAC;QAC7F,MAAM,IAAI,KAAK,CACd,QAAQ,aAAa,yHAAyH,CAC9I,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,gBAAgB,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QAC7C,SAAS,EAAE,iBAAiB;QAC5B,eAAe,EAAE,eAAe;QAChC,iBAAiB,EAAE,MAAM;QACzB,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,KAAK;QACZ,KAAK;QACL,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,KAAK;KACL,CAAC,CAAC,QAAQ,EAAE,CAAC;IACd,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QAChC,YAAY,EACX,yGAAyG;KAC1G,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,WAAW;SAC5B,MAAM,CAAC;QACP,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,uEAAuE;QAChF,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;KACjE,CAAC;SACD,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kCAAkC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpE,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACjE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;QACjG,OAAO,MAAM,yBAAyB,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACb,CAAC;YAAS,CAAC;QACV,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,yFAAyF;QACzF,wFAAwF;QACxF,0FAA0F;QAC1F,0FAA0F;QAC1F,sFAAsF;QACtF,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;IACvC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC5C,IAAI,EAAE,+BAA+B;IACrC,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,sBAAsB;IAClC,KAAK,EAAE,kBAAkB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;CACD,CAAC","sourcesContent":["/**\n * OpenAI Responses API token sharing through Sign in with ChatGPT.\n *\n * This public-client flow uses no client secret and sends the resulting user\n * access token directly to api.openai.com.\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { createServer, type Server, type ServerResponse } from \"node:http\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"../../utils/oauth-page.ts\";\nimport { getProviderEnvValue } from \"../../utils/provider-env.ts\";\nimport type { LoginOptions, OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { generatePKCE } from \"./pkce.ts\";\n\n// every login registers a new client with this ID; OpenAI returns the issued client ID in the callback\nconst DYNAMIC_CLIENT_ID = \"dynamic_agent_client\";\nconst AGENT_NAME_HINT = \"Pi\";\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst AUTHORIZE_URL = \"https://auth.openai.com/api/accounts/authorize\";\nconst TOKEN_URL = \"https://auth.openai.com/api/accounts/oauth/token\";\nconst RESOURCE = \"https://api.openai.com/v1\";\nconst CALLBACK_HOST = getProviderEnvValue(\"PI_OAUTH_CALLBACK_HOST\") || \"127.0.0.1\";\nconst CALLBACK_PORT = 1455;\nconst CALLBACK_PATH = \"/auth/callback\";\nconst REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;\nconst DIRECT_TOKEN_SCOPE = \"chatgpt.tokens.use.direct\";\nconst SCOPE = `openid profile email offline_access resource.invoke ${DIRECT_TOKEN_SCOPE}`;\n// Refresh this long before the real expiry so a request never starts with a token about to expire.\nconst EXPIRY_MARGIN_MS = 3 * 60 * 1000;\n\ntype AuthorizationResult = {\n\tcode: string;\n\tclientId: string;\n};\n\ntype CallbackServer = {\n\tserver: Server;\n\tresult: Promise<AuthorizationResult>;\n};\n\ntype TokenResponse = {\n\taccess_token?: unknown;\n\trefresh_token?: unknown;\n\texpires_in?: unknown;\n\tid_token?: unknown;\n\tscope?: unknown;\n};\n\nfunction randomValue(): string {\n\treturn randomBytes(32).toString(\"base64url\");\n}\n\nfunction authorizationResultFromCallback(url: URL, expectedState: string): AuthorizationResult {\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) throw new Error(\"Missing authorization code\");\n\tconst state = url.searchParams.get(\"state\");\n\tif (!state) throw new Error(\"Missing OAuth state\");\n\tif (state !== expectedState) throw new Error(\"OAuth state mismatch\");\n\tconst clientId = url.searchParams.get(\"client_id\")?.trim();\n\tif (!clientId) throw new Error(\"OpenAI OAuth registration callback did not contain an issued client ID\");\n\treturn { code, clientId };\n}\n\nfunction authorizationResultFromManualInput(input: string, expectedState: string): AuthorizationResult {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(input.trim());\n\t} catch {\n\t\tthrow new Error(\"Paste the full callback URL from the browser\");\n\t}\n\tconst expected = new URL(REDIRECT_URI);\n\tif (url.origin !== expected.origin || url.pathname !