@inhuman.tools/harness 0.0.0-stage → 0.2.0

package/dist/providers/auth/oidc.d.ts

@@ -0,0 +1,60 @@
+export declare const OIDC_REFRESH_SKEW_MS: number;
+export declare const OIDC_REFRESH_MS = 60000;
+/** Fail-backoff is `nowMs - refreshFailedAtMs`, not `setTimeout`. */
+export declare const OIDC_REFRESH_BACKOFF_MS = 30000;
+export type OidcProfile = {
+    readonly driver: string;
+    readonly clientId: string;
+    readonly authorizeUrl: string;
+    readonly tokenUrl: string;
+    readonly userinfoUrl: string;
+    readonly scope: string;
+    readonly extraAuthorize: Readonly<Record<string, string>>;
+    readonly loginHint: string;
+    readonly baseUrl: string;
+    /** Injected transport; defaults to global `fetch`. */
+    readonly fetch?: typeof fetch;
+};
+export type OidcPkce = {
+    readonly verifier: string;
+    readonly challenge: string;
+    readonly state: string;
+    readonly url: string;
+};
+export type OidcTokens = {
+    readonly apiKey: string;
+    readonly refreshToken: string;
+    readonly expiresAt: string;
+    readonly idToken?: string;
+    readonly accountId?: string;
+    readonly displayName?: string;
+    readonly email?: string;
+    readonly plan?: string;
+};
+export type OidcIdentity = {
+    readonly accountId?: string;
+    readonly displayName?: string;
+    readonly email?: string;
+    readonly plan?: string;
+};
+export declare function pkceChallenge(verifier: string): string;
+export declare function mintOidcPkce(profile: OidcProfile): OidcPkce;
+export declare function oidcFromVerifier(profile: OidcProfile, verifier: string, state: string): OidcPkce;
+export declare function exchangeOidcCode(profile: OidcProfile, code: string, verifier: string, redirectUri: string): Promise<OidcTokens>;
+export declare function refreshOidcToken(profile: OidcProfile, refreshToken: string): Promise<OidcTokens>;
+export declare function accessTokenExpiring(expiresAt: string | undefined, now?: number): boolean;
+export declare function secretsFromTokens(tokens: OidcTokens): Record<string, string>;
+export declare function identityFromClaims(claims: Record<string, unknown> | null): OidcIdentity;
+/** Later non-empty fields win. */
+export declare function mergeOidcIdentity(...parts: readonly OidcIdentity[]): OidcIdentity;
+export declare function secretsFromIdentity(identity: OidcIdentity): Record<string, string>;
+export declare function tokensFromGrantBody(rec: Record<string, unknown> | null, driver: string, fallbackRefresh?: string): OidcTokens;
+/** A token endpoint refusal. `code` is the OAuth `error` field when the body had one. */
+export declare class OidcGrantError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(message: string, status: number, code: string | undefined);
+}
+export declare function fetchOidcUserinfo(profile: Pick<OidcProfile, "driver" | "userinfoUrl">, accessToken: string): Promise<OidcIdentity>;
+export declare function jwtPayload(token: string | undefined): Record<string, unknown> | null;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/providers/auth/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/providers/auth/oidc.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAClD,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAKF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAI3D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAahG;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtG;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAa,GAAG,OAAO,CAK5F;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW5E;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,YAAY,CAqCvF;AAED,kCAAkC;AAClC,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,CAcjF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlF;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACnC,MAAM,EAAE,MAAM,EACd,eAAe,SAAK,GACnB,UAAU,CAoBZ;AAWD,yFAAyF;AACzF,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;gBAFjC,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS;CAKpC;AAoBD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,aAAa,CAAC,EACpD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAuBvB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAUpF"}

package/dist/providers/auth/oidc.js

@@ -0,0 +1,227 @@
+/**
+ * OAuth/OIDC authorization-code + PKCE and refresh. No OpenAI connection,
+ * no vendor roster. Tea injects redirect_uri after it binds the loopback.
