@jeffusion/bungee-core 5.10.0 → 5.12.0

package/dist/plugins/chatgpt-oauth/control.js

@@ -1,6 +1,512 @@
 // @bun
+// packages/core/src/plugin-services/host-rpc.ts
+import { AsyncLocalStorage } from "async_hooks";
+
+// packages/core/src/plugin-services/wire-contract.ts
+import { isProxy } from "util/types";
+var RPC_JSON_MAX_BYTES = 64 * 1024;
+var RPC_CONTRACT_MAX_BYTES = 256 * 1024;
+var JSON_MAX_DEPTH = 64;
+var SCHEMA_MAX_DEPTH = 64;
+var RPC_MAX_TIMEOUT_MS = 300000;
+var RPC_MAX_METHODS = 128;
+var RPC_SERVICE_ID = /^[a-z][a-z0-9.-]{0,127}$/;
+var RPC_METHOD_NAME = /^[A-Za-z_][A-Za-z0-9_.-]{0,127}$/;
+var RPC_CALL_PURPOSES = new Set(["bootstrap", "background", "management", "request", "attempt"]);
+var RPC_COMMAND_DEDUPLICATION = new Set(["local-transaction", "external-contract", "none"]);
+var RPC_COMMAND_POLICY_KEYS = new Set(["deduplication", "resultRetentionMs", "quotaBytes", "maxResultBytes"]);
+var CONTRACT_KEYS = ["id", "version", "methods"];
+var METHOD_KEYS = [
+  "kind",
+  "input",
+  "output",
+  "purposes",
+  "timeoutMs",
+  "maxInputBytes",
+  "maxOutputBytes",
+  "command"
+];
+
+class RpcProtocolError extends Error {
+  code;
+  name = "RpcProtocolError";
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+function failData(category) {
+  throw new RpcProtocolError("invalid_data", `invalid_data in ${category}`);
+}
+function failSize() {
+  throw new RpcProtocolError("size_limit", "size_limit: JSON value exceeds the byte limit");
+}
+function failContract(reason) {
+  throw new RpcProtocolError("invalid_contract", `invalid_contract: ${reason}`);
+}
+function isPlainObject(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  if (isProxy(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isPositiveSafeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function isNonNegativeSafeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function hasLoneSurrogate(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      if (index + 1 >= value.length)
+        return true;
+      const next = value.charCodeAt(index + 1);
+      if (next < 56320 || next > 57343)
+        return true;
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArrayIndex(key, length) {
+  if (!/^(?:0|[1-9]\d*)$/.test(key))
+    return false;
+  const index = Number(key);
+  return Number.isSafeInteger(index) && index >= 0 && index < length;
+}
+function assertKnownKeys(input, allowed, category) {
+  for (const key of Object.keys(input)) {
+    if (!allowed.includes(key))
+      failContract(`unknown ${category} field`);
+  }
+}
+function spend(budget, bytes) {
+  budget.left -= bytes;
+  if (budget.left < 0)
+    failSize();
+}
+function snapshot(value, depth, ancestors, budget) {
+  if (value === null) {
+    spend(budget, 4);
+    return null;
+  }
+  if (typeof value === "boolean") {
+    spend(budget, value ? 4 : 5);
+    return value;
+  }
+  if (typeof value === "string") {
+    if (hasLoneSurrogate(value))
+      failData("string");
+    spend(budget, Buffer.byteLength(value, "utf8") + 2);
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      failData("number");
+    spend(budget, 1);
+    return value;
+  }
+  if (typeof value !== "object")
+    failData("json");
+  const object = value;
+  if (isProxy(object))
+    failData("json");
+  if (ancestors.has(object))
+    failData("json");
+  const nextDepth = depth + 1;
+  if (nextDepth > JSON_MAX_DEPTH)
+    failData("json");
+  if (Array.isArray(object)) {
+    if (Object.getPrototypeOf(object) !== Array.prototype)
+      failData("array");
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(object, "length");
+    if (!lengthDescriptor || !("value" in lengthDescriptor) || typeof lengthDescriptor.value !== "number") {
+      failData("array");
+    }
+    const length = lengthDescriptor.value;
+    if (!Number.isSafeInteger(length) || length < 0)
+      failData("array");
+    if (length > budget.left)
+      failSize();
+    spend(budget, 2);
+    if (length > 1)
+      spend(budget, length - 1);
+    ancestors.add(object);
+    const items = new Array(length);
+    let count = 0;
+    for (const key of Reflect.ownKeys(object)) {
+      if (key === "length")
+        continue;
+      if (typeof key !== "string" || !isArrayIndex(key, length))
+        failData("array");
+      const descriptor = Object.getOwnPropertyDescriptor(object, key);
+      if (!descriptor || !descriptor.enumerable || !("value" in descriptor))
+        failData("array");
+      items[Number(key)] = snapshot(descriptor.value, nextDepth, ancestors, budget);
+      count += 1;
+    }
+    if (count !== length)
+      failData("array");
+    ancestors.delete(object);
+    return items;
+  }
+  const prototype = Object.getPrototypeOf(object);
+  if (prototype !== Object.prototype && prototype !== null)
+    failData("object");
+  const keys = Reflect.ownKeys(object);
+  if (keys.length > budget.left)
+    failSize();
+  spend(budget, 2);
+  if (keys.length > 1)
+    spend(budget, keys.length - 1);
+  ancestors.add(object);
+  const result = {};
+  for (const key of keys) {
+    if (typeof key !== "string")
+      failData("object");
+    if (hasLoneSurrogate(key))
+      failData("object");
+    const descriptor = Object.getOwnPropertyDescriptor(object, key);
+    if (!descriptor || !descriptor.enumerable || !("value" in descriptor))
+      failData("object");
+    spend(budget, Buffer.byteLength(key, "utf8") + 3);
+    Object.defineProperty(result, key, {
+      value: snapshot(descriptor.value, nextDepth, ancestors, budget),
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  }
+  ancestors.delete(object);
+  return result;
+}
+function snapshotPureInput(input) {
+  try {
+    const pure = snapshot(input, 0, new Set, { left: RPC_CONTRACT_MAX_BYTES });
+    if (Buffer.byteLength(JSON.stringify(pure), "utf8") > RPC_CONTRACT_MAX_BYTES)
+      failContract("input must be bounded pure JSON data");
+    return pure;
+  } catch (error) {
+    if (error instanceof RpcProtocolError && (error.code === "invalid_data" || error.code === "size_limit")) {
+      failContract("input must be bounded pure JSON data");
+    }
+    throw error;
+  }
+}
+function checkOptionalNonNegative(value, field) {
+  if (value === undefined)
+    return;
+  if (!isNonNegativeSafeInteger(value))
+    failContract(`${field} must be a non-negative safe integer`);
+  return value;
+}
+function checkOptionalFinite(value, field) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "number" || !Number.isFinite(value))
+    failContract(`${field} must be a finite number`);
+  return value;
+}
+function checkSchema(input, depth, seen) {
+  if (depth > SCHEMA_MAX_DEPTH)
+    failContract("schema nesting exceeds the limit");
+  if (!isPlainObject(input))
+    failContract("schema must be a plain object");
+  if (seen.has(input))
+    failContract("schema must not contain cycles");
+  seen.add(input);
+  const type = input.type;
+  if (type === "string") {
+    assertKnownKeys(input, ["type", "minLength", "maxLength"], "schema");
+    const min = checkOptionalNonNegative(input.minLength, "minLength");
+    const max = checkOptionalNonNegative(input.maxLength, "maxLength");
+    if (min !== undefined && max !== undefined && min > max)
+      failContract("string minLength must not exceed maxLength");
+  } else if (type === "number") {
