@mastra/code-sdk 1.0.3-alpha.1 → 1.1.0-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (258) hide show
  1. package/CHANGELOG.md +38 -0
  2. package/dist/acp/agent.js +155 -167
  3. package/dist/acp/agent.js.map +1 -1
  4. package/dist/acp/event-mapper.js +193 -168
  5. package/dist/acp/event-mapper.js.map +1 -1
  6. package/dist/acp/index.js +60 -49
  7. package/dist/acp/index.js.map +1 -1
  8. package/dist/acp/server.js +31 -30
  9. package/dist/acp/server.js.map +1 -1
  10. package/dist/acp.js +1 -4
  11. package/dist/agents/credential-resolver.js +40 -29
  12. package/dist/agents/credential-resolver.js.map +1 -1
  13. package/dist/agents/custom-provider-source.js +16 -9
  14. package/dist/agents/custom-provider-source.js.map +1 -1
  15. package/dist/agents/instructions.js +27 -36
  16. package/dist/agents/instructions.js.map +1 -1
  17. package/dist/agents/mastracode-gateway.js +355 -428
  18. package/dist/agents/mastracode-gateway.js.map +1 -1
  19. package/dist/agents/memory.js +87 -78
  20. package/dist/agents/memory.js.map +1 -1
  21. package/dist/agents/model.js +114 -119
  22. package/dist/agents/model.js.map +1 -1
  23. package/dist/agents/modes/build.js +12 -13
  24. package/dist/agents/modes/build.js.map +1 -1
  25. package/dist/agents/modes/explore.js +14 -13
  26. package/dist/agents/modes/explore.js.map +1 -1
  27. package/dist/agents/modes/plan.js +14 -15
  28. package/dist/agents/modes/plan.js.map +1 -1
  29. package/dist/agents/prompts/agent-instructions.js +78 -69
  30. package/dist/agents/prompts/agent-instructions.js.map +1 -1
  31. package/dist/agents/prompts/build.js +19 -16
  32. package/dist/agents/prompts/build.js.map +1 -1
  33. package/dist/agents/prompts/fast.js +8 -4
  34. package/dist/agents/prompts/fast.js.map +1 -1
  35. package/dist/agents/prompts/index.js +48 -47
  36. package/dist/agents/prompts/index.js.map +1 -1
  37. package/dist/agents/prompts/model.js +6 -5
  38. package/dist/agents/prompts/model.js.map +1 -1
  39. package/dist/agents/prompts/plan.js +20 -16
  40. package/dist/agents/prompts/plan.js.map +1 -1
  41. package/dist/agents/prompts/tool-guidance.js +77 -109
  42. package/dist/agents/prompts/tool-guidance.js.map +1 -1
  43. package/dist/agents/sandbox-filesystem.js +245 -259
  44. package/dist/agents/sandbox-filesystem.js.map +1 -1
  45. package/dist/agents/sandbox-reattach.js +9 -11
  46. package/dist/agents/sandbox-reattach.js.map +1 -1
  47. package/dist/agents/thread-caveman-state.js +92 -81
  48. package/dist/agents/thread-caveman-state.js.map +1 -1
  49. package/dist/agents/tool-availability.js +62 -80
  50. package/dist/agents/tool-availability.js.map +1 -1
  51. package/dist/agents/tools.js +99 -139
  52. package/dist/agents/tools.js.map +1 -1
  53. package/dist/agents/workspace.js +232 -225
  54. package/dist/agents/workspace.js.map +1 -1
  55. package/dist/analytics.js +139 -128
  56. package/dist/analytics.js.map +1 -1
  57. package/dist/auth/authorization-input.js +39 -25
  58. package/dist/auth/authorization-input.js.map +1 -1
  59. package/dist/auth/device-code.js +112 -80
  60. package/dist/auth/device-code.js.map +1 -1
  61. package/dist/auth/index.js +2 -9
  62. package/dist/auth/pkce.js +27 -16
  63. package/dist/auth/pkce.js.map +1 -1
  64. package/dist/auth/providers/anthropic.js +107 -93
  65. package/dist/auth/providers/anthropic.js.map +1 -1
  66. package/dist/auth/providers/github-copilot.js +304 -293
  67. package/dist/auth/providers/github-copilot.js.map +1 -1
  68. package/dist/auth/providers/openai-codex.js +442 -460
  69. package/dist/auth/providers/openai-codex.js.map +1 -1
  70. package/dist/auth/providers/xai.js +179 -145
  71. package/dist/auth/providers/xai.js.map +1 -1
  72. package/dist/auth/storage.js +182 -175
  73. package/dist/auth/storage.js.map +1 -1
  74. package/dist/auth/types.js +1 -1
  75. package/dist/clipboard/index.js +206 -172
  76. package/dist/clipboard/index.js.map +1 -1
  77. package/dist/constants.js +11 -16
  78. package/dist/constants.js.map +1 -1
  79. package/dist/error-classification.js +19 -11
  80. package/dist/error-classification.js.map +1 -1
  81. package/dist/evals/context-builder.js +145 -104
  82. package/dist/evals/context-builder.js.map +1 -1
  83. package/dist/evals/index.js +4 -7
  84. package/dist/evals/scorers/classify-command.js +62 -41
  85. package/dist/evals/scorers/classify-command.js.map +1 -1
  86. package/dist/evals/scorers/efficiency.js +239 -181
  87. package/dist/evals/scorers/efficiency.js.map +1 -1
  88. package/dist/evals/scorers/extract-tools.js +51 -47
  89. package/dist/evals/scorers/extract-tools.js.map +1 -1
  90. package/dist/evals/scorers/index.js +1 -5
  91. package/dist/evals/scorers/outcome.js +321 -212
  92. package/dist/evals/scorers/outcome.js.map +1 -1
  93. package/dist/goal-manager.js +266 -261
  94. package/dist/goal-manager.js.map +1 -1
  95. package/dist/goal-signal.js +14 -13
  96. package/dist/goal-signal.js.map +1 -1
  97. package/dist/headless/cli.js +153 -154
  98. package/dist/headless/cli.js.map +1 -1
  99. package/dist/headless/flags.js +180 -178
  100. package/dist/headless/flags.js.map +1 -1
  101. package/dist/headless/format.js +72 -71
  102. package/dist/headless/format.js.map +1 -1
  103. package/dist/headless/index.js +5 -31
  104. package/dist/headless/policy.js +35 -31
  105. package/dist/headless/policy.js.map +1 -1
  106. package/dist/headless/run-mc.js +332 -334
  107. package/dist/headless/run-mc.js.map +1 -1
  108. package/dist/headless/types.js +16 -7
  109. package/dist/headless/types.js.map +1 -1
  110. package/dist/hooks/config.js +56 -61
  111. package/dist/hooks/config.js.map +1 -1
  112. package/dist/hooks/executor.js +118 -116
  113. package/dist/hooks/executor.js.map +1 -1
  114. package/dist/hooks/index.js +4 -15
  115. package/dist/hooks/manager.js +221 -280
  116. package/dist/hooks/manager.js.map +1 -1
  117. package/dist/hooks/types.js +5 -4
  118. package/dist/hooks/types.js.map +1 -1
  119. package/dist/index.d.ts.map +1 -1
  120. package/dist/index.js +632 -712
  121. package/dist/index.js.map +1 -1
  122. package/dist/ipc/ipc-reporter.js +19 -22
  123. package/dist/ipc/ipc-reporter.js.map +1 -1
  124. package/dist/lsp/client.js +248 -306
  125. package/dist/lsp/client.js.map +1 -1
  126. package/dist/lsp/index.js +1 -6
  127. package/dist/lsp/language.js +39 -43
  128. package/dist/lsp/language.js.map +1 -1
  129. package/dist/lsp/manager.js +78 -93
  130. package/dist/lsp/manager.js.map +1 -1
  131. package/dist/lsp/server.js +151 -120
  132. package/dist/lsp/server.js.map +1 -1
  133. package/dist/lsp/workspace.js +50 -47
  134. package/dist/lsp/workspace.js.map +1 -1
  135. package/dist/mcp/config.js +210 -199
  136. package/dist/mcp/config.js.map +1 -1
  137. package/dist/mcp/index.js +2 -9
  138. package/dist/mcp/manager.js +482 -475
  139. package/dist/mcp/manager.js.map +1 -1
  140. package/dist/mcp/types.js +1 -1
  141. package/dist/onboarding/custom-packs.js +14 -17
  142. package/dist/onboarding/custom-packs.js.map +1 -1
  143. package/dist/onboarding/custom-providers.js +22 -20
  144. package/dist/onboarding/custom-providers.js.map +1 -1
  145. package/dist/onboarding/index.d.ts +1 -1
  146. package/dist/onboarding/index.d.ts.map +1 -1
  147. package/dist/onboarding/index.js +3 -21
  148. package/dist/onboarding/om-settings.d.ts +5 -0
  149. package/dist/onboarding/om-settings.d.ts.map +1 -1
  150. package/dist/onboarding/om-settings.js +41 -20
  151. package/dist/onboarding/om-settings.js.map +1 -1
  152. package/dist/onboarding/packs.d.ts +4 -6
  153. package/dist/onboarding/packs.d.ts.map +1 -1
  154. package/dist/onboarding/packs.js +154 -105
  155. package/dist/onboarding/packs.js.map +1 -1
  156. package/dist/onboarding/settings.js +575 -517
  157. package/dist/onboarding/settings.js.map +1 -1
  158. package/dist/permissions.js +112 -99
  159. package/dist/permissions.js.map +1 -1
  160. package/dist/plugin.js +21 -23
  161. package/dist/plugin.js.map +1 -1
  162. package/dist/plugins/dependencies.js +64 -87
  163. package/dist/plugins/dependencies.js.map +1 -1
  164. package/dist/plugins/install.js +159 -169
  165. package/dist/plugins/install.js.map +1 -1
  166. package/dist/plugins/loader.js +170 -185
  167. package/dist/plugins/loader.js.map +1 -1
  168. package/dist/plugins/manager.js +374 -380
  169. package/dist/plugins/manager.js.map +1 -1
  170. package/dist/plugins/manifest.js +38 -63
  171. package/dist/plugins/manifest.js.map +1 -1
  172. package/dist/plugins/package-link.js +48 -64
  173. package/dist/plugins/package-link.js.map +1 -1
  174. package/dist/plugins/paths.js +18 -19
  175. package/dist/plugins/paths.js.map +1 -1
  176. package/dist/plugins/registry.js +97 -81
  177. package/dist/plugins/registry.js.map +1 -1
  178. package/dist/plugins/scaffold.js +62 -98
  179. package/dist/plugins/scaffold.js.map +1 -1
  180. package/dist/plugins/types.js +1 -1
  181. package/dist/processors/plan-rejection-abort.js +45 -44
  182. package/dist/processors/plan-rejection-abort.js.map +1 -1
  183. package/dist/providers/amazon-bedrock-gateway.js +134 -125
  184. package/dist/providers/amazon-bedrock-gateway.js.map +1 -1
  185. package/dist/providers/amazon-bedrock.js +68 -47
  186. package/dist/providers/amazon-bedrock.js.map +1 -1
  187. package/dist/providers/claude-max.js +153 -133
  188. package/dist/providers/claude-max.js.map +1 -1
  189. package/dist/providers/github-copilot.js +232 -230
  190. package/dist/providers/github-copilot.js.map +1 -1
  191. package/dist/providers/openai-codex.js +271 -260
  192. package/dist/providers/openai-codex.js.map +1 -1
  193. package/dist/providers/xai.js +57 -50
  194. package/dist/providers/xai.js.map +1 -1
  195. package/dist/schema.js +91 -89
  196. package/dist/schema.js.map +1 -1
  197. package/dist/theme-palette.js +18 -14
  198. package/dist/theme-palette.js.map +1 -1
  199. package/dist/tool-names.js +46 -37
  200. package/dist/tool-names.js.map +1 -1
  201. package/dist/tools/index.js +2 -8
  202. package/dist/tools/request-sandbox-access.js +71 -80
  203. package/dist/tools/request-sandbox-access.js.map +1 -1
  204. package/dist/tools/utils.js +26 -16
  205. package/dist/tools/utils.js.map +1 -1
  206. package/dist/tools/web-search.js +51 -55
  207. package/dist/tools/web-search.js.map +1 -1
  208. package/dist/utils/binaries.js +65 -61
  209. package/dist/utils/binaries.js.map +1 -1
  210. package/dist/utils/debug-log.js +51 -47
  211. package/dist/utils/debug-log.js.map +1 -1
  212. package/dist/utils/errors.js +157 -192
  213. package/dist/utils/errors.js.map +1 -1
  214. package/dist/utils/gateway-sync.js +49 -37
  215. package/dist/utils/gateway-sync.js.map +1 -1
  216. package/dist/utils/path-security.js +7 -6
  217. package/dist/utils/path-security.js.map +1 -1
  218. package/dist/utils/plan-diff.js +58 -39
  219. package/dist/utils/plan-diff.js.map +1 -1
  220. package/dist/utils/plans.js +92 -74
  221. package/dist/utils/plans.js.map +1 -1
  222. package/dist/utils/project.js +318 -256
  223. package/dist/utils/project.js.map +1 -1
  224. package/dist/utils/signals-pubsub.js +117 -99
  225. package/dist/utils/signals-pubsub.js.map +1 -1
  226. package/dist/utils/slash-command-loader.js +118 -154
  227. package/dist/utils/slash-command-loader.js.map +1 -1
  228. package/dist/utils/slash-command-processor.js +92 -83
  229. package/dist/utils/slash-command-processor.js.map +1 -1
  230. package/dist/utils/stdin-pipe.js +87 -63
  231. package/dist/utils/stdin-pipe.js.map +1 -1
  232. package/dist/utils/storage-factory.js +104 -84
  233. package/dist/utils/storage-factory.js.map +1 -1
  234. package/dist/utils/storage-maintenance.js +249 -211
  235. package/dist/utils/storage-maintenance.js.map +1 -1
  236. package/dist/utils/thread-lock.js +96 -92
  237. package/dist/utils/thread-lock.js.map +1 -1
  238. package/dist/utils/token-estimator.js +12 -12
  239. package/dist/utils/token-estimator.js.map +1 -1
  240. package/dist/utils/update-check.d.ts +1 -1
  241. package/dist/utils/update-check.js +341 -259
  242. package/dist/utils/update-check.js.map +1 -1
  243. package/dist/voice/stt-registry.js +131 -113
  244. package/dist/voice/stt-registry.js.map +1 -1
  245. package/package.json +12 -12
  246. package/dist/acp.js.map +0 -1
  247. package/dist/auth/index.js.map +0 -1
  248. package/dist/auth/types.js.map +0 -1
  249. package/dist/evals/index.js.map +0 -1
  250. package/dist/evals/scorers/index.js.map +0 -1
  251. package/dist/headless/index.js.map +0 -1
  252. package/dist/hooks/index.js.map +0 -1
  253. package/dist/lsp/index.js.map +0 -1
  254. package/dist/mcp/index.js.map +0 -1
  255. package/dist/mcp/types.js.map +0 -1
  256. package/dist/onboarding/index.js.map +0 -1
  257. package/dist/plugins/types.js.map +0 -1
  258. package/dist/tools/index.js.map +0 -1