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { postForm, wrapFetchFailure } from "./fetch.js";
+import { asExpiresIn, asNonEmpty, asPositiveInt, asRecord, parseJsonUnknown } from "./json.js";
+export const OIDC_REFRESH_SKEW_MS = 5 * 60 * 1000;
+export const OIDC_REFRESH_MS = 60_000;
+/** Fail-backoff is `nowMs - refreshFailedAtMs`, not `setTimeout`. */
+export const OIDC_REFRESH_BACKOFF_MS = 30_000;
+/** JWT claim namespace some issuers nest account fields under. */
+const NESTED_AUTH_CLAIMS = "https://api.openai.com/auth";
+export function pkceChallenge(verifier) {
+    return createHash("sha256").update(verifier).digest("base64url");
+}
+export function mintOidcPkce(profile) {
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(16).toString("base64url");
+    return oidcFromVerifier(profile, verifier, state);
+}
+export function oidcFromVerifier(profile, verifier, state) {
+    const challenge = pkceChallenge(verifier);
+    const url = new URL(profile.authorizeUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", profile.clientId);
+    url.searchParams.set("scope", profile.scope);
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", state);
+    for (const [key, value] of Object.entries(profile.extraAuthorize)) {
+        url.searchParams.set(key, value);
+    }
+    return { verifier, challenge, state, url: url.toString() };
+}
+export async function exchangeOidcCode(profile, code, verifier, redirectUri) {
+    return tokenGrant(profile, {
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: redirectUri,
+        client_id: profile.clientId,
+        code_verifier: verifier,
+    });
+}
+export async function refreshOidcToken(profile, refreshToken) {
+    return tokenGrant(profile, {
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: profile.clientId,
+    }, refreshToken);
+}
+export function accessTokenExpiring(expiresAt, now = Date.now()) {
+    if (expiresAt === undefined || expiresAt.trim() === "")
+        return false;
+    const at = Date.parse(expiresAt);
+    if (!Number.isFinite(at))
+        return false;
+    return at - now <= OIDC_REFRESH_SKEW_MS;
+}
+export function secretsFromTokens(tokens) {
+    return {
+        apiKey: tokens.apiKey,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt,
+        ...(tokens.idToken === undefined ? {} : { idToken: tokens.idToken }),
+        ...(tokens.accountId === undefined ? {} : { accountId: tokens.accountId }),
+        ...(tokens.displayName === undefined ? {} : { displayName: tokens.displayName }),
+        ...(tokens.email === undefined ? {} : { email: tokens.email }),
+        ...(tokens.plan === undefined ? {} : { plan: tokens.plan }),
+    };
+}
+export function identityFromClaims(claims) {
+    if (claims === null)
+        return {};
+    const auth = asRecord(claims[NESTED_AUTH_CLAIMS]);
+    const given = asNonEmpty(claims.given_name) ?? asNonEmpty(claims.first_name) ?? asNonEmpty(claims.firstName);
+    const family = asNonEmpty(claims.family_name) ?? asNonEmpty(claims.last_name) ?? asNonEmpty(claims.lastName);
+    const composed = given !== undefined && family !== undefined ? `${given} ${family}` : (given ?? family);
+    const email = asNonEmpty(claims.email) ?? asNonEmpty(auth?.email);
+    const displayName = asNonEmpty(claims.name) ??
+        asNonEmpty(claims.preferred_username) ??
+        asNonEmpty(claims.nickname) ??
+        asNonEmpty(claims.username) ??
+        asNonEmpty(claims.login) ??
+        asNonEmpty(claims.handle) ??
+        composed ??
+        email;
+    const plan = asNonEmpty(auth?.chatgpt_plan_type) ??
+        asNonEmpty(claims.chatgpt_plan_type) ??
+        asNonEmpty(claims.plan) ??
+        asNonEmpty(claims.subscription) ??