+    assertKnownKeys(input, ["type", "integer", "minimum", "maximum"], "schema");
+    if (input.integer !== undefined && typeof input.integer !== "boolean")
+      failContract("number integer flag must be boolean");
+    const min = checkOptionalFinite(input.minimum, "minimum");
+    const max = checkOptionalFinite(input.maximum, "maximum");
+    if (min !== undefined && max !== undefined && min > max)
+      failContract("number minimum must not exceed maximum");
+  } else if (type === "boolean") {
+    assertKnownKeys(input, ["type"], "schema");
+  } else if (type === "null") {
+    assertKnownKeys(input, ["type"], "schema");
+  } else if (type === "literal") {
+    assertKnownKeys(input, ["type", "value"], "schema");
+    if (!Object.prototype.hasOwnProperty.call(input, "value"))
+      failContract("literal schema requires a value");
+    try {
+      snapshot(input.value, 0, new Set, { left: Infinity });
+    } catch (error) {
+      if (error instanceof RpcProtocolError && error.code === "invalid_data") {
+        failContract("literal value must be pure JSON");
+      }
+      throw error;
+    }
+  } else if (type === "array") {
+    assertKnownKeys(input, ["type", "items", "maxItems"], "schema");
+    if (!Object.prototype.hasOwnProperty.call(input, "items"))
+      failContract("array schema requires items");
+    checkSchema(input.items, depth + 1, seen);
+    checkOptionalNonNegative(input.maxItems, "maxItems");
+  } else if (type === "object") {
+    assertKnownKeys(input, ["type", "properties", "optional"], "schema");
+    const properties = input.properties;
+    if (!isPlainObject(properties))
+      failContract("object schema requires a properties record");
+    for (const key of Object.keys(properties))
+      checkSchema(properties[key], depth + 1, seen);
+    const optional = input.optional;
+    if (optional !== undefined) {
+      if (!Array.isArray(optional))
+        failContract("object optional must be an array of field names");
+      const names = new Set;
+      for (const name of optional) {
+        if (typeof name !== "string")
+          failContract("object optional entries must be strings");
+        if (names.has(name))
+          failContract("object optional entries must be unique");
+        names.add(name);
+        if (!Object.prototype.hasOwnProperty.call(properties, name)) {
+          failContract("object optional names must exist in properties");
+        }
+      }
+    }
+  } else if (type === "record") {
+    assertKnownKeys(input, ["type", "values", "maxEntries"], "schema");
+    if (!Object.prototype.hasOwnProperty.call(input, "values"))
+      failContract("record schema requires values");
+    checkSchema(input.values, depth + 1, seen);
+    checkOptionalNonNegative(input.maxEntries, "maxEntries");
+  } else if (type === "union") {
+    assertKnownKeys(input, ["type", "variants"], "schema");
+    const variants = input.variants;
+    if (!Array.isArray(variants) || variants.length === 0) {
+      failContract("union schema requires a non-empty variants array");
+    }
+    for (const variant of variants)
+      checkSchema(variant, depth + 1, seen);
+  } else if (type === "json") {
+    assertKnownKeys(input, ["type", "maxBytes"], "schema");
+    if (input.maxBytes !== undefined && !isPositiveSafeInteger(input.maxBytes)) {
+      failContract("json schema maxBytes must be a positive safe integer");
+    }
+  } else {
+    failContract("unknown schema type");
+  }
+  seen.delete(input);
+}
+function checkByteLimit(value, field) {
+  if (value === undefined)
+    return;
+  if (!isPositiveSafeInteger(value) || value > RPC_JSON_MAX_BYTES) {
+    failContract(`${field} must be a positive integer no larger than the RPC envelope`);
+  }
+  return value;
+}
+function checkCommandPolicy(policy, maxOutputBytes) {
+  const keys = Object.keys(policy);
+  if (keys.length !== RPC_COMMAND_POLICY_KEYS.size || keys.some((key) => !RPC_COMMAND_POLICY_KEYS.has(key))) {
+    failContract("command policy fields are fixed");
+  }
+  const deduplication = policy.deduplication;
+  if (typeof deduplication !== "string" || !RPC_COMMAND_DEDUPLICATION.has(deduplication)) {
+    failContract("invalid command deduplication");
+  }
+  const retention = policy.resultRetentionMs;
+  if (retention !== null && !isPositiveSafeInteger(retention)) {
+    failContract("resultRetentionMs must be a positive integer or null");
+  }
+  const maxResultBytes = policy.maxResultBytes;
+  if (!isPositiveSafeInteger(maxResultBytes))
+    failContract("maxResultBytes must be a positive safe integer");
+  if (maxResultBytes > maxOutputBytes)
+    failContract("maxResultBytes must not exceed maxOutputBytes");
+  const quotaBytes = policy.quotaBytes;
+  if (!isPositiveSafeInteger(quotaBytes))
+    failContract("quotaBytes must be a positive safe integer");
+  if (quotaBytes < maxResultBytes)
+    failContract("quotaBytes must be able to hold maxResultBytes");
+}
+function checkMethod(definition) {
+  assertKnownKeys(definition, METHOD_KEYS, "method");
+  const kind = definition.kind;
+  if (kind !== "query" && kind !== "command")
+    failContract("method kind must be query or command");
+  checkSchema(definition.input, 0, new Set);
+  checkSchema(definition.output, 0, new Set);
+  const purposes = definition.purposes;
+  if (!Array.isArray(purposes) || purposes.length === 0)
+    failContract("purposes must be a non-empty array");
+  const seenPurposes = new Set;
+  for (const purpose of purposes) {
+    if (typeof purpose !== "string" || !RPC_CALL_PURPOSES.has(purpose))
+      failContract("invalid purpose");
+    if (seenPurposes.has(purpose))
+      failContract("purposes must be unique");
+    seenPurposes.add(purpose);
+  }
+  if (definition.timeoutMs !== undefined) {
+    if (!isPositiveSafeInteger(definition.timeoutMs) || definition.timeoutMs > RPC_MAX_TIMEOUT_MS) {
+      failContract("timeoutMs must be a positive integer no larger than the timeout bound");
+    }
+  }
+  checkByteLimit(definition.maxInputBytes, "maxInputBytes");
+  const maxOutputBytes = checkByteLimit(definition.maxOutputBytes, "maxOutputBytes");
+  const command = definition.command;
+  if (kind === "command") {
+    if (!isPlainObject(command))
+      failContract("command methods require an explicit command policy");
+    checkCommandPolicy(command, maxOutputBytes ?? RPC_JSON_MAX_BYTES);
+  } else if (command !== undefined) {
+    failContract("query methods must not declare a command policy");
+  }
+}
+function checkContract(contract) {
+  if (!isPlainObject(contract))
+    failContract("contract must be a plain object");
+  assertKnownKeys(contract, CONTRACT_KEYS, "contract");
+  if (typeof contract.id !== "string" || !RPC_SERVICE_ID.test(contract.id))
+    failContract("invalid service id");
+  if (!isPositiveSafeInteger(contract.version))
+    failContract("service version must be a positive safe integer");
+  const methods = contract.methods;
+  if (!isPlainObject(methods))
+    failContract("methods must be a plain object");
+  const names = Object.keys(methods);
+  if (names.length === 0)
+    failContract("service must declare at least one method");
+  if (names.length > RPC_MAX_METHODS)
+    failContract("service declares too many methods");
+  for (const name of names) {
+    if (!RPC_METHOD_NAME.test(name))
+      failContract("invalid method name");
