@miruzero/zgpt 0.1.3 → 0.1.5

package/src/connector/mcp.js

@@ -0,0 +1,154 @@
+'use strict';
+
+// Browser-derived MCP connector operations. The single SDK API catalog owns routes,
+// authentication, transport, encoding and response handling. Never auto-create a link.
+const api = require('../api');
+
+const bad = (message) => Object.assign(new Error(message), { code: 'BAD_ARGS' });
+const nonempty = (value, field) => {
+  if (typeof value !== 'string' || !value.trim()) throw bad(field + ' is required');
+  return value.trim();
+};
+const safeHttpUrl = (value, field) => {
+  const text = nonempty(value, field);
+  let url;
+  try { url = new URL(text); } catch { throw bad(field + ' must be a valid HTTPS URL'); }
+  if (url.protocol !== 'https:' || url.username || url.password)
+    throw bad(field + ' must be a valid HTTPS URL without embedded credentials');
+  return text;
+};
+const logoValue = (value) => {
+  const input=nonempty(value,'logoUrl');
+  if (input.startsWith('data:')) {
+    const match=/^data:image\/png;base64,([A-Za-z0-9+/]+={0,2})$/.exec(input);
+    if (!match) throw bad('logoUrl must be a PNG data URL');
+    if (Buffer.from(match[1],'base64').length > 10 * 1024)
+      throw bad('logoUrl PNG exceeds the 10 KB maximum');
+    return input;
+  }
+  return safeHttpUrl(input,'logoUrl');
+};
+const makeTarget = ({mcpUrl, tunnelId}) => {
+  if (mcpUrl != null && tunnelId != null) throw bad('Choose either mcpUrl or tunnelId, not both');
+  if (mcpUrl != null) return {mcp_url:safeHttpUrl(mcpUrl,'mcpUrl')};
+  if (tunnelId != null) {
+    const id=nonempty(tunnelId,'tunnelId');
+    if (!/^tunnel_[a-z0-9]{32}$/.test(id)) throw bad('tunnelId must match tunnel_<32 lowercase letters or digits>');
+    return {tunnel_id:id};
+  }
+  throw bad('mcpUrl or tunnelId is required');
+};
+const request = (key, options, patch = {}) =>
+  api.invoke(key, {
+    ...options,...patch,
+    headers:{...options.headers,...patch.headers,'OAI-Product-Sku':'CONNECTOR_SETTING'}
+  });
+
+const authRequestFromDiscovery = (discovery) => {
+  const config=discovery?.oauth_config;
+  const invalid=() => Object.assign(new Error('MCP OAuth discovery returned incomplete or unsupported metadata'), {
+    code:'MCP_OAUTH_CONFIG_INVALID'
+  });
+  if (!config || typeof config !== 'object' || Array.isArray(config)) throw invalid();
+  if (config.type === 'NONE') return {supported_auth:[],oauth_client_params:null};
+  if (config.type !== 'OAUTH' ||
+      typeof config.authorization_url !== 'string' || !config.authorization_url ||
+      typeof config.token_url !== 'string' || !config.token_url) throw invalid();
+  // ChatGPT Web puts the discovered OAuth config inside supported_auth.
+  // Registration, PKCE, scopes and resource stay exactly as advertised by the server.
+  return {supported_auth:[config],oauth_client_params:null};
+};
+
+exports.createCustomMcpServer = async (options = {}) => {
+  const name = nonempty(options.name,'name');
+  const target=makeTarget(options);
+  let authRequest;
+  if (options.authRequest !== undefined) {
+    if (options.authentication) throw bad('Use authentication or authRequest, not both');
+    if (!options.authRequest || typeof options.authRequest !== 'object' ||
+        Array.isArray(options.authRequest) || !Array.isArray(options.authRequest.supported_auth))
+      throw bad('authRequest must be a web-compatible object with supported_auth array');
+    authRequest=options.authRequest;
+  } else if (options.authentication === 'NONE') {
+    authRequest={supported_auth:[],oauth_client_params:null};
+  } else if (options.authentication === undefined || options.authentication === 'AUTO') {
+    // Discovery is safe to repeat and does not create a connector or a link.
+    // Never silently downgrade OAuth to NONE on a discovery error.
+    const discovery=await exports.getCustomMcpOAuthConfig(options);