package/dist/auth/providers/openai-codex.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../../src/auth/providers/openai-codex.ts"],"sourcesContent":["/**\n * OpenAI Codex (ChatGPT OAuth) flow\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/openai-codex.ts\n *\n * NOTE: This module uses Node.js crypto and http for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\n// NEVER convert to top-level imports - breaks browser/Vite builds (web-ui)\nlet _randomBytes: ((size: number) => Buffer) | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _cryptoPromise: Promise<typeof import('node:crypto')> | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _httpPromise: Promise<typeof import('node:http')> | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _http: typeof import('node:http') | null = null;\ntype HttpServer = {\n off: (event: 'error' | 'listening', listener: (...args: any[]) => void) => HttpServer;\n once: (event: 'error' | 'listening', listener: (...args: any[]) => void) => HttpServer;\n listen: (port: number, hostname: string) => HttpServer;\n close: () => void;\n};\nif (typeof process !== 'undefined' && (process.versions?.node || process.versions?.bun)) {\n _cryptoPromise = import('node:crypto').then(m => {\n _randomBytes = m.randomBytes;\n return m;\n });\n _httpPromise = import('node:http').then(m => {\n _http = m;\n return m;\n });\n}\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { AuthMode, OAuthCredentials, OAuthLoginCallbacks, OAuthPrompt, OAuthProviderInterface } from '../types.js';\n\nexport const OPENAI_CODEX_AUTH_MODES: ReadonlyArray<AuthMode> = [\n {\n id: 'browser',\n name: 'Browser (local callback)',\n description: 'Opens the browser and waits for the OAuth callback on localhost.',\n },\n {\n id: 'device',\n name: 'Device code (headless)',\n description: 'Shows a code to enter at openai.com — for SSH, remote, or no-browser environments.',\n },\n];\n\nconst CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\nconst ISSUER = 'https://auth.openai.com';\nconst AUTHORIZE_URL = `${ISSUER}/oauth/authorize`;\nconst TOKEN_URL = `${ISSUER}/oauth/token`;\nconst DEVICE_USER_CODE_URL = `${ISSUER}/api/accounts/deviceauth/usercode`;\nconst DEVICE_TOKEN_URL = `${ISSUER}/api/accounts/deviceauth/token`;\nconst DEVICE_AUTHORIZE_URL = `${ISSUER}/codex/device`;\nconst DEVICE_REDIRECT_URI = `${ISSUER}/deviceauth/callback`;\nconst DEFAULT_CALLBACK_PORT = 1455;\nconst FALLBACK_CALLBACK_PORT = 1457;\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\nconst DEVICE_AUTH_TIMEOUT_MS = 15 * 60 * 1000;\nconst SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';\nconst JWT_CLAIM_PATH = 'https://api.openai.com/auth';\n\nconst SUCCESS_HTML = `<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n <title>Authentication successful</title>\n</head>\n<body>\n <p>Authentication successful. Return to your terminal to continue.</p>\n</body>\n</html>`;\n\ntype TokenSuccess = {\n type: 'success';\n access: string;\n refresh: string;\n expires: number;\n idToken?: string;\n};\ntype TokenFailure = { type: 'failed' };\ntype TokenResult = TokenSuccess | TokenFailure;\n\ntype JwtPayload = {\n chatgpt_account_id?: string;\n [JWT_CLAIM_PATH]?: {\n chatgpt_account_id?: string;\n };\n [key: string]: unknown;\n};\n\nasync function createState(): Promise<string> {\n const randomBytes = await getRandomBytes();\n return randomBytes(16).toString('hex');\n}\n\nfunction decodeJwt(token: string): JwtPayload | null {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) return null;\n const payload = parts[1] ?? '';\n const padded = payload\n .replace(/-/g, '+')\n .replace(/_/g, '/')\n .padEnd(Math.ceil(payload.length / 4) * 4, '=');\n const decoded = atob(padded);\n return JSON.parse(decoded) as JwtPayload;\n } catch {\n return null;\n }\n}\n\nfunction extractAccountIdFromClaims(payload: JwtPayload | null | undefined): string | null {\n if (!payload) return null;\n const accountId = payload.chatgpt_account_id ?? payload[JWT_CLAIM_PATH]?.chatgpt_account_id;\n return typeof accountId === 'string' && accountId.length > 0 ? accountId : null;\n}\n\nfunction getAccountId(tokens: { idToken?: string; access: string }, fallback?: string): string | undefined {\n const fromIdToken = tokens.idToken ? extractAccountIdFromClaims(decodeJwt(tokens.idToken)) : null;\n if (fromIdToken) return fromIdToken;\n\n const fromAccessToken = extractAccountIdFromClaims(decodeJwt(tokens.access));\n if (fromAccessToken) return fromAccessToken;\n\n return fallback;\n}\n\nfunction requireAccountId(tokens: { idToken?: string; access: string }, fallback?: string): string {\n const accountId = getAccountId(tokens, fallback);\n if (!accountId) {\n throw new Error('Failed to extract ChatGPT account id from OpenAI Codex token');\n }\n return accountId;\n}\n\ntype TokenResponseJson = {\n id_token?: string;\n access_token?: string;\n refresh_token?: string;\n expires_in?: number;\n};\n\nfunction tokenResponseToResult(json: TokenResponseJson, logPrefix: string): TokenResult {\n if (!json.access_token || !json.refresh_token) {\n console.error(`[openai-codex] ${logPrefix} response missing fields:`, json);\n return { type: 'failed' };\n }\n\n return {\n type: 'success',\n access: json.access_token,\n refresh: json.refresh_token,\n expires: Date.now() + (json.expires_in ?? DEFAULT_TOKEN_EXPIRES_IN_SECONDS) * 1000,\n idToken: json.id_token,\n };\n}\n\nasync function exchangeAuthorizationCode(code: string, verifier: string, redirectUri: string): Promise<TokenResult> {\n const response = await fetch(TOKEN_URL, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'authorization_code',\n client_id: CLIENT_ID,\n code,\n code_verifier: verifier,\n redirect_uri: redirectUri,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n console.error('[openai-codex] code->token failed:', response.status, text);\n return { type: 'failed' };\n }\n\n return tokenResponseToResult((await response.json()) as TokenResponseJson, 'token');\n}\n\nasync function refreshAccessToken(refreshToken: string): Promise<TokenResult> {\n try {\n const response = await fetch(TOKEN_URL, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'refresh_token',\n refresh_token: refreshToken,\n client_id: CLIENT_ID,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n console.error('[openai-codex] Token refresh failed:', response.status, text);\n return { type: 'failed' };\n }\n\n return tokenResponseToResult((await response.json()) as TokenResponseJson, 'Token refresh');\n } catch (error) {\n console.error('[openai-codex] Token refresh error:', error);\n return { type: 'failed' };\n }\n}\n\nasync function getRandomBytes() {\n if (!_randomBytes && _cryptoPromise) {\n _randomBytes = (await _cryptoPromise).randomBytes;\n }\n if (!_randomBytes) {\n throw new Error('OpenAI Codex OAuth is only available in Node.js environments');\n }\n return _randomBytes;\n}\n\nasync function createAuthorizationFlow(\n redirectUri: string,\n state: string,\n originator: string = 'mastracode',\n): Promise<{ verifier: string; url: string }> {\n const { verifier, challenge } = await generatePKCE();\n\n const url = new URL(AUTHORIZE_URL);\n url.searchParams.set('response_type', 'code');\n url.searchParams.set('client_id', CLIENT_ID);\n url.searchParams.set('redirect_uri', redirectUri);\n url.searchParams.set('scope', SCOPE);\n url.searchParams.set('code_challenge', challenge);\n url.searchParams.set('code_challenge_method', 'S256');\n url.searchParams.set('state', state);\n url.searchParams.set('id_token_add_organizations', 'true');\n url.searchParams.set('codex_cli_simplified_flow', 'true');\n url.searchParams.set('originator', originator);\n\n return { verifier, url: url.toString() };\n}\n\ntype OAuthServerInfo = {\n redirectUri: string;\n warning?: string;\n close: () => void;\n cancelWait: () => void;\n waitForCode: () => Promise<{ code: string } | null>;\n};\n\ntype CallbackPorts = {\n defaultPort: number;\n fallbackPort: number;\n};\n\nconst CODEX_CALLBACK_PORTS: CallbackPorts = {\n defaultPort: DEFAULT_CALLBACK_PORT,\n fallbackPort: FALLBACK_CALLBACK_PORT,\n};\n\nasync function requestCancel(port: number): Promise<void> {\n try {\n await fetch(`http://127.0.0.1:${port}/cancel`, { signal: AbortSignal.timeout(200) });\n } catch {\n // The existing listener might not be a Codex auth server.\n }\n}\n\nfunction listen(server: HttpServer, port: number): Promise<boolean> {\n return new Promise(resolve => {\n const onError = () => {\n server.off('listening', onListening);\n resolve(false);\n };\n const onListening = () => {\n server.off('error', onError);\n resolve(true);\n };\n\n server.once('error', onError);\n server.once('listening', onListening);\n server.listen(port, '127.0.0.1');\n });\n}\n\nasync function bindOAuthServer(server: HttpServer, ports: CallbackPorts): Promise<number | null> {\n await requestCancel(ports.defaultPort);\n if (await listen(server, ports.defaultPort)) return ports.defaultPort;\n if (await listen(server, ports.fallbackPort)) return ports.fallbackPort;\n\n return null;\n}\n\nasync function getHttpModule() {\n if (!_http && _httpPromise) {\n _http = await _httpPromise;\n }\n if (!_http) {\n throw new Error('OpenAI Codex OAuth is only available in Node.js environments');\n }\n return _http;\n}\n\nasync function startLocalOAuthServer(\n state: string,\n ports: CallbackPorts = CODEX_CALLBACK_PORTS,\n): Promise<OAuthServerInfo> {\n const http = await getHttpModule();\n let lastCode: string | null = null;\n let cancelled = false;\n const server = http.createServer((req, res) => {\n try {\n const url = new URL(req.url || '', 'http://localhost');\n if (url.pathname === '/cancel') {\n cancelled = true;\n res.statusCode = 200;\n res.end('Cancelled');\n return;\n }\n if (url.pathname !== '/auth/callback') {\n res.statusCode = 404;\n res.end('Not found');\n return;\n }\n if (url.searchParams.get('state') !== state) {\n res.statusCode = 400;\n res.end('State mismatch');\n return;\n }\n const code = url.searchParams.get('code');\n if (!code) {\n res.statusCode = 400;\n res.end('Missing authorization code');\n return;\n }\n res.statusCode = 200;\n res.setHeader('Content-Type', 'text/html; charset=utf-8');\n res.end(SUCCESS_HTML);\n lastCode = code;\n } catch {\n res.statusCode = 500;\n res.end('Internal error');\n }\n });\n\n return new Promise(resolve => {\n bindOAuthServer(server, ports).then(port => {\n if (!port) {\n resolve({\n redirectUri: `http://localhost:${ports.fallbackPort}/auth/callback`,\n warning: `OpenAI Codex OAuth requires localhost port ${ports.defaultPort} or ${ports.fallbackPort}, but both are in use. Automatic browser callback will not work until one is freed.`,\n close: () => {\n try {\n server.close();\n } catch {\n // ignore\n }\n },\n cancelWait: () => {},\n waitForCode: async () => null,\n });\n return;\n }\n\n resolve({\n redirectUri: `http://localhost:${port}/auth/callback`,\n close: () => server.close(),\n cancelWait: () => {\n cancelled = true;\n },\n waitForCode: async () => {\n const sleep = () => new Promise(r => setTimeout(r, 100));\n for (let i = 0; i < 600; i += 1) {\n if (lastCode) return { code: lastCode };\n if (cancelled) return null;\n await sleep();\n }\n return null;\n },\n });\n });\n });\n}\n\n/**\n * Serializable pending state for a Codex device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests — the\n * device token response carries the `code_verifier`, so no PKCE state needs\n * to be kept client-side.\n */\nexport interface CodexDeviceLoginPending {\n deviceAuthId: string;\n userCode: string;\n /** Verification URL for the user to open. */\n url: string;\n instructions: string;\n /** Poll interval in ms suggested by the server. */\n intervalMs: number;\n /** ms epoch after which the device authorization expires. */\n deadlineAt: number;\n}\n\nexport type CodexDevicePollResult =\n | { status: 'complete'; credentials: OAuthCredentials }\n | { status: 'pending'; nextPollMs: number }\n | { status: 'failed'; error: string };\n\n/**\n * Start a Codex device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startCodexDeviceLogin(options?: { signal?: AbortSignal }): Promise<CodexDeviceLoginPending> {\n const response = await fetch(DEVICE_USER_CODE_URL, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'User-Agent': 'mastracode',\n },\n body: JSON.stringify({ client_id: CLIENT_ID, originator: 'mastracode' }),\n signal: options?.signal,\n });\n\n if (!response.ok) {\n throw new Error(`Failed to initiate OpenAI Codex device authorization: ${response.status}`);\n }\n\n const deviceData = (await response.json()) as {\n device_auth_id?: string;\n user_code?: string;\n usercode?: string;\n interval?: string | number;\n };\n\n const userCode = deviceData.user_code ?? deviceData.usercode;\n\n if (!deviceData.device_auth_id || !userCode) {\n throw new Error('OpenAI Codex device authorization response missing required fields');\n }\n\n const intervalSeconds =\n typeof deviceData.interval === 'number' ? deviceData.interval : Number.parseInt(deviceData.interval ?? '', 10) || 5;\n\n return {\n deviceAuthId: deviceData.device_auth_id,\n userCode,\n url: DEVICE_AUTHORIZE_URL,\n instructions: `Enter code: ${userCode}`,\n intervalMs: Math.max(intervalSeconds, 1) * 1000,\n deadlineAt: Date.now() + DEVICE_AUTH_TIMEOUT_MS,\n };\n}\n\n/**\n * Perform exactly one upstream poll for a pending Codex device login.\n * The Codex device endpoint signals \"still pending\" via HTTP 403/404 (it is\n * not an RFC 8628 error-JSON endpoint); on success it returns the\n * authorization code plus server-held PKCE verifier, which we exchange\n * immediately for credentials. Never throws for flow-level conditions.\n */\nexport async function pollCodexDeviceLogin(\n pending: CodexDeviceLoginPending,\n options?: { signal?: AbortSignal },\n): Promise<CodexDevicePollResult> {\n if (Date.now() >= pending.deadlineAt) {\n return { status: 'failed', error: 'OpenAI Codex device authorization timed out after 15 minutes' };\n }\n\n const pollResponse = await fetch(DEVICE_TOKEN_URL, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'User-Agent': 'mastracode',\n },\n body: JSON.stringify({\n device_auth_id: pending.deviceAuthId,\n user_code: pending.userCode,\n }),\n signal: options?.signal,\n });\n\n if (pollResponse.ok) {\n const data = (await pollResponse.json()) as {\n authorization_code?: string;\n code_verifier?: string;\n };\n\n if (!data.authorization_code || !data.code_verifier) {\n return { status: 'failed', error: 'OpenAI Codex device token response missing required fields' };\n }\n\n const tokenResult = await exchangeAuthorizationCode(\n data.authorization_code,\n data.code_verifier,\n DEVICE_REDIRECT_URI,\n );\n if (tokenResult.type !