+    const definition = methods[name];
+    if (!isPlainObject(definition))
+      failContract("method definition must be a plain object");
+    checkMethod(definition);
+  }
+}
+function deepFreeze(value) {
+  if (Array.isArray(value)) {
+    for (const item of value)
+      deepFreeze(item);
+    return Object.freeze(value);
+  }
+  if (isPlainObject(value)) {
+    for (const key of Object.keys(value))
+      deepFreeze(value[key]);
+    return Object.freeze(value);
+  }
+  return value;
+}
+function defineRpcService(contract) {
+  const pure = snapshotPureInput(contract);
+  checkContract(pure);
+  return deepFreeze(pure);
+}
+
+// packages/core/src/plugin-services/rpc-runtime.ts
+var PROCESSES = new Set(["control", "worker", "ingress"]);
+var SCOPES = new Set(["global", "binding"]);
+var PURPOSES = new Set(["bootstrap", "background", "management", "request", "attempt"]);
+var ENDPOINTS = new WeakMap;
+var REVOKED = new WeakMap;
+
+// packages/core/src/plugin-services/host-rpc.ts
+var SERVICE_ERROR_MESSAGES = {
+  unauthorized: "RPC call is not authorized",
+  not_ready: "RPC endpoint is not ready",
+  retired: "RPC endpoint is retiring",
+  revoked: "RPC endpoint generation was revoked",
+  unsupported_method: "RPC method is not published",
+  wrong_purpose: "RPC method is not published for this purpose",
+  invalid_input: "RPC input is not valid",
+  invalid_output: "RPC output is not valid",
+  invalid_operation_id: "RPC command operation id is invalid",
+  overloaded: "RPC runtime is at capacity",
+  cancelled: "RPC call was cancelled",
+  timeout: "RPC call deadline exceeded",
+  unknown: "RPC command outcome is unknown",
+  capability_unavailable: "RPC command execution is unavailable",
+  closed: "RPC runtime is closed",
+  failed: "RPC call failed",
+  conflict: "RPC command identity conflicts with an existing record",
+  expired: "RPC command result has expired",
+  pending: "RPC command is still pending",
+  rejected: "RPC command was rejected",
+  missing: "RPC command has no stored result",
+  storage_failure: "RPC command storage failed",
+  deadlock: "RPC call chain would deadlock",
+  call_depth_exceeded: "RPC call depth exceeded",
+  undeclared: "RPC service is not declared by the manifest",
+  unavailable: "RPC service is unavailable",
+  ambiguous_placement: "RPC service placement is ambiguous",
+  invalid_registration: "RPC registration is invalid"
+};
+var SERVICE_ERROR_CODES = new Set(Object.keys(SERVICE_ERROR_MESSAGES));
+var EMPTY_OPTIONS = Object.freeze({});
+var FRAME_STORE = new AsyncLocalStorage;
+var CALLEE_INFO = new WeakMap;
+// packages/core/src/plugin-services/peer-channel-protocol.ts
+var CHANNEL_REQUEST_MAX_BYTES = 4 * 1024;
+var CHANNEL_RESULT_MAX_BYTES = 60 * 1024;
+var CHANNEL_MAX_CHUNK_BYTES = 60 * 1024;
+var PLUGIN_CHANNEL_LANES = Object.freeze(["event", "snapshot", "stream"]);
+var ERROR_CODES = new Set([
+  "unavailable",
+  "ambiguous",
+  "unauthorized",
+  "invalid",
+  "overloaded",
+  "expired",
+  "conflict",
+  "gap",
+  "truncated",
+  "rejected",
+  "cancelled",
+  "closed",
+  "unknown",
+  "failed"
+]);
+var RPC_CALL_PURPOSES2 = new Set(["bootstrap", "background", "management", "request", "attempt"]);
+
+// packages/core/src/plugin-services/peer-channel-hub.ts
+var CHANNEL_MAX_TRANSFER_BUFFER_BYTES = 4 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_MAX_TOTAL_BUFFER_BYTES = 16 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_STREAM_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
+var CHANNEL_STREAM_MAX_CREDIT_BYTES = 8 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_STREAM_DEFAULT_CREDIT_BYTES = 4 * CHANNEL_MAX_CHUNK_BYTES;
+var CHANNEL_SNAPSHOT_MAX_BYTES = 64 * 1024 * 1024;
+var CHANNEL_EVENT_MAX_PAYLOAD_BYTES = 60 * 1024;
+var EMPTY = new Uint8Array(0);
+var HANDLE_REGISTRATIONS = new WeakMap;
+
+// packages/core/src/plugin-services/snapshot-store.ts
+var DEFAULT_CHUNK_BYTES = 60 * 1024;
+var SNAPSHOT_FAMILY_REFS = new Map;
+
+// packages/core/src/plugin-services.ts
+var CHANNEL_KINDS = new Set(["events", "snapshot", "stream"]);
+
+// plugins/chatgpt-oauth/server/rpc.ts
+var command = { deduplication: "none", resultRetentionMs: null, quotaBytes: 65536, maxResultBytes: 65536 };
+var businessRpc = defineRpcService({ id: "chatgpt-oauth.credentials.v1", version: 1, methods: {
+  getCredential: { kind: "command", input: { type: "object", properties: {} }, output: { type: "object", properties: { version: { type: "number", integer: true, minimum: 1 }, expiresAt: { type: "number" }, headers: { type: "record", values: { type: "string" }, maxEntries: 16 } } }, purposes: ["attempt"], command, timeoutMs: 15000 },
+  rejectAccess: { kind: "command", input: { type: "object", properties: { version: { type: "number", integer: true, minimum: 1 } } }, output: { type: "object", properties: { rejected: { type: "boolean" } } }, purposes: ["attempt"], command, timeoutMs: 15000 }
+} });
+
 // plugins/chatgpt-oauth/server/control.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // plugins/chatgpt-oauth/server/oauth.ts
 import { createHash, randomBytes } from "crypto";
@@ -519,8 +1025,181 @@ function extractCodexIdentity(idToken) {
   };
 }
 
+// plugins/chatgpt-oauth/server/siwc.ts
+import { createPublicKey, randomBytes as randomBytes2, randomUUID, verify } from "crypto";
+var SIWC_AUTH_URL = "https://auth.openai.com/api/accounts/authorize";
+var SIWC_TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+var SIWC_JWKS_URL = "https://auth.openai.com/.well-known/jwks.json";
+var SIWC_ISSUER = "https://auth.openai.com";
+var SIWC_REDIRECT_URI = "http://127.0.0.1:1455/auth/callback";
+var SIWC_RESOURCE = "https://api.openai.com/v1";
+var SIWC_SCOPES = ["openid", "profile", "email", "offline_access", "resource.invoke", "chatgpt.tokens.use.direct"];
+var SIWC_REGISTRATION_KEY = "siwc.registration.v1";
+var CLIENT_ID = /^oaiapp_[A-Za-z0-9_-]{1,200}$/;
+var HOST_ID = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function invalid(kind = "invalid_response") {
+  throw new CodexOAuthError(kind, `SIWC ${kind === "invalid_callback" ? "callback" : "response"} is invalid`, { retryable: false });
+}
+async function getSiwcHostId(store, canWrite = () => true) {
+  for (let attempt = 0;attempt < 12; attempt++) {
+    if (!canWrite())
+      throw new CodexOAuthError("cancelled", "SIWC operation was cancelled", { retryable: false });
+    const current = await store.get(SIWC_REGISTRATION_KEY);
+    if (current) {
+      try {
+        const record = JSON.parse(current.value);
+        if (record?.schema === 1 && typeof record.hostId === "string" && HOST_ID.test(record.hostId))
+          return record.hostId;
+      } catch {}
+      return invalid();
+    }
+    const hostId = `urn:uuid:${randomUUID()}`;
+    if (!canWrite())
+      throw new CodexOAuthError("cancelled", "SIWC operation was cancelled", { retryable: false });
+    try {
+      await store.compareAndSet(SIWC_REGISTRATION_KEY, null, JSON.stringify({ schema: 1, hostId }));
+      return hostId;
+    } catch (error) {
+      if (error.code !== "version_conflict")
+        throw error;
+    }
+  }
+  return invalid();
+}
+function validSiwcMetadata(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const item = value;
