@modelprofile.com/authswitch 9.2.0 → 10.0.0

package/ts/classes.login.ts

@@ -1,13 +1,27 @@
-import * as plugins from './plugins.js';
+import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
+import { parseOpenAiTokenClaims } from './openaiauth.js';
 import type { IHarnessLoginHandle, IHarnessLoginOptions, IHarnessLoginResult } from './interfaces.harness.js';
+import type { IOpenAiDevicePrompt, IOpenAiLoginHandle, IOpenAiLoginOptions, IOpenAiLoginResult,
+  IOpenAiOAuthCredential } from './interfaces.openai.js';
 
-export type TAuthLoginFlow = plugins.flexAccounts.TSmartAiProviderLoginFlow;
-export type TAuthLoginCredential = plugins.flexAccounts.TSmartAiProviderCredential;
-export type TAuthLoginPrompt = plugins.flexAccounts.TSmartAiProviderLoginPrompt;
-export interface IAuthLoginResult extends plugins.flexAccounts.ISmartAiProviderLoginResult {}
-export interface IAuthLoginHandle extends plugins.flexAccounts.ISmartAiProviderLoginHandle {}
-export interface IAuthLoginProvider extends Pick<plugins.flexAccounts.ISmartAiProviderAdapter, 'descriptor' | 'beginLogin' | 'dispose'> {}
-export interface IAuthLoginOptions extends plugins.flexAccounts.ISmartAiProviderLoginOptions {
+/** The one login flow: a device sign-in, which needs no browser on the machine that signs in. */
+export type TAuthLoginFlow = IOpenAiLoginOptions['flow'];
+export type TAuthLoginCredential = IOpenAiOAuthCredential;
+export type TAuthLoginPrompt = IOpenAiDevicePrompt;
+export interface IAuthLoginResult extends IOpenAiLoginResult {}
+export interface IAuthLoginHandle extends IOpenAiLoginHandle {}
+/** A provider this login owner starts sign-ins with, named by its `providerId`. */
+export interface IAuthLoginProviderDescriptor {
+  providerId: string;
+  displayName: string;
+  loginFlows: readonly TAuthLoginFlow[];
+}
+export interface IAuthLoginProvider {
+  readonly descriptor: IAuthLoginProviderDescriptor;
+  beginLogin(options: IOpenAiLoginOptions): Promise<IAuthLoginHandle>;
+  dispose(): Promise<void>;
+}
+export interface IAuthLoginOptions extends IOpenAiLoginOptions {
   providerId: string;
 }
 export interface IAuthSwitchLoginOptions {
@@ -23,13 +37,13 @@ export class AuthSwitchLogin {
   private closing?: Promise<void>;
   private readonly handles = new Set<IAuthLoginHandle>();
 
-  constructor(providers: IAuthLoginProvider[] = [new plugins.flexAccounts.OpenAiProviderAdapter()], private readonly options: IAuthSwitchLoginOptions = {}) {
+  constructor(providers: IAuthLoginProvider[] = [new AuthSwitchOpenAiProvider()], private readonly options: IAuthSwitchLoginOptions = {}) {
     for (const provider of providers) {
       if (this.providers.has(provider.descriptor.providerId)) throw new Error('Duplicate login provider.');
       this.providers.set(provider.descriptor.providerId, provider);
     }
   }
-  public listProviders(): plugins.flexAccounts.ISmartAiProviderDescriptor[] {
+  public listProviders(): IAuthLoginProviderDescriptor[] {
     return [...this.providers.values()].map(provider => ({ ...provider.descriptor, loginFlows: [...provider.descriptor.loginFlows] }));
   }
   public async beginLogin(options: IAuthLoginOptions): Promise<IAuthLoginHandle> {
@@ -70,7 +84,7 @@ export const beginSavedOpenAiLogin = async (
   fetcher?: typeof fetch,
 ): Promise<IHarnessLoginHandle> => {
   if (options.providerId !== 'openai' || options.flow !== 'device') throw new Error('This harness supports OpenAI device login.');
-  const service = new AuthSwitchLogin([new plugins.flexAccounts.OpenAiProviderAdapter({ fetch: fetcher })]);
+  const service = new AuthSwitchLogin([new AuthSwitchOpenAiProvider({ fetch: fetcher })]);
   try {
     const handle = await service.beginLogin({ providerId: 'openai', flow: 'device' });
     const completion = handle.completion.then(save).catch((): IHarnessLoginResult => ({
@@ -81,23 +95,22 @@ export const beginSavedOpenAiLogin = async (
 };
 