== 'success') {\n return { status: 'failed', error: 'Token exchange failed' };\n }\n\n let accountId: string;\n try {\n accountId = requireAccountId(tokenResult);\n } catch (error) {\n return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n }\n\n return {\n status: 'complete',\n credentials: {\n access: tokenResult.access,\n refresh: tokenResult.refresh,\n expires: tokenResult.expires,\n accountId,\n },\n };\n }\n\n if (pollResponse.status !== 403 && pollResponse.status !== 404) {\n const text = await pollResponse.text().catch(() => '');\n return {\n status: 'failed',\n error: `OpenAI Codex device authorization failed: ${pollResponse.status}${text ? ` ${text}` : ''}`,\n };\n }\n\n return { status: 'pending', nextPollMs: pending.intervalMs };\n}\n\nasync function loginOpenAICodexDevice(options: {\n onAuth: (info: { url: string; instructions?: string }) => void;\n onProgress?: (message: string) => void;\n signal?: AbortSignal;\n sleep?: (ms: number) => Promise<void>;\n}): Promise<OAuthCredentials> {\n const pending = await startCodexDeviceLogin({ signal: options.signal });\n const sleep = options.sleep ?? (ms => new Promise<void>(resolve => setTimeout(resolve, ms)));\n\n options.onAuth({\n url: pending.url,\n instructions: pending.instructions,\n });\n\n await sleep(pending.intervalMs);\n\n while (true) {\n if (options.signal?.aborted) {\n throw new Error('Login cancelled');\n }\n\n const result = await pollCodexDeviceLogin(pending, { signal: options.signal });\n if (result.status === 'complete') {\n return result.credentials;\n }\n if (result.status === 'failed') {\n throw new Error(result.error);\n }\n\n options.onProgress?.('Waiting for OpenAI Codex device authorization...');\n await sleep(result.nextPollMs);\n }\n}\n\n/**\n * Login with OpenAI Codex OAuth\n *\n * @param options.onAuth - Called with URL and instructions when auth starts\n * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)\n * @param options.onProgress - Optional progress messages\n * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.\n * Races with browser callback - whichever completes first wins.\n * Useful for showing paste input immediately alongside browser flow.\n * @param options.originator - OAuth originator parameter (defaults to \"mastracode\")\n */\nexport async function loginOpenAICodex(options: {\n onAuth: (info: { url: string; instructions?: string }) => void;\n onPrompt: (prompt: OAuthPrompt) => Promise<string>;\n onProgress?: (message: string) => void;\n onManualCodeInput?: () => Promise<string>;\n signal?: AbortSignal;\n originator?: string;\n mode?: 'browser' | 'device';\n}): Promise<OAuthCredentials> {\n const envMode =\n typeof process !== 'undefined' && process.env?.MASTRACODE_OPENAI_CODEX_AUTH_MODE === 'device'\n ? 'device'\n : undefined;\n const mode = options.mode ?? envMode ?? 'browser';\n if (mode === 'device') {\n return loginOpenAICodexDevice({\n onAuth: options.onAuth,\n onProgress: options.onProgress,\n signal: options.signal,\n });\n }\n\n const state = await createState();\n const server = await startLocalOAuthServer(state);\n if (server.warning) {\n options.onProgress?.(server.warning);\n }\n const { verifier, url } = await createAuthorizationFlow(\n server.redirectUri,\n state,\n options.originator ?? 'mastracode',\n );\n\n options.onAuth({\n url,\n instructions: server.warning\n ? `${server.warning} You can still paste the authorization code or full redirect URL manually.`\n : 'A browser window should open. Complete login to finish.',\n });\n\n let code: string | undefined;\n try {\n if (options.onManualCodeInput) {\n // Race between browser callback and manual input\n let manualCode: string | undefined;\n let manualError: Error | undefined;\n const manualPromise = options\n .onManualCodeInput()\n .then(input => {\n manualCode = input;\n server.cancelWait();\n })\n .catch(err => {\n manualError = err instanceof Error ? err : new Error(String(err));\n server.cancelWait();\n });\n\n const result = await server.waitForCode();\n\n // If manual input was cancelled, throw that error\n if (manualError) {\n throw manualError;\n }\n\n if (result?.code) {\n // Browser callback won\n code = result.code;\n } else if (manualCode) {\n // Manual input won (or callback timed out and user had entered code)\n const parsed = parseAuthorizationInput(manualCode);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n\n // If still no code, wait for manual promise to complete and try that\n if (!code) {\n await manualPromise;\n if (manualError) {\n throw manualError;\n }\n if (manualCode) {\n const parsed = parseAuthorizationInput(manualCode);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n }\n } else {\n // Original flow: wait for callback, then prompt if needed\n const result = await server.waitForCode();\n if (result?.code) {\n code = result.code;\n }\n }\n\n // Fallback to onPrompt if still no code\n if (!code) {\n const input = await options.onPrompt({\n message: 'Paste the authorization code (or full redirect URL):',\n });\n const parsed = parseAuthorizationInput(input);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n\n if (!code) {\n throw new Error('Missing authorization code');\n }\n\n const tokenResult = await exchangeAuthorizationCode(code, verifier, server.redirectUri);\n if (tokenResult.type !== 'success') {\n throw new Error('Token exchange failed');\n }\n\n const accountId = requireAccountId(tokenResult);\n\n return {\n access: tokenResult.access,\n refresh: tokenResult.refresh,\n expires: tokenResult.expires,\n accountId,\n };\n } finally {\n server.close();\n }\n}\n\nexport const __testing = {\n createAuthorizationFlow,\n decodeJwt,\n extractAccountIdFromClaims,\n getAccountId,\n loginOpenAICodexDevice,\n requireAccountId,\n startLocalOAuthServer,\n};\n\n/**\n * Refresh OpenAI Codex OAuth token\n */\nexport async function refreshOpenAICodexToken(\n refreshToken: string,\n previousAccountId?: string,\n): Promise<OAuthCredentials> {\n const result = await refreshAccessToken(refreshToken);\n if (result.type !== 'success') {\n throw new Error('Failed to refresh OpenAI Codex token');\n }\n\n const accountId = requireAccountId(result, previousAccountId);\n\n return {\n access: result.access,\n refresh: result.refresh,\n expires: result.expires,\n accountId,\n };\n}\n\nexport const openaiCodexOAuthProvider: OAuthProviderInterface = {\n id: 'openai-codex',\n name: 'ChatGPT Plus/Pro (Codex Subscription)',\n usesCallbackServer: true,\n authModes: OPENAI_CODEX_AUTH_MODES,\n\n async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n const mode = callbacks.authMode === 'device' || callbacks.authMode === 'browser' ? callbacks.authMode : undefined;\n return loginOpenAICodex({\n onAuth: callbacks.onAuth,\n onPrompt: callbacks.onPrompt,\n onProgress: callbacks.onProgress,\n onManualCodeInput: callbacks.onManualCodeInput,\n signal: callbacks.signal,\n mode,\n });\n },\n\n async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n return refreshOpenAICodexToken(credentials.refresh, credentials.accountId as string | undefined);\n },\n\n getApiKey(credentials: OAuthCredentials): string {\n return credentials.access;\n },\n};\n"],"mappings":"AAWA,IAAI,eAAkD;AAEtD,IAAI,iBAA+D;AAEnE,IAAI,eAA2D;AAE/D,IAAI,QAA2C;AAO/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,MAAM;AACvF,mBAAiB,OAAO,aAAa,EAAE,KAAK,OAAK;AAC/C,mBAAe,EAAE;AACjB,WAAO;AAAA,EACT,CAAC;AACD,iBAAe,OAAO,WAAW,EAAE,KAAK,OAAK;AAC3C,YAAQ;AACR,WAAO;AAAA,EACT,CAAC;AACH;AAEA,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAGtB,MAAM,0BAAmD;AAAA,EAC9D;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AACF;AAEA,MAAM,YAAY;AAClB,MAAM,SAAS;AACf,MAAM,gBAAgB,GAAG,MAAM;AAC/B,MAAM,YAAY,GAAG,MAAM;AAC3B,MAAM,uBAAuB,GAAG,MAAM;AACtC,MAAM,mBAAmB,GAAG,MAAM;AAClC,MAAM,uBAAuB,GAAG,MAAM;AACtC,MAAM,sBAAsB,GAAG,MAAM;AACrC,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AACzC,MAAM,yBAAyB,KAAK,KAAK;AACzC,MAAM,QAAQ;AACd,MAAM,iBAAiB;AAEvB,MAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BrB,eAAe,cAA+B;AAC5C,QAAM,cAAc,MAAM,eAAe;AACzC,SAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AACvC;AAEA,SAAS,UAAU,OAAkC;AACnD,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,UAAU,MAAM,CAAC,KAAK;AAC5B,UAAM,SAAS,QACZ,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG,EACjB,OAAO,KAAK,KAAK,QAAQ,SAAS,CAAC,IAAI,GAAG,GAAG;AAChD,UAAM,UAAU,KAAK,MAAM;AAC3B,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BAA2B,SAAuD;AACzF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,YAAY,QAAQ,sBAAsB,QAAQ,cAAc,GAAG;AACzE,SAAO,OAAO,cAAc,YAAY,UAAU,SAAS,IAAI,YAAY;AAC7E;AAEA,SAAS,aAAa,QAA8C,UAAuC;AACzG,QAAM,cAAc,OAAO,UAAU,2BAA2B,UAAU,OAAO,OAAO,CAAC,IAAI;AAC7F,MAAI,YAAa,QAAO;AAExB,QAAM,kBAAkB,2BAA2B,UAAU,OAAO,MAAM,CAAC;AAC3E,MAAI,gBAAiB,QAAO;AAE5B,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA8C,UAA2B;AACjG,QAAM,YAAY,aAAa,QAAQ,QAAQ;AAC/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO;AACT;AASA,SAAS,sBAAsB,MAAyB,WAAgC;AACtF,MAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,eAAe;AAC7C,YAAQ,MAAM,kBAAkB,SAAS,6BAA6B,IAAI;AAC1E,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,SAAS,KAAK,IAAI,KAAK,KAAK,cAAc,oCAAoC;AAAA,IAC9E,SAAS,KAAK;AAAA,EAChB;AACF;AAEA,eAAe,0BAA0B,MAAc,UAAkB,aAA2C;AAClH,QAAM,WAAW,MAAM,MAAM,WAAW;AAAA,IACtC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM,IAAI,gBAAgB;AAAA,MACxB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA,eAAe;AAAA,MACf,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,YAAQ,MAAM,sCAAsC,SAAS,QAAQ,IAAI;AACzE,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAEA,SAAO,sBAAuB,MAAM,SAAS,KAAK,GAAyB,OAAO;AACpF;AAEA,eAAe,mBAAmB,cAA4C;AAC5E,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,WAAW;AAAA,MACtC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,eAAe;AAAA,QACf,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,cAAQ,MAAM,wCAAwC,SAAS,QAAQ,IAAI;AAC3E,aAAO,EAAE,MAAM,SAAS;AAAA,IAC1B;AAEA,WAAO,sBAAuB,MAAM,SAAS,KAAK,GAAyB,eAAe;AAAA,EAC5F,SAAS,OAAO;AACd,YAAQ,MAAM,uCAAuC,KAAK;AAC1D,WAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AACF;AAEA,eAAe,iBAAiB;AAC9B,MAAI,CAAC,gBAAgB,gBAAgB;AACnC,oBAAgB,MAAM,gBAAgB;AAAA,EACxC;AACA,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO;AACT;AAEA,eAAe,wBACb,aACA,OACA,aAAqB,cACuB;AAC5C,QAAM,EAAE,UAAU,UAAU,IAAI,MAAM,aAAa;AAEnD,QAAM,MAAM,IAAI,IAAI,aAAa;AACjC,MAAI,aAAa,IAAI,iBAAiB,MAAM;AAC5C,MAAI,aAAa,IAAI,aAAa,SAAS;AAC3C,MAAI,aAAa,IAAI,gBAAgB,WAAW;AAChD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,aAAa,IAAI,kBAAkB,SAAS;AAChD,MAAI,aAAa,IAAI,yBAAyB,MAAM;AACpD,MAAI,aAAa,IAAI,SAAS,KAAK;AACnC,MAAI,aAAa,IAAI,8BAA8B,MAAM;AACzD,MAAI,aAAa,IAAI,6BAA6B,MAAM;AACxD,MAAI,aAAa,IAAI,cAAc,UAAU;AAE7C,SAAO,EAAE,UAAU,KAAK,IAAI,SAAS,EAAE;AACzC;AAeA,MAAM,uBAAsC;AAAA,EAC1C,aAAa;AAAA,EACb,cAAc;AAChB;AAEA,eAAe,cAAc,MAA6B;AACxD,MAAI;AACF,UAAM,MAAM,oBAAoB,IAAI,WAAW,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;AAAA,EACrF,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,OAAO,QAAoB,MAAgC;AAClE,SAAO,IAAI,QAAQ,aAAW;AAC5B,UAAM,UAAU,MAAM;AACpB,aAAO,IAAI,aAAa,WAAW;AACnC,cAAQ,KAAK;AAAA,IACf;AACA,UAAM,cAAc,MAAM;AACxB,aAAO,IAAI,SAAS,OAAO;AAC3B,cAAQ,IAAI;AAAA,IACd;AAEA,WAAO,KAAK,SAAS,OAAO;AAC5B,WAAO,KAAK,aAAa,WAAW;AACpC,WAAO,OAAO,MAAM,WAAW;AAAA,EACjC,CAAC;AACH;AAEA,eAAe,gBAAgB,QAAoB,OAA8C;AAC/F,QAAM,cAAc,MAAM,WAAW;AACrC,MAAI,MAAM,OAAO,QAAQ,MAAM,WAAW,EAAG,QAAO,MAAM;AAC1D,MAAI,MAAM,OAAO,QAAQ,MAAM,YAAY,EAAG,QAAO,MAAM;AAE3D,SAAO;AACT;AAEA,eAAe,gBAAgB;AAC7B,MAAI,CAAC,SAAS,cAAc;AAC1B,YAAQ,MAAM;AAAA,EAChB;AACA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO;AACT;AAEA,eAAe,sBACb,OACA,QAAuB,sBACG;AAC1B,QAAM,OAAO,MAAM,cAAc;AACjC,MAAI,WAA0B;AAC9B,MAAI,YAAY;AAChB,QAAM,SAAS,KAAK,aAAa,CAAC,KAAK,QAAQ;AAC7C,QAAI;AACF,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;AACrD,UAAI,IAAI,aAAa,WAAW;AAC9B,oBAAY;AACZ,YAAI,aAAa;AACjB,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AACA,UAAI,IAAI,aAAa,kBAAkB;AACrC,YAAI,aAAa;AACjB,YAAI,IAAI,WAAW;AACnB;AAAA,MACF;AACA,UAAI,IAAI,aAAa,IAAI,OAAO,MAAM,OAAO;AAC3C,YAAI,aAAa;AACjB,YAAI,IAAI,gBAAgB;AACxB;AAAA,MACF;AACA,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAI,CAAC,MAAM;AACT,YAAI,aAAa;AACjB,YAAI,IAAI,4BAA4B;AACpC;AAAA,MACF;AACA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,0BAA0B;AACxD,UAAI,IAAI,YAAY;AACpB,iBAAW;AAAA,IACb,QAAQ;AACN,UAAI,aAAa;AACjB,UAAI,IAAI,gBAAgB;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,SAAO,IAAI,QAAQ,aAAW;AAC5B,oBAAgB,QAAQ,KAAK,EAAE,KAAK,UAAQ;AAC1C,UAAI,CAAC,MAAM;AACT,gBAAQ;AAAA,UACN,aAAa,oBAAoB,MAAM,YAAY;AAAA,UACnD,SAAS,8CAA8C,MAAM,WAAW,OAAO,MAAM,YAAY;AAAA,UACjG,OAAO,MAAM;AACX,gBAAI;AACF,qBAAO,MAAM;AAAA,YACf,QAAQ;AAAA,YAER;AAAA,UACF;AAAA,UACA,YAAY,MAAM;AAAA,UAAC;AAAA,UACnB,aAAa,YAAY;AAAA,QAC3B,CAAC;AACD;AAAA,MACF;AAEA,cAAQ;AAAA,QACN,aAAa,oBAAoB,IAAI;AAAA,QACrC,OAAO,MAAM,OAAO,MAAM;AAAA,QAC1B,YAAY,MAAM;AAChB,sBAAY;AAAA,QACd;AAAA,QACA,aAAa,YAAY;AACvB,gBAAM,QAAQ,MAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,GAAG,CAAC;AACvD,mBAAS,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;AAC/B,gBAAI,SAAU,QAAO,EAAE,MAAM,SAAS;AACtC,gBAAI,UAAW,QAAO;AACtB,kBAAM,MAAM;AAAA,UACd;AACA,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACH;AA6BA,eAAsB,sBAAsB,SAAsE;AAChH,QAAM,WAAW,MAAM,MAAM,sBAAsB;AAAA,IACjD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB;AAAA,IACA,MAAM,KAAK,UAAU,EAAE,WAAW,WAAW,YAAY,aAAa,CAAC;AAAA,IACvE,QAAQ,SAAS;AAAA,EACnB,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,yDAAyD,SAAS,MAAM,EAAE;AAAA,EAC5F;AAEA,QAAM,aAAc,MAAM,SAAS,KAAK;AAOxC,QAAM,WAAW,WAAW,aAAa,WAAW;AAEpD,MAAI,CAAC