+  return Object.keys(item).every((key) => ["clientId", "subject", "scopes"].includes(key)) && typeof item.clientId === "string" && CLIENT_ID.test(item.clientId) && typeof item.subject === "string" && item.subject.length > 0 && item.subject.length <= 512 && item.subject.trim() === item.subject && !/[\u0000-\u001f\u007f]/.test(item.subject) && Array.isArray(item.scopes) && item.scopes.length <= 128 && item.scopes.every((scope) => typeof scope === "string" && /^[\x21\x23-\x5b\x5d-\x7e]{1,128}$/.test(scope)) && item.scopes.includes("resource.invoke") && item.scopes.includes("chatgpt.tokens.use.direct");
+}
+function createSiwcNonce(random = randomBytes2) {
+  return Buffer.from(random(32)).toString("base64url");
+}
+function buildSiwcAuthorizationUrl(pkce, nonce, hostId, clientId) {
+  if (!HOST_ID.test(hostId) || clientId !== undefined && !CLIENT_ID.test(clientId) || !nonce || !pkce.state || !pkce.codeChallenge)
+    return invalid();
+  const url = new URL(SIWC_AUTH_URL);
+  url.search = new URLSearchParams({
+    client_id: clientId ?? "dynamic_agent_client",
+    agent_name_hint: "Bungee",
+    ext_agent_host_id: hostId,
+    response_type: "code",
+    redirect_uri: SIWC_REDIRECT_URI,
+    resource: SIWC_RESOURCE,
+    scope: SIWC_SCOPES.join(" "),
+    state: pkce.state,
+    nonce,
+    code_challenge: pkce.codeChallenge,
+    code_challenge_method: "S256"
+  }).toString();
+  return url.toString();
+}
+function parseSiwcCallbackUrl(raw, options) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return invalid("invalid_callback");
+  }
+  const expected = new URL(SIWC_REDIRECT_URI);
+  const now = options.now ?? Date.now();
+  if (raw.length > 4096 || raw.trim() !== raw || raw.split("?")[0] !== SIWC_REDIRECT_URI || url.origin !== expected.origin || url.pathname !== expected.pathname || url.username || url.password || url.hash || !Number.isFinite(now) || !Number.isFinite(options.issuedAt) || options.issuedAt < 0 || now < options.issuedAt || now - options.issuedAt > CODEX_CALLBACK_TTL_MS || [...url.searchParams.keys()].some((key) => url.searchParams.getAll(key).length !== 1) || url.searchParams.has("userinfo") || !options.expectedState || url.searchParams.get("state") !== options.expectedState || url.searchParams.has("error") || url.searchParams.has("error_description"))
+    return invalid("invalid_callback");
+  const code = url.searchParams.get("code");
+  const clientId = url.searchParams.get("client_id");
+  if (!code || code.trim() !== code || /[\u0000-\u001f\u007f]/.test(code) || !clientId || !CLIENT_ID.test(clientId) || options.expectedClientId !== undefined && clientId !== options.expectedClientId)
+    return invalid("invalid_callback");
+  return { code, clientId };
+}
+function jwtObject(part) {
+  try {
+    if (!/^[A-Za-z0-9_-]+$/.test(part))
+      return invalid();
+    const value = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    if (value && typeof value === "object" && !Array.isArray(value))
+      return value;
+  } catch {}
+  return invalid();
+}
+async function verifySiwcIdToken(idToken, expected, options = {}) {
+  if (!CLIENT_ID.test(expected.clientId) || idToken.length > 32768)
+    return invalid();
+  const parts = idToken.split(".");
+  if (parts.length !== 3 || !/^[A-Za-z0-9_-]+$/.test(parts[2]))
+    return invalid();
+  const header = jwtObject(parts[0]);
+  const payload = jwtObject(parts[1]);
+  if (header.alg !== "RS256" || typeof header.kid !== "string" || !header.kid || header.crit !== undefined)
+    return invalid();
+  const jwks = await requestJson(SIWC_JWKS_URL, { method: "GET", headers: { accept: "application/json" } }, options);
+  if (!Array.isArray(jwks.keys) || jwks.keys.length > 128)
+    return invalid();
+  const keys = jwks.keys.filter((key) => key && typeof key === "object" && key.kid === header.kid && key.kty === "RSA" && (key.alg === undefined || key.alg === "RS256") && (key.use === undefined || key.use === "sig") && (key.key_ops === undefined || Array.isArray(key.key_ops) && key.key_ops.includes("verify")) && key.d === undefined);
+  if (keys.length !== 1)
+    return invalid();
+  try {
+    const publicKey = createPublicKey({ key: keys[0], format: "jwk" });
+    if (!verify("RSA-SHA256", Buffer.from(`${parts[0]}.${parts[1]}`), publicKey, Buffer.from(parts[2], "base64url")))
+      return invalid();
+  } catch {
+    return invalid();
+  }
+  const aud = payload.aud;
+  const now = expected.now ?? Date.now();
+  if (payload.iss !== SIWC_ISSUER || !(aud === expected.clientId || Array.isArray(aud) && aud.every((item) => typeof item === "string") && aud.includes(expected.clientId)) || Array.isArray(aud) && aud.length > 1 && payload.azp !== expected.clientId || payload.azp !== undefined && payload.azp !== expected.clientId || typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || !Number.isFinite(now) || payload.exp * 1000 <= now || payload.nbf !== undefined && (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf * 1000 > now) || typeof payload.sub !== "string" || !payload.sub || payload.sub.length > 512 || payload.sub.trim() !== payload.sub || /[\u0000-\u001f\u007f]/.test(payload.sub) || expected.nonce !== undefined && payload.nonce !== expected.nonce || expected.subject !== undefined && payload.sub !== expected.subject)
+    return invalid();
+  return { subject: payload.sub, email: typeof payload.email === "string" && payload.email.length <= 512 && !/[\u0000-\u001f\u007f]/.test(payload.email) ? payload.email : undefined };
+}
+function tokenString(record, key, fallback) {
+  if (record[key] === undefined && fallback !== undefined)
+    return fallback;
+  const value = record[key];
+  if (typeof value !== "string" || !value || value.trim() !== value || value.length > 32768 || /[\r\n\0]/.test(value))
+    return invalid();
+  return value;
+}
+async function siwcTokenSet(record, expected, options, previous) {
+  const accessToken = tokenString(record, "access_token");
+  const refreshToken = tokenString(record, "refresh_token", previous?.refreshToken);
+  const idToken = tokenString(record, "id_token", previous?.idToken);
+  if (record.token_type !== undefined && (typeof record.token_type !== "string" || record.token_type.toLowerCase() !== "bearer"))
+    return invalid();
+  if (typeof record.expires_in !== "number" || !Number.isFinite(record.expires_in) || record.expires_in <= 0 || record.expires_in * 1000 > Number.MAX_SAFE_INTEGER - Date.now())
+    return invalid();
+  const scopes = record.scope === undefined && previous?.siwc ? [...previous.siwc.scopes] : tokenString(record, "scope").split(/\s+/);
+  const verified = record.id_token === undefined && previous?.siwc ? { subject: previous.siwc.subject, email: previous.identity?.email } : await verifySiwcIdToken(idToken, expected, options);
+  const siwc = { clientId: expected.clientId, subject: verified.subject, scopes };
+  if (!validSiwcMetadata(siwc))
+    return invalid();
+  return {
+    accessToken,
+    refreshToken,
+    idToken,
+    expiresIn: record.expires_in,
+    expiresAt: Date.now() + record.expires_in * 1000,
+    tokenType: "Bearer",
+    identity: { email: verified.email },
+    identityStatus: "parsed",
+    siwc
+  };
+}
+async function exchangeSiwcCode(code, codeVerifier, clientId, nonce, options = {}) {
+  if (!code || !codeVerifier || !nonce || !CLIENT_ID.test(clientId))
+    return invalid();