== expected.pathname) {\n\t\tthrow new Error(`The pasted callback URL must start with ${REDIRECT_URI}`);\n\t}\n\tconst error = url.searchParams.get(\"error\");\n\tif (error) throw new Error(`ChatGPT authorization failed: ${error}`);\n\treturn authorizationResultFromCallback(url, expectedState);\n}\n\nfunction sendHtml(response: ServerResponse, status: number, body: string): void {\n\tresponse.writeHead(status, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\tresponse.end(body);\n}\n\nfunction startCallbackServer(expectedState: string): Promise<CallbackServer> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resolveResult!: (result: AuthorizationResult) => void;\n\t\tlet rejectResult!: (error: Error) => void;\n\t\tconst result = new Promise<AuthorizationResult>((resolveAuthorization, rejectAuthorization) => {\n\t\t\tresolveResult = resolveAuthorization;\n\t\t\trejectResult = rejectAuthorization;\n\t\t});\n\n\t\tconst server = createServer((request, response) => {\n\t\t\ttry {\n\t\t\t\tconst url = new URL(request.url || \"\", REDIRECT_URI);\n\t\t\t\tif (url.pathname !== CALLBACK_PATH) {\n\t\t\t\t\tsendHtml(response, 404, oauthErrorHtml(\"Callback route not found.\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tconst error = url.searchParams.get(\"error\");\n\t\t\t\tif (error) {\n\t\t\t\t\tsendHtml(response, 400, oauthErrorHtml(\"ChatGPT was not connected.\", `Error: ${error}`));\n\t\t\t\t\trejectResult(new Error(`ChatGPT authorization failed: ${error}`));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tlet authorizationResult: AuthorizationResult;\n\t\t\t\ttry {\n\t\t\t\t\tauthorizationResult = authorizationResultFromCallback(url, expectedState);\n\t\t\t\t} catch (error) {\n\t\t\t\t\tconst message = error instanceof Error ? error.message : \"Invalid callback\";\n\t\t\t\t\tsendHtml(response, 400, oauthErrorHtml(message));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tsendHtml(response, 200, oauthSuccessHtml(\"ChatGPT authentication completed. You can close this window.\"));\n\t\t\t\tresolveResult(authorizationResult);\n\t\t\t} catch {\n\t\t\t\tsendHtml(response, 500, oauthErrorHtml(\"Internal error while processing the callback.\"));\n\t\t\t}\n\t\t});\n\n\t\tserver.once(\"error\", reject);\n\t\tserver.listen(CALLBACK_PORT, CALLBACK_HOST, () => {\n\t\t\tserver.removeListener(\"error\", reject);\n\t\t\tserver.on(\"error\", rejectResult);\n\t\t\tresolve({ server, result });\n\t\t});\n\t});\n}\n\nasync function requestToken(body: URLSearchParams, signal: AbortSignal): Promise<TokenResponse> {\n\tconst response = await fetch(TOKEN_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\taccept: \"application/json\",\n\t\t\t\"content-type\": \"application/x-www-form-urlencoded\",\n\t\t},\n\t\tbody,\n\t\tsignal,\n\t});\n\tif (!response.ok) {\n\t\tconst responseBody = await response.text().catch(() => \"\");\n\t\tthrow new Error(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`);\n\t}\n\tconst data: unknown = await response.json();\n\tif (typeof data !== \"object\" || data === null || Array.isArray(data)) {\n\t\tthrow new Error(\"OpenAI OAuth token response must be an object\");\n\t}\n\treturn data as TokenResponse;\n}\n\nfunction requireTokenString(value: unknown, field: \"access_token\" | \"refresh_token\" | \"scope\"): string {\n\tif (typeof value !== \"string\" || value.trim().length === 0) {\n\t\tthrow new Error(`OpenAI OAuth token response has invalid ${field}`);\n\t}\n\treturn value;\n}\n\nfunction credentialFromTokenResponse(token: TokenResponse, clientId: string): OAuthCredential {\n\tconst access = requireTokenString(token.access_token, \"access_token\");\n\tconst refresh = requireTokenString(token.refresh_token, \"refresh_token\");\n\tconst scope = requireTokenString(token.scope, \"scope\");\n\tif (typeof token.expires_in !== \"number\" || !Number.isFinite(token.expires_in) || token.expires_in <= 0) {\n\t\tthrow new Error(\"OpenAI OAuth token response has invalid expires_in\");\n\t}\n\tconst scopes = scope.trim().split(/\\s+/).filter(Boolean);\n\tif (!scopes.includes(DIRECT_TOKEN_SCOPE)) {\n\t\tthrow new Error(`OpenAI OAuth grant did not include ${DIRECT_TOKEN_SCOPE}`);\n\t}\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess,\n\t\trefresh,\n\t\texpires: Date.now() + token.expires_in * 1000 - EXPIRY_MARGIN_MS,\n\t\tclientId,\n\t\tscopes,\n\t};\n}\n\nasync function exchangeAuthorizationCode(\n\tcode: string,\n\tverifier: string,\n\tclientId: string,\n\tsignal: AbortSignal,\n): Promise<OAuthCredential> {\n\tconst token = await requestToken(\n\t\tnew URLSearchParams({\n\t\t\tgrant_type: \"authorization_code\",\n\t\t\tclient_id: clientId,\n\t\t\tcode,\n\t\t\tcode_verifier: verifier,\n\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\tresource: RESOURCE,\n\t\t}),\n\t\tsignal,\n\t);\n\t// Pi does not use the ID token to identify the user or read profile data.