,WAAW,kBAAkB,CAAC,UAAU;AAC3C,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AAEA,QAAM,kBACJ,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW,OAAO,SAAS,WAAW,YAAY,IAAI,EAAE,KAAK;AAEpH,SAAO;AAAA,IACL,cAAc,WAAW;AAAA,IACzB;AAAA,IACA,KAAK;AAAA,IACL,cAAc,eAAe,QAAQ;AAAA,IACrC,YAAY,KAAK,IAAI,iBAAiB,CAAC,IAAI;AAAA,IAC3C,YAAY,KAAK,IAAI,IAAI;AAAA,EAC3B;AACF;AASA,eAAsB,qBACpB,SACA,SACgC;AAChC,MAAI,KAAK,IAAI,KAAK,QAAQ,YAAY;AACpC,WAAO,EAAE,QAAQ,UAAU,OAAO,+DAA+D;AAAA,EACnG;AAEA,QAAM,eAAe,MAAM,MAAM,kBAAkB;AAAA,IACjD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB;AAAA,IACA,MAAM,KAAK,UAAU;AAAA,MACnB,gBAAgB,QAAQ;AAAA,MACxB,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,IACD,QAAQ,SAAS;AAAA,EACnB,CAAC;AAED,MAAI,aAAa,IAAI;AACnB,UAAM,OAAQ,MAAM,aAAa,KAAK;AAKtC,QAAI,CAAC,KAAK,sBAAsB,CAAC,KAAK,eAAe;AACnD,aAAO,EAAE,QAAQ,UAAU,OAAO,6DAA6D;AAAA,IACjG;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL;AAAA,IACF;AACA,QAAI,YAAY,SAAS,WAAW;AAClC,aAAO,EAAE,QAAQ,UAAU,OAAO,wBAAwB;AAAA,IAC5D;AAEA,QAAI;AACJ,QAAI;AACF,kBAAY,iBAAiB,WAAW;AAAA,IAC1C,SAAS,OAAO;AACd,aAAO,EAAE,QAAQ,UAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,IAC3F;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,QAAQ,YAAY;AAAA,QACpB,SAAS,YAAY;AAAA,QACrB,SAAS,YAAY;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,aAAa,WAAW,OAAO,aAAa,WAAW,KAAK;AAC9D,UAAM,OAAO,MAAM,aAAa,KAAK,EAAE,MAAM,MAAM,EAAE;AACrD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,OAAO,6CAA6C,aAAa,MAAM,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE;AAAA,IAClG;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,WAAW,YAAY,QAAQ,WAAW;AAC7D;AAEA,eAAe,uBAAuB,SAKR;AAC5B,QAAM,UAAU,MAAM,sBAAsB,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACtE,QAAM,QAAQ,QAAQ,UAAU,QAAM,IAAI,QAAc,aAAW,WAAW,SAAS,EAAE,CAAC;AAE1F,UAAQ,OAAO;AAAA,IACb,KAAK,QAAQ;AAAA,IACb,cAAc,QAAQ;AAAA,EACxB,CAAC;AAED,QAAM,MAAM,QAAQ,UAAU;AAE9B,SAAO,MAAM;AACX,QAAI,QAAQ,QAAQ,SAAS;AAC3B,YAAM,IAAI,MAAM,iBAAiB;AAAA,IACnC;AAEA,UAAM,SAAS,MAAM,qBAAqB,SAAS,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC7E,QAAI,OAAO,WAAW,YAAY;AAChC,aAAO,OAAO;AAAA,IAChB;AACA,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,MAAM,OAAO,KAAK;AAAA,IAC9B;AAEA,YAAQ,aAAa,kDAAkD;AACvE,UAAM,MAAM,OAAO,UAAU;AAAA,EAC/B;AACF;AAaA,eAAsB,iBAAiB,SAQT;AAC5B,QAAM,UACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,sCAAsC,WACjF,WACA;AACN,QAAM,OAAO,QAAQ,QAAQ,WAAW;AACxC,MAAI,SAAS,UAAU;AACrB,WAAO,uBAAuB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ;AAAA,MACpB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,MAAM,YAAY;AAChC,QAAM,SAAS,MAAM,sBAAsB,KAAK;AAChD,MAAI,OAAO,SAAS;AAClB,YAAQ,aAAa,OAAO,OAAO;AAAA,EACrC;AACA,QAAM,EAAE,UAAU,IAAI,IAAI,MAAM;AAAA,IAC9B,OAAO;AAAA,IACP;AAAA,IACA,QAAQ,cAAc;AAAA,EACxB;AAEA,UAAQ,OAAO;AAAA,IACb;AAAA,IACA,cAAc,OAAO,UACjB,GAAG,OAAO,OAAO,+EACjB;AAAA,EACN,CAAC;AAED,MAAI;AACJ,MAAI;AACF,QAAI,QAAQ,mBAAmB;AAE7B,UAAI;AACJ,UAAI;AACJ,YAAM,gBAAgB,QACnB,kBAAkB,EAClB,KAAK,WAAS;AACb,qBAAa;AACb,eAAO,WAAW;AAAA,MACpB,CAAC,EACA,MAAM,SAAO;AACZ,sBAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAChE,eAAO,WAAW;AAAA,MACpB,CAAC;AAEH,YAAM,SAAS,MAAM,OAAO,YAAY;AAGxC,UAAI,aAAa;AACf,cAAM;AAAA,MACR;AAEA,UAAI,QAAQ,MAAM;AAEhB,eAAO,OAAO;AAAA,MAChB,WAAW,YAAY;AAErB,cAAM,SAAS,wBAAwB,UAAU;AACjD,YAAI,OAAO,SAAS,OAAO,UAAU,OAAO;AAC1C,gBAAM,IAAI,MAAM,gBAAgB;AAAA,QAClC;AACA,eAAO,OAAO;AAAA,MAChB;AAGA,UAAI,CAAC,MAAM;AACT,cAAM;AACN,YAAI,aAAa;AACf,gBAAM;AAAA,QACR;AACA,YAAI,YAAY;AACd,gBAAM,SAAS,wBAAwB,UAAU;AACjD,cAAI,OAAO,SAAS,OAAO,UAAU,OAAO;AAC1C,kBAAM,IAAI,MAAM,gBAAgB;AAAA,UAClC;AACA,iBAAO,OAAO;AAAA,QAChB;AAAA,MACF;AAAA,IACF,OAAO;AAEL,YAAM,SAAS,MAAM,OAAO,YAAY;AACxC,UAAI,QAAQ,MAAM;AAChB,eAAO,OAAO;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,CAAC,MAAM;AACT,YAAM,QAAQ,MAAM,QAAQ,SAAS;AAAA,QACnC,SAAS;AAAA,MACX,CAAC;AACD,YAAM,SAAS,wBAAwB,KAAK;AAC5C,UAAI,OAAO,SAAS,OAAO,UAAU,OAAO;AAC1C,cAAM,IAAI,MAAM,gBAAgB;AAAA,MAClC;AACA,aAAO,OAAO;AAAA,IAChB;AAEA,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,4BAA4B;AAAA,IAC9C;AAEA,UAAM,cAAc,MAAM,0BAA0B,MAAM,UAAU,OAAO,WAAW;AACtF,QAAI,YAAY,SAAS,WAAW;AAClC,YAAM,IAAI,MAAM,uBAAuB;AAAA,IACzC;AAEA,UAAM,YAAY,iBAAiB,WAAW;AAE9C,WAAO;AAAA,MACL,QAAQ,YAAY;AAAA,MACpB,SAAS,YAAY;AAAA,MACrB,SAAS,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF,UAAE;AACA,WAAO,MAAM;AAAA,EACf;AACF;AAEO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,eAAsB,wBACpB,cACA,mBAC2B;AAC3B,QAAM,SAAS,MAAM,mBAAmB,YAAY;AACpD,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,QAAM,YAAY,iBAAiB,QAAQ,iBAAiB;AAE5D,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,2BAAmD;AAAA,EAC9D,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,oBAAoB;AAAA,EACpB,WAAW;AAAA,EAEX,MAAM,MAAM,WAA2D;AACrE,UAAM,OAAO,UAAU,aAAa,YAAY,UAAU,aAAa,YAAY,UAAU,WAAW;AACxG,WAAO,iBAAiB;AAAA,MACtB,QAAQ,UAAU;AAAA,MAClB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,mBAAmB,UAAU;AAAA,MAC7B,QAAQ,UAAU;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,aAA0D;AAC3E,WAAO,wBAAwB,YAAY,SAAS,YAAY,SAA+B;AAAA,EACjG;AAAA,EAEA,UAAU,aAAuC;AAC/C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}
1
+ {"version":3,"file":"openai-codex.js","names":[],"sources":["../../../src/auth/providers/openai-codex.ts"],"sourcesContent":["/**\n * OpenAI Codex (ChatGPT OAuth) flow\n *\n * Inspired by pi-mono's OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/openai-codex.ts\n *\n * NOTE: This module uses Node.js crypto and http for the OAuth callback.\n * It is only intended for CLI use, not browser environments.\n */\n\n// NEVER convert to top-level imports - breaks browser/Vite builds (web-ui)\nlet _randomBytes: ((size: number) => Buffer) | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _cryptoPromise: Promise<typeof import('node:crypto')> | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _httpPromise: Promise<typeof import('node:http')> | null = null;\n// eslint-disable-next-line @typescript-eslint/consistent-type-imports\nlet _http: typeof import('node:http') | null = null;\ntype HttpServer = {\n off: (event: 'error' | 'listening', listener: (...args: any[]) => void) => HttpServer;\n once: (event: 'error' | 'listening', listener: (...args: any[]) => void) => HttpServer;\n listen: (port: number, hostname: string) => HttpServer;\n close: () => void;\n};\nif (typeof process !== 'undefined' && (process.versions?.node || process.versions?.bun)) {\n _cryptoPromise = import('node:crypto').then(m => {\n _randomBytes = m.randomBytes;\n return m;\n });\n _httpPromise = import('node:http').then(m => {\n _http = m;\n return m;\n });\n}\n\nimport { parseAuthorizationInput } from '../authorization-input.js';\nimport { generatePKCE } from '../pkce.js';\nimport type { AuthMode, OAuthCredentials, OAuthLoginCallbacks, OAuthPrompt, OAuthProviderInterface } from '../types.js';\n\nexport const OPENAI_CODEX_AUTH_MODES: ReadonlyArray<AuthMode> = [\n {\n id: 'browser',\n name: 'Browser (local callback)',\n description: 'Opens the browser and waits for the OAuth callback on localhost.',\n },\n {\n id: 'device',\n name: 'Device code (headless)',\n description: 'Shows a code to enter at openai.com — for SSH, remote, or no-browser environments.',\n },\n];\n\nconst CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\nconst ISSUER = 'https://auth.openai.com';\nconst AUTHORIZE_URL = `${ISSUER}/oauth/authorize`;\nconst TOKEN_URL = `${ISSUER}/oauth/token`;\nconst DEVICE_USER_CODE_URL = `${ISSUER}/api/accounts/deviceauth/usercode`;\nconst DEVICE_TOKEN_URL = `${ISSUER}/api/accounts/deviceauth/token`;\nconst DEVICE_AUTHORIZE_URL = `${ISSUER}/codex/device`;\nconst DEVICE_REDIRECT_URI = `${ISSUER}/deviceauth/callback`;\nconst DEFAULT_CALLBACK_PORT = 1455;\nconst FALLBACK_CALLBACK_PORT = 1457;\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\nconst DEVICE_AUTH_TIMEOUT_MS = 15 * 60 * 1000;\nconst SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';\nconst JWT_CLAIM_PATH = 'https://api.openai.com/auth';\n\nconst SUCCESS_HTML = `<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n <title>Authentication successful</title>\n</head>\n<body>\n <p>Authentication successful. Return to your terminal to continue.</p>\n</body>\n</html>`;\n\ntype TokenSuccess = {\n type: 'success';\n access: string;\n refresh: string;\n expires: number;\n idToken?: string;\n};\ntype TokenFailure = { type: 'failed' };\ntype TokenResult = TokenSuccess | TokenFailure;\n\ntype JwtPayload = {\n chatgpt_account_id?: string;\n [JWT_CLAIM_PATH]?: {\n chatgpt_account_id?: string;\n };\n [key: string]: unknown;\n};\n\nasync function createState(): Promise<string> {\n const randomBytes = await getRandomBytes();\n return randomBytes(16).toString('hex');\n}\n\nfunction decodeJwt(token: string): JwtPayload | null {\n try {\n const parts = token.split('.');\n if (parts.length !== 3) return null;\n const payload = parts[1] ?? '';\n const padded = payload\n .replace(/-/g, '+')\n .replace(/_/g, '/')\n .padEnd(Math.ceil(payload.length / 4) * 4, '=');\n const decoded = atob(padded);\n return JSON.parse(decoded) as JwtPayload;\n } catch {\n return null;\n }\n}\n\nfunction extractAccountIdFromClaims(payload: JwtPayload | null | undefined): string | null {\n if (!payload) return null;\n const accountId = payload.chatgpt_account_id ?? payload[JWT_CLAIM_PATH]?.chatgpt_account_id;\n return typeof accountId === 'string' && accountId.length > 0 ? accountId : null;\n}\n\nfunction getAccountId(tokens: { idToken?: string; access: string }, fallback?: string): string | undefined {\n const fromIdToken = tokens.idToken ? extractAccountIdFromClaims(decodeJwt(tokens.idToken)) : null;\n if (fromIdToken) return fromIdToken;\n\n const fromAccessToken = extractAccountIdFromClaims(decodeJwt(tokens.access));\n if (fromAccessToken) return fromAccessToken;\n\n return fallback;\n}\n\nfunction requireAccountId(tokens: { idToken?: string; access: string }, fallback?: string): string {\n const accountId = getAccountId(tokens, fallback);\n if (!accountId) {\n throw new Error('Failed to extract ChatGPT account id from OpenAI Codex token');\n }\n return accountId;\n}\n\ntype TokenResponseJson = {\n id_token?: string;\n access_token?: string;\n refresh_token?: string;\n expires_in?: number;\n};\n\nfunction tokenResponseToResult(json: TokenResponseJson, logPrefix: string): TokenResult {\n if (!json.access_token || !json.refresh_token) {\n console.error(`[openai-codex] ${logPrefix} response missing fields:`, json);\n return { type: 'failed' };\n }\n\n return {\n type: 'success',\n access: json.access_token,\n refresh: json.refresh_token,\n expires: Date.now() + (json.expires_in ?? DEFAULT_TOKEN_EXPIRES_IN_SECONDS) * 1000,\n idToken: json.id_token,\n };\n}\n\nasync function exchangeAuthorizationCode(code: string, verifier: string, redirectUri: string): Promise<TokenResult> {\n const response = await fetch(TOKEN_URL, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'authorization_code',\n client_id: CLIENT_ID,\n code,\n code_verifier: verifier,\n redirect_uri: redirectUri,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n console.error('[openai-codex] code->token failed:', response.status, text);\n return { type: 'failed' };\n }\n\n return tokenResponseToResult((await response.json()) as TokenResponseJson, 'token');\n}\n\nasync function refreshAccessToken(refreshToken: string): Promise<TokenResult> {\n try {\n const response = await fetch(TOKEN_URL, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'refresh_token',\n refresh_token: refreshToken,\n client_id: CLIENT_ID,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n console.error('[openai-codex] Token refresh failed:', response.status, text);\n return { type: 'failed' };\n }\n\n return tokenResponseToResult((await response.json()) as TokenResponseJson, 'Token refresh');\n } catch (error) {\n console.error('[openai-codex] Token refresh error:', error);\n return { type: 'failed' };\n }\n}\n\nasync function getRandomBytes() {\n if (!_randomBytes && _cryptoPromise) {\n _randomBytes = (await _cryptoPromise).randomBytes;\n }\n if (!_randomBytes) {\n throw new Error('OpenAI Codex OAuth is only available in Node.js environments');\n }\n return _randomBytes;\n}\n\nasync function createAuthorizationFlow(\n redirectUri: string,\n state: string,\n originator: string = 'mastracode',\n): Promise<{ verifier: string; url: string }> {\n const { verifier, challenge } = await generatePKCE();\n\n const url = new URL(AUTHORIZE_URL);\n url.searchParams.set('response_type', 'code');\n url.searchParams.set('client_id', CLIENT_ID);\n url.searchParams.set('redirect_uri', redirectUri);\n url.searchParams.set('scope', SCOPE);\n url.searchParams.set('code_challenge', challenge);\n url.searchParams.set('code_challenge_method', 'S256');\n url.searchParams.set('state', state);\n url.searchParams.set('id_token_add_organizations', 'true');\n url.searchParams.set('codex_cli_simplified_flow', 'true');\n url.searchParams.set('originator', originator);\n\n return { verifier, url: url.toString() };\n}\n\ntype OAuthServerInfo = {\n redirectUri: string;\n warning?: string;\n close: () => void;\n cancelWait: () => void;\n waitForCode: () => Promise<{ code: string } | null>;\n};\n\ntype CallbackPorts = {\n defaultPort: number;\n fallbackPort: number;\n};\n\nconst CODEX_CALLBACK_PORTS: CallbackPorts = {\n defaultPort: DEFAULT_CALLBACK_PORT,\n fallbackPort: FALLBACK_CALLBACK_PORT,\n};\n\nasync function requestCancel(port: number): Promise<void> {\n try {\n await fetch(`http://127.0.0.1:${port}/cancel`, { signal: AbortSignal.timeout(200) });\n } catch {\n // The existing listener might not be a Codex auth server.