+  const body = new URLSearchParams({ grant_type: "authorization_code", client_id: clientId, code, code_verifier: codeVerifier, redirect_uri: SIWC_REDIRECT_URI, resource: SIWC_RESOURCE });
+  const record = await requestJson(SIWC_TOKEN_URL, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: body.toString() }, options);
+  return siwcTokenSet(record, { clientId, nonce }, options);
+}
+async function refreshSiwcToken(previous, options = {}) {
+  if (!validSiwcMetadata(previous.siwc) || !previous.refreshToken)
+    return invalid();
+  const body = new URLSearchParams({ grant_type: "refresh_token", client_id: previous.siwc.clientId, refresh_token: previous.refreshToken, resource: SIWC_RESOURCE });
+  const record = await requestJson(SIWC_TOKEN_URL, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: body.toString() }, options, true);
+  return siwcTokenSet(record, { clientId: previous.siwc.clientId, subject: previous.siwc.subject }, options, previous);
+}
+
 // plugins/chatgpt-oauth/server/accounts.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 var ACCOUNT_STORE_KEY = "accounts.v1";
 var ACCOUNT_SCHEMA_VERSION = 1;
 
@@ -553,6 +1232,7 @@ function copyIdentity(value) {
 function copyAccount(value) {
   return {
     ...value,
+    siwc: value.siwc && { ...value.siwc, scopes: [...value.siwc.scopes] },
     identity: copyIdentity(value.identity),
     refreshLock: value.refreshLock && { ...value.refreshLock },
     autoResetAttempts: value.autoResetAttempts?.map((item) => ({ ...item }))
@@ -565,7 +1245,7 @@ function validStoredAccount(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return false;
   const account = value;
-  return typeof account.id === "string" && account.id.length > 0 && account.id.length <= 128 && typeof account.label === "string" && account.label.length > 0 && account.label.length <= MAX_TEXT && ["active", "disabled", "reauth_required", "revoked"].includes(account.status) && Number.isSafeInteger(account.generation) && account.generation > 0 && (account.loginFence === undefined || Number.isSafeInteger(account.loginFence) && account.loginFence > 0) && (account.credentialValid === undefined || typeof account.credentialValid === "boolean") && (account.autoResetCredits === undefined || typeof account.autoResetCredits === "boolean") && validAutoResetAttempts(account.autoResetAttempts) && Number.isFinite(account.createdAt) && Number.isFinite(account.updatedAt);
+  return typeof account.id === "string" && account.id.length > 0 && account.id.length <= 128 && typeof account.label === "string" && account.label.length > 0 && account.label.length <= MAX_TEXT && ["active", "disabled", "reauth_required", "revoked"].includes(account.status) && Number.isSafeInteger(account.generation) && account.generation > 0 && (account.loginFence === undefined || Number.isSafeInteger(account.loginFence) && account.loginFence > 0) && (account.credentialValid === undefined || typeof account.credentialValid === "boolean") && (account.autoResetCredits === undefined || typeof account.autoResetCredits === "boolean") && (account.siwc === undefined || validSiwcMetadata(account.siwc)) && validAutoResetAttempts(account.autoResetAttempts) && Number.isFinite(account.createdAt) && Number.isFinite(account.updatedAt);
 }
 function decode(value) {
   if (value === undefined)
@@ -601,6 +1281,7 @@ function statusReason(account) {
 function accountListItem(account) {
   const pending = account.autoResetAttempts?.find((item) => !item.completed);
   return {
+    authType: account.siwc ? "siwc" : "codex",
     id: account.id,
     label: account.label,
     status: account.status,
@@ -608,10 +1289,25 @@ function accountListItem(account) {
     reason: statusReason(account),
     expiresAt: account.expiresAt,
     identity: copyIdentity(account.identity),
-    autoResetCredits: account.autoResetCredits === true,
-    pendingAutoReset: pending && { ...pending }
+    autoResetCredits: !account.siwc && account.autoResetCredits === true,
+    pendingAutoReset: !account.siwc && pending ? { ...pending } : undefined
   };
 }
+function validateTokenIdentity(token) {
+  if (token.identityStatus !== "parsed" || (token.siwc === undefined ? !token.identity?.accountId : !validSiwcMetadata(token.siwc))) {
+    throw new AccountControlError("invalid_identity");
+  }
+}
+function validateSiwcBinding(account, token) {
+  if (Boolean(account.siwc) !== Boolean(token.siwc))
+    throw new AccountControlError("identity_mismatch");
+  if (account.siwc) {
+    if (!validSiwcMetadata(token.siwc) || token.identityStatus !== "parsed")
+      throw new AccountControlError("invalid_identity");
+    if (account.siwc.clientId !== token.siwc.clientId || account.siwc.subject !== token.siwc.subject)
+      throw new AccountControlError("identity_mismatch");
+  }
+}
 
 class AccountStore {
   secretStore;
@@ -646,6 +1342,19 @@ class AccountStore {
   async list() {
     return (await this.read()).aggregate.accounts.map(accountListItem);
   }
+  async remove(id) {
+    text(id, 128);
+    await this.mutate((aggregate) => {
+      aggregate.accounts = aggregate.accounts.filter((account) => account.id !== id);
+    });
+  }
+  async purgeRevoked() {
+    if (!(await this.read()).aggregate.accounts.some((account) => account.status === "revoked"))
+      return;
+    await this.mutate((aggregate) => {
+      aggregate.accounts = aggregate.accounts.filter((account) => account.status !== "revoked");
+    });
+  }
   async get(id) {
     const account = (await this.read()).aggregate.accounts.find((item) => item.id === id);
     if (!account)
@@ -654,14 +1363,13 @@ class AccountStore {
   }
   async create(label, token, canCommit = () => true) {
     text(label);
-    if (token.identityStatus !== "parsed" || !token.identity?.accountId)
-      throw new AccountControlError("invalid_identity");
+    validateTokenIdentity(token);
     return this.mutate((aggregate) => {
       if (aggregate.accounts.length >= MAX_ACCOUNTS)
         throw new AccountControlError("invalid_input");
       const now = Date.now();
       const account = {
-        id: randomUUID(),
+        id: randomUUID2(),
         label,
         status: token.expiresAt === undefined ? "reauth_required" : "active",
         generation: 1,
@@ -673,7 +1381,8 @@ class AccountStore {
         refreshToken: text(token.refreshToken, MAX_TOKEN),
         idToken: optionalText(token.idToken, MAX_TOKEN),
         expiresAt: token.expiresAt,
-        identity: copyIdentity(token.identity)
+        identity: copyIdentity(token.identity),
+        siwc: token.siwc && { ...token.siwc, scopes: [...token.siwc.scopes] }
       };
       aggregate.accounts.push(account);
       return copyAccount(account);
@@ -697,7 +1406,9 @@ class AccountStore {
       if (token.identity?.accountId && account.identity?.accountId && token.identity.accountId !== account.identity.accountId) {
         throw new AccountControlError("identity_mismatch");
       }
+      validateSiwcBinding(account, token);
       const now = Date.now();
+      account.siwc = token.siwc && { ...token.siwc, scopes: [...token.siwc.scopes] };
       account.accessToken = text(token.accessToken, MAX_TOKEN);
       account.refreshToken = text(token.refreshToken, MAX_TOKEN);
       if (token.idToken !== undefined && token.identityStatus !== "invalid")
@@ -739,9 +1450,9 @@ class AccountStore {
       if (account.generation !== expected.generation || account.loginFence !== expected.loginFence) {