+    authRequest=authRequestFromDiscovery(discovery);
+  } else throw bad('Unknown authentication type; use AUTO, NONE or a configured authRequest');
+  if (options.description !== undefined && typeof options.description !== 'string') throw bad('description must be a string');
+  if (options.customHeaders !== undefined && !Array.isArray(options.customHeaders)) throw bad('customHeaders must be an array');
+  const body = {
+    name, ...target,
+    description:(options.description || '').trim(),
+    logo_url:options.logoUrl == null ? null : logoValue(options.logoUrl),
+    auth_request:authRequest
+  };
+  if (options.customHeaders?.length) body.custom_headers=options.customHeaders;
+  return request('POST /backend-api/aip/connectors/mcp',options,{body});
+};
+
+exports.renameCustomMcpServer = async (options = {}) =>
+  request('PATCH /backend-api/aip/connectors/{id}/name',options,{
+    pathValues:[nonempty(options.connectorId,'connectorId')],
+    body:{name:nonempty(options.name,'name')}
+  });
+
+exports.describeCustomMcpServer = async (options = {}) => {
+  if (typeof options.description !== 'string') throw bad('description must be a string');
+  return request('PATCH /backend-api/aip/connectors/{id}/description',options,{
+    pathValues:[nonempty(options.connectorId,'connectorId')],
+    body:{description:options.description}
+  });
+};
+
+exports.setCustomMcpServerLogo = async (options = {}) =>
+  request('PATCH /backend-api/aip/connectors/{id}/logo',options,{
+    pathValues:[nonempty(options.connectorId,'connectorId')],
+    body:{logo_url:logoValue(options.logoUrl)}
+  });
+
+exports.deleteCustomMcpServer = async (options = {}) =>
+  request('DELETE /backend-api/aip/connectors/{id}',options,{
+    pathValues:[nonempty(options.connectorId,'connectorId')]
+  });
+
+exports.getCustomMcpServer = async (options = {}) =>
+  request('GET /backend-api/aip/connectors/{id}',options,{
+    pathValues:[nonempty(options.connectorId,'connectorId')]
+  });
+
+exports.listCustomMcpTunnels = async (options = {}) =>
+  request('GET /backend-api/aip/connectors/mcp/tunnels',options);
+
+exports.getCustomMcpOAuthConfig = async (options = {}, injectedOptions = {}) => {
+  // A single URL argument makes `zgpt connector getCustomMcpOAuthConfig https://...` usable on PowerShell.
+  if (typeof options === 'string') options={...injectedOptions,mcpUrl:options};
+  if (options.customHeaders !== undefined && !Array.isArray(options.customHeaders))
+    throw bad('customHeaders must be an array');
+  return request('POST /backend-api/aip/connectors/mcp/oauth_config',options,{
+    body:{...makeTarget(options),custom_headers:options.customHeaders || []}
+  });
+};
+
+// Unlink an account connection without deleting the MCP connector definition.
+// The user must explicitly invoke this destructive operation; never auto-unlink
+// after an auth error, reconnect or action refresh.
+exports.disconnectConnectorLink = async (options = {}, injectedOptions = {}) => {
+  if (typeof options === 'string') options = { ...injectedOptions, linkId: options };
+  const linkId = nonempty(options.linkId, 'linkId');
+  if (!/^link_[A-Za-z0-9_-]+$/.test(linkId))
+    throw bad('linkId must be a connector link identifier (link_...)');
+  return request('DELETE /backend-api/aip/connectors/links/{id}', options, {
+    pathValues: [linkId]
+  });
+};
+
+// Refresh uses the linked connection ID, not the connector ID.
+exports.reloadCustomMcpServerActions = async (options = {}, injectedOptions = {}) => {
+  // Accept the linkId directly for `zgpt connector reloadCustomMcpServerActions <linkId>`.
+  // The legacy options-object form and the SDK's single refresh implementation stay intact.
+  if (typeof options === 'string') options = { ...injectedOptions, linkId: options };
+  return require('./write').refreshConnectorActions(options);
+};