\n }\n}\n\nfunction listen(server: HttpServer, port: number): Promise<boolean> {\n return new Promise(resolve => {\n const onError = () => {\n server.off('listening', onListening);\n resolve(false);\n };\n const onListening = () => {\n server.off('error', onError);\n resolve(true);\n };\n\n server.once('error', onError);\n server.once('listening', onListening);\n server.listen(port, '127.0.0.1');\n });\n}\n\nasync function bindOAuthServer(server: HttpServer, ports: CallbackPorts): Promise<number | null> {\n await requestCancel(ports.defaultPort);\n if (await listen(server, ports.defaultPort)) return ports.defaultPort;\n if (await listen(server, ports.fallbackPort)) return ports.fallbackPort;\n\n return null;\n}\n\nasync function getHttpModule() {\n if (!_http && _httpPromise) {\n _http = await _httpPromise;\n }\n if (!_http) {\n throw new Error('OpenAI Codex OAuth is only available in Node.js environments');\n }\n return _http;\n}\n\nasync function startLocalOAuthServer(\n state: string,\n ports: CallbackPorts = CODEX_CALLBACK_PORTS,\n): Promise<OAuthServerInfo> {\n const http = await getHttpModule();\n let lastCode: string | null = null;\n let cancelled = false;\n const server = http.createServer((req, res) => {\n try {\n const url = new URL(req.url || '', 'http://localhost');\n if (url.pathname === '/cancel') {\n cancelled = true;\n res.statusCode = 200;\n res.end('Cancelled');\n return;\n }\n if (url.pathname !== '/auth/callback') {\n res.statusCode = 404;\n res.end('Not found');\n return;\n }\n if (url.searchParams.get('state') !== state) {\n res.statusCode = 400;\n res.end('State mismatch');\n return;\n }\n const code = url.searchParams.get('code');\n if (!code) {\n res.statusCode = 400;\n res.end('Missing authorization code');\n return;\n }\n res.statusCode = 200;\n res.setHeader('Content-Type', 'text/html; charset=utf-8');\n res.end(SUCCESS_HTML);\n lastCode = code;\n } catch {\n res.statusCode = 500;\n res.end('Internal error');\n }\n });\n\n return new Promise(resolve => {\n bindOAuthServer(server, ports).then(port => {\n if (!port) {\n resolve({\n redirectUri: `http://localhost:${ports.fallbackPort}/auth/callback`,\n warning: `OpenAI Codex OAuth requires localhost port ${ports.defaultPort} or ${ports.fallbackPort}, but both are in use. Automatic browser callback will not work until one is freed.`,\n close: () => {\n try {\n server.close();\n } catch {\n // ignore\n }\n },\n cancelWait: () => {},\n waitForCode: async () => null,\n });\n return;\n }\n\n resolve({\n redirectUri: `http://localhost:${port}/auth/callback`,\n close: () => server.close(),\n cancelWait: () => {\n cancelled = true;\n },\n waitForCode: async () => {\n const sleep = () => new Promise(r => setTimeout(r, 100));\n for (let i = 0; i < 600; i += 1) {\n if (lastCode) return { code: lastCode };\n if (cancelled) return null;\n await sleep();\n }\n return null;\n },\n });\n });\n });\n}\n\n/**\n * Serializable pending state for a Codex device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests — the\n * device token response carries the `code_verifier`, so no PKCE state needs\n * to be kept client-side.\n */\nexport interface CodexDeviceLoginPending {\n deviceAuthId: string;\n userCode: string;\n /** Verification URL for the user to open. */\n url: string;\n instructions: string;\n /** Poll interval in ms suggested by the server. */\n intervalMs: number;\n /** ms epoch after which the device authorization expires. */\n deadlineAt: number;\n}\n\nexport type CodexDevicePollResult =\n | { status: 'complete'; credentials: OAuthCredentials }\n | { status: 'pending'; nextPollMs: number }\n | { status: 'failed'; error: string };\n\n/**\n * Start a Codex device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startCodexDeviceLogin(options?: { signal?: AbortSignal }): Promise<CodexDeviceLoginPending> {\n const response = await fetch(DEVICE_USER_CODE_URL, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'User-Agent': 'mastracode',\n },\n body: JSON.stringify({ client_id: CLIENT_ID, originator: 'mastracode' }),\n signal: options?.signal,\n });\n\n if (!response.ok) {\n throw new Error(`Failed to initiate OpenAI Codex device authorization: ${response.status}`);\n }\n\n const deviceData = (await response.json()) as {\n device_auth_id?: string;\n user_code?: string;\n usercode?: string;\n interval?: string | number;\n };\n\n const userCode = deviceData.user_code ?? deviceData.usercode;\n\n if (!deviceData.device_auth_id || !userCode) {\n throw new Error('OpenAI Codex device authorization response missing required fields');\n }\n\n const intervalSeconds =\n typeof deviceData.interval === 'number' ? deviceData.interval : Number.parseInt(deviceData.interval ?? '', 10) || 5;\n\n return {\n deviceAuthId: deviceData.device_auth_id,\n userCode,\n url: DEVICE_AUTHORIZE_URL,\n instructions: `Enter code: ${userCode}`,\n intervalMs: Math.max(intervalSeconds, 1) * 1000,\n deadlineAt: Date.now() + DEVICE_AUTH_TIMEOUT_MS,\n };\n}\n\n/**\n * Perform exactly one upstream poll for a pending Codex device login.\n * The Codex device endpoint signals \"still pending\" via HTTP 403/404 (it is\n * not an RFC 8628 error-JSON endpoint); on success it returns the\n * authorization code plus server-held PKCE verifier, which we exchange\n * immediately for credentials. Never throws for flow-level conditions.\n */\nexport async function pollCodexDeviceLogin(\n pending: CodexDeviceLoginPending,\n options?: { signal?: AbortSignal },\n): Promise<CodexDevicePollResult> {\n if (Date.now() >= pending.deadlineAt) {\n return { status: 'failed', error: 'OpenAI Codex device authorization timed out after 15 minutes' };\n }\n\n const pollResponse = await fetch(DEVICE_TOKEN_URL, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n 'User-Agent': 'mastracode',\n },\n body: JSON.stringify({\n device_auth_id: pending.deviceAuthId,\n user_code: pending.userCode,\n }),\n signal: options?.signal,\n });\n\n if (pollResponse.ok) {\n const data = (await pollResponse.json()) as {\n authorization_code?: string;\n code_verifier?: string;\n };\n\n if (!data.authorization_code || !data.code_verifier) {\n return { status: 'failed', error: 'OpenAI Codex device token response missing required fields' };\n }\n\n const tokenResult = await exchangeAuthorizationCode(\n data.authorization_code,\n data.code_verifier,\n DEVICE_REDIRECT_URI,\n );\n if (tokenResult.type !== 'success') {\n return { status: 'failed', error: 'Token exchange failed' };\n }\n\n let accountId: string;\n try {\n accountId = requireAccountId(tokenResult);\n } catch (error) {\n return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n }\n\n return {\n status: 'complete',\n credentials: {\n access: tokenResult.access,\n refresh: tokenResult.refresh,\n expires: tokenResult.expires,\n accountId,\n },\n };\n }\n\n if (pollResponse.status !== 403 && pollResponse.status !== 404) {\n const text = await pollResponse.text().catch(() => '');\n return {\n status: 'failed',\n error: `OpenAI Codex device authorization failed: ${pollResponse.status}${text ? ` ${text}` : ''}`,\n };\n }\n\n return { status: 'pending', nextPollMs: pending.intervalMs };\n}\n\nasync function loginOpenAICodexDevice(options: {\n onAuth: (info: { url: string; instructions?: string }) => void;\n onProgress?: (message: string) => void;\n signal?: AbortSignal;\n sleep?: (ms: number) => Promise<void>;\n}): Promise<OAuthCredentials> {\n const pending = await startCodexDeviceLogin({ signal: options.signal });\n const sleep = options.sleep ?? (ms => new Promise<void>(resolve => setTimeout(resolve, ms)));\n\n options.onAuth({\n url: pending.url,\n instructions: pending.instructions,\n });\n\n await sleep(pending.intervalMs);\n\n while (true) {\n if (options.signal?.aborted) {\n throw new Error('Login cancelled');\n }\n\n const result = await pollCodexDeviceLogin(pending, { signal: options.signal });\n if (result.status === 'complete') {\n return result.credentials;\n }\n if (result.status === 'failed') {\n throw new Error(result.error);\n }\n\n options.onProgress?.('Waiting for OpenAI Codex device authorization...');\n await sleep(result.nextPollMs);\n }\n}\n\n/**\n * Login with OpenAI Codex OAuth\n *\n * @param options.onAuth - Called with URL and instructions when auth starts\n * @param options.onPrompt - Called to prompt user for manual code paste (fallback if no onManualCodeInput)\n * @param options.onProgress - Optional progress messages\n * @param options.onManualCodeInput - Optional promise that resolves with user-pasted code.\n * Races with browser callback - whichever completes first wins.\n * Useful for showing paste input immediately alongside browser flow.\n * @param options.originator - OAuth originator parameter (defaults to \"mastracode\")\n */\nexport async function loginOpenAICodex(options: {\n onAuth: (info: { url: string; instructions?: string }) => void;\n onPrompt: (prompt: OAuthPrompt) => Promise<string>;\n onProgress?: (message: string) => void;\n onManualCodeInput?: () => Promise<string>;\n signal?: AbortSignal;\n originator?: string;\n mode?: 'browser' | 'device';\n}): Promise<OAuthCredentials> {\n const envMode =\n typeof process !== 'undefined' && process.env?.MASTRACODE_OPENAI_CODEX_AUTH_MODE === 'device'\n ? 'device'\n : undefined;\n const mode = options.mode ?? envMode ?? 'browser';\n if (mode === 'device') {\n return loginOpenAICodexDevice({\n onAuth: options.onAuth,\n onProgress: options.onProgress,\n signal: options.signal,\n });\n }\n\n const state = await createState();\n const server = await startLocalOAuthServer(state);\n if (server.warning) {\n options.onProgress?.(server.warning);\n }\n const { verifier, url } = await createAuthorizationFlow(\n server.redirectUri,\n state,\n options.originator ?? 'mastracode',\n );\n\n options.onAuth({\n url,\n instructions: server.warning\n ? `${server.warning} You can still paste the authorization code or full redirect URL manually.`\n : 'A browser window should open. Complete login to finish.',\n });\n\n let code: string | undefined;\n try {\n if (options.onManualCodeInput) {\n // Race between browser callback and manual input\n let manualCode: string | undefined;\n let manualError: Error | undefined;\n const manualPromise = options\n .onManualCodeInput()\n .then(input => {\n manualCode = input;\n server.cancelWait();\n })\n .catch(err => {\n manualError = err instanceof Error ? err : new Error(String(err));\n server.cancelWait();\n });\n\n const result = await server.waitForCode();\n\n // If manual input was cancelled, throw that error\n if (manualError) {\n throw manualError;\n }\n\n if (result?.code) {\n // Browser callback won\n code = result.code;\n } else if (manualCode) {\n // Manual input won (or callback timed out and user had entered code)\n const parsed = parseAuthorizationInput(manualCode);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n\n // If still no code, wait for manual promise to complete and try that\n if (!code) {\n await manualPromise;\n if (manualError) {\n throw manualError;\n }\n if (manualCode) {\n const parsed = parseAuthorizationInput(manualCode);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n }\n } else {\n // Original flow: wait for callback, then prompt if needed\n const result = await server.waitForCode();\n if (result?.code) {\n code = result.code;\n }\n }\n\n // Fallback to onPrompt if still no code\n if (!code) {\n const input = await options.onPrompt({\n message: 'Paste the authorization code (or full redirect URL):',\n });\n const parsed = parseAuthorizationInput(input);\n if (parsed.state && parsed.state !== state) {\n throw new Error('State mismatch');\n }\n code = parsed.code;\n }\n\n if (!code) {\n throw new Error('Missing authorization code');\n }\n\n const tokenResult = await exchangeAuthorizationCode(code, verifier, server.redirectUri);\n if (tokenResult.type !== 'success') {\n throw new Error('Token exchange failed');\n }\n\n const accountId = requireAccountId(tokenResult);\n\n return {\n access: tokenResult.access,\n refresh: tokenResult.refresh,\n expires: tokenResult.expires,\n accountId,\n };\n } finally {\n server.close();\n }\n}\n\nexport const __testing = {\n createAuthorizationFlow,\n decodeJwt,\n extractAccountIdFromClaims,\n getAccountId,\n loginOpenAICodexDevice,\n requireAccountId,\n startLocalOAuthServer,\n};\n\n/**\n * Refresh OpenAI Codex OAuth token\n */\nexport async function refreshOpenAICodexToken(\n refreshToken: string,\n previousAccountId?: string,\n): Promise<OAuthCredentials> {\n const result = await refreshAccessToken(refreshToken);\n if (result.type !