 /** Convert a verified OpenAI login for native OpenCode without exposing it in public account DTOs. */
-export const openCodeCredentialFromLogin = (credential: plugins.flexAccounts.IOpenAiChatGptOAuthCredential): {
+export const openCodeCredentialFromLogin = (credential: IOpenAiOAuthCredential): {
   type: 'oauth'; access: string; refresh: string; expires: number; accountId?: string;
 } => {
   try {
-    const auth = plugins.flexAccounts.toOpenAiChatGptAuthCredentials(credential);
-    const payload = credential.accessToken.split('.')[1];
+    if (credential.kind !== 'chatgptOAuth' || credential.providerId !== 'openai' || !credential.accessToken
+      || !credential.refreshToken || !credential.idToken) throw new Error();
+    const accountId = parseOpenAiTokenClaims(credential.idToken).chatgptAccountId;
     let expires = 0;
-    if (payload && payload.length <= 48 * 1024) {
-      try {
-        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as { exp?: unknown };
-        expires = typeof claims?.exp === 'number' ? claims.exp * 1000 : 0;
-      } catch { /* Opaque access tokens are valid; native OpenCode refreshes an unknown expiry. */ }
-    }
+    try {
+      const expiresAt = parseOpenAiTokenClaims(credential.accessToken).expiresAt;
+      expires = expiresAt === undefined ? 0 : Date.parse(expiresAt);
+    } catch { /* Opaque access tokens are valid; native OpenCode refreshes an unknown expiry. */ }
     return {
       type: 'oauth', access: credential.accessToken, refresh: credential.refreshToken,
       expires: Number.isSafeInteger(expires) && expires >= 0 ? expires : 0,
-      ...(auth.accountId ? { accountId: auth.accountId } : {}),
+      ...(accountId ? { accountId } : {}),
     };
   } catch { throw new Error('OpenAI login credential is invalid.'); }
 };

