@lumifai/harness-model-codex-oauth 0.1.0

package/README.md

@@ -0,0 +1,124 @@
+# @lumifai/harness-model-codex-oauth
+
+Mastra model gateway that bills OpenAI requests to a ChatGPT / Codex subscription
+(Plus, Pro, Team, Business, or Enterprise) instead of a Platform API key.
+Registering it lets any harness model string of the form
+`codex-oauth/openai/<model-id>` run against `chatgpt.com/backend-api/codex` with
+a subscription OAuth token, so mode models, subagents, and the model picker all
+work unchanged.
+
+The gateway is a thin credential swap over the standard `@ai-sdk/openai`
+Responses provider: streaming, tool calls, usage accounting, and reasoning are
+handled by that provider. The harness agent loop, tool permissions, and
+human-in-the-loop flow are untouched.
+
+## Before you enable this
+
+ChatGPT OAuth tokens are scoped to Codex / ChatGPT product surfaces. The
+Platform API (`api.openai.com`) rejects them, and the Codex backend rejects
+Platform API keys. This gateway talks to the subscription endpoint with the
+credential written by `codex login`, which means **it presents your application
+as a local Codex client**. Consequences you are accepting:
+
+- It is a deliberate reuse of a subscription credential outside the Codex CLI,
+  not a supported multi-tenant configuration. The subscription account is the
+  one at risk if OpenAI objects.
+- OpenAI can change the Codex backend check at any time and requests will start
+  failing with no deprecation path.
+- Use this only for local or self-hosted development where each developer
+  supplies their own credential. Do not ship it as a customer-facing auth path,
+  and do not use it for production or multi-tenant traffic.
+
+Because of that, the acknowledgement is a required constructor argument rather
+than an option with a default:
+
+```typescript
+createCodexOAuthGateway({ acknowledgeCodexSubscription: true });
+```
+
+For anything customer-facing, use a normal `OPENAI_API_KEY` with the built-in
+`openai/*` models instead.
+
+## Install
+
+```bash
+pnpm add @lumifai/harness-model-codex-oauth
+```
+
+## Get credentials
+
+Requires a ChatGPT plan that includes Codex. Sign in once with the Codex CLI:
+
+```bash
+codex login
+```
+
+That writes `~/.codex/auth.json` (access token, refresh token, account id). The
+gateway reads that file by default and refreshes the access token in place when
+it is near expiry. No env var export is required for the common local path.
+
+Fallback when no auth file is present (typical in CI). To use a non-default
+auth file path, set `CODEX_HOME` instead — env tokens do not override an
+existing `auth.json`:
+
+```bash
+export CODEX_OAUTH_ACCESS_TOKEN='…'
+export CODEX_OAUTH_ACCOUNT_ID='…'          # or embed the chatgpt_account_id claim in the JWT
+export CODEX_OAUTH_REFRESH_TOKEN='…'       # optional; enables refresh without the auth file
+# or point at a non-default Codex home:
+export CODEX_HOME='/path/to/codex-home'
+```
+
+Treat these as secrets. The gateway resolves credentials per request, so a
+rotated token is picked up without a restart.
+
+## Register the gateway
+
+```typescript
+import { createHarnessSessionManager } from '@lumifai/harness-server';
+import { createCodexOAuthGateway } from '@lumifai/harness-model-codex-oauth';
+
+const manager = createHarnessSessionManager({
+  bootConfig: {
+    gateways: [createCodexOAuthGateway({ acknowledgeCodexSubscription: true })],
+
+    planModel: 'codex-oauth/openai/gpt-5.4',
+    buildModel: 'codex-oauth/openai/gpt-5.4',
+
+    workspaceBasePath: './workspace',
+    workspaceMode: 'local',
+  },
+});
+```
+
+The gateway claims only `codex-oauth/…` model ids, so bare `openai/…` ids keep
+routing to the API-key provider and both can coexist in one process.
+
+The advertised catalog is static, so model resolution works offline and issues
+no network call at boot. Pass `models` to advertise a different set:
+
+```typescript
+createCodexOAuthGateway({
+  acknowledgeCodexSubscription: true,
+  models: ['gpt-5.6-luna', 'gpt-5.4', 'gpt-5.4-mini'],
+});
+```
+
+Other options: `resolveCredentials` replaces the auth-file / env lookup (for a
+secret manager), `baseURL` points at a proxy in front of the Codex backend, and
+`originator` overrides the upstream identity header (defaults to `codex_cli_rs`).
+The subscription bearer token is sent to whatever host `baseURL` resolves to —
+only use a proxy you trust.
+
+## Notes
+
+- **Rate limits are your subscription's.** Quotas are far tighter than
+  pay-as-you-go API limits and are shared with your own Codex CLI usage. Expect
+  rate-limit errors under concurrent load.
+- **Responses API only.** The Codex ChatGPT backend speaks
+  `/backend-api/codex/responses`, not Chat Completions. The gateway configures
+  `@ai-sdk/openai` accordingly.
+- **API credentials do not interfere.** This gateway never reads
+  `OPENAI_API_KEY`, so there is no credential precedence to unset.
+- **Not multi-tenant.** One local credential per process. Do not pool or
+  redistribute tokens across users.

package/dist/auth.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Loads ChatGPT / Codex subscription OAuth credentials for local use.
+ *
+ * Default source is the auth file written by `codex login`
+ * (`~/.codex/auth.json`). Tokens expire, so callers should run them through
+ * {@link ensureFreshCodexCredentials} before each request.
+ */
+export declare const CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR = "CODEX_OAUTH_ACCESS_TOKEN";
+export declare const CODEX_OAUTH_ACCOUNT_ID_ENV_VAR = "CODEX_OAUTH_ACCOUNT_ID";
+export declare const CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR = "CODEX_OAUTH_REFRESH_TOKEN";
+/** Codex CLI's public OAuth client id (not a secret). */
+export declare const CODEX_OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const CODEX_OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token";
+/** Refresh when the access token is within this many ms of expiry. */
+export declare const CODEX_OAUTH_REFRESH_MARGIN_MS: number;
+export type CodexOAuthCredentials = {
+    accessToken: string;
+    accountId: string;
+    refreshToken?: string;
+    idToken?: string;
+    /** Absolute expiry time of the access token, in epoch milliseconds. */
+    expiresAt?: number;
+    /** Path of the auth file these credentials were loaded from, if any. */
+    authFilePath?: string;
+};
+export type CodexOAuthCredentialsResolver = () => CodexOAuthCredentials | undefined | Promise<CodexOAuthCredentials | undefined>;
+/** Best-effort JWT payload decode — no signature verification. */
+export declare function parseJwtClaims(token: string): Record<string, unknown> | undefined;
+export declare function deriveAccountId(...tokens: Array<string | undefined>): string | undefined;
+export declare function deriveExpiresAtMs(token: string): number | undefined;
+/** Candidate auth.json paths, matching Codex / ChatGPT local CLI conventions. */
+export declare function resolveCodexAuthFileCandidates(env?: NodeJS.ProcessEnv, home?: string): string[];
+export declare function loadCodexAuthFile(path: string): (CodexOAuthCredentials & {
+    authFilePath: string;
+}) | undefined;
+export declare function resolveCodexCredentialsFromEnv(env?: NodeJS.ProcessEnv): CodexOAuthCredentials | undefined;
+/**
+ * Default credential lookup: first existing Codex auth file, then env fallback
+ * when no auth file is present. (`CODEX_HOME` covers a non-default auth file path.)