package/src/connector/write.js

@@ -21,6 +21,7 @@ exports.refreshConnectorActions = async (options = {}) => {
   const target = '/backend-api/aip/connectors/mcp/refresh_actions';
   const requestJson = options.requestJson || direct.requestJson;
   return requireSuccess(await requestJson(target, options.token, options.sessionHeaders, {
-    method: 'POST', body: { link_id: options.linkId }, route: target, retry: false
+    method: 'POST', body: { link_id: options.linkId }, route: target, retry: false,
+    headers:{...options.headers,'OAI-Product-Sku':'CONNECTOR_SETTING'}
   }), target);
 };

package/src/conversation/index.js

@@ -55,6 +55,35 @@ exports.send = async (id, message, options = {}) => write.sendConversation({
   message,
   ...(await bindCanonicalContext(options))
 });
+// CLI-friendly management façade matching the verified Zero_LLM command tree.
+// Mutations stay owned by ./write; no copied HTTP routes or parallel auth stack.
+const required = (value, name) => {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw Object.assign(new Error(name + ' is required'), { code: 'BAD_ARGS' });
+  }
+  return value.trim();
+};
+exports.create = async (message, options = {}) => write.createConversation({
+  ...(await bindCanonicalContext(options)),
+  message: required(message, 'message')
+});
+exports.rename = async (id, title, options = {}) => write.renameConversation({
+  ...(await bindCanonicalContext(options)),
+  conversationId: required(id, 'conversationId'),
+  title: required(title, 'title')
+});
+exports.delete = async (id, options = {}) => write.deleteConversation({
+  ...(await bindCanonicalContext(options)),
+  conversationId: required(id, 'conversationId')
+});
+exports.move = async (id, projectId = null, options = {}) => write.moveConversation({
+  ...(await bindCanonicalContext(options)),
+  conversationId: required(id, 'conversationId'),
+  projectId: projectId === 'exit' || projectId == null ? null : required(projectId, 'projectId')
+});
+// Compatibility with the Zero_LLM CLI: new/del map to the same owners.
+exports.new = exports.create;
+exports.del = exports.delete;
 exports.temp = {
   new: async (message, options = {}) => temporary.createConversation({
     message,

package/src/conversation/read.js

@@ -2,6 +2,14 @@
 
 const direct = require('../transport/direct/http-client');
 
+const pageBudget = (maxPages = 1000) => {
+  if (!Number.isSafeInteger(maxPages) || maxPages < 1) {
+    throw Object.assign(new Error('maxPages must be a positive safe integer'), { code: 'PAGINATION_BUDGET_INVALID' });
+  }
+  return maxPages;
+};
+const paginationError = (code, message) => Object.assign(new Error(message), { code });
+
 const requireOk = (response, target) => {
   if (!response || response.status !== 200 || !response.json) {
     const error = new Error(`ChatGPT request failed (${response?.status || 'no-status'}): ${target}`);
@@ -52,25 +60,45 @@ exports.listStandalone = async ({
   token,
   sessionHeaders,
   requestJson = direct.requestJson,
-  onProgress = () => {}
+  onProgress = () => {},
+  maxPages = 1000
 }) => {
+  const budget = pageBudget(maxPages);
   const items = [];
+  const seenItems = new Set();
   let offset = 0;
   const limit = 50;
 