== 'success') {\n throw new Error('Failed to refresh OpenAI Codex token');\n }\n\n const accountId = requireAccountId(result, previousAccountId);\n\n return {\n access: result.access,\n refresh: result.refresh,\n expires: result.expires,\n accountId,\n };\n}\n\nexport const openaiCodexOAuthProvider: OAuthProviderInterface = {\n id: 'openai-codex',\n name: 'ChatGPT Plus/Pro (Codex Subscription)',\n usesCallbackServer: true,\n authModes: OPENAI_CODEX_AUTH_MODES,\n\n async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n const mode = callbacks.authMode === 'device' || callbacks.authMode === 'browser' ? callbacks.authMode : undefined;\n return loginOpenAICodex({\n onAuth: callbacks.onAuth,\n onPrompt: callbacks.onPrompt,\n onProgress: callbacks.onProgress,\n onManualCodeInput: callbacks.onManualCodeInput,\n signal: callbacks.signal,\n mode,\n });\n },\n\n async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n return refreshOpenAICodexToken(credentials.refresh, credentials.accountId as string | undefined);\n },\n\n getApiKey(credentials: OAuthCredentials): string {\n return credentials.access;\n },\n};\n"],"mappings":";;;;;;;;;;;;AAWA,IAAI,eAAkD;AAEtD,IAAI,iBAA+D;AAEnE,IAAI,eAA2D;AAE/D,IAAI,QAA2C;AAO/C,IAAI,OAAO,YAAY,gBAAgB,QAAQ,UAAU,QAAQ,QAAQ,UAAU,MAAM;CACvF,iBAAiB,OAAO,SAAc,CAAC,MAAK,MAAK;EAC/C,eAAe,EAAE;EACjB,OAAO;CACT,CAAC;CACD,eAAe,OAAO,OAAY,CAAC,MAAK,MAAK;EAC3C,QAAQ;EACR,OAAO;CACT,CAAC;AACH;AAMA,MAAa,0BAAmD,CAC9D;CACE,IAAI;CACJ,MAAM;CACN,aAAa;AACf,GACA;CACE,IAAI;CACJ,MAAM;CACN,aAAa;AACf,CACF;AAEA,MAAM,YAAY;AAClB,MAAM,SAAS;AACf,MAAM,gBAAgB,GAAG,OAAO;AAChC,MAAM,YAAY,GAAG,OAAO;AAC5B,MAAM,uBAAuB,GAAG,OAAO;AACvC,MAAM,mBAAmB,GAAG,OAAO;AACnC,MAAM,uBAAuB,GAAG,OAAO;AACvC,MAAM,sBAAsB,GAAG,OAAO;AACtC,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AACzC,MAAM,yBAAyB,MAAU;AACzC,MAAM,QAAQ;AACd,MAAM,iBAAiB;AAEvB,MAAM,eAAe;;;;;;;;;;;AA8BrB,eAAe,cAA+B;CAE5C,QAAO,MADmB,eAAe,EAAA,CACtB,EAAE,CAAC,CAAC,SAAS,KAAK;AACvC;AAEA,SAAS,UAAU,OAAkC;CACnD,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,IAAI,MAAM,WAAW,GAAG,OAAO;EAC/B,MAAM,UAAU,MAAM,MAAM;EAC5B,MAAM,SAAS,QACZ,QAAQ,MAAM,GAAG,CAAC,CAClB,QAAQ,MAAM,GAAG,CAAC,CAClB,OAAO,KAAK,KAAK,QAAQ,SAAS,CAAC,IAAI,GAAG,GAAG;EAChD,MAAM,UAAU,KAAK,MAAM;EAC3B,OAAO,KAAK,MAAM,OAAO;CAC3B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,2BAA2B,SAAuD;CACzF,IAAI,CAAC,SAAS,OAAO;CACrB,MAAM,YAAY,QAAQ,sBAAsB,QAAQ,eAAe,EAAE;CACzE,OAAO,OAAO,cAAc,YAAY,UAAU,SAAS,IAAI,YAAY;AAC7E;AAEA,SAAS,aAAa,QAA8C,UAAuC;CACzG,MAAM,cAAc,OAAO,UAAU,2BAA2B,UAAU,OAAO,OAAO,CAAC,IAAI;CAC7F,IAAI,aAAa,OAAO;CAExB,MAAM,kBAAkB,2BAA2B,UAAU,OAAO,MAAM,CAAC;CAC3E,IAAI,iBAAiB,OAAO;CAE5B,OAAO;AACT;AAEA,SAAS,iBAAiB,QAA8C,UAA2B;CACjG,MAAM,YAAY,aAAa,QAAQ,QAAQ;CAC/C,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO;AACT;AASA,SAAS,sBAAsB,MAAyB,WAAgC;CACtF,IAAI,CAAC,KAAK,gBAAgB,CAAC,KAAK,eAAe;EAC7C,QAAQ,MAAM,kBAAkB,UAAU,4BAA4B,IAAI;EAC1E,OAAO,EAAE,MAAM,SAAS;CAC1B;CAEA,OAAO;EACL,MAAM;EACN,QAAQ,KAAK;EACb,SAAS,KAAK;EACd,SAAS,KAAK,IAAI,KAAK,KAAK,cAAc,oCAAoC;EAC9E,SAAS,KAAK;CAChB;AACF;AAEA,eAAe,0BAA0B,MAAc,UAAkB,aAA2C;CAClH,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GACxB,YAAY;GACZ,WAAW;GACX;GACA,eAAe;GACf,cAAc;EAChB,CAAC;CACH,CAAC;CAED,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,QAAQ,MAAM,sCAAsC,SAAS,QAAQ,IAAI;EACzE,OAAO,EAAE,MAAM,SAAS;CAC1B;CAEA,OAAO,sBAAuB,MAAM,SAAS,KAAK,GAAyB,OAAO;AACpF;AAEA,eAAe,mBAAmB,cAA4C;CAC5E,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,WAAW;GACtC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ,eAAe;IACf,WAAW;GACb,CAAC;EACH,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;GACjD,QAAQ,MAAM,wCAAwC,SAAS,QAAQ,IAAI;GAC3E,OAAO,EAAE,MAAM,SAAS;EAC1B;EAEA,OAAO,sBAAuB,MAAM,SAAS,KAAK,GAAyB,eAAe;CAC5F,SAAS,OAAO;EACd,QAAQ,MAAM,uCAAuC,KAAK;EAC1D,OAAO,EAAE,MAAM,SAAS;CAC1B;AACF;AAEA,eAAe,iBAAiB;CAC9B,IAAI,CAAC,gBAAgB,gBACnB,gBAAgB,MAAM,eAAA,CAAgB;CAExC,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO;AACT;AAEA,eAAe,wBACb,aACA,OACA,aAAqB,cACuB;CAC5C,MAAM,EAAE,UAAU,cAAc,MAAM,aAAa;CAEnD,MAAM,MAAM,IAAI,IAAI,aAAa;CACjC,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,aAAa,SAAS;CAC3C,IAAI,aAAa,IAAI,gBAAgB,WAAW;CAChD,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,IAAI,aAAa,IAAI,kBAAkB,SAAS;CAChD,IAAI,aAAa,IAAI,yBAAyB,MAAM;CACpD,IAAI,aAAa,IAAI,SAAS,KAAK;CACnC,IAAI,aAAa,IAAI,8BAA8B,MAAM;CACzD,IAAI,aAAa,IAAI,6BAA6B,MAAM;CACxD,IAAI,aAAa,IAAI,cAAc,UAAU;CAE7C,OAAO;EAAE;EAAU,KAAK,IAAI,SAAS;CAAE;AACzC;AAeA,MAAM,uBAAsC;CAC1C,aAAa;CACb,cAAc;AAChB;AAEA,eAAe,cAAc,MAA6B;CACxD,IAAI;EACF,MAAM,MAAM,oBAAoB,KAAK,UAAU,EAAE,QAAQ,YAAY,QAAQ,GAAG,EAAE,CAAC;CACrF,QAAQ,CAER;AACF;AAEA,SAAS,OAAO,QAAoB,MAAgC;CAClE,OAAO,IAAI,SAAQ,YAAW;EAC5B,MAAM,gBAAgB;GACpB,OAAO,IAAI,aAAa,WAAW;GACnC,QAAQ,KAAK;EACf;EACA,MAAM,oBAAoB;GACxB,OAAO,IAAI,SAAS,OAAO;GAC3B,QAAQ,IAAI;EACd;EAEA,OAAO,KAAK,SAAS,OAAO;EAC5B,OAAO,KAAK,aAAa,WAAW;EACpC,OAAO,OAAO,MAAM,WAAW;CACjC,CAAC;AACH;AAEA,eAAe,gBAAgB,QAAoB,OAA8C;CAC/F,MAAM,cAAc,MAAM,WAAW;CACrC,IAAI,MAAM,OAAO,QAAQ,MAAM,WAAW,GAAG,OAAO,MAAM;CAC1D,IAAI,MAAM,OAAO,QAAQ,MAAM,YAAY,GAAG,OAAO,MAAM;CAE3D,OAAO;AACT;AAEA,eAAe,gBAAgB;CAC7B,IAAI,CAAC,SAAS,cACZ,QAAQ,MAAM;CAEhB,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO;AACT;AAEA,eAAe,sBACb,OACA,QAAuB,sBACG;CAC1B,MAAM,OAAO,MAAM,cAAc;CACjC,IAAI,WAA0B;CAC9B,IAAI,YAAY;CAChB,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ;EAC7C,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,kBAAkB;GACrD,IAAI,IAAI,aAAa,WAAW;IAC9B,YAAY;IACZ,IAAI,aAAa;IACjB,IAAI,IAAI,WAAW;IACnB;GACF;GACA,IAAI,IAAI,aAAa,kBAAkB;IACrC,IAAI,aAAa;IACjB,IAAI,IAAI,WAAW;IACnB;GACF;GACA,IAAI,IAAI,aAAa,IAAI,OAAO,MAAM,OAAO;IAC3C,IAAI,aAAa;IACjB,IAAI,IAAI,gBAAgB;IACxB;GACF;GACA,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;GACxC,IAAI,CAAC,MAAM;IACT,IAAI,aAAa;IACjB,IAAI,IAAI,4BAA4B;IACpC;GACF;GACA,IAAI,aAAa;GACjB,IAAI,UAAU,gBAAgB,0BAA0B;GACxD,IAAI,IAAI,YAAY;GACpB,WAAW;EACb,QAAQ;GACN,IAAI,aAAa;GACjB,IAAI,IAAI,gBAAgB;EAC1B;CACF,CAAC;CAED,OAAO,IAAI,SAAQ,YAAW;EAC5B,gBAAgB,QAAQ,KAAK,CAAC,CAAC,MAAK,SAAQ;GAC1C,IAAI,CAAC,MAAM;IACT,QAAQ;KACN,aAAa,oBAAoB,MAAM,aAAa;KACpD,SAAS,8CAA8C,MAAM,YAAY,MAAM,MAAM,aAAa;KAClG,aAAa;MACX,IAAI;OACF,OAAO,MAAM;MACf,QAAQ,CAER;KACF;KACA,kBAAkB,CAAC;KACnB,aAAa,YAAY;IAC3B,CAAC;IACD;GACF;GAEA,QAAQ;IACN,aAAa,oBAAoB,KAAK;IACtC,aAAa,OAAO,MAAM;IAC1B,kBAAkB;KAChB,YAAY;IACd;IACA,aAAa,YAAY;KACvB,MAAM,cAAc,IAAI,SAAQ,MAAK,WAAW,GAAG,GAAG,CAAC;KACvD,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG;MAC/B,IAAI,UAAU,OAAO,EAAE,MAAM,SAAS;MACtC,IAAI,WAAW,OAAO;MACtB,MAAM,MAAM;KACd;KACA,OAAO;IACT;GACF,CAAC;EACH,CAAC;CACH,CAAC;AACH;;;;;AA6BA,eAAsB,sBAAsB,SAAsE;CAChH,MAAM,WAAW,MAAM,MAAM,sBAAsB;EACjD,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,KAAK,UAAU;GAAE,WAAW;GAAW,YAAY;EAAa,CAAC;EACvE,QAAQ,SAAS;CACnB,CAAC;CAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,yDAAyD,SAAS,QAAQ;CAG5F,MAAM,aAAc,MAAM,SAAS,KAAK;CAOxC,MAAM,WAAW,WAAW,aAAa,WAAW;CAEpD,IAAI,CAAC,WAAW,kBAAkB,CAAC,UACjC,MAAM,IAAI,MAAM,oEAAoE;CAGtF,MAAM,kBACJ,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW,OAAO,SAAS,WAAW,YAAY,IAAI,EAAE,KAAK;CAEpH,OAAO;EACL,cAAc,WAAW;EACzB;EACA,KAAK;EACL,cAAc,eAAe;EAC7B,YAAY,KAAK,IAAI,iBAAiB,CAAC,IAAI;EAC3C,YAAY,KAAK,IAAI,IAAI;CAC3B;AACF;;;;;;;;AASA,eAAsB,qBACpB,SACA,SACgC;CAChC,IAAI,KAAK,IAAI,KAAK,QAAQ,YACxB,OAAO;EAAE,QAAQ;EAAU,OAAO;CAA+D;CAGnG,MAAM,eAAe,MAAM,MAAM,kBAAkB;EACjD,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,KAAK,UAAU;GACnB,gBAAgB,QAAQ;GACxB,WAAW,QAAQ;EACrB,CAAC;EACD,QAAQ,SAAS;CACnB,CAAC;CAED,IAAI,aAAa,IAAI;EACnB,MAAM,OAAQ,MAAM,aAAa,KAAK;EAKtC,IAAI,CAAC,KAAK,sBAAsB,CAAC,KAAK,eACpC,OAAO;GAAE,QAAQ;GAAU,OAAO;EAA6D;EAGjG,MAAM,cAAc,MAAM,0BACxB,KAAK,oBACL,KAAK,eACL,mBACF;EACA,IAAI,YAAY,SAAS,WACvB,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAwB;EAG5D,IAAI;EACJ,IAAI;GACF,YAAY,iBAAiB,WAAW;EAC1C,SAAS,OAAO;GACd,OAAO;IAAE,QAAQ;IAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC3F;EAEA,OAAO;GACL,QAAQ;GACR,aAAa;IACX,QAAQ,YAAY;IACpB,SAAS,YAAY;IACrB,SAAS,YAAY;IACrB;GACF;EACF;CACF;CAEA,IAAI,aAAa,WAAW,OAAO,aAAa,WAAW,KAAK;EAC9D,MAAM,OAAO,MAAM,aAAa,KAAK,CAAC,CAAC,YAAY,EAAE;EACrD,OAAO;GACL,QAAQ;GACR,OAAO,6CAA6C,aAAa,SAAS,OAAO,IAAI,SAAS;EAChG;CACF;CAEA,OAAO;EAAE,QAAQ;EAAW,YAAY,QAAQ;CAAW;AAC7D;AAEA,eAAe,uBAAuB,SAKR;CAC5B,MAAM,UAAU,MAAM,sBAAsB,EAAE,QAAQ,QAAQ,OAAO,CAAC;CACtE,MAAM,QAAQ,QAAQ,WAAU,OAAM,IAAI,SAAc,YAAW,WAAW,SAAS,EAAE,CAAC;CAE1F,QAAQ,OAAO;EACb,KAAK,QAAQ;EACb,cAAc,QAAQ;CACxB,CAAC;CAED,MAAM,MAAM,QAAQ,UAAU;CAE9B,OAAO,MAAM;EACX,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;EAGnC,MAAM,SAAS,MAAM,qBAAqB,SAAS,EAAE,QAAQ,QAAQ,OAAO,CAAC;EAC7E,IAAI,OAAO,WAAW,YACpB,OAAO,OAAO;EAEhB,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,MAAM,OAAO,KAAK;EAG9B,QAAQ,aAAa,kDAAkD;EACvE,MAAM,MAAM,OAAO,UAAU;CAC/B;AACF;;;;;;;;;;;;AAaA,eAAsB,iBAAiB,SAQT;CAC5B,MAAM,UACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,sCAAsC,WACjF,WACA,KAAA;CAEN,KADa,QAAQ,QAAQ,WAAW,eAC3B,UACX,OAAO,uBAAuB;EAC5B,QAAQ,QAAQ;EAChB,YAAY,QAAQ;EACpB,QAAQ,QAAQ;CAClB,CAAC;CAGH,MAAM,QAAQ,MAAM,YAAY;CAChC,MAAM,SAAS,MAAM,sBAAsB,KAAK;CAChD,IAAI,OAAO,SACT,QAAQ,aAAa,OAAO,OAAO;CAErC,MAAM,EAAE,UAAU,QAAQ,MAAM,wBAC9B,OAAO,aACP,OACA,QAAQ,cAAc,YACxB;CAEA,QAAQ,OAAO;EACb;EACA,cAAc,OAAO,UACjB,GAAG,OAAO,QAAQ,8EAClB;CACN,CAAC;CAED,IAAI;CACJ,IAAI;EACF,IAAI,QAAQ,mBAAmB;GAE7B,IAAI;GACJ,IAAI;GACJ,MAAM,gBAAgB,QACnB,kBAAkB,CAAC,CACnB,MAAK,UAAS;IACb,aAAa;IACb,OAAO,WAAW;GACpB,CAAC,CAAC,CACD,OAAM,QAAO;IACZ,cAAc,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;IAChE,OAAO,WAAW;GACpB,CAAC;GAEH,MAAM,SAAS,MAAM,OAAO,YAAY;GAGxC,IAAI,aACF,MAAM;GAGR,IAAI,QAAQ,MAEV,OAAO,OAAO;QACT,IAAI,YAAY;IAErB,MAAM,SAAS,wBAAwB,UAAU;IACjD,IAAI,OAAO,SAAS,OAAO,UAAU,OACnC,MAAM,IAAI,MAAM,gBAAgB;IAElC,OAAO,OAAO;GAChB;GAGA,IAAI,CAAC,MAAM;IACT,MAAM;IACN,IAAI,aACF,MAAM;IAER,IAAI,YAAY;KACd,MAAM,SAAS,wBAAwB,UAAU;KACjD,IAAI,OAAO,SAAS,OAAO,UAAU,OACnC,MAAM,IAAI,MAAM,gBAAgB;KAElC,OAAO,OAAO;IAChB;GACF;EACF,OAAO;GAEL,MAAM,SAAS,MAAM,OAAO,YAAY;GACxC,IAAI,QAAQ,MACV,OAAO,OAAO;EAElB;EAGA,IAAI,CAAC,MAAM;GAIT,MAAM,SAAS,wBAAwB,MAHnB,QAAQ,SAAS,EACnC,SAAS,uDACX,CAAC,CAC2C;GAC5C,IAAI,OAAO,SAAS,OAAO,UAAU,OACnC,MAAM,IAAI,MAAM,gBAAgB;GAElC,OAAO,OAAO;EAChB;EAEA,IAAI,CAAC,MACH,MAAM,IAAI,MAAM,4BAA4B;EAG9C,MAAM,cAAc,MAAM,0BAA0B,MAAM,UAAU,OAAO,WAAW;EACtF,IAAI,YAAY,SAAS,WACvB,MAAM,IAAI,MAAM,uBAAuB;EAGzC,MAAM,YAAY,iBAAiB,WAAW;EAE9C,OAAO;GACL,QAAQ,YAAY;GACpB,SAAS,YAAY;GACrB,SAAS,YAAY;GACrB;EACF;CACF,UAAU;EACR,OAAO,MAAM;CACf;AACF;AAEA,MAAa,YAAY;CACvB;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;AAKA,eAAsB,wBACpB,cACA,mBAC2B;CAC3B,MAAM,SAAS,MAAM,mBAAmB,YAAY;CACpD,IAAI,OAAO,SAAS,WAClB,MAAM,IAAI,MAAM,sCAAsC;CAGxD,MAAM,YAAY,iBAAiB,QAAQ,iBAAiB;CAE5D,OAAO;EACL,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,SAAS,OAAO;EAChB;CACF;AACF;AAEA,MAAa,2BAAmD;CAC9D,IAAI;CACJ,MAAM;CACN,oBAAoB;CACpB,WAAW;CAEX,MAAM,MAAM,WAA2D;EACrE,MAAM,OAAO,UAAU,aAAa,YAAY,UAAU,aAAa,YAAY,UAAU,WAAW,KAAA;EACxG,OAAO,iBAAiB;GACtB,QAAQ,UAAU;GAClB,UAAU,UAAU;GACpB,YAAY,UAAU;GACtB,mBAAmB,UAAU;GAC7B,QAAQ,UAAU;GAClB;EACF,CAAC;CACH;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,wBAAwB,YAAY,SAAS,YAAY,SAA+B;CACjG;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}
package/dist/auth/providers/xai.js CHANGED
@@ -1,171 +1,205 @@
1
1
  import { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from "../device-code.js";
2
+ //#region src/auth/providers/xai.ts
3
+ /**
4
+ * xAI OAuth flow (Grok)
5
+ *
6
+ * Ported from pi-mono's xAI OAuth implementation:
7
+ * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts
8
+ *
9
+ * xAI uses a standard RFC 8628 device authorization grant, so the flow needs
10
+ * no inbound connection to the server. The primitives are split into
11
+ * `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist
12
+ * the JSON-serializable pending state between HTTP requests; the blocking
13
+ * `loginXAI()` wraps them for TUI use.
14
+ */
2
15
  const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
3
16
  const DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
4
17
  const TOKEN_URL = "https://auth.x.ai/oauth2/token";
5
18
  const SCOPE = "openid profile email offline_access grok-cli:access api:access";
6
19
  const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
7
20
  const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;
8
- const REFRESH_SKEW_MS = 5 * 60 * 1e3;
21
+ const REFRESH_SKEW_MS = 300 * 1e3;
9
22
  async function postForm(url, params, signal) {
10
- return fetch(url, {
11
- method: "POST",
12
- headers: { "Content-Type": "application/x-www-form-urlencoded" },
13
- body: new URLSearchParams(params).toString(),
14
- signal
15
- });
23
+ return fetch(url, {
24
+ method: "POST",
25
+ headers: { "Content-Type": "application/x-www-form-urlencoded" },
26
+ body: new URLSearchParams(params).toString(),
27
+ signal
28
+ });
16
29
  }
30
+ /** The verification URI is opened by the user; only accept https URLs. */
17
31
  function validateVerificationUri(raw) {
18
- let parsed;
19
- try {
20
- parsed = new URL(raw);
21
- } catch {
22
- throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);
23
- }
24
- if (parsed.protocol !== "https:") {
25
- throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);
26
- }
27
- return parsed.toString();
32
+ let parsed;
33
+ try {
34
+ parsed = new URL(raw);
35
+ } catch {
36
+ throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);
37
+ }
38
+ if (parsed.protocol !== "https:") throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);
39
+ return parsed.toString();
28
40
  }
29
41
  function credentialsFromTokenResponse(data, previousRefreshToken) {
30
- const record = data ?? {};
31
- const access = record.access_token;
32
- if (typeof access !== "string" || access.length === 0) {
33
- throw new Error("xAI token response missing access_token");
34
- }
35
- const refresh = typeof record.refresh_token === "string" && record.refresh_token.length > 0 ? record.refresh_token : previousRefreshToken;
36
- if (!refresh) {
37
- throw new Error("xAI token response missing refresh_token");
38
- }
39
- const expiresIn = typeof record.expires_in === "number" && record.expires_in > 0 ? record.expires_in : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;
40
- return {
41
- access,
42
- refresh,
43
- expires: Date.now() + expiresIn * 1e3 - REFRESH_SKEW_MS
44
- };
42
+ const record = data ?? {};
43
+ const access = record.access_token;
44
+ if (typeof access !== "string" || access.length === 0) throw new Error("xAI token response missing access_token");
45
+ const refresh = typeof record.refresh_token === "string" && record.refresh_token.length > 0 ? record.refresh_token : previousRefreshToken;
46
+ if (!refresh) throw new Error("xAI token response missing refresh_token");
47
+ const expiresIn = typeof record.expires_in === "number" && record.expires_in > 0 ? record.expires_in : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;
48
+ return {
49
+ access,
50
+ refresh,
51
+ expires: Date.now() + expiresIn * 1e3 - REFRESH_SKEW_MS
52
+ };
45
53
  }
54
+ /**
55
+ * Start an xAI device-code login: request a user code and return the
56
+ * serializable pending state for subsequent polls.