package/ts/classes.openaiprovider.ts

@@ -0,0 +1,365 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+
+import * as plugins from './plugins.js';
+import {
+  exchangeOpenAiDeviceAuthorization, OpenAiAuthError, parseOpenAiTokenClaims, pollOpenAiDeviceCode,
+  refreshOpenAiTokens, requestOpenAiDeviceCode, revokeOpenAiRefreshToken, type IOpenAiTokenSet,
+} from './openaiauth.js';
+import { OpenAiBackendError, readOpenAiAccountUsage } from './openaiusage.js';
+import type {
+  IOpenAiAccess, IOpenAiAccountSummary, IOpenAiDevicePrompt, IOpenAiLoginHandle, IOpenAiLoginOptions,
+  IOpenAiLoginResult, IOpenAiOAuthCredential, IOpenAiOperationOptions, IOpenAiProviderDescriptor,
+  TOpenAiAccountRateLimitsResult, TOpenAiLoginCancelStatus, TOpenAiRefreshResult,
+} from './interfaces.openai.js';
+
+const DEVICE_LOGIN_TIMEOUT_MS = 15 * 60 * 1000;
+const OPERATION_TIMEOUT_MS = 30_000;
+const MAXIMUM_OPERATION_TIMEOUT_MS = 20 * 60 * 1000;
+const MAXIMUM_HEADER_BYTES = 16 * 1024;
+
+/**
+ * Why a provider operation failed, as a code a caller branches on:
+ * - `INVALID_ARGUMENT` and `CREDENTIAL_INVALID`: the caller's input.
+ * - `CLOSED`: the provider was disposed. `ABORTED` / `TIMEOUT`: the caller's signal or the time limit.
+ * - `LOGIN_FAILED` / `LOGIN_CANCELED`: a device sign-in did not produce a credential.
+ * - `REVOKE_FAILED`: the service did not confirm a revocation; the sign-in may still be valid.
+ */
+export type TOpenAiProviderErrorCode = 'INVALID_ARGUMENT' | 'CREDENTIAL_INVALID' | 'CLOSED' | 'ABORTED' | 'TIMEOUT'
+  | 'LOGIN_FAILED' | 'LOGIN_CANCELED' | 'REVOKE_FAILED';
+
+export class OpenAiProviderError extends Error {
+  constructor(public readonly code: TOpenAiProviderErrorCode) {
+    super(`OpenAI provider operation failed (${code}).`);
+    this.name = 'OpenAiProviderError';
+  }
+}
+
+export interface IOpenAiProviderOptions {
+  fetch?: typeof fetch;
+  now?: () => Date;
+}
+
+interface IOperation {
+  controller: AbortController;
+  signal: AbortSignal;
+  readonly timedOut: boolean;
+  cleanup(): void;
+}
+
+interface ISharedRefresh {
+  controller: AbortController;
+  promise: Promise<TOpenAiRefreshResult>;
+  waiters: number;
+  settled: boolean;
+}
+
+const createOperation = (options: IOpenAiOperationOptions, defaultTimeoutMs: number): IOperation => {
+  const timeoutMs = options.timeoutMs ?? defaultTimeoutMs;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAXIMUM_OPERATION_TIMEOUT_MS) {
+    throw new OpenAiProviderError('INVALID_ARGUMENT');
+  }
+  const controller = new AbortController();
+  let timedOut = false;
+  const onExternalAbort = (): void => controller.abort();
+  options.signal?.addEventListener('abort', onExternalAbort, { once: true });
+  if (options.signal?.aborted) controller.abort();
+  const timer = setTimeout(() => { timedOut = true; controller.abort(); }, timeoutMs);
+  return {
+    controller,
+    signal: controller.signal,
+    get timedOut() { return timedOut; },
+    cleanup: () => {
+      clearTimeout(timer);
+      options.signal?.removeEventListener('abort', onExternalAbort);
+    },
+  };
+};
+
+const failureCode = (operation: IOperation): 'ABORTED' | 'TIMEOUT' | null =>
+  operation.timedOut ? 'TIMEOUT' : operation.signal.aborted ? 'ABORTED' : null;
+
+/** The token set a stored credential holds, with its ID-token claims; a malformed credential is refused. */
+const tokensOf = (credential: IOpenAiOAuthCredential): IOpenAiTokenSet => {
+  if (credential === null || typeof credential !== 'object' || credential.kind !== 'chatgptOAuth'
+    || credential.providerId !== 'openai' || !credential.accessToken || !credential.refreshToken || !credential.idToken) {
+    throw new OpenAiProviderError('CREDENTIAL_INVALID');
+  }
+  try {
+    return { accessToken: credential.accessToken, refreshToken: credential.refreshToken, idToken: credential.idToken,
+      claims: parseOpenAiTokenClaims(credential.idToken) };
+  } catch { throw new OpenAiProviderError('CREDENTIAL_INVALID'); }
+};
+
+const credentialOf = (tokens: IOpenAiTokenSet, lastRefreshAt?: string): IOpenAiOAuthCredential => {
+  if (!tokens.idToken) throw new OpenAiProviderError('CREDENTIAL_INVALID');
+  return { kind: 'chatgptOAuth', providerId: 'openai', accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken, idToken: tokens.idToken,
+    ...(lastRefreshAt === undefined ? {} : { lastRefreshAt }) };
+};
+
+const summaryOf = (credential: IOpenAiOAuthCredential): IOpenAiAccountSummary => {
+  const claims = tokensOf(credential).claims;
+  return {
+    providerId: 'openai', authKind: 'chatgptOAuth',
+    ...(claims.chatgptAccountId ? { accountId: claims.chatgptAccountId } : {}),
+    ...(claims.email ? { email: claims.email } : {}),
+    ...(claims.chatgptPlanType ? { plan: claims.chatgptPlanType } : {}),
+  };
+};
+
+const requireAccess = (access: IOpenAiAccess): IOpenAiAccess => {
+  if (access === null || typeof access !== 'object' || typeof access.accessToken !== 'string' || !access.accessToken
+    || Buffer.byteLength(access.accessToken, 'utf8') > MAXIMUM_HEADER_BYTES
+    || typeof access.accountId !== 'string' || !access.accountId
+    || Buffer.byteLength(access.accountId, 'utf8') > MAXIMUM_HEADER_BYTES
+    || typeof access.isFedrampAccount !== 'boolean') {
+    throw new OpenAiProviderError('CREDENTIAL_INVALID');
+  }
+  return { accessToken: access.accessToken, accountId: access.accountId, isFedrampAccount: access.isFedrampAccount };
+};
+
+class OpenAiLoginHandle implements IOpenAiLoginHandle {
+  public readonly completion: Promise<IOpenAiLoginResult>;
+  private closePromise?: Promise<void>;
+  private done = false;
+
+  constructor(public readonly prompt: IOpenAiDevicePrompt, completion: Promise<IOpenAiLoginResult>,