-  for (let pageNumber = 0; pageNumber < 1000; pageNumber += 1) {
+  for (let pageNumber = 0; pageNumber < budget; pageNumber += 1) {
     const target = `/backend-api/conversations?offset=${offset}&limit=${limit}&order=updated&is_archived=false&is_starred=false`;
     const page = requireOk(await requestJson(target, token, sessionHeaders), target);
     const pageItems = Array.isArray(page.items) ? page.items : [];
-    items.push(...pageItems);
-    onProgress({ type: 'conversation-page', count: items.length, pageCount: pageItems.length, offset });
+    if (page.offset !== undefined && page.offset !== null && Number(page.offset) !== offset) {
+      throw paginationError('PAGINATION_STALLED', 'conversation pagination server offset did not advance');
+    }
+    let added = 0;
+    for (const item of pageItems) {
+      const id = item?.id || item?.conversation_id;
+      const key = id ? `id:${id}` : `row:${JSON.stringify(item)}`;
+      if (seenItems.has(key)) continue;
+      seenItems.add(key);
+      items.push(item);
+      added++;
+    }
+    if (pageItems.length > 0 && added === 0 && pageNumber > 0) {
+      throw paginationError('PAGINATION_STALLED', 'conversation pagination returned no new items');
+    }
+    onProgress({ type: 'conversation-page', count: items.length, pageCount: added, offset });
 
     const total = Number(page.total);
     const pageLimit = Number(page.limit) || limit;
+    if (!Number.isSafeInteger(pageLimit) || pageLimit <= 0) {
+      throw paginationError('PAGINATION_STALLED', 'conversation pagination returned an invalid page limit');
+    }
     offset += pageLimit;
     if (!Number.isFinite(total) || offset >= total || pageItems.length === 0) return items;
   }
-  throw Object.assign(new Error('conversation pagination exceeded 1000 pages'), { code: 'PAGINATION_LIMIT' });
+  throw paginationError('PAGINATION_LIMIT', `conversation pagination exceeded ${budget} pages`);
 };
 exports.searchGlobal = async ({
   query,
@@ -186,10 +214,12 @@ exports.getConversationMessagesPage = async ({
 exports.findConversationMessage = async ({
   conversationId, messageId, numTurns = 10, includeHasVersions = true,
   token, sessionHeaders, requestJson = direct.requestJson,
-  getConversation = exports.getConversation, getMessagesPage = exports.getConversationMessagesPage
+  getConversation = exports.getConversation, getMessagesPage = exports.getConversationMessagesPage,
+  maxPages = 1000
 }) => {
   if (!conversationId) throw new Error('conversationId is required');
   if (!messageId) throw new Error('messageId is required');
+  const budget = pageBudget(maxPages);
   const current = await getConversation({ conversationId, token, sessionHeaders, requestJson });
   let pagesScanned = 1;
   let nodesScanned = Array.isArray(current?.messages) ? current.messages.length : 0;
@@ -200,6 +230,7 @@ exports.findConversationMessage = async ({
   let hasPrevious = pageInfo.has_previous_page === true;
   const seen = new Set();
   while (hasPrevious && before) {
+    if (pagesScanned >= budget) throw paginationError('PAGINATION_LIMIT', `conversation message search exceeded ${budget} pages`);
     if (seen.has(before)) throw Object.assign(new Error('conversation history cursor stalled'), { code: 'PAGINATION_STALLED' });
     seen.add(before);
     const page = await getMessagesPage({ conversationId, before, numTurns, includeHasVersions, token, sessionHeaders, requestJson });
@@ -220,9 +251,11 @@ exports.findConversationMessage = async ({
 exports.getConversationHistory = async ({
   conversationId, numTurns = 10, includeHasVersions = true,
   token, sessionHeaders, requestJson = direct.requestJson,
-  getConversation = exports.getConversation, getMessagesPage = exports.getConversationMessagesPage
+  getConversation = exports.getConversation, getMessagesPage = exports.getConversationMessagesPage,
+  maxPages = 1000
 }) => {
   if (!conversationId) throw new Error('conversationId is required');
+  const budget = pageBudget(maxPages);
   const current = await getConversation({ conversationId, token, sessionHeaders, requestJson });
   const pages = [{ ...current, kind: 'current_window', before: null }];
   let messageCount = Array.isArray(current?.messages) ? current.messages.length : 0;
@@ -231,6 +264,7 @@ exports.getConversationHistory = async ({
   let hasPrevious = pageInfo.has_previous_page === true;
   const seen = new Set();
   while (hasPrevious && before) {
+    if (pages.length >= budget) throw paginationError('PAGINATION_LIMIT', `conversation history exceeded ${budget} pages`);
     if (seen.has(before)) throw Object.assign(new Error('conversation history cursor stalled'), { code: 'PAGINATION_STALLED' });
     seen.add(before);
     const page = await getMessagesPage({ conversationId, before, numTurns, includeHasVersions, token, sessionHeaders, requestJson });