+ */
+export declare function resolveCodexCredentials(env?: NodeJS.ProcessEnv, home?: string): CodexOAuthCredentials | undefined;
+export declare function needsCodexTokenRefresh(credentials: CodexOAuthCredentials, now?: number, marginMs?: number): boolean;
+export type RefreshCodexTokensOptions = {
+    refreshToken: string;
+    /** Fallback when the refreshed tokens omit `chatgpt_account_id`. */
+    accountId?: string;
+    fetchImpl?: typeof fetch;
+    clientId?: string;
+    tokenUrl?: string;
+    now?: () => number;
+};
+export declare function refreshCodexTokens(options: RefreshCodexTokensOptions): Promise<CodexOAuthCredentials | undefined>;
+/** Writes refreshed tokens back to a Codex-compatible auth.json (mode 0600). */
+export declare function persistCodexAuthFile(path: string, credentials: CodexOAuthCredentials): void;
+export type EnsureFreshCodexCredentialsOptions = {
+    credentials: CodexOAuthCredentials;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    /** Persist refreshed tokens. Defaults to writing `credentials.authFilePath` when set. */
+    persist?: (credentials: CodexOAuthCredentials) => void | Promise<void>;
+    refreshMarginMs?: number;
+    /** Ignore expiry margin and refresh whenever a refresh token is available. */
+    forceRefresh?: boolean;
+};
+/**
+ * Returns credentials that are not near expiry, refreshing via the Codex OAuth
+ * client when a refresh token is available.
+ */
+export declare function ensureFreshCodexCredentials(options: EnsureFreshCodexCredentialsOptions): Promise<CodexOAuthCredentials>;
+/**
+ * Prefer an in-memory refreshed snapshot over a stale env/file reload of the
+ * same account so env-only credentials do not re-refresh on every request.
+ */
+export declare function mergeCredentialSnapshot(cached: CodexOAuthCredentials | undefined, resolved: CodexOAuthCredentials): CodexOAuthCredentials;
+export type LiveCodexCredentialsResolver = {
+    resolve: (options?: {
+        forceRefresh?: boolean;
+    }) => Promise<CodexOAuthCredentials>;
+};
+export type CreateLiveCodexCredentialsResolverOptions = {
+    resolveCredentials?: CodexOAuthCredentialsResolver;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    persist?: EnsureFreshCodexCredentialsOptions['persist'];
+    refreshMarginMs?: number;
+};
+/**
+ * Per-gateway credential cache with in-flight refresh dedup. Concurrent callers
+ * share one refresh; sequential callers reuse the cached access token until it
+ * nears expiry (including the env-var path with no auth file to persist to).
+ */
+export declare function createLiveCodexCredentialsResolver(options?: CreateLiveCodexCredentialsResolverOptions): LiveCodexCredentialsResolver;

package/dist/auth.js

@@ -0,0 +1,348 @@
+"use strict";
+/**
+ * Loads ChatGPT / Codex subscription OAuth credentials for local use.
+ *
+ * Default source is the auth file written by `codex login`
+ * (`~/.codex/auth.json`). Tokens expire, so callers should run them through
+ * {@link ensureFreshCodexCredentials} before each request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_OAUTH_REFRESH_MARGIN_MS = exports.CODEX_OAUTH_TOKEN_URL = exports.CODEX_OAUTH_CLIENT_ID = exports.CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR = exports.CODEX_OAUTH_ACCOUNT_ID_ENV_VAR = exports.CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR = void 0;
+exports.parseJwtClaims = parseJwtClaims;
+exports.deriveAccountId = deriveAccountId;
+exports.deriveExpiresAtMs = deriveExpiresAtMs;
+exports.resolveCodexAuthFileCandidates = resolveCodexAuthFileCandidates;
+exports.loadCodexAuthFile = loadCodexAuthFile;
+exports.resolveCodexCredentialsFromEnv = resolveCodexCredentialsFromEnv;
+exports.resolveCodexCredentials = resolveCodexCredentials;
+exports.needsCodexTokenRefresh = needsCodexTokenRefresh;
+exports.refreshCodexTokens = refreshCodexTokens;
+exports.persistCodexAuthFile = persistCodexAuthFile;
+exports.ensureFreshCodexCredentials = ensureFreshCodexCredentials;
+exports.mergeCredentialSnapshot = mergeCredentialSnapshot;
+exports.createLiveCodexCredentialsResolver = createLiveCodexCredentialsResolver;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_fs_1 = require("node:fs");
+exports.CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR = 'CODEX_OAUTH_ACCESS_TOKEN';
+exports.CODEX_OAUTH_ACCOUNT_ID_ENV_VAR = 'CODEX_OAUTH_ACCOUNT_ID';
+exports.CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR = 'CODEX_OAUTH_REFRESH_TOKEN';
+/** Codex CLI's public OAuth client id (not a secret). */
+exports.CODEX_OAUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+exports.CODEX_OAUTH_TOKEN_URL = 'https://auth.openai.com/oauth/token';
+/** Refresh when the access token is within this many ms of expiry. */
+exports.CODEX_OAUTH_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Best-effort JWT payload decode — no signature verification. */
+function parseJwtClaims(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[1])
+        return undefined;
+    try {
+        const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const json = Buffer.from(padded + '='.repeat((4 - (padded.length % 4)) % 4), 'base64').toString('utf8');
+        const parsed = JSON.parse(json);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function deriveAccountId(...tokens) {
+    for (const token of tokens) {
+        if (!token)
+            continue;
+        const claims = parseJwtClaims(token);
+        const auth = claims?.['https://api.openai.com/auth'];
+        if (isRecord(auth) && typeof auth.chatgpt_account_id === 'string' && auth.chatgpt_account_id) {
+            return auth.chatgpt_account_id;
+        }
+    }
+    return undefined;
+}
+function deriveExpiresAtMs(token) {
+    const claims = parseJwtClaims(token);
+    return typeof claims?.exp === 'number' ? claims.exp * 1000 : undefined;
+}
+/** Candidate auth.json paths, matching Codex / ChatGPT local CLI conventions. */
+function resolveCodexAuthFileCandidates(env = process.env, home = (0, node_os_1.homedir)()) {
+    const paths = [];
+    if (env.CODEX_HOME)
+        paths.push((0, node_path_1.join)(env.CODEX_HOME, 'auth.json'));
+    if (env.CHATGPT_LOCAL_HOME)
+        paths.push((0, node_path_1.join)(env.CHATGPT_LOCAL_HOME, 'auth.json'));
+    paths.push((0, node_path_1.join)(home, '.codex', 'auth.json'));
+    paths.push((0, node_path_1.join)(home, '.chatgpt-local', 'auth.json'));
+    return paths;