57
+ */
46
58
  async function startXAIDeviceLogin(options) {
47
- const response = await postForm(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: SCOPE }, options?.signal);
48
- if (!response.ok) {
49
- const text = await response.text().catch(() => "");
50
- throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ""}`);
51
- }
52
- const data = await response.json();
53
- if (!data.device_code || !data.user_code || !data.verification_uri) {
54
- throw new Error("xAI device authorization response missing required fields");
55
- }
56
- const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);
57
- return {
58
- deviceCode: data.device_code,
59
- userCode: data.user_code,
60
- url,
61
- instructions: `Enter code: ${data.user_code}`,
62
- state: createDeviceCodePollState({
63
- intervalSeconds: data.interval,
64
- expiresInSeconds: typeof data.expires_in === "number" && data.expires_in > 0 ? data.expires_in : 600
65
- })
66
- };
59
+ const response = await postForm(DEVICE_CODE_URL, {
60
+ client_id: CLIENT_ID,
61
+ scope: SCOPE
62
+ }, options?.signal);
63
+ if (!response.ok) {
64
+ const text = await response.text().catch(() => "");
65
+ throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ""}`);
66
+ }
67
+ const data = await response.json();
68
+ if (!data.device_code || !data.user_code || !data.verification_uri) throw new Error("xAI device authorization response missing required fields");
69
+ const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);
70
+ return {
71
+ deviceCode: data.device_code,
72
+ userCode: data.user_code,
73
+ url,
74
+ instructions: `Enter code: ${data.user_code}`,
75
+ state: createDeviceCodePollState({
76
+ intervalSeconds: data.interval,
77
+ expiresInSeconds: typeof data.expires_in === "number" && data.expires_in > 0 ? data.expires_in : 600
78
+ })
79
+ };
67
80
  }
68
81
  async function pollXAITokenOnce(pending, signal) {
69
- const response = await postForm(
70
- TOKEN_URL,
71
- {
72
- grant_type: DEVICE_CODE_GRANT_TYPE,
73
- device_code: pending.deviceCode,
74
- client_id: CLIENT_ID
75
- },
76
- signal
77
- );
78
- if (response.ok) {
79
- const data = await response.json();
80
- try {
81
- return { status: "complete", result: credentialsFromTokenResponse(data) };
82
- } catch (error) {
83
- return { status: "failed", error: error instanceof Error ? error.message : String(error) };
84
- }
85
- }
86
- const text = await response.text().catch(() => "");
87
- let body = {};
88
- try {
89
- body = JSON.parse(text);
90
- } catch {
91
- }
92
- switch (body.error) {
93
- case "authorization_pending":
94
- return { status: "pending", intervalSeconds: body.interval };
95
- case "slow_down":
96
- return { status: "slow_down", intervalSeconds: body.interval };
97
- case "access_denied":
98
- case "authorization_denied":
99
- return { status: "failed", error: "xAI authorization was denied" };
100
- case "expired_token":
101
- return { status: "failed", error: "xAI device code expired before authorization completed" };
102
- default:
103
- return {
104
- status: "failed",
105
- error: `xAI device authorization failed: ${response.status}${text ? ` ${text}` : ""}`
106
- };
107
- }
82
+ const response = await postForm(TOKEN_URL, {
83
+ grant_type: DEVICE_CODE_GRANT_TYPE,
84
+ device_code: pending.deviceCode,
85
+ client_id: CLIENT_ID
86
+ }, signal);
87
+ if (response.ok) {
88
+ const data = await response.json();
89
+ try {
90
+ return {
91
+ status: "complete",
92
+ result: credentialsFromTokenResponse(data)
93
+ };
94
+ } catch (error) {
95
+ return {
96
+ status: "failed",
97
+ error: error instanceof Error ? error.message : String(error)
98
+ };
99
+ }
100
+ }
101
+ const text = await response.text().catch(() => "");
102
+ let body = {};
103
+ try {
104
+ body = JSON.parse(text);
105
+ } catch {}
106
+ switch (body.error) {
107
+ case "authorization_pending": return {
108
+ status: "pending",
109
+ intervalSeconds: body.interval
110
+ };
111
+ case "slow_down": return {
112
+ status: "slow_down",
113
+ intervalSeconds: body.interval
114
+ };
115
+ case "access_denied":
116
+ case "authorization_denied": return {
117
+ status: "failed",
118
+ error: "xAI authorization was denied"
119
+ };
120
+ case "expired_token": return {
121
+ status: "failed",
122
+ error: "xAI device code expired before authorization completed"
123
+ };
124
+ default: return {
125
+ status: "failed",
126
+ error: `xAI device authorization failed: ${response.status}${text ? ` ${text}` : ""}`
127
+ };
128
+ }
108
129
  }
130
+ /**
131
+ * Perform exactly one upstream poll for a pending xAI device login.
132
+ * Returns the updated pending state so callers (e.g. web routes) can persist
133
+ * slow_down interval growth between polls. Never throws for flow-level
134
+ * conditions.
135
+ */
109
136
  async function pollXAIDeviceLogin(pending, options) {
110
- const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));
111
- switch (step.status) {
112
- case "complete":
113
- return { status: "complete", credentials: step.result };
114
- case "failed":
115
- return { status: "failed", error: step.error };
116
- case "pending":
117
- case "slow_down":
118
- return {
119
- status: "pending",
120
- nextPollMs: step.nextPollMs,
121
- pending: { ...pending, state: step.state }
122
- };
123
- }
137
+ const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));
138
+ switch (step.status) {
139
+ case "complete": return {
140
+ status: "complete",
141
+ credentials: step.result
142
+ };
143
+ case "failed": return {
144
+ status: "failed",
145
+ error: step.error
146
+ };
147
+ case "pending":
148
+ case "slow_down": return {
149
+ status: "pending",
150
+ nextPollMs: step.nextPollMs,
151
+ pending: {
152
+ ...pending,
153
+ state: step.state
154
+ }
155
+ };
156
+ }
124
157
  }
158
+ /**
159
+ * Login with xAI OAuth (device-code flow), blocking until authorized.
160
+ */
125
161
  async function loginXAI(callbacks) {
126
- const pending = await startXAIDeviceLogin({ signal: callbacks.signal });
127
- callbacks.onAuth({ url: pending.url, instructions: pending.instructions });
128
- callbacks.onProgress?.("Waiting for xAI device authorization...");
129
- return pollDeviceCodeUntilComplete({
130
- state: pending.state,
131
- pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),
132
- signal: callbacks.signal
133
- });
162
+ const pending = await startXAIDeviceLogin({ signal: callbacks.signal });
163
+ callbacks.onAuth({
164
+ url: pending.url,
165
+ instructions: pending.instructions
166
+ });
167
+ callbacks.onProgress?.("Waiting for xAI device authorization...");
168
+ return pollDeviceCodeUntilComplete({
169
+ state: pending.state,
170
+ pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),
171
+ signal: callbacks.signal
172
+ });
134
173
  }
174
+ /**
175
+ * Refresh xAI OAuth token
176
+ */
135
177
  async function refreshXAIToken(refreshToken, signal) {
136
- const response = await postForm(
137
- TOKEN_URL,
138
- {
139
- grant_type: "refresh_token",
140
- client_id: CLIENT_ID,
141
- refresh_token: refreshToken
142
- },
143
- signal
144
- );
145
- if (!response.ok) {
146
- const text = await response.text().catch(() => "");
147
- throw new Error(`xAI token refresh failed: ${response.status}${text ? ` ${text}` : ""}`);
148
- }
149
- return credentialsFromTokenResponse(await response.json(), refreshToken);
178
+ const response = await postForm(TOKEN_URL, {
179
+ grant_type: "refresh_token",
180
+ client_id: CLIENT_ID,
181
+ refresh_token: refreshToken
182
+ }, signal);
183
+ if (!response.ok) {
184
+ const text = await response.text().catch(() => "");
185
+ throw new Error(`xAI token refresh failed: ${response.status}${text ? ` ${text}` : ""}`);
186
+ }
187
+ return credentialsFromTokenResponse(await response.json(), refreshToken);
150
188
  }
151
189
  const xaiOAuthProvider = {
152
- id: "xai",
153
- name: "xAI (Grok)",
154
- async login(callbacks) {
155
- return loginXAI(callbacks);
156
- },
157
- async refreshToken(credentials) {
158
- return refreshXAIToken(credentials.refresh);
159
- },
160
- getApiKey(credentials) {
161
- return credentials.access;
162
- }
163
- };
164
- export {
165
- loginXAI,
166
- pollXAIDeviceLogin,
167
- refreshXAIToken,
168
- startXAIDeviceLogin,
169
- xaiOAuthProvider
190
+ id: "xai",
191
+ name: "xAI (Grok)",
192
+ async login(callbacks) {
193
+ return loginXAI(callbacks);
194
+ },
195
+ async refreshToken(credentials) {
196
+ return refreshXAIToken(credentials.refresh);
197
+ },
198
+ getApiKey(credentials) {
199
+ return credentials.access;
200
+ }
170
201
  };
202
+ //#endregion
203
+ export { loginXAI, pollXAIDeviceLogin, refreshXAIToken, startXAIDeviceLogin, xaiOAuthProvider };
204
+
171
205
  //# sourceMappingURL=xai.js.map
package/dist/auth/providers/xai.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../../src/auth/providers/xai.ts"],"sourcesContent":["/**\n * xAI OAuth flow (Grok)\n *\n * Ported from pi-mono's xAI OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts\n *\n * xAI uses a standard RFC 8628 device authorization grant, so the flow needs\n * no inbound connection to the server. The primitives are split into\n * `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist\n * the JSON-serializable pending state between HTTP requests; the blocking\n * `loginXAI()` wraps them for TUI use.\n */\n\nimport { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from '../device-code.js';\nimport type { DeviceCodePollOutcome, DeviceCodePollState } from '../device-code.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';\nconst DEVICE_CODE_URL = 'https://auth.x.ai/oauth2/device/code';\nconst TOKEN_URL = 'https://auth.x.ai/oauth2/token';\nconst SCOPE = 'openid profile email offline_access grok-cli:access api:access';\nconst DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\n// Refresh 5 minutes before actual expiry (same skew as Anthropic).\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\n\nasync function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {\n return fetch(url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams(params).toString(),\n signal,\n });\n}\n\n/** The verification URI is opened by the user; only accept https URLs. */\nfunction validateVerificationUri(raw: string): string {\n let parsed: URL;\n try {\n parsed = new URL(raw);\n } catch {\n throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);\n }\n if (parsed.protocol !== 'https:') {\n throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);\n }\n return parsed.toString();\n}\n\nfunction credentialsFromTokenResponse(data: unknown, previousRefreshToken?: string): OAuthCredentials {\n const record = (data ?? {}) as Record<string, unknown>;\n const access = record.access_token;\n if (typeof access !== 'string' || access.length === 0) {\n throw new Error('xAI token response missing access_token');\n }\n\n // xAI may not rotate the refresh token on refresh; keep the previous one.\n const refresh =\n typeof record.refresh_token === 'string' && record.refresh_token.length > 0\n ? record.refresh_token\n : previousRefreshToken;\n if (!refresh) {\n throw new Error('xAI token response missing refresh_token');\n }\n\n const expiresIn =\n typeof record.expires_in === 'number' && record.expires_in > 0\n ? record.expires_in\n : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;\n\n return {\n access,\n refresh,\n expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,\n };\n}\n\n/**\n * Serializable pending state for an xAI device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests.\n */\nexport interface XAIDeviceLoginPending {\n deviceCode: string;\n userCode: string;\n /** Verification URL for the user to open (https-only, validated). */\n url: string;\n instructions: string;\n /** RFC 8628 poll-loop state (interval growth, deadline, slow_down count). */\n state: DeviceCodePollState;\n}\n\nexport type XAIDevicePollResult =\n | { status: 'complete'; credentials: OAuthCredentials }\n | { status: 'pending'; nextPollMs: number; pending: XAIDeviceLoginPending }\n | { status: 'failed'; error: string };\n\n/**\n * Start an xAI device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startXAIDeviceLogin(options?: { signal?: AbortSignal }): Promise<XAIDeviceLoginPending> {\n const response = await postForm(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: SCOPE }, options?.signal);\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ''}`);\n }\n\n const data = (await response.json()) as {\n device_code?: string;\n user_code?: string;\n verification_uri?: string;\n verification_uri_complete?: string;\n interval?: number;\n expires_in?: number;\n };\n\n if (!data.device_code || !data.user_code || !data.verification_uri) {\n throw new Error('xAI device authorization response missing required fields');\n }\n\n const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);\n\n return {\n deviceCode: data.device_code,\n userCode: data.user_code,\n url,\n instructions: `Enter code: ${data.user_code}`,\n state: createDeviceCodePollState({\n intervalSeconds: data.interval,\n expiresInSeconds: typeof data.expires_in === 'number' && data.expires_in > 0 ? data.expires_in : 600,\n }),\n };\n}\n\nasync function pollXAITokenOnce(\n pending: XAIDeviceLoginPending,\n signal?: AbortSignal,\n): Promise<DeviceCodePollOutcome<OAuthCredentials>> {\n const response = await postForm(\n TOKEN_URL,\n {\n grant_type: DEVICE_CODE_GRANT_TYPE,\n device_code: pending.deviceCode,\n client_id: CLIENT_ID,\n },\n signal,\n );\n\n if (response.ok) {\n const data = (await response.json()) as unknown;\n try {\n return { status: 'complete', result: credentialsFromTokenResponse(data) };\n } catch (error) {\n return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n }\n }\n\n const text = await response.text().catch(() => '');\n let body: { error?: string; interval?: number } = {};\n try {\n body = JSON.parse(text) as { error?: string; interval?: number };\n } catch {\n // Non-JSON error body — fail loudly below with the raw text.\n }\n\n switch (body.error) {\n case 'authorization_pending':\n return { status: 'pending', intervalSeconds: body.interval };\n case 'slow_down':\n return { status: 'slow_down', intervalSeconds: body.interval };\n case 'access_denied':\n case 'authorization_denied':\n return { status: 'failed', error: 'xAI authorization was denied' };\n case 'expired_token':\n return { status: 'failed', error: 'xAI device code expired before authorization completed' };\n default:\n return {\n status: 'failed',\n error: `xAI device authorization failed: ${response.status}${text ? ` ${text}` : ''}`,\n };\n }\n}\n\n/**\n * Perform exactly one upstream poll for a pending xAI device login.\n * Returns the updated pending state so callers (e.g. web routes) can persist\n * slow_down interval growth between polls. Never throws for flow-level\n * conditions.\n */\nexport async function pollXAIDeviceLogin(\n pending: XAIDeviceLoginPending,\n options?: { signal?: AbortSignal },\n): Promise<XAIDevicePollResult> {\n const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));\n\n switch (step.status) {\n case 'complete':\n return { status: 'complete', credentials: step.result };\n case 'failed':\n return { status: 'failed', error: step.error };\n case 'pending':\n case 'slow_down':\n return {\n status: 'pending',\n nextPollMs: step.nextPollMs,\n pending: { ...pending, state: step.state },\n };\n }\n}\n\n/**\n * Login with xAI OAuth (device-code flow), blocking until authorized.\n */\nexport async function loginXAI(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n const pending = await startXAIDeviceLogin({ signal: callbacks.signal });\n\n callbacks.onAuth({ url: pending.url, instructions: pending.instructions });\n callbacks.onProgress?.