+    private readonly abortController: AbortController, private readonly cleanup: () => Promise<void>,
+    onDone: () => void) {
+    this.completion = completion.finally(async () => {
+      this.done = true;
+      try { await this.cleanup(); } finally { onDone(); }
+    });
+    void this.completion.catch(() => undefined);
+  }
+
+  public async cancel(): Promise<TOpenAiLoginCancelStatus> {
+    if (this.done || this.abortController.signal.aborted) return 'notFound';
+    this.abortController.abort();
+    return 'canceled';
+  }
+
+  public close(): Promise<void> {
+    this.closePromise ??= (async () => {
+      await this.cancel();
+      await this.completion.catch(() => undefined);
+      await this.cleanup();
+    })().catch(error => { this.closePromise = undefined; throw error; });
+    return this.closePromise;
+  }
+}
+
+/**
+ * The authority's ChatGPT provider: device sign-in, one shared refresh per refresh token, revocation, the
+ * credential's claims and the account's usage limits. It holds no credential of its own; every call names the
+ * one it acts on.
+ */
+export class AuthSwitchOpenAiProvider {
+  public readonly descriptor: IOpenAiProviderDescriptor = { providerId: 'openai', displayName: 'OpenAI', loginFlows: ['device'] };
+  private readonly fetcher: typeof fetch;
+  private readonly now: () => Date;
+  private readonly handles = new Set<OpenAiLoginHandle>();
+  private readonly operations = new Set<AbortController>();
+  private readonly refreshes = new Map<string, ISharedRefresh>();
+  private closed = false;
+  private disposePromise?: Promise<void>;
+
+  constructor(options: IOpenAiProviderOptions = {}) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    if (!fetcher) throw new OpenAiProviderError('INVALID_ARGUMENT');
+    this.fetcher = fetcher;
+    this.now = options.now ?? (() => new Date());
+  }
+
+  private requireOpen(): void {
+    if (this.closed) throw new OpenAiProviderError('CLOSED');
+  }
+
+  /** What a stored credential's claims say about its account. Throws `CREDENTIAL_INVALID` for a malformed one. */
+  public inspectCredential(credential: IOpenAiOAuthCredential): IOpenAiAccountSummary {
+    this.requireOpen();
+    return summaryOf(credential);
+  }
+
+  /** Starts a device sign-in; the handle's prompt is shown to the person, its completion carries the credential. */
+  public async beginLogin(options: IOpenAiLoginOptions): Promise<IOpenAiLoginHandle> {
+    this.requireOpen();
+    if (options?.flow !== 'device' || (options.timeoutMs ?? DEVICE_LOGIN_TIMEOUT_MS) > DEVICE_LOGIN_TIMEOUT_MS) {
+      throw new OpenAiProviderError('INVALID_ARGUMENT');
+    }
+    const operation = createOperation(options, DEVICE_LOGIN_TIMEOUT_MS);
+    const abortController = operation.controller;
+    this.operations.add(abortController);
+    const cleanup = async (): Promise<void> => {
+      this.operations.delete(abortController);
+      operation.cleanup();
+    };
+    const auth = { fetch: this.fetcher, signal: abortController.signal };
+    try {
+      const deviceCode = await requestOpenAiDeviceCode(auth);
+      const completion = pollOpenAiDeviceCode(deviceCode, { ...auth, timeoutMs: options.timeoutMs ?? DEVICE_LOGIN_TIMEOUT_MS })
+        .then(authorization => exchangeOpenAiDeviceAuthorization(authorization, auth))
+        .then(tokens => {
+          const credential = credentialOf(tokens);
+          return { credential, account: summaryOf(credential) };
+        });
+      this.requireOpen();
+      if (abortController.signal.aborted) throw new OpenAiProviderError('ABORTED');
+      const handle = new OpenAiLoginHandle(
+        { flow: 'device', verificationUrl: deviceCode.verificationUrl, userCode: deviceCode.userCode },
+        completion.catch((error: unknown) => {
+          if (operation.timedOut) throw new OpenAiProviderError('TIMEOUT');
+          if (options.signal?.aborted) throw new OpenAiProviderError('ABORTED');
+          if (abortController.signal.aborted) throw new OpenAiProviderError('LOGIN_CANCELED');
+          if (error instanceof OpenAiProviderError) throw error;
+          throw new OpenAiProviderError('LOGIN_FAILED');
+        }),
+        abortController, cleanup, () => this.handles.delete(handle));
+      this.handles.add(handle);
+      return handle;
+    } catch (error) {
+      abortController.abort();
+      await cleanup().catch(() => undefined);
+      if (operation.timedOut) throw new OpenAiProviderError('TIMEOUT');
+      if (options.signal?.aborted) throw new OpenAiProviderError('ABORTED');
+      if (error instanceof OpenAiProviderError) throw error;
+      throw new OpenAiProviderError('LOGIN_FAILED');
+    }
+  }
+
+  /**
+   * Refreshes one credential. Concurrent callers of the same refresh token share one request, so a rotating grant
+   * is sent once; a caller that stops waiting leaves the shared request to the others, and the last one cancels it.
+   */
+  public async refreshCredential(credential: IOpenAiOAuthCredential,
+    options: IOpenAiOperationOptions = {}): Promise<TOpenAiRefreshResult> {
+    this.requireOpen();
+    tokensOf(credential);
+    const waitOperation = createOperation(options, OPERATION_TIMEOUT_MS);
+    if (waitOperation.signal.aborted) {
+      waitOperation.cleanup();
+      return { success: false, credential, errorCode: waitOperation.timedOut ? 'TIMEOUT' : 'ABORTED',
+        requestOutcome: 'notSent' };
+    }
+    let shared: ISharedRefresh | undefined;
+    let joined = false;
+    let onAbort: (() => void) | undefined;
+    try {
+      const key = plugins.crypto.createHash('sha256').update(credential.refreshToken, 'utf8').digest('base64url');
+      shared = this.refreshes.get(key);
+      if (!shared) {
+        const controller = new AbortController();