package/src/index.js

@@ -9,6 +9,5 @@ exports.file = require('./file');
 exports.memory = require('./memory');
 exports.settings = require('./settings');
 exports.share = require('./share');
-
-
-
+exports.profile = require('./profile');
+exports.api = require('./api');

package/src/profile/index.js

@@ -0,0 +1,41 @@
+'use strict';
+const context = require('../runtime-context');
+const direct = require('../transport/direct/http-client');
+
+const bodyRequired = (value) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length === 0)
+    throw Object.assign(new Error('body must be a nonempty object'), { code: 'BAD_ARGS' });
+  return value;
+};
+const idRequired = (value, name) => {
+  if (typeof value !== 'string' || value.trim().length === 0)
+    throw Object.assign(new Error(name + ' is required'), { code: 'BAD_ARGS' });
+  return encodeURIComponent(value);
+};
+const call = async (target, method, options) => {
+  const resolved = await context.bind(options);
+  const route = method === 'PATCH' ? '/backend-api/accounts/{id}/users/{id}' : target;
+  const args = { method, route, retry: false };
+  if (method !== 'GET') args.body = bodyRequired(resolved.body);
+  const response = await (resolved.requestJson || direct.requestJson)(target, resolved.token, resolved.sessionHeaders, args);
+  if (!response || response.status < 200 || response.status >= 300)
+    throw Object.assign(new Error('ChatGPT profile request failed (' + (response?.status || 'no-status') + '): ' + target), {
+      status: response?.status || null, code: response?.status === 429 ? 'RATE_LIMITED' : 'PROFILE_REQUEST_FAILED', target
+    });
+  if (method === 'GET' && (response.json === undefined || response.json === null))
+    throw Object.assign(new Error('Profile response missing JSON'), { code: 'PROFILE_BAD_RESPONSE' });
+  return response.json || { success: true };
+};
+
+// These are captured/static Web Chat routes. Callers must be entitled to the requested surface.
+exports.getMe = (options = {}) => call('/backend-api/profiles/me', 'GET', options);
+exports.getIdentity = (options = {}) => call('/backend-anon/me', 'GET', options);
+exports.getAuraIdentity = (options = {}) => call('/backend-api/aura/identity', 'GET', options);
+exports.getCreator = (options = {}) => call('/backend-api/gizmo_creator_profile', 'GET', options);
+exports.updateCreator = (options = {}) => call('/backend-api/gizmo_creator_profile', 'POST', options);
+exports.updateWorkspaceUser = async (options = {}) => {
+  const a = idRequired(options.accountId, 'accountId');
+  const u = idRequired(options.userId, 'userId');
+  bodyRequired(options.body);
+  return call('/backend-api/accounts/' + a + '/users/' + u, 'PATCH', options);
+};

package/src/project/index.js

@@ -3,4 +3,38 @@
 const read = require('./read');
 const write = require('./write');
 