+}
+function loadCodexAuthFile(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return undefined;
+    let raw;
+    try {
+        raw = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(raw) || !isRecord(raw.tokens))
+        return undefined;
+    const tokens = raw.tokens;
+    const accessToken = tokens?.access_token?.trim();
+    if (!accessToken)
+        return undefined;
+    const accountId = tokens?.account_id?.trim() || deriveAccountId(tokens?.id_token, accessToken);
+    if (!accountId)
+        return undefined;
+    return {
+        accessToken,
+        accountId,
+        refreshToken: tokens?.refresh_token?.trim() || undefined,
+        idToken: tokens?.id_token?.trim() || undefined,
+        expiresAt: deriveExpiresAtMs(accessToken),
+        authFilePath: path,
+    };
+}
+function resolveCodexCredentialsFromEnv(env = process.env) {
+    const accessToken = env[exports.CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR]?.trim();
+    if (!accessToken)
+        return undefined;
+    const accountId = env[exports.CODEX_OAUTH_ACCOUNT_ID_ENV_VAR]?.trim() || deriveAccountId(accessToken);
+    if (!accountId)
+        return undefined;
+    return {
+        accessToken,
+        accountId,
+        refreshToken: env[exports.CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR]?.trim() || undefined,
+        expiresAt: deriveExpiresAtMs(accessToken),
+    };
+}
+/**
+ * Default credential lookup: first existing Codex auth file, then env fallback
+ * when no auth file is present. (`CODEX_HOME` covers a non-default auth file path.)
+ */
+function resolveCodexCredentials(env = process.env, home = (0, node_os_1.homedir)()) {
+    for (const path of resolveCodexAuthFileCandidates(env, home)) {
+        const fromFile = loadCodexAuthFile(path);
+        if (fromFile)
+            return fromFile;
+    }
+    return resolveCodexCredentialsFromEnv(env);
+}
+function needsCodexTokenRefresh(credentials, now = Date.now(), marginMs = exports.CODEX_OAUTH_REFRESH_MARGIN_MS) {
+    const expiresAt = credentials.expiresAt ?? deriveExpiresAtMs(credentials.accessToken);
+    if (expiresAt == null || expiresAt <= 0)
+        return false;
+    return expiresAt <= now + marginMs;
+}
+async function refreshCodexTokens(options) {
+    const doFetch = options.fetchImpl ?? globalThis.fetch;
+    const response = await doFetch(options.tokenUrl ?? exports.CODEX_OAUTH_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: options.refreshToken,
+            client_id: options.clientId ?? exports.CODEX_OAUTH_CLIENT_ID,
+            scope: 'openid profile email offline_access',
+        }).toString(),
+    });
+    if (!response.ok)
+        return undefined;
+    const payload = (await response.json());
+    if (!payload.access_token)
+        return undefined;
+    const now = options.now?.() ?? Date.now();
+    const accountId = deriveAccountId(payload.id_token, payload.access_token) ?? options.accountId;
+    if (!accountId)
+        return undefined;
+    return {
+        accessToken: payload.access_token,
+        refreshToken: payload.refresh_token ?? options.refreshToken,
+        idToken: payload.id_token,
+        accountId,
+        expiresAt: now + (payload.expires_in ?? 3600) * 1000,
+    };
+}
+/** Writes refreshed tokens back to a Codex-compatible auth.json (mode 0600). */
+function persistCodexAuthFile(path, credentials) {
+    let existing = {};
+    if ((0, node_fs_1.existsSync)(path)) {
+        try {
+            const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            if (isRecord(parsed))
+                existing = parsed;
+        }
+        catch {
+            existing = {};
+        }
+    }
+    else {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+    }
+    const next = {
+        ...existing,
+        auth_mode: existing.auth_mode ?? 'chatgpt',
+        tokens: {
+            ...(isRecord(existing.tokens) ? existing.tokens : {}),
+            access_token: credentials.accessToken,
+            account_id: credentials.accountId,
+            // Only overwrite optional fields when present — a refresh_token grant often
+            // omits id_token, and JSON.stringify would otherwise delete the existing key.
+            ...(credentials.refreshToken ? { refresh_token: credentials.refreshToken } : {}),
+            ...(credentials.idToken ? { id_token: credentials.idToken } : {}),
+        },
+        last_refresh: new Date().toISOString(),
+    };
+    const tmpPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        (0, node_fs_1.writeFileSync)(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+        try {
+            (0, node_fs_1.chmodSync)(tmpPath, 0o600);
+        }
+        catch {
+            // Best-effort on platforms that ignore mode.
+        }
+        (0, node_fs_1.renameSync)(tmpPath, path);
+    }
+    catch (error) {
+        try {
+            (0, node_fs_1.unlinkSync)(tmpPath);
+        }
+        catch {
+            // Ignore cleanup failures.
+        }
+        throw error;
+    }
+}
+/**
+ * Returns credentials that are not near expiry, refreshing via the Codex OAuth
+ * client when a refresh token is available.
+ */
+async function ensureFreshCodexCredentials(options) {
+    const { credentials } = options;
+    const now = options.now?.() ?? Date.now();
+    const shouldRefresh = options.forceRefresh || needsCodexTokenRefresh(credentials, now, options.refreshMarginMs);
+    if (!shouldRefresh) {
+        return credentials;
+    }
+    if (!credentials.refreshToken) {
+        if (options.forceRefresh || needsCodexTokenRefresh(credentials, now, 0)) {
+            throw new Error('Codex subscription OAuth token expired and no refresh token is available. Run `codex login`.');
+        }
+        return credentials;
+    }
+    const refreshed = await refreshCodexTokens({
+        refreshToken: credentials.refreshToken,
+        accountId: credentials.accountId,
+        fetchImpl: options.fetchImpl,
+        now: options.now,
+    });
+    if (!refreshed) {
+        if (options.forceRefresh || needsCodexTokenRefresh(credentials, now, 0)) {
+            throw new Error('Codex subscription OAuth token expired and refresh failed. Run `codex login`.');
+        }
+        return credentials;
+    }
+    const next = {
+        ...refreshed,
+        // Preserve an existing id_token when the refresh response omitted one.