+        asNonEmpty(claims.subscription_tier) ??
+        asNonEmpty(claims.subscriptionTier) ??
+        asNonEmpty(claims.tier);
+    // `sub` is the OIDC subject, not a vendor account id.
+    const accountId = asNonEmpty(auth?.chatgpt_account_id) ??
+        asNonEmpty(claims.chatgpt_account_id) ??
+        asNonEmpty(claims.userId) ??
+        asNonEmpty(claims.user_id) ??
+        asNonEmpty(claims.account_id);
+    return {
+        ...(accountId === undefined ? {} : { accountId }),
+        ...(displayName === undefined ? {} : { displayName }),
+        ...(email === undefined ? {} : { email }),
+        ...(plan === undefined ? {} : { plan }),
+    };
+}
+/** Later non-empty fields win. */
+export function mergeOidcIdentity(...parts) {
+    const out = {};
+    for (const part of parts) {
+        if (part.accountId !== undefined && part.accountId !== "")
+            out.accountId = part.accountId;
+        if (part.displayName !== undefined && part.displayName !== "")
+            out.displayName = part.displayName;
+        if (part.email !== undefined && part.email !== "")
+            out.email = part.email;
+        if (part.plan !== undefined && part.plan !== "")
+            out.plan = part.plan;
+    }
+    return out;
+}
+export function secretsFromIdentity(identity) {
+    return {
+        ...(identity.accountId === undefined ? {} : { accountId: identity.accountId }),
+        ...(identity.displayName === undefined ? {} : { displayName: identity.displayName }),
+        ...(identity.email === undefined ? {} : { email: identity.email }),
+        ...(identity.plan === undefined ? {} : { plan: identity.plan }),
+    };
+}
+export function tokensFromGrantBody(rec, driver, fallbackRefresh = "") {
+    const apiKey = asNonEmpty(rec?.access_token);
+    const refreshToken = asNonEmpty(rec?.refresh_token) ?? asNonEmpty(fallbackRefresh);
+    if (apiKey === undefined)
+        throw new Error(`${driver} token exchange returned no access token`);
+    if (refreshToken === undefined)
+        throw new Error(`${driver} token exchange returned no refresh token`);
+    const idToken = asNonEmpty(rec?.id_token);
+    const user = asRecord(rec?.user);
+    const userId = asNonEmpty(user?.id);
+    return {
+        apiKey,
+        refreshToken,
+        expiresAt: expiresAtOf(rec?.expires_in, apiKey),
+        ...(idToken === undefined ? {} : { idToken }),
+        ...mergeOidcIdentity(identityFromClaims(jwtPayload(idToken) ?? jwtPayload(apiKey)), 
+        // Non-standard `user` object (WorkOS): `{id, email, first_name, ...}`.