-Object.assign(exports, read, write);
+Object.assign(exports, read, write);
+
+// Mirror the proven Zero_LLM Project CLI without copying HTTP implementations.
+// All actions use the same canonical Zero SDK session and project owner methods.
+const bindContext = require('../runtime-context').bind;
+const required = (value, name) => {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw Object.assign(new Error(name + ' is required'), { code: 'BAD_ARGS' });
+  }
+  return value.trim();
+};
+exports.list = async (options = {}) => read.listProjects(await bindContext(options));
+exports.get = async (id, options = {}) => read.getProject({
+  ...(await bindContext(options)), projectId: required(id, 'projectId')
+});
+exports.conversations = async (id, options = {}) => read.listProjectConversations({
+  ...(await bindContext(options)), projectId: required(id, 'projectId')
+});
+exports.create = async (name, options = {}) => write.createProject({
+  ...(await bindContext(options)), name: required(name, 'name')
+});
+exports.rename = async (id, name, options = {}) => write.renameProject({
+  ...(await bindContext(options)), projectId: required(id, 'projectId'), name: required(name, 'name')
+});
+exports.delete = async (id, options = {}) => write.deleteProject({
+  ...(await bindContext(options)), projectId: required(id, 'projectId')
+});
+exports.save = async (projectId, conversationId, messageId, options = {}) => write.saveProjectMessage({
+  ...(await bindContext(options)), projectId: required(projectId, 'projectId'),
+  conversationId: required(conversationId, 'conversationId'),
+  messageId: required(messageId, 'messageId')
+});
+// Keep the legacy LAB's natural command names without duplicating logic.
+exports.new = exports.create;
+exports.del = exports.delete;