+        idToken: refreshed.idToken ?? credentials.idToken,
+        authFilePath: credentials.authFilePath,
+    };
+    if (options.persist) {
+        await options.persist(next);
+    }
+    else if (credentials.authFilePath) {
+        persistCodexAuthFile(credentials.authFilePath, next);
+    }
+    return next;
+}
+function credentialExpiryMs(credentials) {
+    return credentials.expiresAt ?? deriveExpiresAtMs(credentials.accessToken) ?? 0;
+}
+/**
+ * Prefer an in-memory refreshed snapshot over a stale env/file reload of the
+ * same account so env-only credentials do not re-refresh on every request.
+ */
+function mergeCredentialSnapshot(cached, resolved) {
+    if (!cached)
+        return resolved;
+    if (cached.accountId !== resolved.accountId)
+        return resolved;
+    if (cached.authFilePath &&
+        resolved.authFilePath &&
+        cached.authFilePath !== resolved.authFilePath) {
+        return resolved;
+    }
+    if (credentialExpiryMs(cached) < credentialExpiryMs(resolved)) {
+        return {
+            ...resolved,
+            idToken: resolved.idToken ?? cached.idToken,
+            refreshToken: resolved.refreshToken ?? cached.refreshToken,
+            authFilePath: resolved.authFilePath ?? cached.authFilePath,
+        };
+    }
+    return {
+        ...resolved,
+        accessToken: cached.accessToken,
+        refreshToken: cached.refreshToken ?? resolved.refreshToken,
+        idToken: cached.idToken ?? resolved.idToken,
+        expiresAt: cached.expiresAt ?? resolved.expiresAt,
+        authFilePath: resolved.authFilePath ?? cached.authFilePath,
+    };
+}
+/**
+ * Per-gateway credential cache with in-flight refresh dedup. Concurrent callers
+ * share one refresh; sequential callers reuse the cached access token until it
+ * nears expiry (including the env-var path with no auth file to persist to).
+ */
+function createLiveCodexCredentialsResolver(options = {}) {
+    let cached;
+    let inflight;
+    let inflightForce = false;
+    return {
+        async resolve({ forceRefresh = false } = {}) {
+            if (inflight && (!forceRefresh || inflightForce)) {
+                return inflight;
+            }
+            const previous = inflight;
+            const run = (async () => {
+                if (previous) {
+                    try {
+                        await previous;
+                    }
+                    catch {
+                        // Prior attempt failed; continue with a fresh resolve.
+                    }
+                }
+                const resolved = await (options.resolveCredentials ?? resolveCodexCredentials)();
+                if (!resolved) {
+                    throw new Error('Codex subscription OAuth credentials missing. Run `codex login` (writes ~/.codex/auth.json) or export CODEX_OAUTH_ACCESS_TOKEN and CODEX_OAUTH_ACCOUNT_ID.');
+                }
+                const candidate = mergeCredentialSnapshot(cached, resolved);
+                const fresh = await ensureFreshCodexCredentials({
+                    credentials: candidate,
+                    fetchImpl: options.fetchImpl,
+                    now: options.now,
+                    persist: options.persist,
+                    refreshMarginMs: options.refreshMarginMs,
+                    forceRefresh,
+                });
+                cached = fresh;
+                return fresh;
+            })().finally(() => {
+                if (inflight === run) {
+                    inflight = undefined;
+                    inflightForce = false;
+                }
+            });
+            inflight = run;
+            inflightForce = forceRefresh;
+            return run;
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAwDH,wCAcC;AAED,0CAUC;AAED,8CAGC;AAGD,wEAUC;AAED,8CA4BC;AAED,wEAeC;AAMD,0DASC;AAED,wDAQC;AAYD,gDAoCC;AAGD,oDA6CC;AAiBD,kEAmDC;AAUD,0DA+BC;AAmBD,gFAqDC;AA/bD,qCAAkC;AAClC,yCAA0C;AAC1C,qCAQiB;AAEJ,QAAA,gCAAgC,GAAG,0BAA0B,CAAC;AAC9D,QAAA,8BAA8B,GAAG,wBAAwB,CAAC;AAC1D,QAAA,iCAAiC,GAAG,2BAA2B,CAAC;AAE7E,yDAAyD;AAC5C,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AAEvD,QAAA,qBAAqB,GAAG,qCAAqC,CAAC;AAE3E,sEAAsE;AACzD,QAAA,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA2B3D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kEAAkE;AAClE,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAC7F,MAAM,CACP,CAAC;QACF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAAC,GAAG,MAAiC;IAClE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,6BAA6B,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED,iFAAiF;AACjF,SAAgB,8BAA8B,CAC5C,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,IAAA,iBAAO,GAAE;IAExB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,kBAAkB;QAAE,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,iBAAiB,CAC/B,IAAY;IAEZ,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAiC,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/F,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,OAAO;QACL,WAAW;QACX,SAAS;QACT,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS;QACxD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS;QAC9C,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC;QACzC,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAC5C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,WAAW,GAAG,GAAG,CAAC,wCAAgC,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,SAAS,GAAG,GAAG,CAAC,sCAA8B,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;IAC9F,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,OAAO;QACL,WAAW;QACX,SAAS;QACT,YAAY,EAAE,GAAG,CAAC,yCAAiC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;QACzE,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG,EACpC,OAAe,IAAA,iBAAO,GAAE;IAExB,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,8BAA8B,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAgB,sBAAsB,CACpC,WAAkC,EAClC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,QAAQ,GAAG,qCAA6B;IAExC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,IAAI,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACtF,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,SAAS,IAAI,GAAG,GAAG,QAAQ,CAAC;AACrC,CAAC;AAYM,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,6BAAqB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;YACnC,SAAS,EAAE,OAAO,CAAC,QAAQ,IAAI,6BAAqB;YACpD,KAAK,EAAE,qCAAqC;SAC7C,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKrC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC;IAC/F,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,YAAY;QACjC,YAAY,EAAE,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY;QAC3D,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,SAAS;QACT,SAAS,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;KACrD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAgB,oBAAoB,CAAC,IAAY,EAAE,WAAkC;IACnF,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG;QACX,GAAG,QAAQ;QACX,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS;QAC1C,MAAM,EAAE;YACN,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,YAAY,EAAE,WAAW,CAAC,WAAW;YACrC,UAAU,EAAE,WAAW,CAAC,SAAS;YACjC,4EAA4E;YAC5E,8EAA8E;YAC9E,