         throw new AccountControlError("stale_refresh");
       }
-      if (token.identityStatus !== "parsed" || !token.identity?.accountId)
-        throw new AccountControlError("invalid_identity");
-      if (account.identity?.accountId && token.identity.accountId !== account.identity.accountId) {
+      validateTokenIdentity(token);
+      validateSiwcBinding(account, token);
+      if (account.identity?.accountId && token.identity?.accountId !== account.identity.accountId) {
         throw new AccountControlError("identity_mismatch");
       }
       account.accessToken = text(token.accessToken, MAX_TOKEN);
@@ -758,6 +1469,7 @@ class AccountStore {
         account.status = "active";
       }
       account.identity = copyIdentity(token.identity);
+      account.siwc = token.siwc && { ...token.siwc, scopes: [...token.siwc.scopes] };
       account.generation += 1;
       account.updatedAt = Date.now();
       delete account.refreshLock;
@@ -769,22 +1481,12 @@ class AccountStore {
       const account = aggregate.accounts.find((item) => item.id === id);
       if (!account)
         throw new AccountControlError("not_found");
-      if (account.status === "revoked") {
-        if (status === "revoked")
-          return copyAccount(account);
+      if (account.status === "revoked")
         throw new AccountControlError("revoked");
-      }
       account.status = status;
       account.generation += 1;
       account.updatedAt = Date.now();
       delete account.refreshLock;
-      if (status === "revoked") {
-        delete account.accessToken;
-        delete account.refreshToken;
-        delete account.idToken;
-        delete account.expiresAt;
-        account.credentialValid = false;
-      }
       return copyAccount(account);
     });
   }
@@ -810,6 +1512,8 @@ class AccountStore {
         throw new AccountControlError("not_found");
       if (account.status === "revoked")
         throw new AccountControlError("revoked");
+      if (account.siwc)
+        throw new AccountControlError("unsupported_operation");
       account.autoResetCredits = enabled;
       account.updatedAt = Date.now();
       return copyAccount(account);
@@ -818,7 +1522,7 @@ class AccountStore {
   async claimAutoReset(id, credit, now) {
     return this.mutate((aggregate) => {
       const account = aggregate.accounts.find((item) => item.id === id);
-      if (!account || !accountListItem(account).available || account.autoResetCredits !== true)
+      if (!account || account.siwc || !accountListItem(account).available || account.autoResetCredits !== true)
         return;
       const attempts = account.autoResetAttempts ?? [];
       if (attempts.some((item) => !item.completed || item.creditId === credit.id))
@@ -826,7 +1530,7 @@ class AccountStore {
       account.autoResetAttempts = attempts.filter((item) => !item.completed || item.expiresAt === undefined || item.expiresAt > now);
       if (account.autoResetAttempts.length >= MAX_AUTO_RESET_ATTEMPTS || credit.expiresAt === undefined || credit.expiresAt <= now)
         return;
-      const attempt = { creditId: credit.id, redeemRequestId: randomUUID(), expiresAt: credit.expiresAt, completed: false };
+      const attempt = { creditId: credit.id, redeemRequestId: randomUUID2(), expiresAt: credit.expiresAt, completed: false };
       account.autoResetAttempts.push(attempt);
       account.updatedAt = Date.now();
       return { ...attempt };
@@ -837,6 +1541,8 @@ class AccountStore {
       const account = aggregate.accounts.find((item) => item.id === id);
       if (!account)
         throw new AccountControlError("not_found");
+      if (account.siwc)
+        throw new AccountControlError("unsupported_operation");
       const attempts = account.autoResetAttempts ?? [];
       const pending = attempts.find((item) => !item.completed);
       if (pending) {
@@ -945,7 +1651,7 @@ class AccountStore {
 }
 
 // plugins/chatgpt-oauth/server/sessions.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 class LoginSessionError extends Error {
   code;
   name = "LoginSessionError";
@@ -988,7 +1694,7 @@ class LoginSessionManager {
     this.hostSignal.addEventListener("abort", onHostAbort, { once: true });
     const issuedAt = this.now();
     const session = {
-      id: randomUUID2(),
+      id: randomUUID3(),
       kind,
       state: "pending",
       issuedAt,
@@ -1076,6 +1782,19 @@ class LoginSessionManager {
     session.codeVerifier = pkce.codeVerifier;
     return { sessionId: session.id, authorizationUrl: buildCodexAuthorizationUrl(pkce), expiresAt: session.expiresAt };
   }
+  startSiwc(hostId, accountRef, clientId, fence) {
+    if (accountRef !== undefined && (typeof accountRef !== "string" || !accountRef || accountRef.length > 128))
+      throw new LoginSessionError("invalid_input");
+    const pkce = createPKCE(this.deps.random);
+    const nonce = createSiwcNonce(this.deps.random);
+    const authorizationUrl = buildSiwcAuthorizationUrl(pkce, nonce, hostId, clientId);
+    const session = this.newSession("siwc", accountRef, fence, CODEX_CALLBACK_TTL_MS);
+    session.stateValue = pkce.state;
+    session.codeVerifier = pkce.codeVerifier;
+    session.nonce = nonce;
+    session.clientId = clientId;
+    return { sessionId: session.id, authorizationUrl, expiresAt: session.expiresAt };
+  }
   setFence(id, fence) {
     const session = this.get(id);
     if (session.state !== "pending")
@@ -1188,6 +1907,24 @@ class LoginSessionManager {
       throw error;
     }
   }
+  async completeSiwc(id, callbackUrl, commit) {
+    const session = this.claim(id, "siwc");
+    try {
+      const callback = parseSiwcCallbackUrl(callbackUrl, { expectedState: session.stateValue, expectedClientId: session.clientId, issuedAt: session.issuedAt, now: this.now() });
+      const token = await exchangeSiwcCode(callback.code, session.codeVerifier, callback.clientId, session.nonce, safeOptions(this.deps, session.controller.signal));
+      return await this.finish(session, token, commit);
+    } catch (error) {
+      if (session.controller.signal.aborted && session.state === "cancelled")
+        throw new LoginSessionError("cancelled");
+      if (session.state === "exchanging") {
+        session.state = session.controller.signal.aborted ? "cancelled" : "failed";
+        session.errorCode = session.controller.signal.aborted ? "cancelled" : "login_failed";
+        if (session.state === "failed")
+          throw new LoginSessionError("failed");
+      }
+      throw error;
+    }
+  }
   cancel(id) {
     const session = this.get(id);
     if (session.state === "success" || session.state === "cancelled" || session.state === "failed" || session.state === "committing")
@@ -1956,6 +2693,7 @@ class AutoResetScheduler {
 
 // plugins/chatgpt-oauth/server/control.ts
 var CHATGPT_TARGET = "https://chatgpt.com";
+var SIWC_TARGET = "https://api.openai.com";
 var CONTROL_HOST_CONTRACT_GAP = "ControlRpcContext.binding.bindingOptions.accountRef is required and host-resolved; RPC payload is never used as a fallback.";
 
 class ControlError extends Error {
@@ -1982,7 +2720,8 @@ function safeError(error) {
       identity_mismatch: "identity_mismatch",
       invalid_identity: "invalid_identity",
       disposed: "disposed",
-      stale_refresh: "stale_refresh"