\n\t// Keep the presence check as part of the token-response contract.\n\tif (typeof token.id_token !== \"string\" || token.id_token.trim().length === 0) {\n\t\tthrow new Error(\"OpenAI OAuth token response did not contain an ID token\");\n\t}\n\treturn credentialFromTokenResponse(token, clientId);\n}\n\nasync function refreshAccessToken(credential: OAuthCredential, signal: AbortSignal): Promise<OAuthCredential> {\n\tconst clientId = credential.clientId;\n\tif (typeof clientId !== \"string\" || clientId.trim().length === 0) {\n\t\tthrow new Error(\"Stored OpenAI OAuth credential does not contain an issued client ID; reconnect ChatGPT\");\n\t}\n\tconst token = await requestToken(\n\t\tnew URLSearchParams({\n\t\t\tgrant_type: \"refresh_token\",\n\t\t\tclient_id: clientId,\n\t\t\trefresh_token: credential.refresh,\n\t\t\tresource: RESOURCE,\n\t\t}),\n\t\tsignal,\n\t);\n\treturn credentialFromTokenResponse(token, clientId);\n}\n\n/** OpenAI identifies each installation (\"agent host\") by a stable URI such as `urn:uuid:<uuid>`. */\nfunction agentHostId(deviceId: string | undefined): string {\n\tif (!deviceId || !UUID_PATTERN.test(deviceId)) {\n\t\tthrow new Error(\"Sign in with ChatGPT requires a device ID (UUID) for this installation\");\n\t}\n\treturn `urn:uuid:${deviceId.toLowerCase()}`;\n}\n\nasync function loginOpenAIChatGPT(\n\tinteraction: ProviderAuthInteraction,\n\toptions?: LoginOptions,\n): Promise<OAuthCredential> {\n\tconst hostId = agentHostId(options?.getDeviceId?.());\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst state = randomValue();\n\tconst nonce = randomValue();\n\t// Without this server, the browser's callback would reach whatever else holds the port (another\n\t// pending login or the Codex CLI), which rejects it as a state mismatch. Fail with a clear error instead.\n\tconst callback = await startCallbackServer(state).catch((error: unknown) => {\n\t\tif (!(error instanceof Error && \"code\" in error && error.code === \"EADDRINUSE\")) throw error;\n\t\tthrow new Error(\n\t\t\t`Port ${CALLBACK_PORT} is in use, probably by an unfinished login in another pi session or by the Codex CLI. Cancel that login and try again.`,\n\t\t);\n\t});\n\n\tconst authorizationUrl = new URL(AUTHORIZE_URL);\n\tauthorizationUrl.search = new URLSearchParams({\n\t\tclient_id: DYNAMIC_CLIENT_ID,\n\t\tagent_name_hint: AGENT_NAME_HINT,\n\t\text_agent_host_id: hostId,\n\t\tresponse_type: \"code\",\n\t\tredirect_uri: REDIRECT_URI,\n\t\tresource: RESOURCE,\n\t\tscope: SCOPE,\n\t\tstate,\n\t\tcode_challenge: challenge,\n\t\tcode_challenge_method: \"S256\",\n\t\tnonce,\n\t}).toString();\n\tinteraction.notify({\n\t\ttype: \"auth_url\",\n\t\turl: authorizationUrl.toString(),\n\t\tinstructions:\n\t\t\t\"Complete sign-in in your browser. If the callback does not complete, paste the final redirect URL here.\",\n\t});\n\n\tconst manualAbort = new AbortController();\n\tconst manualCode = interaction\n\t\t.prompt({\n\t\t\ttype: \"manual_code\",\n\t\t\tmessage: \"Complete login in your browser, or paste the final redirect URL here:\",\n\t\t\tplaceholder: REDIRECT_URI,\n\t\t\tsignal: AbortSignal.any([manualAbort.signal, interaction.signal]),\n\t\t})\n\t\t.then((input) => authorizationResultFromManualInput(input, state));\n\n\ttry {\n\t\tconst result = await Promise.race([callback.result, manualCode]);\n\t\tinteraction.notify({ type: \"progress\", message: \"Exchanging authorization code for tokens...\" });\n\t\treturn await exchangeAuthorizationCode(result.code, verifier, result.clientId, interaction.signal);\n\t} catch (error) {\n\t\tif (interaction.signal.aborted) throw new Error(\"Login cancelled\");\n\t\tthrow error;\n\t} finally {\n\t\tmanualAbort.abort();\n\t\tcallback.server.close();\n\t\t// close() only stops accepting new connections. Browsers open spare connections ahead of\n\t\t// time, and one that has not sent a request yet stays open and attached to this server.\n\t\t// A later login in the same process starts a new server with a new state, but the browser\n\t\t// may send that login's callback over the spare connection. This server would then handle\n\t\t// it and reject it with \"OAuth state mismatch\", and the new login would never see it.\n\t\tcallback.server.closeAllConnections();\n\t}\n}\n\nexport const openaiChatGPTOAuth: OAuthAuth = {\n\tname: \"OpenAI (ChatGPT subscription)\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with ChatGPT\",\n\tlogin: loginOpenAIChatGPT,\n\trefresh: refreshAccessToken,\n\tasync toAuth(credential) {\n\t\treturn { apiKey: credential.access };\n\t},\n};\n"]}