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACD,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC3D,IAAI,CAAC;QACH,IAAA,uBAAa,EAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;QACD,IAAA,oBAAU,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAaD;;;GAGG;AACI,KAAK,UAAU,2BAA2B,CAC/C,OAA2C;IAE3C,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,aAAa,GACjB,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAE5F,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAA0B;QAClC,GAAG,SAAS;QACZ,uEAAuE;QACvE,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO;QACjD,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QACpC,oBAAoB,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAkC;IAC5D,OAAO,WAAW,CAAC,SAAS,IAAI,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,MAAyC,EACzC,QAA+B;IAE/B,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC7D,IACE,MAAM,CAAC,YAAY;QACnB,QAAQ,CAAC,YAAY;QACrB,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAC7C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,GAAG,QAAQ;YACX,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;YAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;YAC1D,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;SAC3D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;QAC1D,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;QACjD,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;KAC3D,CAAC;AACJ,CAAC;AAcD;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,UAAqD,EAAE;IAEvD,IAAI,MAAyC,CAAC;IAC9C,IAAI,QAAoD,CAAC;IACzD,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,EAAE;YACzC,IAAI,QAAQ,IAAI,CAAC,CAAC,YAAY,IAAI,aAAa,CAAC,EAAE,CAAC;gBACjD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC;YAC1B,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC;oBACjB,CAAC;oBAAC,MAAM,CAAC;wBACP,uDAAuD;oBACzD,CAAC;gBACH,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,4JAA4J,CAC7J,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC5D,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;oBAC9C,WAAW,EAAE,SAAS;oBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,YAAY;iBACb,CAAC,CAAC;gBACH,MAAM,GAAG,KAAK,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACrB,QAAQ,GAAG,SAAS,CAAC;oBACrB,aAAa,GAAG,KAAK,CAAC;gBACxB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,QAAQ,GAAG,GAAG,CAAC;YACf,aAAa,GAAG,YAAY,CAAC;YAC7B,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,60 @@
+import { MastraModelGateway } from '@mastra/core/llm';
+import type { GatewayLanguageModel, ProviderConfig } from '@mastra/core/llm';
+import { type CodexOAuthCredentialsResolver } from './auth';
+import { type CodexOAuthModelId } from './models';
+import { type CreateCodexOAuthFetchOptions } from './oauth-fetch';
+export type CodexOAuthGatewayOptions = {
+    /**
+     * Required, explicit opt-in. This gateway bills ChatGPT / Codex subscription
+     * quotas via OAuth credentials intended for the Codex CLI. Only enable it for
+     * local/self-hosted use where each developer supplies their own credential;
+     * never as a customer-facing or multi-tenant auth path. See README
+     * "Before you enable this".
+     */
+    acknowledgeCodexSubscription: true;
+    /** Model ids to advertise under `codex-oauth/openai/<id>`. */
+    models?: ReadonlyArray<CodexOAuthModelId>;
+    /**
+     * Overrides the default `~/.codex/auth.json` / env lookup. Invoked on every
+     * outbound Codex request so a rotated token is picked up without resolving a
+     * new language model.
+     */
+    resolveCredentials?: CodexOAuthCredentialsResolver;
+    /**
+     * Overrides the Codex Responses base URL (proxy in front of it). The
+     * subscription OAuth bearer token is sent to whatever host this resolves to —
+     * only point it at a proxy you trust.
+     */
+    baseURL?: string;
+    /** Upstream `originator` header. Pass `false` to omit. */
+    originator?: CreateCodexOAuthFetchOptions['originator'];
+    /** Injected in tests. */
+    fetchImpl?: typeof fetch;
+};
+export declare function createCodexOAuthGateway(options: CodexOAuthGatewayOptions): CodexOAuthGateway;
+export declare class CodexOAuthGateway extends MastraModelGateway {
+    readonly id: "codex-oauth";
+    readonly name = "Codex subscription (OAuth)";
+    private readonly models;
+    private readonly resolveCredentials;
+    private readonly liveCredentials;
+    private readonly oauthFetch;
+    private readonly baseURL;
+    private readonly originator;
+    private readonly fetchImpl?;
+    constructor(options: CodexOAuthGatewayOptions);
+    /**
+     * Claims only ids carrying this gateway's own prefix. Bare `openai/*` ids
+     * keep routing to the API-key provider so both can coexist in one process.
+     */
+    handlesModel(modelId: string): boolean;
+    fetchProviders(): Promise<Record<string, ProviderConfig>>;
+    buildUrl(): Promise<string | undefined>;
+    getApiKey(): Promise<string>;
+    resolveLanguageModel(args: {
+        modelId: string;
+        providerId: string;
+        apiKey: string;
+        headers?: Record<string, string>;
+    }): Promise<GatewayLanguageModel>;
+}

package/dist/gateway.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexOAuthGateway = void 0;
+exports.createCodexOAuthGateway = createCodexOAuthGateway;
+const openai_1 = require("@ai-sdk/openai");
+const llm_1 = require("@mastra/core/llm");
+const auth_1 = require("./auth");
+const models_1 = require("./models");
+const oauth_fetch_1 = require("./oauth-fetch");
+function createCodexOAuthGateway(options) {
+    return new CodexOAuthGateway(options);
+}
+class CodexOAuthGateway extends llm_1.MastraModelGateway {
+    id = models_1.CODEX_OAUTH_GATEWAY_ID;
+    name = 'Codex subscription (OAuth)';
+    models;
+    resolveCredentials;
+    liveCredentials;
+    oauthFetch;
+    baseURL;
+    originator;
+    fetchImpl;
+    constructor(options) {
+        super();
+        if (options?.acknowledgeCodexSubscription !== true) {
+            throw new Error('CodexOAuthGateway requires `acknowledgeCodexSubscription: true`. Subscription OAuth tokens are only for local Codex use; see the package README before enabling this.');
+        }
+        this.models = options.models?.length ? [...options.models] : models_1.DEFAULT_CODEX_OAUTH_MODELS;
+        this.resolveCredentials = options.resolveCredentials ?? auth_1.resolveCodexCredentials;
+        this.baseURL = options.baseURL ?? oauth_fetch_1.CODEX_RESPONSES_BASE_URL;
+        this.originator = options.originator;
+        this.fetchImpl = options.fetchImpl;
+        this.liveCredentials = (0, auth_1.createLiveCodexCredentialsResolver)({
+            resolveCredentials: () => this.resolveCredentials(),
+            fetchImpl: this.fetchImpl,
+        });
+        this.oauthFetch = (0, oauth_fetch_1.createCodexOAuthFetch)({
+            liveCredentials: this.liveCredentials,
+            originator: this.originator,
+            fetchImpl: this.fetchImpl,
+        });
+    }
+    /**
+     * Claims only ids carrying this gateway's own prefix. Bare `openai/*` ids
+     * keep routing to the API-key provider so both can coexist in one process.