+        identityFromClaims(user), userId === undefined ? {} : { accountId: userId }),
+    };
+}
+/** `expires_in` when sent, else the access token's JWT `exp`, else one hour. */
+function expiresAtOf(expiresIn, accessToken) {
+    if (asPositiveInt(expiresIn) === undefined) {
+        const exp = jwtPayload(accessToken)?.exp;
+        if (typeof exp === "number" && Number.isFinite(exp) && exp > 0)
+            return new Date(exp * 1000).toISOString();
+    }
+    return new Date(Date.now() + asExpiresIn(expiresIn) * 1000).toISOString();
+}
+/** A token endpoint refusal. `code` is the OAuth `error` field when the body had one. */
+export class OidcGrantError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "OidcGrantError";
+    }
+}
+async function tokenGrant(profile, body, fallbackRefresh = "") {
+    const response = await postForm(profile.tokenUrl, body, `${profile.driver} token`, profile.fetch);
+    if (!response.ok) {
+        let code;
+        try {
+            code = asNonEmpty(asRecord(await response.json())?.error);
+        }
+        catch {
+            /* no JSON body */
+        }
+        throw new OidcGrantError(`${profile.driver} token exchange failed (${response.status})`, response.status, code);
+    }
+    return tokensFromGrantBody(asRecord(await response.json()), profile.driver, fallbackRefresh);
+}
+export async function fetchOidcUserinfo(profile, accessToken) {
+    if (profile.userinfoUrl.length === 0)
+        return {};
+    let response;
+    try {
+        response = await fetch(profile.userinfoUrl, {
+            headers: {
+                accept: "application/json",
+                authorization: `Bearer ${accessToken}`,
+            },
+        });
+    }
+    catch (error) {
+        throw wrapFetchFailure(error, {
+            why: `${profile.driver} userinfo`,
+            method: "GET",
+            url: profile.userinfoUrl,
+        });
+    }
+    if (!response.ok)
+        return {};
+    try {
+        return identityFromClaims(asRecord(await response.json()));
+    }
+    catch {
+        return {};
+    }
+}
+export function jwtPayload(token) {
+    if (token === undefined || token.trim() === "")
+        return null;
+    const parts = token.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const json = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
+        return asRecord(parseJsonUnknown(json));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oidc.js.map

package/dist/providers/auth/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/providers/auth/oidc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAyC9C,kEAAkE;AAClE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAoB;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAoB,EAAE,QAAgB,EAAE,KAAa;IACpF,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoB,EACpB,IAAY,EACZ,QAAgB,EAChB,WAAmB;IAEnB,OAAO,UAAU,CAAC,OAAO,EAAE;QACzB,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAoB,EAAE,YAAoB;IAC/E,OAAO,UAAU,CACf,OAAO,EACP;QACE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC5B,EACD,YAAY,CACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAA6B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACjF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,EAAE,GAAG,GAAG,IAAI,oBAAoB,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAsC;IACvE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7G,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,WAAW,GACf,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QACvB,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACrC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3B,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3B,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;QACxB,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,QAAQ;QACR,KAAK,CAAC;IACR,MAAM,IAAI,GACR,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC;QACnC,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QACvB,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACnC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,sDAAsD;IACtD,MAAM,SAAS,GACb,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACrC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1B,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,iBAAiB,CAAC,GAAG,KAA8B;IACjE,MAAM,GAAG,GAKL,EAAE,CAAC;IACP,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;YAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1F,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAClG,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACxD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAmC,EACnC,MAAc,EACd,eAAe,GAAG,EAAE;IAEpB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,0CAA0C,CAAC,CAAC;IAC/F,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,2CAA2C,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO;QACL,MAAM;QACN,YAAY;QACZ,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,iBAAiB,CAClB,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7D,uEAAuE;QACvE,kBAAkB,CAAC,IAAI,CAAC,EACxB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAClD;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,SAAkB,EAAE,WAAmB;IAC1D,IAAI,aAAa,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED,yFAAyF;AACzF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAG5B;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,IAAwB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAoB;QAGjC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,KAAK,UAAU,UAAU,CACvB,OAAoB,EACpB,IAA4B,EAC5B,eAAe,GAAG,EAAE;IAEpB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAClG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,GAAG,OAAO,CAAC,MAAM,2BAA2B,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoD,EACpD,WAAmB;IAEnB,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;YAC1C,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,KAAK,EAAE;YAC5B,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,WAAW;YACjC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,OAAO,CAAC,WAAW;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/providers/chatgpt/connection.d.ts

@@ -0,0 +1,75 @@
+import { type OidcIdentity } from "../auth/index.js";
+import { OpenAiCompatDriverConnection, type AccountSnapshot, type CacheAffinity, type CacheFlavor } from "../openai-compat/index.js";
+type AdoptCallback = (kind: "UI", body: string) => Promise<Readonly<Record<string, unknown>>>;
+type DriverAdoptArgs = {
+    name?: string;
+    settings?: Record<string, unknown>;
+    signal?: AbortSignal;
+};
+type DriverAdoptBags = {
+    readonly name?: string;
+    readonly settings: Record<string, unknown>;
+    readonly secrets: Record<string, string>;
+};
+/** Unlocks the Codex catalog; older versions return `{ models: [] }`. */
+export declare const CHATGPT_CLIENT_VERSION = "1.0.0";
+export declare class ChatGptDriverConnection extends OpenAiCompatDriverConnection {
+    #private;
+    static oidcProfile: {
+        driver: string;
+        clientId: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        userinfoUrl: string;
+        scope: string;
+        extraAuthorize: {
+            originator: string;
+            id_token_add_organizations: string;
+            codex_cli_simplified_flow: string;
+        };
+        loginHint: string;
+        baseUrl: string;
+    };
+    static configurationLabel: string;
+    static offers: {
+        name: string;
+        description: string;
+        live: boolean;
+        adoptable: boolean;
+        settings: {
+            baseUrl: string;
+        };
+    }[];
+    static adopt(this: typeof ChatGptDriverConnection, args: DriverAdoptArgs, callback: AdoptCallback): Promise<DriverAdoptBags>;
+    accessor state: {
+        identity: OidcIdentity | undefined;
+        catalogName: string;
+        account: AccountSnapshot | undefined;
+        keyMask: string;
+        auth: "needs-auth" | undefined;
+        models: string[];
+        windows: Record<string, number>;
+    };
+    get expiring(): boolean;
+    get needsAuth(): boolean;
+    get fresh(): boolean;
+    bootstrap(): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+    protected refreshGrant(): Promise<void>;
+    protected reportLive(): void;
+    protected modelsRequestUrl(): string;
+    completionRequestUrl(): string;
+    completionApi(): "responses";
+    protected authHeaders(): Record<string, string>;
+    cacheFlavor(): CacheFlavor;
+    /** `session-id` / `thread-id` headers plus body `prompt_cache_key`. */
+    cacheAffinity(sessionId: string, _model: string): CacheAffinity;
+    protected accountPolls(): boolean;
+    /**
+     * 5h + weekly remaining. Codex `/status` reads the same path.
+     * GET `https://chatgpt.com/backend-api/wham/usage`
+     */
+    protected loadAccount(): Promise<AccountSnapshot | undefined>;
+}
+export {};
+//# sourceMappingURL=connection.d.ts.map

package/dist/providers/chatgpt/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/providers/chatgpt/connection.ts"],"names":[],"mappings":"AASA,OAAO,EAYL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAGL,4BAA4B,EAE5B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAE9F,KAAK,eAAe,GAAG;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,CAAC;AASF,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAE9C,qBAAa,uBAAwB,SAAQ,4BAA4B;;IACvE,MAAM,CAAC,WAAW;;;;;;;;;;;;;;MAchB;IACF,OAAgB,kBAAkB,SAAa;IAC/C,MAAM,CAAC,MAAM;;;;;;;;QAQX;WAEoB,KAAK,CACzB,IAAI,EAAE,OAAO,uBAAuB,EACpC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,eAAe,CAAC;IAuB3B,SAAsC,KAAK;kBAElB,YAAY,GAAG,SAAS;;;;;;;MAC/C;IAEF,IACa,QAAQ,IAAI,OAAO,CAG/B;IAED,IACa,SAAS,IAAI,OAAO,CAMhC;IAED,IACa,KAAK,IAAI,OAAO,CAG5B;IAEc,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAgE1B,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;cAM5B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;cAgBnC,UAAU,IAAI,IAAI;cAgBlB,gBAAgB,IAAI,MAAM;IAIpC,oBAAoB,IAAI,MAAM;IAI9B,aAAa,IACb,WAAW;cAGD,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAS/C,WAAW,IAAI,WAAW;IAInC,uEAAuE;IAC9D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa;cAIrD,YAAY,IAAI,OAAO;IAI1C;;;OAGG;cACsB,WAAW,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;CAkB7E"}