+        let created!: ISharedRefresh;
+        const promise = this.performRefresh(credential, controller.signal).finally(() => {
+          created.settled = true;
+          if (this.refreshes.get(key) === created) this.refreshes.delete(key);
+        });
+        created = { controller, promise, waiters: 0, settled: false };
+        this.refreshes.set(key, created);
+        shared = created;
+      }
+      shared.waiters++;
+      joined = true;
+      const aborted = new Promise<TOpenAiRefreshResult>(resolve => {
+        onAbort = () => resolve({ success: false, credential, errorCode: waitOperation.timedOut ? 'TIMEOUT' : 'ABORTED',
+          requestOutcome: 'outcomeUnknown' });
+        waitOperation.signal.addEventListener('abort', onAbort, { once: true });
+      });
+      return await Promise.race([shared.promise, aborted]);
+    } finally {
+      if (onAbort) waitOperation.signal.removeEventListener('abort', onAbort);
+      waitOperation.cleanup();
+      if (shared && joined) shared.waiters--;
+      if (shared && joined && shared.waiters === 0 && !shared.settled) shared.controller.abort();
+    }
+  }
+
+  private async performRefresh(credential: IOpenAiOAuthCredential, signal: AbortSignal): Promise<TOpenAiRefreshResult> {
+    const input = tokensOf(credential);
+    const operation = createOperation({ signal }, OPERATION_TIMEOUT_MS);
+    this.operations.add(operation.controller);
+    try {
+      const refreshed = await refreshOpenAiTokens(input, { fetch: this.fetcher, signal: operation.signal });
+      // A refresh that returned the same tokens, or no ID token, proves nothing about the grant it used.
+      if ((refreshed.accessToken === input.accessToken && refreshed.refreshToken === input.refreshToken)
+        || !refreshed.idToken) {
+        return { success: false, credential, errorCode: 'REFRESH_FAILED', requestOutcome: 'outcomeUnknown' };
+      }
+      const previous = credential.lastRefreshAt === undefined ? 0 : Date.parse(credential.lastRefreshAt);
+      const now = this.now().getTime();
+      const lastRefreshAt = new Date(Math.max(now, Number.isFinite(previous) ? previous + 1 : now)).toISOString();
+      const next = credentialOf(refreshed, lastRefreshAt);
+      return { success: true, credential: next, account: summaryOf(next) };
+    } catch (error) {
+      return {
+        success: false, credential,
+        errorCode: failureCode(operation) ?? 'REFRESH_FAILED',
+        requestOutcome: error instanceof OpenAiAuthError ? error.requestOutcome ?? 'outcomeUnknown' : 'outcomeUnknown',
+        ...(error instanceof OpenAiAuthError && error.status !== undefined ? { responseStatus: error.status } : {}),
+        ...(error instanceof OpenAiAuthError && error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),
+      };
+    } finally {
+      this.operations.delete(operation.controller);
+      operation.cleanup();
+    }
+  }
+
+  /** Reads the account's usage limits with access alone; a rejected token asks the caller to renew it. */
+  public async getAccountRateLimits(access: IOpenAiAccess,
+    options: IOpenAiOperationOptions = {}): Promise<TOpenAiAccountRateLimitsResult> {
+    this.requireOpen();
+    const read = requireAccess(access);
+    const operation = createOperation(options, OPERATION_TIMEOUT_MS);
+    this.operations.add(operation.controller);
+    try {
+      const usage = await readOpenAiAccountUsage(read, { fetch: this.fetcher, signal: operation.signal,
+        timeoutMs: MAXIMUM_OPERATION_TIMEOUT_MS, now: this.now });
+      return { success: true, rateLimits: usage.rateLimits };
+    } catch (error) {
+      if (error instanceof OpenAiBackendError && error.reason === 'unauthorized') {
+        return { success: false, errorCode: 'CREDENTIAL_REFRESH_REQUIRED' };
+      }
+      return { success: false, errorCode: failureCode(operation) ?? 'ACCOUNT_RATE_LIMITS_FAILED' };
+    } finally {
+      this.operations.delete(operation.controller);
+      operation.cleanup();
+    }
+  }
+
+  /**
+   * Revokes a credential's refresh token at the service, so that sign-in refreshes nothing anywhere afterwards.
+   * Throws `REVOKE_FAILED`, `TIMEOUT` or `ABORTED` when the service did not confirm it.
+   */
+  public async revokeCredential(credential: IOpenAiOAuthCredential, options: IOpenAiOperationOptions = {}): Promise<void> {
+    this.requireOpen();
+    const tokens = tokensOf(credential);
+    const operation = createOperation(options, OPERATION_TIMEOUT_MS);
+    this.operations.add(operation.controller);
+    try {
+      await revokeOpenAiRefreshToken(tokens.refreshToken, { fetch: this.fetcher, signal: operation.signal });
+    } catch {
+      throw new OpenAiProviderError(failureCode(operation) ?? 'REVOKE_FAILED');
+    } finally {
+      this.operations.delete(operation.controller);
+      operation.cleanup();
+    }
+  }
+
+  /** Cancels every sign-in and request in flight and waits for them; the provider cannot be used afterwards. */
+  public dispose(): Promise<void> {
+    this.disposePromise ??= (async () => {
+      this.closed = true;
+      for (const operation of this.operations) operation.abort();
+      const results = await Promise.allSettled([...this.handles].map(handle => handle.close()));
+      const deadline = Date.now() + 5_000;
+      while (this.operations.size > 0 && Date.now() < deadline) {
+        await new Promise<void>(resolve => setTimeout(resolve, 10));
+      }
+      if (results.some(result => result.status === 'rejected') || this.operations.size > 0) {
+        throw new OpenAiProviderError('CLOSED');
+      }
+      this.handles.clear();
+    })().catch(error => { this.disposePromise = undefined; throw error; });
+    return this.disposePromise;
+  }
+}