+     */
+    handlesModel(modelId) {
+        return modelId.startsWith(`${this.id}/`);
+    }
+    async fetchProviders() {
+        return {
+            [models_1.CODEX_OAUTH_PROVIDER_ID]: {
+                name: 'OpenAI (Codex subscription)',
+                apiKeyEnvVar: auth_1.CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR,
+                gateway: this.id,
+                models: [...this.models],
+                docUrl: 'https://developers.openai.com/codex/',
+            },
+        };
+    }
+    async buildUrl() {
+        // The OpenAI provider owns its own URL from `baseURL`; nothing to build here.
+        return undefined;
+    }
+    async getApiKey() {
+        const fresh = await this.liveCredentials.resolve();
+        return fresh.accessToken;
+    }
+    async resolveLanguageModel(args) {
+        if (args.providerId !== models_1.CODEX_OAUTH_PROVIDER_ID) {
+            throw new Error(`CodexOAuthGateway only supports providerId="${models_1.CODEX_OAUTH_PROVIDER_ID}" (got ${args.providerId})`);
+        }
+        const openai = (0, openai_1.createOpenAI)({
+            // The bearer token is applied by the fetch wrapper. This placeholder only
+            // satisfies the provider's required apiKey setting.
+            apiKey: 'codex-oauth',
+            baseURL: this.baseURL,
+            headers: args.headers,
+            // Prefer the live resolver over Mastra's captured `args.apiKey` so a
+            // rotated / refreshed token is used on the next request without
+            // re-resolving the model. The fetch instance is shared so concurrent
+            // requests dedupe token refresh.
+            fetch: this.oauthFetch,
+        });
+        // Default OpenAI factory uses the Responses API, which is what the Codex
+        // ChatGPT backend speaks (`…/codex/responses`).
+        return openai((0, models_1.stripCodexOAuthPrefix)(args.modelId));
+    }
+}
+exports.CodexOAuthGateway = CodexOAuthGateway;
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":";;;AAsDA,0DAEC;AAxDD,2CAA8C;AAC9C,0CAAsD;AAItD,iCAMgB;AAChB,qCAMkB;AAClB,+CAIuB;AA+BvB,SAAgB,uBAAuB,CAAC,OAAiC;IACvE,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAa,iBAAkB,SAAQ,wBAAkB;IAC9C,EAAE,GAAG,+BAAsB,CAAC;IAC5B,IAAI,GAAG,4BAA4B,CAAC;IAE5B,MAAM,CAAmC;IACzC,kBAAkB,CAAgC;IAClD,eAAe,CAA+B;IAC9C,UAAU,CAAe;IACzB,OAAO,CAAS;IAChB,UAAU,CAA6C;IACvD,SAAS,CAAgB;IAE1C,YAAY,OAAiC;QAC3C,KAAK,EAAE,CAAC;QAER,IAAI,OAAO,EAAE,4BAA4B,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,uKAAuK,CACxK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAA0B,CAAC;QACxF,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,8BAAuB,CAAC;QAChF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,sCAAwB,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,IAAA,yCAAkC,EAAC;YACxD,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAA,mCAAqB,EAAC;YACtC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,OAAe;QAC1B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO;YACL,CAAC,gCAAuB,CAAC,EAAE;gBACzB,IAAI,EAAE,6BAA6B;gBACnC,YAAY,EAAE,uCAAgC;gBAC9C,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;gBACxB,MAAM,EAAE,sCAAsC;aAC/C;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,8EAA8E;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAK1B;QACC,IAAI,IAAI,CAAC,UAAU,KAAK,gCAAuB,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,+CAA+C,gCAAuB,UAAU,IAAI,CAAC,UAAU,GAAG,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC;YAC1B,0EAA0E;YAC1E,oDAAoD;YACpD,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,iCAAiC;YACjC,KAAK,EAAE,IAAI,CAAC,UAAU;SACvB,CAAC,CAAC;QAEH,yEAAyE;QACzE,gDAAgD;QAChD,OAAO,MAAM,CAAC,IAAA,8BAAqB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAyB,CAAC;IAC7E,CAAC;CACF;AAhGD,8CAgGC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { CodexOAuthGateway, createCodexOAuthGateway } from './gateway';
+export type { CodexOAuthGatewayOptions } from './gateway';
+export { CODEX_OAUTH_GATEWAY_ID, CODEX_OAUTH_PROVIDER_ID, DEFAULT_CODEX_OAUTH_MODELS, } from './models';
+export type { CodexOAuthModelId, CodexOAuthProviderId } from './models';
+export { CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR, CODEX_OAUTH_ACCOUNT_ID_ENV_VAR, CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR, resolveCodexCredentials, } from './auth';
+export type { CodexOAuthCredentials, CodexOAuthCredentialsResolver } from './auth';
+export { CODEX_RESPONSES_BASE_URL } from './oauth-fetch';

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_RESPONSES_BASE_URL = exports.resolveCodexCredentials = exports.CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR = exports.CODEX_OAUTH_ACCOUNT_ID_ENV_VAR = exports.CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR = exports.DEFAULT_CODEX_OAUTH_MODELS = exports.CODEX_OAUTH_PROVIDER_ID = exports.CODEX_OAUTH_GATEWAY_ID = exports.createCodexOAuthGateway = exports.CodexOAuthGateway = void 0;
+var gateway_1 = require("./gateway");
+Object.defineProperty(exports, "CodexOAuthGateway", { enumerable: true, get: function () { return gateway_1.CodexOAuthGateway; } });
+Object.defineProperty(exports, "createCodexOAuthGateway", { enumerable: true, get: function () { return gateway_1.createCodexOAuthGateway; } });
+var models_1 = require("./models");
+Object.defineProperty(exports, "CODEX_OAUTH_GATEWAY_ID", { enumerable: true, get: function () { return models_1.CODEX_OAUTH_GATEWAY_ID; } });
+Object.defineProperty(exports, "CODEX_OAUTH_PROVIDER_ID", { enumerable: true, get: function () { return models_1.CODEX_OAUTH_PROVIDER_ID; } });
+Object.defineProperty(exports, "DEFAULT_CODEX_OAUTH_MODELS", { enumerable: true, get: function () { return models_1.DEFAULT_CODEX_OAUTH_MODELS; } });
+var auth_1 = require("./auth");
+Object.defineProperty(exports, "CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR", { enumerable: true, get: function () { return auth_1.CODEX_OAUTH_ACCESS_TOKEN_ENV_VAR; } });
+Object.defineProperty(exports, "CODEX_OAUTH_ACCOUNT_ID_ENV_VAR", { enumerable: true, get: function () { return auth_1.CODEX_OAUTH_ACCOUNT_ID_ENV_VAR; } });
+Object.defineProperty(exports, "CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR", { enumerable: true, get: function () { return auth_1.CODEX_OAUTH_REFRESH_TOKEN_ENV_VAR; } });
+Object.defineProperty(exports, "resolveCodexCredentials", { enumerable: true, get: function () { return auth_1.resolveCodexCredentials; } });
+var oauth_fetch_1 = require("./oauth-fetch");
+Object.defineProperty(exports, "CODEX_RESPONSES_BASE_URL", { enumerable: true, get: function () { return oauth_fetch_1.CODEX_RESPONSES_BASE_URL; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qCAAuE;AAA9D,4GAAA,iBAAiB,OAAA;AAAE,kHAAA,uBAAuB,OAAA;AAEnD,mCAIkB;AAHhB,gHAAA,sBAAsB,OAAA;AACtB,iHAAA,uBAAuB,OAAA;AACvB,oHAAA,0BAA0B,OAAA;AAG5B,+BAKgB;AAJd,wHAAA,gCAAgC,OAAA;AAChC,sHAAA,8BAA8B,OAAA;AAC9B,yHAAA,iCAAiC,OAAA;AACjC,+GAAA,uBAAuB,OAAA;AAGzB,6CAAyD;AAAhD,uHAAA,wBAAwB,OAAA"}

package/dist/models.d.ts

@@ -0,0 +1,16 @@
+export declare const CODEX_OAUTH_GATEWAY_ID: "codex-oauth";
+export declare const CODEX_OAUTH_PROVIDER_ID: "openai";
+export type CodexOAuthProviderId = typeof CODEX_OAUTH_PROVIDER_ID;
+export type CodexOAuthModelId = string;
+/**
+ * Advertised catalog. Static so model resolution needs no network call at boot.