+      stale_refresh: "stale_refresh",
+      unsupported_operation: "unsupported_operation"
     };
     return new ControlError(map[error.code] ?? "refresh_failed");
   }
@@ -2147,6 +2886,11 @@ function lease(account) {
     throw new ControlError(account.status);
   if (!account.accessToken)
     throw new ControlError("reauth_required");
+  if (account.siwc) {
+    if (!validSiwcMetadata(account.siwc) || !Number.isFinite(account.expiresAt))
+      throw new ControlError("reauth_required");
+    return { version: account.generation, expiresAt: account.expiresAt, headers: { Authorization: `Bearer ${account.accessToken}` } };
+  }
   if (!account.identity?.accountId)
     throw new ControlError("identity_missing");
   if (!Number.isFinite(account.expiresAt))
@@ -2165,7 +2909,7 @@ class ChatgptControl {
   accounts;
   sessions;
   now;
-  workerOwner = `chatgpt-control-${randomUUID3()}`;
+  workerOwner = `chatgpt-control-${randomUUID4()}`;
   inFlight = new Map;
   refreshControllers = new Map;
   apiLifetime = new AbortController;
@@ -2184,7 +2928,7 @@ class ChatgptControl {
       now: this.now,
       timeoutMs: deps.timeoutMs,
       hostSignal: this.apiLifetime.signal,
-      credential: (id, signal) => this.credential(id, signal),
+      credential: (id, signal) => this.credential(id, signal, "codex"),
       rejectAccess: (id, version) => this.accounts.rejectAccess(id, version)
     });
     this.autoReset = new AutoResetScheduler(this.accounts, this.usage, this.apiLifetime.signal, this.now, deps.autoResetTimer);
@@ -2197,6 +2941,12 @@ class ChatgptControl {
       host.signal.addEventListener("abort", this.abortListener, { once: true });
     this.api = this.buildApi();
     this.rpc = this.buildRpc();
+    host.services?.rpc?.publish(businessRpc, Object.fromEntries(this.rpc.map((declaration) => [declaration.name, (payload, context) => {
+      const frame = host.resolveRpcCallee?.(context.callee);
+      if (!frame?.binding || !frame.attempt || frame.binding.plugin !== "chatgpt-oauth")
+        throw new ControlError("binding_options_unavailable");
+      return declaration.invoke(payload, { ...host, binding: frame.binding, attempt: { ...frame.attempt, signal: AbortSignal.any([frame.attempt.signal, context.signal]) } });
+    }])));
   }
   assertAlive(signal) {
     if (this.disposed || this.host.signal.aborted)
@@ -2206,7 +2956,7 @@ class ChatgptControl {
   }
   async start() {
     this.assertAlive();
-    await this.accounts.read();
+    await this.accounts.purgeRevoked();
     this.assertAlive();
     this.autoReset.start();
   }
@@ -2229,7 +2979,8 @@ class ChatgptControl {
       }
       const generation = lock.account.generation;
       try {
-        const token = await refreshCodexToken(lock.account.refreshToken, { fetchImpl: this.deps.fetchImpl, signal });
+        const refreshOptions = { fetchImpl: this.deps.fetchImpl, signal, timeoutMs: this.deps.timeoutMs };
+        const token = lock.account.siwc ? await refreshSiwcToken({ accessToken: lock.account.accessToken, refreshToken: lock.account.refreshToken, idToken: lock.account.idToken, identity: lock.account.identity, identityStatus: "parsed", siwc: lock.account.siwc }, refreshOptions) : await refreshCodexToken(lock.account.refreshToken, refreshOptions);
         this.assertAlive(signal);
         const updated = await this.accounts.replaceCredentials(id, token, { owner: this.workerOwner, generation });
         this.assertAlive(signal);
@@ -2238,12 +2989,14 @@ class ChatgptControl {
         if (this.disposed || this.host.signal.aborted)
           throw new ControlError("disposed");
         const oauthCode = error.kind;
-        if (oauthCode === "refresh_token_reused") {
+        if (oauthCode === "refresh_token_reused" || lock.account.siwc && (error.upstreamCode === "invalid_grant" || oauthCode === "invalid_response" || error instanceof AccountControlError && ["identity_mismatch", "invalid_identity"].includes(error.code))) {
           const fenced = await this.accounts.failRefreshReauth(id, this.workerOwner, generation).catch(() => false);
           if (!fenced) {
             const latest = await this.accounts.get(id).catch(() => {
               return;
             });
+            if (!latest)
+              throw new ControlError("not_found");
             if (latest?.status === "revoked")
               throw new ControlError("revoked");
             if (latest?.status === "disabled")
@@ -2260,6 +3013,8 @@ class ChatgptControl {
           const latest = await this.accounts.get(id).catch(() => {
             return;
           });
+          if (!latest)
+            throw new ControlError("not_found");
           if (latest?.status === "revoked")
             throw new ControlError("revoked");
           if (latest?.status === "disabled")
@@ -2274,10 +3029,38 @@ class ChatgptControl {
     }
     throw new ControlError("refresh_in_progress");
   }
-  async credential(id, signal) {
+  async requireKind(id, kind, error = "source_mismatch") {
+    const account = await this.accounts.get(id);
+    if (Boolean(account.siwc) !== (kind === "siwc"))
+      throw new ControlError(error);
+    return account;
+  }
+  async bindingAccount(context) {
+    const id = accountRefFromBinding(context);
+    const source = context.binding.contributionId;
+    if (source === "chatgpt-siwc")
+      await this.requireKind(id, "siwc");
+    else if (source === "chatgpt" || source === "upstream")
+      await this.requireKind(id, "codex");
+    else
+      throw new ControlError("source_mismatch");
+    return id;
+  }
+  async draft(context, kind) {
+    const body = await this.readJson(context);
+    exactKeys(body, ["accountRef"]);
+    const account = await this.requireKind(requiredText(body.accountRef, 128), kind);
+    if (!accountListItem(account).available)
+      throw new ControlError(account.status === "active" ? "reauth_required" : account.status);
+    const draft = { target: kind === "siwc" ? SIWC_TARGET : CHATGPT_TARGET, bindingOptions: { accountRef: account.id } };
+    return jsonResponse(draft);
+  }
+  async credential(id, signal, kind) {
     this.assertAlive(signal);
     const account = await this.accounts.get(id);
     this.assertAlive(signal);
+    if (kind === "codex" && account.siwc)
+      throw new ControlError("unsupported_operation");
     if (account.status !== "active")
       throw new ControlError(account.status);
     if (!isRefreshable(account, this.now())) {
@@ -2318,6 +3101,8 @@ class ChatgptControl {
     return readRequestJson(context.request, context.requestSignal, context.signal, this.apiLifetime.signal);
   }
   async startDevice(accountRef) {
+    if (accountRef !== undefined)
+      await this.requireKind(accountRef, "codex");
     const started = await this.sessions.startDevice(accountRef, () => this.loginFence(accountRef));
     this.sessions.completeDevice(started.sessionId, (token, info, guard) => this.commitLogin(token, info, guard)).catch(() => {
       return;
@@ -2342,11 +3127,17 @@ class ChatgptControl {
     };
     return [
       { path: "/accounts", methods: ["GET"], handler: "listAccounts", invoke: invoke(async () => jsonResponse({ accounts: await this.accounts.list() })) },
-      { path: "/accounts/usage", methods: ["GET"], handler: "getAccountUsage", invoke: invoke(async (context) => jsonResponse(await this.usage.get(this.accountRefQuery(context.request), context.requestSignal))) },