package/ts/classes.opencodeharness.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import { parseOpenAiTokenClaims, type IOpenAiTokenClaims } from './openaiauth.js';
 import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
 import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw } from './classes.credentialstore.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
@@ -80,8 +81,8 @@ export class OpenCodeHarness extends FileHarness {
   }
   private openAiInfo(entry: Record<string, unknown>): { accountId?: string; email?: string; plan?: string } {
     if (entry.type !== 'oauth') return {};
-    let claims: plugins.flexAuth.IOpenAiChatGptTokenInfo | undefined;
-    try { claims = plugins.flexAuth.parseOpenAiChatGptTokenInfo(credentialText(entry.access)!); } catch { /* Opaque tokens can still be preserved. */ }
+    let claims: IOpenAiTokenClaims | undefined;
+    try { claims = parseOpenAiTokenClaims(credentialText(entry.access)!); } catch { /* Opaque tokens can still be preserved. */ }
     const accountId = credentialText(entry.accountId) ?? claims?.chatgptAccountId;
     if (entry.accountId && claims?.chatgptAccountId && entry.accountId !== claims.chatgptAccountId) throw new Error('OpenCode OpenAI account ID does not match the credential.');
     return { accountId, email: claims?.email?.toLowerCase(), plan: claims?.chatgptPlanType };