+ * Override with `createCodexOAuthGateway({ models })` to track new releases
+ * without waiting for a package bump.
+ */
+export declare const DEFAULT_CODEX_OAUTH_MODELS: ReadonlyArray<CodexOAuthModelId>;
+/**
+ * Strips a `codex-oauth/` or `codex-oauth/openai/` prefix from a router id.
+ * Mastra hands `resolveLanguageModel` the full router id, while the OpenAI
+ * provider expects the bare model id.
+ */
+export declare function stripCodexOAuthPrefix(modelId: string): CodexOAuthModelId;

package/dist/models.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CODEX_OAUTH_MODELS = exports.CODEX_OAUTH_PROVIDER_ID = exports.CODEX_OAUTH_GATEWAY_ID = void 0;
+exports.stripCodexOAuthPrefix = stripCodexOAuthPrefix;
+exports.CODEX_OAUTH_GATEWAY_ID = 'codex-oauth';
+exports.CODEX_OAUTH_PROVIDER_ID = 'openai';
+/**
+ * Advertised catalog. Static so model resolution needs no network call at boot.
+ * Override with `createCodexOAuthGateway({ models })` to track new releases
+ * without waiting for a package bump.
+ */
+exports.DEFAULT_CODEX_OAUTH_MODELS = [
+    'gpt-5.6-sol',
+    'gpt-5.6-terra',
+    'gpt-5.6-luna',
+    'gpt-5.5',
+    'gpt-5.4',
+    'gpt-5.4-mini',
+];
+/**
+ * Strips a `codex-oauth/` or `codex-oauth/openai/` prefix from a router id.
+ * Mastra hands `resolveLanguageModel` the full router id, while the OpenAI
+ * provider expects the bare model id.
+ */
+function stripCodexOAuthPrefix(modelId) {
+    const trimmed = modelId.trim();
+    const gatewayPrefix = `${exports.CODEX_OAUTH_GATEWAY_ID}/`;
+    const withoutGateway = trimmed.startsWith(gatewayPrefix)
+        ? trimmed.slice(gatewayPrefix.length)
+        : trimmed;
+    const providerPrefix = `${exports.CODEX_OAUTH_PROVIDER_ID}/`;
+    return withoutGateway.startsWith(providerPrefix)
+        ? withoutGateway.slice(providerPrefix.length)
+        : withoutGateway;
+}
+//# sourceMappingURL=models.js.map

package/dist/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":";;;AA2BA,sDAWC;AAtCY,QAAA,sBAAsB,GAAG,aAAsB,CAAC;AAEhD,QAAA,uBAAuB,GAAG,QAAiB,CAAC;AAMzD;;;;GAIG;AACU,QAAA,0BAA0B,GAAqC;IAC1E,aAAa;IACb,eAAe;IACf,cAAc;IACd,SAAS;IACT,SAAS;IACT,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,GAAG,8BAAsB,GAAG,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QACtD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC;IAEZ,MAAM,cAAc,GAAG,GAAG,+BAAuB,GAAG,CAAC;IACrD,OAAO,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC;QAC9C,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;QAC7C,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC"}

package/dist/oauth-fetch.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Rewrites OpenAI Responses API requests so they authenticate against the
+ * ChatGPT Codex subscription backend instead of the metered Platform API.
+ *
+ * Deltas versus a normal API-key request:
+ *   1. `Authorization: Bearer <oauth>` plus `ChatGPT-Account-Id`.
+ *   2. `OpenAI-Beta: responses=experimental` and a Codex `originator`.
+ *   3. Body normalization: `store` defaults to false, `max_output_tokens` is
+ *      dropped (Codex rejects it), and `system` roles become `developer`.
+ */
+import { type CodexOAuthCredentialsResolver, type LiveCodexCredentialsResolver } from './auth';
+export declare const CODEX_RESPONSES_BASE_URL = "https://chatgpt.com/backend-api/codex";
+export declare const CODEX_OAUTH_ORIGINATOR = "codex_cli_rs";
+export declare const CODEX_OAUTH_BETA = "responses=experimental";
+export type CreateCodexOAuthFetchOptions = {
+    /** Resolved per request so a rotated / refreshed token is picked up live. */
+    resolveCredentials?: CodexOAuthCredentialsResolver;
+    /**
+     * Shared live credential cache (refresh dedup + in-memory reuse). When set,
+     * takes precedence over `resolveCredentials`.
+     */
+    liveCredentials?: LiveCodexCredentialsResolver;
+    /** Upstream `originator` header. Pass `false` to omit. */
+    originator?: string | false;
+    /** Defaults to global `fetch`. Injected in tests. */
+    fetchImpl?: typeof fetch;
+};
+/**
+ * Codex Responses body tweaks required for subscription auth compatibility.
+ * Exported for tests.
+ */
+export declare function normalizeCodexResponsesBody(body: Record<string, unknown>): Record<string, unknown>;
+export declare function createCodexOAuthFetch(options?: CreateCodexOAuthFetchOptions): typeof fetch;

package/dist/oauth-fetch.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Rewrites OpenAI Responses API requests so they authenticate against the
+ * ChatGPT Codex subscription backend instead of the metered Platform API.
+ *
+ * Deltas versus a normal API-key request:
+ *   1. `Authorization: Bearer <oauth>` plus `ChatGPT-Account-Id`.