package/src/session/direct-transport.js

@@ -1,68 +1,60 @@
-'use strict';
-
-const fs = require('node:fs');
-const paths = require('../config/paths');
-const direct = require('../transport/direct/http-client');
-
-const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
-const mergeSetCookies = (cookieString, setCookie) => {
-  const jar = new Map();
-  const add = (entry) => {
-    const first = String(entry || '').split(';')[0];
-    const index = first.indexOf('=');
-    if (index > 0) jar.set(first.slice(0, index).trim(), first.slice(index + 1).trim());
-  };
-  for (const pair of String(cookieString || '').split(';')) add(pair);
-  for (const entry of Array.isArray(setCookie) ? setCookie : [setCookie]) add(entry);
-  return [...jar].map(([name, value]) => `${name}=${value}`).join('; ');
-};
-const bootstrapHeaders = (env) => {
-  const state = readJson(paths.sessionFile(env)) || {};
-  const saved = state.headers && typeof state.headers === 'object' && !Array.isArray(state.headers) ? state.headers : {};
-  const { Cookie: _cookie, cookie: _cookieLower, authorization: _authorization, ...safe } = saved;
-  return {
-    ...safe,
-    origin: safe.origin || 'https://chatgpt.com',
-    referer: safe.referer || 'https://chatgpt.com/',
-    accept: safe.accept || 'application/json'
-  };
-};
-
-exports.createTransport = ({ requestJson = direct.requestJson } = {}) => async ({ sessionMarker, workspaceAccountId = null, env = process.env } = {}) => {
-  if (!sessionMarker || typeof sessionMarker !== 'string') {
-    throw Object.assign(new Error('Missing local ChatGPT session marker'), { code: 'CHATGPT_SESSION_MARKER_MISSING' });
-  }
-  const sessionFile = paths.sessionFile(env);
-  const sessionHeaders = bootstrapHeaders(env);
-  const first = await requestJson('/api/auth/session', sessionMarker, sessionHeaders, {
-    route: '/api/auth/session', env, sessionFile, persistSession: false
-  });
-  if (![200, 403].includes(Number(first?.status))) {
-    throw Object.assign(new Error('ChatGPT session bootstrap round one failed'), { code: 'CHATGPT_SESSION_BOOTSTRAP_FAILED', status: first?.status || 0 });
-  }
-  const cookie = mergeSetCookies('', first?.headers?.['set-cookie']);
-  if (!cookie) {
-    throw Object.assign(new Error('ChatGPT session bootstrap did not return a cookie'), { code: 'CHATGPT_SESSION_BOOTSTRAP_COOKIE_MISSING', status: first?.status || 0 });
-  }
-  sessionHeaders.Cookie = cookie;
-  const switched = await requestJson('/account-switch/switch', null, sessionHeaders, {
-    method: 'POST',
-    body: workspaceAccountId ? { workspaceAccountId } : {},
-    route: '/account-switch/switch',
-    headers: { 'OAI-Account-Switch-Session-Token': sessionMarker },
-    env,
-    sessionFile,
-    persistSession: false
-  });
-  if (!switched || switched.status < 200 || switched.status >= 300) {
-    throw Object.assign(new Error('ChatGPT direct session exchange failed'), { code: 'CHATGPT_SESSION_EXCHANGE_FAILED', status: switched?.status || 0 });
-  }
-  const switchedCookie = mergeSetCookies(sessionHeaders.Cookie, switched?.headers?.['set-cookie']);
-  if (switchedCookie) sessionHeaders.Cookie = switchedCookie;
-  const second = await requestJson('/api/auth/session', null, sessionHeaders, {
-    route: '/api/auth/session', env, sessionFile, persistSession: false
-  });
-  return { status: Number(second?.status || 0), body: second?.json ?? null, sessionHeaders };
-};
-
-exports.transport = exports.createTransport();
+'use strict';
+
+const fs = require('node:fs');
+const paths = require('../config/paths');
+const direct = require('../transport/direct/http-client');
+
+const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+const mergeSetCookies = (cookieString, setCookie) => {
+  const jar = new Map();
+  const add = (entry) => {
+    const first = String(entry || '').split(';')[0];
+    const index = first.indexOf('=');
+    if (index > 0) jar.set(first.slice(0, index).trim(), first.slice(index + 1).trim());
+  };
+  for (const pair of String(cookieString || '').split(';')) add(pair);
+  for (const entry of Array.isArray(setCookie) ? setCookie : [setCookie]) add(entry);
+  return [...jar].map(([name, value]) => `${name}=${value}`).join('; ');
+};
+const bootstrapHeaders = (env) => {
+  const state = readJson(paths.sessionFile(env)) || {};
+  const saved = state.headers && typeof state.headers === 'object' && !Array.isArray(state.headers) ? state.headers : {};
+  const { Cookie: _cookie, cookie: _cookieLower, authorization: _authorization, ...safe } = saved;
+  return {
+    ...safe,
+    origin: safe.origin || 'https://chatgpt.com',
+    referer: safe.referer || 'https://chatgpt.com/',
+    accept: safe.accept || 'application/json'
+  };
+};
+
+exports.createTransport = ({ requestJson = direct.requestJson } = {}) => async ({ sessionMarker, workspaceAccountId = null, env = process.env } = {}) => {
+  if (!sessionMarker || typeof sessionMarker !== 'string') {
+    throw Object.assign(new Error('Missing local ChatGPT session marker'), { code: 'CHATGPT_SESSION_MARKER_MISSING' });
+  }
+  const sessionFile = paths.sessionFile(env);
+  const sessionHeaders = bootstrapHeaders(env);
+  sessionHeaders.Cookie = mergeSetCookies(sessionHeaders.Cookie || sessionHeaders.cookie || '', `__Secure-next-auth.session-token=${sessionMarker}`);
+  delete sessionHeaders.cookie;
+
+  const first = await requestJson('/api/auth/session', null, sessionHeaders, {
+    route: '/api/auth/session', env, sessionFile, persistSession: false
+  });
+  if (![200, 403].includes(Number(first?.status))) {
+    throw Object.assign(new Error('ChatGPT session bootstrap round one failed'), { code: 'CHATGPT_SESSION_BOOTSTRAP_FAILED', status: first?.status || 0 });
+  }
+
+  sessionHeaders.Cookie = mergeSetCookies(sessionHeaders.Cookie, first?.headers?.['set-cookie']);
+  const firstBody = first?.json;
+  const firstAuthenticated = Boolean(firstBody && typeof firstBody === 'object' && !Array.isArray(firstBody) && (firstBody.user || firstBody.account || firstBody.accessToken || firstBody.sessionToken));
+  if (Number(first?.status) === 200 && firstAuthenticated) {
+    return { status: 200, body: firstBody, sessionHeaders };
+  }
+
+  const second = await requestJson('/api/auth/session', null, sessionHeaders, {
+    route: '/api/auth/session', env, sessionFile, persistSession: false
+  });
+  return { status: Number(second?.status || 0), body: second?.json ?? null, sessionHeaders };
+};
+
+exports.transport = exports.createTransport();