package/ts/classes.service.ts

@@ -41,9 +41,8 @@ const publicOutcome = (outcome: IHarnessOutcome): IHarnessOutcome => ({ lines: [
 const publicResult = (result: TAuthSwitchCoordinationResult): TAuthSwitchCoordinationResult => result.status === 'complete'
   ? { status: 'complete', outcome: publicOutcome(result.outcome) }
   : result.status === 'busy' ? { status: 'busy', message: result.message } : { status: 'unavailable' };
-const publicPrompt = (prompt: TAuthLoginPrompt): TAuthLoginPrompt => prompt.flow === 'device'
-  ? { flow: 'device', verificationUrl: prompt.verificationUrl, userCode: prompt.userCode }
-  : { flow: 'browser', authUrl: prompt.authUrl };
+const publicPrompt = (prompt: TAuthLoginPrompt): TAuthLoginPrompt =>
+  ({ flow: 'device', verificationUrl: prompt.verificationUrl, userCode: prompt.userCode });
 
 export const assertAuthSwitchServiceRequest: (value: unknown) => asserts value is TAuthSwitchServiceRequest = value => {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Invalid authswitch request.');
@@ -63,7 +62,7 @@ export const assertAuthSwitchServiceRequest: (value: unknown) => asserts value i
   } else if ((request.harnessId !== undefined || request.action === 'login')
     && (typeof request.harnessId !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(request.harnessId))) throw new Error('Invalid harness ID.');
   if (request.action === 'login' && (typeof request.providerId !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(request.providerId)
-    || !['device', 'browser'].includes(String(request.flow)))) throw new Error('Invalid login provider or flow.');
+    || request.flow !== 'device')) throw new Error('Invalid login provider or flow.');
 };
 
 /** Hosted account manager. Operations outlive HTTP connections and are retained briefly for polling. */

package/ts/index.ts

@@ -1,6 +1,8 @@
 export * from './interfaces.js';
 export * from './interfaces.harness.js';
 export * from './interfaces.list.js';
+export * from './interfaces.openai.js';
+export * from './classes.openaiprovider.js';
 export * from './classes.codexharness.js';
 export * from './classes.opencodeharness.js';
 export * from './classes.claudecodeharness.js';