+ *   2. `OpenAI-Beta: responses=experimental` and a Codex `originator`.
+ *   3. Body normalization: `store` defaults to false, `max_output_tokens` is
+ *      dropped (Codex rejects it), and `system` roles become `developer`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_OAUTH_BETA = exports.CODEX_OAUTH_ORIGINATOR = exports.CODEX_RESPONSES_BASE_URL = void 0;
+exports.normalizeCodexResponsesBody = normalizeCodexResponsesBody;
+exports.createCodexOAuthFetch = createCodexOAuthFetch;
+const auth_1 = require("./auth");
+exports.CODEX_RESPONSES_BASE_URL = 'https://chatgpt.com/backend-api/codex';
+exports.CODEX_OAUTH_ORIGINATOR = 'codex_cli_rs';
+exports.CODEX_OAUTH_BETA = 'responses=experimental';
+function normalizeHeaders(headers) {
+    const normalized = {};
+    if (!headers)
+        return normalized;
+    if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+        headers.forEach((value, key) => {
+            normalized[key] = value;
+        });
+        return normalized;
+    }
+    if (Array.isArray(headers)) {
+        for (const [key, value] of headers) {
+            if (value !== undefined)
+                normalized[key] = value;
+        }
+        return normalized;
+    }
+    for (const [key, value] of Object.entries(headers)) {
+        if (value !== undefined)
+            normalized[key] = value;
+    }
+    return normalized;
+}
+function deleteHeader(headers, name) {
+    const lower = name.toLowerCase();
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === lower)
+            delete headers[key];
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Codex Responses body tweaks required for subscription auth compatibility.
+ * Exported for tests.
+ */
+function normalizeCodexResponsesBody(body) {
+    const normalized = { ...body };
+    if (normalized.store === undefined) {
+        normalized.store = false;
+    }
+    delete normalized.max_output_tokens;
+    if (Array.isArray(normalized.input)) {
+        normalized.input = normalized.input.map((item) => {
+            if (!isRecord(item) || item.role !== 'system')
+                return item;
+            return { ...item, role: 'developer' };
+        });
+    }
+    return normalized;
+}
+function applyCredentialHeaders(headers, credentials, originator) {
+    deleteHeader(headers, 'authorization');
+    deleteHeader(headers, 'chatgpt-account-id');
+    deleteHeader(headers, 'openai-beta');
+    deleteHeader(headers, 'originator');
+    headers.authorization = `Bearer ${credentials.accessToken}`;
+    headers['ChatGPT-Account-Id'] = credentials.accountId;
+    headers['OpenAI-Beta'] = exports.CODEX_OAUTH_BETA;
+    if (originator)
+        headers.originator = originator;
+}
+function createCodexOAuthFetch(options = {}) {
+    const doFetch = options.fetchImpl ?? globalThis.fetch;
+    const originator = options.originator === false ? undefined : (options.originator ?? exports.CODEX_OAUTH_ORIGINATOR);
+    const liveCredentials = options.liveCredentials ??
+        (0, auth_1.createLiveCodexCredentialsResolver)({
+            resolveCredentials: options.resolveCredentials,
+            fetchImpl: doFetch,
+        });
+    return async function codexOAuthFetch(input, init) {
+        const credentials = await liveCredentials.resolve();
+        const rawBody = init?.body;
+        let body = rawBody;
+        if (typeof rawBody === 'string') {
+            try {
+                const parsed = JSON.parse(rawBody);
+                if (isRecord(parsed)) {
+                    body = JSON.stringify(normalizeCodexResponsesBody(parsed));
+                }
+            }
+            catch {
+                // Non-JSON body: forward unchanged.
+            }
+        }
+        else if (rawBody != null) {
+            // The OpenAI Responses provider always sends a JSON string body. Anything
+            // else means the provider changed shape and body normalization would
+            // silently go missing.
+            throw new Error('Unexpected OpenAI request body: expected a JSON string. Codex OAuth requests cannot be rewritten.');
+        }
+        const headers = normalizeHeaders(init?.headers);
+        applyCredentialHeaders(headers, credentials, originator);
+        const response = await doFetch(input, { ...init, headers, body });
+        if (response.status !== 401)
+            return response;
+        // Opaque / unexpectedly expired access tokens never trip the proactive
+        // margin check — force one refresh and retry once.
+        let refreshed;
+        try {
+            refreshed = await liveCredentials.resolve({ forceRefresh: true });
+        }
+        catch {
+            return response;
+        }
+        if (refreshed.accessToken === credentials.accessToken) {
+            return response;
+        }
+        const retryHeaders = normalizeHeaders(init?.headers);
+        applyCredentialHeaders(retryHeaders, refreshed, originator);
+        return doFetch(input, { ...init, headers: retryHeaders, body });
+    };
+}
+//# sourceMappingURL=oauth-fetch.js.map

package/dist/oauth-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-fetch.js","sourceRoot":"","sources":["../src/oauth-fetch.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAoEH,kEAkBC;AAiBD,sDAyDC;AA9JD,iCAKgB;AAEH,QAAA,wBAAwB,GAAG,uCAAuC,CAAC;AAEnE,QAAA,sBAAsB,GAAG,cAAc,CAAC;AAExC,QAAA,gBAAgB,GAAG,wBAAwB,CAAC;AAgBzD,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAEhC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QACjE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAA6C,CAAC,EAAE,CAAC;QACzF,IAAI,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,OAA+B,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CACzC,IAA6B;IAE7B,MAAM,UAAU,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IAExD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACnC,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,OAAO,UAAU,CAAC,iBAAiB,CAAC;IAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3D,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA+B,EAC/B,WAAkC,EAClC,UAA8B;IAE9B,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvC,YAAY,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAC5C,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpC,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;IACtD,OAAO,CAAC,aAAa,CAAC,GAAG,wBAAgB,CAAC;IAC1C,IAAI,UAAU;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;AAClD,CAAC;AAED,SAAgB,qBAAqB,CAAC,UAAwC,EAAE;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACtD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,8BAAsB,CAAC,CAAC;IAC5F,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe;QACvB,IAAA,yCAAkC,EAAC;YACjC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;IAEL,OAAO,KAAK,UAAU,eAAe,CAAC,KAAK,EAAE,IAAI;QAC/C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;QAEpD,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,CAAC;QAC3B,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,0EAA0E;YAC1E,qEAAqE;YACrE,uBAAuB;YACvB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAE7C,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,sBAAsB,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@lumifai/harness-model-codex-oauth",
+  "version": "0.1.0",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Lumif-ai/lumif-harness.git",
+    "directory": "packages/model-providers/codex-oauth"
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "!dist/**/*.test.*",
+    "README.md"
+  ],
+  "dependencies": {
+    "@ai-sdk/openai": "^4.0.57",
+    "@mastra/core": "1.67.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}