('Waiting for xAI device authorization...');\n\n return pollDeviceCodeUntilComplete({\n state: pending.state,\n pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),\n signal: callbacks.signal,\n });\n}\n\n/**\n * Refresh xAI OAuth token\n */\nexport async function refreshXAIToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials> {\n const response = await postForm(\n TOKEN_URL,\n {\n grant_type: 'refresh_token',\n client_id: CLIENT_ID,\n refresh_token: refreshToken,\n },\n signal,\n );\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n throw new Error(`xAI token refresh failed: ${response.status}${text ? ` ${text}` : ''}`);\n }\n\n return credentialsFromTokenResponse((await response.json()) as unknown, refreshToken);\n}\n\nexport const xaiOAuthProvider: OAuthProviderInterface = {\n id: 'xai',\n name: 'xAI (Grok)',\n\n async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n return loginXAI(callbacks);\n },\n\n async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n return refreshXAIToken(credentials.refresh);\n },\n\n getApiKey(credentials: OAuthCredentials): string {\n return credentials.access;\n },\n};\n"],"mappings":"AAaA,SAAS,2BAA2B,6BAA6B,0BAA0B;AAI3F,MAAM,YAAY;AAClB,MAAM,kBAAkB;AACxB,MAAM,YAAY;AAClB,MAAM,QAAQ;AACd,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AAEzC,MAAM,kBAAkB,IAAI,KAAK;AAEjC,eAAe,SAAS,KAAa,QAAgC,QAAyC;AAC5G,SAAO,MAAM,KAAK;AAAA,IAChB,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM,IAAI,gBAAgB,MAAM,EAAE,SAAS;AAAA,IAC3C;AAAA,EACF,CAAC;AACH;AAGA,SAAS,wBAAwB,KAAqB;AACpD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,MAAM,kEAAkE,GAAG,EAAE;AAAA,EACzF;AACA,MAAI,OAAO,aAAa,UAAU;AAChC,UAAM,IAAI,MAAM,mEAAmE,GAAG,EAAE;AAAA,EAC1F;AACA,SAAO,OAAO,SAAS;AACzB;AAEA,SAAS,6BAA6B,MAAe,sBAAiD;AACpG,QAAM,SAAU,QAAQ,CAAC;AACzB,QAAM,SAAS,OAAO;AACtB,MAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAGA,QAAM,UACJ,OAAO,OAAO,kBAAkB,YAAY,OAAO,cAAc,SAAS,IACtE,OAAO,gBACP;AACN,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,QAAM,YACJ,OAAO,OAAO,eAAe,YAAY,OAAO,aAAa,IACzD,OAAO,aACP;AAEN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,KAAK,IAAI,IAAI,YAAY,MAAO;AAAA,EAC3C;AACF;AAyBA,eAAsB,oBAAoB,SAAoE;AAC5G,QAAM,WAAW,MAAM,SAAS,iBAAiB,EAAE,WAAW,WAAW,OAAO,MAAM,GAAG,SAAS,MAAM;AAExG,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,IAAI,MAAM,gDAAgD,SAAS,MAAM,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE,EAAE;AAAA,EAC5G;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK;AASlC,MAAI,CAAC,KAAK,eAAe,CAAC,KAAK,aAAa,CAAC,KAAK,kBAAkB;AAClE,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AAEA,QAAM,MAAM,wBAAwB,KAAK,6BAA6B,KAAK,gBAAgB;AAE3F,SAAO;AAAA,IACL,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK;AAAA,IACf;AAAA,IACA,cAAc,eAAe,KAAK,SAAS;AAAA,IAC3C,OAAO,0BAA0B;AAAA,MAC/B,iBAAiB,KAAK;AAAA,MACtB,kBAAkB,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,IAAI,KAAK,aAAa;AAAA,IACnG,CAAC;AAAA,EACH;AACF;AAEA,eAAe,iBACb,SACA,QACkD;AAClD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,aAAa,QAAQ;AAAA,MACrB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,EACF;AAEA,MAAI,SAAS,IAAI;AACf,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,QAAI;AACF,aAAO,EAAE,QAAQ,YAAY,QAAQ,6BAA6B,IAAI,EAAE;AAAA,IAC1E,SAAS,OAAO;AACd,aAAO,EAAE,QAAQ,UAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AAAA,IAC3F;AAAA,EACF;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,MAAI,OAA8C,CAAC;AACnD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AAAA,EAER;AAEA,UAAQ,KAAK,OAAO;AAAA,IAClB,KAAK;AACH,aAAO,EAAE,QAAQ,WAAW,iBAAiB,KAAK,SAAS;AAAA,IAC7D,KAAK;AACH,aAAO,EAAE,QAAQ,aAAa,iBAAiB,KAAK,SAAS;AAAA,IAC/D,KAAK;AAAA,IACL,KAAK;AACH,aAAO,EAAE,QAAQ,UAAU,OAAO,+BAA+B;AAAA,IACnE,KAAK;AACH,aAAO,EAAE,QAAQ,UAAU,OAAO,yDAAyD;AAAA,IAC7F;AACE,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,OAAO,oCAAoC,SAAS,MAAM,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE;AAAA,MACrF;AAAA,EACJ;AACF;AAQA,eAAsB,mBACpB,SACA,SAC8B;AAC9B,QAAM,OAAO,MAAM,mBAAmB,QAAQ,OAAO,MAAM,iBAAiB,SAAS,SAAS,MAAM,CAAC;AAErG,UAAQ,KAAK,QAAQ;AAAA,IACnB,KAAK;AACH,aAAO,EAAE,QAAQ,YAAY,aAAa,KAAK,OAAO;AAAA,IACxD,KAAK;AACH,aAAO,EAAE,QAAQ,UAAU,OAAO,KAAK,MAAM;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,YAAY,KAAK;AAAA,QACjB,SAAS,EAAE,GAAG,SAAS,OAAO,KAAK,MAAM;AAAA,MAC3C;AAAA,EACJ;AACF;AAKA,eAAsB,SAAS,WAA2D;AACxF,QAAM,UAAU,MAAM,oBAAoB,EAAE,QAAQ,UAAU,OAAO,CAAC;AAEtE,YAAU,OAAO,EAAE,KAAK,QAAQ,KAAK,cAAc,QAAQ,aAAa,CAAC;AACzE,YAAU,aAAa,yCAAyC;AAEhE,SAAO,4BAA4B;AAAA,IACjC,OAAO,QAAQ;AAAA,IACf,UAAU,MAAM,iBAAiB,SAAS,UAAU,MAAM;AAAA,IAC1D,QAAQ,UAAU;AAAA,EACpB,CAAC;AACH;AAKA,eAAsB,gBAAgB,cAAsB,QAAiD;AAC3G,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,MACE,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,UAAM,IAAI,MAAM,6BAA6B,SAAS,MAAM,GAAG,OAAO,IAAI,IAAI,KAAK,EAAE,EAAE;AAAA,EACzF;AAEA,SAAO,6BAA8B,MAAM,SAAS,KAAK,GAAe,YAAY;AACtF;AAEO,MAAM,mBAA2C;AAAA,EACtD,IAAI;AAAA,EACJ,MAAM;AAAA,EAEN,MAAM,MAAM,WAA2D;AACrE,WAAO,SAAS,SAAS;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,aAA0D;AAC3E,WAAO,gBAAgB,YAAY,OAAO;AAAA,EAC5C;AAAA,EAEA,UAAU,aAAuC;AAC/C,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}
1
+ {"version":3,"file":"xai.js","names":[],"sources":["../../../src/auth/providers/xai.ts"],"sourcesContent":["/**\n * xAI OAuth flow (Grok)\n *\n * Ported from pi-mono's xAI OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts\n *\n * xAI uses a standard RFC 8628 device authorization grant, so the flow needs\n * no inbound connection to the server. The primitives are split into\n * `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist\n * the JSON-serializable pending state between HTTP requests; the blocking\n * `loginXAI()` wraps them for TUI use.\n */\n\nimport { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from '../device-code.js';\nimport type { DeviceCodePollOutcome, DeviceCodePollState } from '../device-code.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';\nconst DEVICE_CODE_URL = 'https://auth.x.ai/oauth2/device/code';\nconst TOKEN_URL = 'https://auth.x.ai/oauth2/token';\nconst SCOPE = 'openid profile email offline_access grok-cli:access api:access';\nconst DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\n// Refresh 5 minutes before actual expiry (same skew as Anthropic).\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\n\nasync function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {\n return fetch(url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams(params).toString(),\n signal,\n });\n}\n\n/** The verification URI is opened by the user; only accept https URLs. */\nfunction validateVerificationUri(raw: string): string {\n let parsed: URL;\n try {\n parsed = new URL(raw);\n } catch {\n throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);\n }\n if (parsed.protocol !== 'https:') {\n throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);\n }\n return parsed.toString();\n}\n\nfunction credentialsFromTokenResponse(data: unknown, previousRefreshToken?: string): OAuthCredentials {\n const record = (data ?? {}) as Record<string, unknown>;\n const access = record.access_token;\n if (typeof access !== 'string' || access.length === 0) {\n throw new Error('xAI token response missing access_token');\n }\n\n // xAI may not rotate the refresh token on refresh; keep the previous one.\n const refresh =\n typeof record.refresh_token === 'string' && record.refresh_token.length > 0\n ? record.refresh_token\n : previousRefreshToken;\n if (!refresh) {\n throw new Error('xAI token response missing refresh_token');\n }\n\n const expiresIn =\n typeof record.expires_in === 'number' && record.expires_in > 0\n ? record.expires_in\n : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;\n\n return {\n access,\n refresh,\n expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,\n };\n}\n\n/**\n * Serializable pending state for an xAI device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests.\n */\nexport interface XAIDeviceLoginPending {\n deviceCode: string;\n userCode: string;\n /** Verification URL for the user to open (https-only, validated). */\n url: string;\n instructions: string;\n /** RFC 8628 poll-loop state (interval growth, deadline, slow_down count). */\n state: DeviceCodePollState;\n}\n\nexport type XAIDevicePollResult =\n | { status: 'complete'; credentials: OAuthCredentials }\n | { status: 'pending'; nextPollMs: number; pending: XAIDeviceLoginPending }\n | { status: 'failed'; error: string };\n\n/**\n * Start an xAI device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startXAIDeviceLogin(options?: { signal?: AbortSignal }): Promise<XAIDeviceLoginPending> {\n const response = await postForm(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: SCOPE }, options?.signal);\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ''}`);\n }\n\n const data = (await response.json()) as {\n device_code?: string;\n user_code?: string;\n verification_uri?: string;\n verification_uri_complete?: string;\n interval?: number;\n expires_in?: number;\n };\n\n if (!data.device_code || !data.user_code || !data.verification_uri) {\n throw new Error('xAI device authorization response missing required fields');\n }\n\n const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);\n\n return {\n deviceCode: data.device_code,\n userCode: data.user_code,\n url,\n instructions: `Enter code: ${data.user_code}`,\n state: createDeviceCodePollState({\n intervalSeconds: data.interval,\n expiresInSeconds: typeof data.expires_in === 'number' && data.expires_in > 0 ? data.expires_in : 600,\n }),\n };\n}\n\nasync function pollXAITokenOnce(\n pending: XAIDeviceLoginPending,\n signal?: AbortSignal,\n): Promise<DeviceCodePollOutcome<OAuthCredentials>> {\n const response = await postForm(\n TOKEN_URL,\n {\n grant_type: DEVICE_CODE_GRANT_TYPE,\n device_code: pending.deviceCode,\n client_id: CLIENT_ID,\n },\n signal,\n );\n\n if (response.ok) {\n const data = (await response.json()) as unknown;\n try {\n return { status: 'complete', result: credentialsFromTokenResponse(data) };\n } catch (error) {\n return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n }\n }\n\n const text = await response.text().catch(() => '');\n let body: { error?: string; interval?: number } = {};\n try {\n body = JSON.parse(text) as { error?: string; interval?: number };\n } catch {\n // Non-JSON error body — fail loudly below with the raw text.\n }\n\n switch (body.error) {\n case 'authorization_pending':\n return { status: 'pending', intervalSeconds: body.interval };\n case 'slow_down':\n return { status: 'slow_down', intervalSeconds: body.interval };\n case 'access_denied':\n case 'authorization_denied':\n return { status: 'failed', error: 'xAI authorization was denied' };\n case 'expired_token':\n return { status: 'failed', error: 'xAI device code expired before authorization completed' };\n default:\n return {\n status: 'failed',\n error: `xAI device authorization failed: ${response.status}${text ? ` ${text}` : ''}`,\n };\n }\n}\n\n/**\n * Perform exactly one upstream poll for a pending xAI device login.\n * Returns the updated pending state so callers (e.g. web routes) can persist\n * slow_down interval growth between polls. Never throws for flow-level\n * conditions.\n */\nexport async function pollXAIDeviceLogin(\n pending: XAIDeviceLoginPending,\n options?: { signal?: AbortSignal },\n): Promise<XAIDevicePollResult> {\n const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));\n\n switch (step.status) {\n case 'complete':\n return { status: 'complete', credentials: step.result };\n case 'failed':\n return { status: 'failed', error: step.error };\n case 'pending':\n case 'slow_down':\n return {\n status: 'pending',\n nextPollMs: step.nextPollMs,\n pending: { ...pending, state: step.state },\n };\n }\n}\n\n/**\n * Login with xAI OAuth (device-code flow), blocking until authorized.\n */\nexport async function loginXAI(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n const pending = await startXAIDeviceLogin({ signal: callbacks.signal });\n\n callbacks.onAuth({ url: pending.url, instructions: pending.instructions });\n callbacks.onProgress?.('Waiting for xAI device authorization...');\n\n return pollDeviceCodeUntilComplete({\n state: pending.state,\n pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),\n signal: callbacks.signal,\n });\n}\n\n/**\n * Refresh xAI OAuth token\n */\nexport async function refreshXAIToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials> {\n const response = await postForm(\n TOKEN_URL,\n {\n grant_type: 'refresh_token',\n client_id: CLIENT_ID,\n refresh_token: refreshToken,\n },\n signal,\n );\n\n if (!response.ok) {\n const text = await response.text().catch(() => '');\n throw new Error(`xAI token refresh failed: ${response.status}${text ? ` ${text}` : ''}`);\n }\n\n return credentialsFromTokenResponse((await response.json()) as unknown, refreshToken);\n}\n\nexport const xaiOAuthProvider: OAuthProviderInterface = {\n id: 'xai',\n name: 'xAI (Grok)',\n\n async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n return loginXAI(callbacks);\n },\n\n async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n return refreshXAIToken(credentials.refresh);\n },\n\n getApiKey(credentials: OAuthCredentials): string {\n return credentials.access;\n },\n};\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AACxB,MAAM,YAAY;AAClB,MAAM,QAAQ;AACd,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AAEzC,MAAM,kBAAkB,MAAS;AAEjC,eAAe,SAAS,KAAa,QAAgC,QAAyC;CAC5G,OAAO,MAAM,KAAK;EAChB,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB,MAAM,CAAC,CAAC,SAAS;EAC3C;CACF,CAAC;AACH;;AAGA,SAAS,wBAAwB,KAAqB;CACpD,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,kEAAkE,KAAK;CACzF;CACA,IAAI,OAAO,aAAa,UACtB,MAAM,IAAI,MAAM,mEAAmE,KAAK;CAE1F,OAAO,OAAO,SAAS;AACzB;AAEA,SAAS,6BAA6B,MAAe,sBAAiD;CACpG,MAAM,SAAU,QAAQ,CAAC;CACzB,MAAM,SAAS,OAAO;CACtB,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,MAAM,IAAI,MAAM,yCAAyC;CAI3D,MAAM,UACJ,OAAO,OAAO,kBAAkB,YAAY,OAAO,cAAc,SAAS,IACtE,OAAO,gBACP;CACN,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,0CAA0C;CAG5D,MAAM,YACJ,OAAO,OAAO,eAAe,YAAY,OAAO,aAAa,IACzD,OAAO,aACP;CAEN,OAAO;EACL;EACA;EACA,SAAS,KAAK,IAAI,IAAI,YAAY,MAAO;CAC3C;AACF;;;;;AAyBA,eAAsB,oBAAoB,SAAoE;CAC5G,MAAM,WAAW,MAAM,SAAS,iBAAiB;EAAE,WAAW;EAAW,OAAO;CAAM,GAAG,SAAS,MAAM;CAExG,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,gDAAgD,SAAS,SAAS,OAAO,IAAI,SAAS,IAAI;CAC5G;CAEA,MAAM,OAAQ,MAAM,SAAS,KAAK;CASlC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,aAAa,CAAC,KAAK,kBAChD,MAAM,IAAI,MAAM,2DAA2D;CAG7E,MAAM,MAAM,wBAAwB,KAAK,6BAA6B,KAAK,gBAAgB;CAE3F,OAAO;EACL,YAAY,KAAK;EACjB,UAAU,KAAK;EACf;EACA,cAAc,eAAe,KAAK;EAClC,OAAO,0BAA0B;GAC/B,iBAAiB,KAAK;GACtB,kBAAkB,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,IAAI,KAAK,aAAa;EACnG,CAAC;CACH;AACF;AAEA,eAAe,iBACb,SACA,QACkD;CAClD,MAAM,WAAW,MAAM,SACrB,WACA;EACE,YAAY;EACZ,aAAa,QAAQ;EACrB,WAAW;CACb,GACA,MACF;CAEA,IAAI,SAAS,IAAI;EACf,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,IAAI;GACF,OAAO;IAAE,QAAQ;IAAY,QAAQ,6BAA6B,IAAI;GAAE;EAC1E,SAAS,OAAO;GACd,OAAO;IAAE,QAAQ;IAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC3F;CACF;CAEA,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,IAAI,OAA8C,CAAC;CACnD,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ,CAER;CAEA,QAAQ,KAAK,OAAb;EACE,KAAK,yBACH,OAAO;GAAE,QAAQ;GAAW,iBAAiB,KAAK;EAAS;EAC7D,KAAK,aACH,OAAO;GAAE,QAAQ;GAAa,iBAAiB,KAAK;EAAS;EAC/D,KAAK;EACL,KAAK,wBACH,OAAO;GAAE,QAAQ;GAAU,OAAO;EAA+B;EACnE,KAAK,iBACH,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAyD;EAC7F,SACE,OAAO;GACL,QAAQ;GACR,OAAO,oCAAoC,SAAS,SAAS,OAAO,IAAI,SAAS;EACnF;CACJ;AACF;;;;;;;AAQA,eAAsB,mBACpB,SACA,SAC8B;CAC9B,MAAM,OAAO,MAAM,mBAAmB,QAAQ,aAAa,iBAAiB,SAAS,SAAS,MAAM,CAAC;CAErG,QAAQ,KAAK,QAAb;EACE,KAAK,YACH,OAAO;GAAE,QAAQ;GAAY,aAAa,KAAK;EAAO;EACxD,KAAK,UACH,OAAO;GAAE,QAAQ;GAAU,OAAO,KAAK;EAAM;EAC/C,KAAK;EACL,KAAK,aACH,OAAO;GACL,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,GAAG;IAAS,OAAO,KAAK;GAAM;EAC3C;CACJ;AACF;;;;AAKA,eAAsB,SAAS,WAA2D;CACxF,MAAM,UAAU,MAAM,oBAAoB,EAAE,QAAQ,UAAU,OAAO,CAAC;CAEtE,UAAU,OAAO;EAAE,KAAK,QAAQ;EAAK,cAAc,QAAQ;CAAa,CAAC;CACzE,UAAU,aAAa,yCAAyC;CAEhE,OAAO,4BAA4B;EACjC,OAAO,QAAQ;EACf,gBAAgB,iBAAiB,SAAS,UAAU,MAAM;EAC1D,QAAQ,UAAU;CACpB,CAAC;AACH;;;;AAKA,eAAsB,gBAAgB,cAAsB,QAAiD;CAC3G,MAAM,WAAW,MAAM,SACrB,WACA;EACE,YAAY;EACZ,WAAW;EACX,eAAe;CACjB,GACA,MACF;CAEA,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,6BAA6B,SAAS,SAAS,OAAO,IAAI,SAAS,IAAI;CACzF;CAEA,OAAO,6BAA8B,MAAM,SAAS,KAAK,GAAe,YAAY;AACtF;AAEA,MAAa,mBAA2C;CACtD,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,SAAS,SAAS;CAC3B;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,gBAAgB,YAAY,OAAO;CAC5C;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}