package/ts/interfaces.openai.ts

@@ -0,0 +1,142 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+
+/**
+ * The ChatGPT account types authswitch owns: the sign-in it runs, the credential it holds and refreshes, and the
+ * credential-free readings it takes. Inference with an access token is FlexHarness's `/openai`, not this.
+ */
+
+/** Whether a failed request reached the provider: `notSent` never did, `outcomeUnknown` may have. */
+export type TOpenAiRequestOutcome = 'notSent' | 'outcomeUnknown';
+
+/**
+ * A ChatGPT sign-in with its rotating refresh token. This exact shape is what the authority seals, so a stored
+ * credential keeps reading back across releases.
+ */
+export interface IOpenAiOAuthCredential {
+  kind: 'chatgptOAuth';
+  providerId: 'openai';
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  /** When this credential was last refreshed; strictly increasing across refreshes. */
+  lastRefreshAt?: string;
+}
+
+/** Access to one ChatGPT workspace, with the workspace and residency its issuer states. */
+export interface IOpenAiAccess {
+  accessToken: string;
+  accountId: string;
+  isFedrampAccount: boolean;
+}
+
+/** What a sign-in's claims say about its account; no token. */
+export interface IOpenAiAccountSummary {
+  providerId: 'openai';
+  authKind: 'chatgptOAuth';
+  accountId?: string;
+  email?: string;
+  plan?: string;
+}
+
+export interface IOpenAiProviderDescriptor {
+  providerId: 'openai';
+  displayName: string;
+  loginFlows: readonly ['device'];
+}
+
+/** What the person signing in does: open the URL and enter the code. */
+export interface IOpenAiDevicePrompt {
+  flow: 'device';
+  verificationUrl: string;
+  userCode: string;
+}
+
+export interface IOpenAiLoginResult {
+  credential: IOpenAiOAuthCredential;
+  account: IOpenAiAccountSummary;
+}
+
+export type TOpenAiLoginCancelStatus = 'canceled' | 'notFound';
+
+/** One device sign-in in flight. `completion` settles once the person approved it, or it failed or was cancelled. */
+export interface IOpenAiLoginHandle {
+  readonly prompt: IOpenAiDevicePrompt;
+  readonly completion: Promise<IOpenAiLoginResult>;
+  cancel(): Promise<TOpenAiLoginCancelStatus>;
+  close(): Promise<void>;
+}
+
+export interface IOpenAiOperationOptions {
+  signal?: AbortSignal;
+  timeoutMs?: number;
+}
+
+export interface IOpenAiLoginOptions extends IOpenAiOperationOptions {
+  flow: 'device';
+}
+
+export type TOpenAiOperationErrorCode = 'ABORTED' | 'TIMEOUT';
+
+export interface IOpenAiRefreshSuccess {
+  success: true;
+  credential: IOpenAiOAuthCredential;
+  account: IOpenAiAccountSummary;
+}
+
+export interface IOpenAiRefreshFailure {
+  success: false;
+  credential: IOpenAiOAuthCredential;
+  errorCode: TOpenAiOperationErrorCode | 'REFRESH_FAILED';
+  /** Never replay a rotating grant when this is `outcomeUnknown`. */
+  requestOutcome: TOpenAiRequestOutcome;
+  /** The response status, when an HTTP response was observed. */
+  responseStatus?: number;
+  /** Bounded Retry-After delay from the observed response. */
+  retryAfterMs?: number;
+}
+
+export type TOpenAiRefreshResult = IOpenAiRefreshSuccess | IOpenAiRefreshFailure;
+
+export interface IOpenAiRateLimitWindow {
+  usedPercent: number;
+  limitWindowSeconds: number;
+  resetAfterSeconds: number;
+  /** Unix timestamp in seconds. */
+  resetsAt: number;
+}
+
+export interface IOpenAiRateLimitDetails {
+  allowed: boolean;
+  limitReached: boolean;
+  primaryWindow?: IOpenAiRateLimitWindow;
+  secondaryWindow?: IOpenAiRateLimitWindow;
+}
+
+export interface IOpenAiAdditionalRateLimit {
+  limitName: string;
+  meteredFeature: string;
+  rateLimit?: IOpenAiRateLimitDetails;
+}
+
+/** An account's usage limits as `wham/usage` reports them, credential-free; the authority stores this shape. */
+export interface IOpenAiAccountRateLimits {
+  providerId: 'openai';
+  plan: string;
+  observedAt: string;
+  rateLimit?: IOpenAiRateLimitDetails;
+  additionalRateLimits: IOpenAiAdditionalRateLimit[];
+  rateLimitReachedType?: string;
+  rateLimitResetCreditsAvailableCount?: number;
+}
+
+export interface IOpenAiAccountRateLimitsSuccess {
+  success: true;
+  rateLimits: IOpenAiAccountRateLimits;
+}
+
+export interface IOpenAiAccountRateLimitsFailure {
+  success: false;
+  errorCode: TOpenAiOperationErrorCode | 'CREDENTIAL_REFRESH_REQUIRED' | 'ACCOUNT_RATE_LIMITS_FAILED';
+}
+
+export type TOpenAiAccountRateLimitsResult = IOpenAiAccountRateLimitsSuccess | IOpenAiAccountRateLimitsFailure;