+      { path: "/accounts/codex", methods: ["GET"], handler: "listCodexAccounts", invoke: invoke(async () => jsonResponse({ accounts: (await this.accounts.list()).filter((account) => account.authType === "codex") })) },
+      { path: "/accounts/siwc", methods: ["GET"], handler: "listSiwcAccounts", invoke: invoke(async () => jsonResponse({ accounts: (await this.accounts.list()).filter((account) => account.authType === "siwc") })) },
+      { path: "/accounts/usage", methods: ["GET"], handler: "getAccountUsage", invoke: invoke(async (context) => {
+        const id = this.accountRefQuery(context.request);
+        return jsonResponse(await this.usage.get(id, context.requestSignal));
+      }) },
       { path: "/accounts/usage/reset", methods: ["POST"], handler: "resetAccountUsage", invoke: invoke(async (context) => {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef", "redeemRequestId", "creditId"]);
         const accountRef = requiredText(body.accountRef, 128);
+        await this.requireKind(accountRef, "codex", "unsupported_operation");
         const redeemRequestId = requiredText(body.redeemRequestId, 128);
         if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(redeemRequestId))
           throw new ControlError("invalid_input");
@@ -2373,14 +3164,18 @@ class ChatgptControl {
           throw new ControlError("invalid_input");
         return jsonResponse({ account: accountListItem(await this.accounts.setAutoResetCredits(requiredText(body.accountRef, 128), body.enabled)) });
       }) },
-      { path: "/accounts/draft", methods: ["POST"], handler: "createDraft", invoke: invoke(async (context) => {
+      { path: "/accounts/draft", methods: ["POST"], handler: "createDraft", invoke: invoke((context) => this.draft(context, "codex")) },
+      { path: "/accounts/siwc/draft", methods: ["POST"], handler: "createSiwcDraft", invoke: invoke((context) => this.draft(context, "siwc")) },
+      { path: "/login/siwc", methods: ["POST"], handler: "startSiwcLogin", invoke: invoke(async (context) => {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef"]);
-        const account = await this.accounts.get(requiredText(body.accountRef, 128));
-        if (!accountListItem(account).available)
-          throw new ControlError(account.status === "active" ? "reauth_required" : account.status);
-        const draft = { target: CHATGPT_TARGET, bindingOptions: { accountRef: account.id } };
-        return jsonResponse(draft);
+        const accountRef = optionalText3(body.accountRef, 128);
+        const account = accountRef === undefined ? undefined : await this.requireKind(accountRef, "siwc");
+        const hostId = await getSiwcHostId(this.host.secretStore, () => !this.disposed && !this.host.signal.aborted);
+        this.assertAlive(context.requestSignal);
+        const fence = await this.loginFence(accountRef);
+        this.assertAlive(context.requestSignal);
+        return jsonResponse(this.sessions.startSiwc(hostId, accountRef, account?.siwc?.clientId, fence));
       }) },
       { path: "/login/device", methods: ["POST"], handler: "startDeviceLogin", invoke: invoke(async (context) => {
         const body = await this.readJson(context);
@@ -2391,6 +3186,8 @@ class ChatgptControl {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef"]);
         const accountRef = optionalText3(body.accountRef, 128);
+        if (accountRef !== undefined)
+          await this.requireKind(accountRef, "codex");
         const started = this.sessions.startPkce(accountRef);
         try {
           if (accountRef !== undefined)
@@ -2415,7 +3212,8 @@ class ChatgptControl {
         const status = this.sessions.status(sessionId);
         if (status.state !== "pending")
           return jsonResponse(status);
-        const result = await this.sessions.completePkce(sessionId, requiredText(body.callbackUrl, 4096), (token, info, guard) => this.commitLogin(token, info, guard));
+        const complete = status.kind === "siwc" ? this.sessions.completeSiwc.bind(this.sessions) : this.sessions.completePkce.bind(this.sessions);
+        const result = await complete(sessionId, requiredText(body.callbackUrl, 4096), (token, info, guard) => this.commitLogin(token, info, guard));
         return jsonResponse({ account: result.result });
       }) },
       { path: "/login/device/complete", methods: ["POST"], handler: "completeDeviceLogin", invoke: invoke(async (context) => {
@@ -2457,9 +3255,9 @@ class ChatgptControl {
         const body = await this.readJson(context);
         exactKeys(body, ["accountRef"]);
         const accountRef = requiredText(body.accountRef, 128);
-        const account = await this.accounts.setStatus(accountRef, "revoked");
+        await this.accounts.remove(accountRef);
         this.usage.invalidateAccount(accountRef);
-        return jsonResponse({ account: accountListItem(account) });
+        return jsonResponse({ deleted: true });
       }) }
     ];
   }
@@ -2468,7 +3266,7 @@ class ChatgptControl {
       { name: "getCredential", handler: "getCredential", invoke: async (_payload, context) => {
         try {
           this.assertAlive(context.attempt.signal);
-          return await this.credential(accountRefFromBinding(context), context.attempt.signal);
+          return await this.credential(await this.bindingAccount(context), context.attempt.signal);
         } catch (error) {
           throw safeError(error);
         }
@@ -2478,7 +3276,7 @@ class ChatgptControl {
           this.assertAlive(context.attempt.signal);
           const body = record(payload);
           exactKeys(body, ["version"]);
-          return { rejected: await this.accounts.rejectAccess(accountRefFromBinding(context), requiredVersion(body.version)) };
+          return { rejected: await this.accounts.rejectAccess(await this.bindingAccount(context), requiredVersion(body.version)) };
         } catch (error) {
           throw safeError(error);
         }
@@ -2504,10 +3302,14 @@ function createControl(context, dependencies = {}) {
 }
 var api = Object.freeze([
   { path: "/accounts", methods: ["GET"], handler: "listAccounts" },
+  { path: "/accounts/codex", methods: ["GET"], handler: "listCodexAccounts" },
+  { path: "/accounts/siwc", methods: ["GET"], handler: "listSiwcAccounts" },
   { path: "/accounts/usage", methods: ["GET"], handler: "getAccountUsage" },
   { path: "/accounts/usage/reset", methods: ["POST"], handler: "resetAccountUsage" },
   { path: "/accounts/auto-reset", methods: ["POST"], handler: "setAutoResetCredits" },
   { path: "/accounts/draft", methods: ["POST"], handler: "createDraft" },
+  { path: "/accounts/siwc/draft", methods: ["POST"], handler: "createSiwcDraft" },
+  { path: "/login/siwc", methods: ["POST"], handler: "startSiwcLogin" },
   { path: "/login/device", methods: ["POST"], handler: "startDeviceLogin" },
   { path: "/login/pkce", methods: ["POST"], handler: "startPkceLogin" },
   { path: "/login/status", methods: ["GET"], handler: "getLoginStatus" },
@@ -2527,6 +3329,7 @@ export {
   CHATGPT_TARGET,
   CONTROL_HOST_CONTRACT_GAP,
   ControlError,
+  SIWC_TARGET,
   api,
   controlApi,
   controlRpc,
@@ -2535,4 +3338,4 @@ export {
   rpc
 };
 
-//# debugId=8E7B0629542A407F64756E2164756E21
+//# debugId=08B71A7DC584C3AB64756E2164756E21