package/src/settings/index.js

@@ -15,4 +15,6 @@ exports.updateAccountUserSetting = async (options = {}) => {
   if (!options.body || typeof options.body !== 'object' || Array.isArray(options.body)) throw Object.assign(new Error('body is required'), { code: 'BAD_ARGS' });
   const target = '/backend-api/settings/account_user_setting';
   return requireOk(await (options.requestJson || direct.requestJson)(target, options.token, options.sessionHeaders, { method: 'PATCH', retry: false, route: target, body: options.body }), target);
-};
+};
+
+Object.assign(exports, require('./web'));

package/src/settings/web.js

@@ -0,0 +1,38 @@
+'use strict';
+const context = require('../runtime-context');
+const direct = require('../transport/direct/http-client');
+
+const invoke = async (route, method, options = {}) => {
+  const requestOptions = { route, method, retry: false };
+  if (method !== 'GET') {
+    if (!options.body || typeof options.body !== 'object' || Array.isArray(options.body) || Object.keys(options.body).length === 0)
+      throw Object.assign(new Error('body must be a nonempty object'), { code: 'BAD_ARGS' });
+    requestOptions.body = options.body;
+  }
+  const bound = await context.bind(options);
+  const response = await (bound.requestJson || direct.requestJson)(route, bound.token, bound.sessionHeaders, requestOptions);
+  if (!response || response.status < 200 || response.status >= 300) {
+    const error = new Error('ChatGPT settings request failed (' + (response?.status || 'no-status') + '): ' + route);
+    error.status = response?.status || null;
+    error.target = route;
+    error.code = response?.status === 429 ? 'RATE_LIMITED' : 'SETTINGS_REQUEST_FAILED';
+    throw error;
+  }
+  if (method === 'GET' && (response.json === undefined || response.json === null))
+    throw Object.assign(new Error('Settings response missing JSON'), { code: 'SETTINGS_BAD_RESPONSE' });
+  return response.json || { success: true };
+};
+
+exports.getVoices = (options = {}) => invoke('/backend-api/settings/voices', 'GET', options);
+exports.getTrainingDataUsage = (options = {}) => invoke('/backend-api/accounts/data_usage_for_training', 'GET', options);
+exports.getAgeVerificationEnabled = (options = {}) => invoke('/backend-api/settings/age_verification_enabled', 'GET', options);
+exports.getAdultStatus = (options = {}) => invoke('/backend-api/settings/is_adult', 'GET', options);
+exports.getConsent = (options = {}) => invoke('/backend-api/user_granular_consent', 'GET', options);
+exports.updateConsent = (options = {}) => invoke('/backend-api/user_granular_consent', 'POST', options);
+exports.getNotifications = (options = {}) => invoke('/backend-api/notifications/settings', 'GET', options);
+exports.updateNotifications = (options = {}) => invoke('/backend-api/notifications/settings', 'PATCH', options);
+exports.setDefaultModel = (options = {}) => invoke('/backend-api/settings/user_default_model_config', 'PATCH', options);
+exports.setLastUsedModel = (options = {}) => invoke('/backend-api/settings/user_last_used_model_config', 'PATCH', options);
+exports.setTppDefaultModel = (options = {}) => invoke('/backend-api/settings/user_tpp_default_model_config', 'PATCH', options);
+exports.setTppLastUsedModel = (options = {}) => invoke('/backend-api/settings/user_tpp_last_used_model_config', 'PATCH', options);
+exports.setLocale = (options = {}) => invoke('/backend-api/accounts/users/locale', 'PATCH', options);