@modelprofile.com/flexharness-providers 7.0.1 → 8.1.0

package/ts_openai_account/smartai.providers.openai.ts

@@ -3,6 +3,7 @@ import * as plugins from './plugins.js';
 import {
   OPENAI_CHATGPT_CODEX_BASE_URL,
   OPENAI_CHATGPT_DEFAULT_ORIGINATOR,
+  OpenAiChatGptAuthError,
   completeOpenAiChatGptDeviceCodeLogin,
   createOpenAiChatGptBrowserAuthorization,
   exchangeOpenAiChatGptBrowserAuthorizationCode,
@@ -29,6 +30,7 @@ import type {
   ISmartAiProviderOperationOptions,
   ISmartAiProviderRateLimitDetails,
   ISmartAiProviderRateLimitWindow,
+  TOpenAiChatGptReadCredential,
   TSmartAiProviderCancelStatus,
   TSmartAiProviderAccountRateLimitsResult,
   TSmartAiProviderCredential,
@@ -183,6 +185,46 @@ const toTokenData = (credentialArg: IOpenAiChatGptOAuthCredential): IOpenAiChatG
   };
 };
 
+interface IOpenAiChatGptReadAccess {
+  accessToken: string;
+  accountId?: string;
+  isFedrampAccount: boolean;
+}
+
+const toReadAccess = (
+  credentialArg: TOpenAiChatGptReadCredential,
+): IOpenAiChatGptReadAccess => {
+  if (!isRecord(credentialArg)) throw createSmartAiProviderError('CREDENTIAL_INVALID');
+  if (credentialArg.kind === 'chatgptOAuth') {
+    const tokenData = toTokenData(credentialArg);
+    return {
+      accessToken: tokenData.accessToken,
+      accountId: tokenData.tokenInfo.chatgptAccountId,
+      isFedrampAccount: tokenData.tokenInfo.chatgptAccountIsFedramp,
+    };
+  }
+  const access = credentialArg;
+  if (
+    access.kind !== 'chatgptAccess'
+    || access.providerId !== 'openai'
+    || typeof access.accessToken !== 'string'
+    || access.accessToken.length === 0
+    || plugins.Buffer.byteLength(access.accessToken, 'utf8') > maximumHeaderBytes
+    || typeof access.accountId !== 'string'
+    || access.accountId.length === 0
+    || plugins.Buffer.byteLength(access.accountId, 'utf8') > maximumHeaderBytes
+    || typeof access.isFedrampAccount !== 'boolean'
+    || Object.keys(access).length !== 5
+  ) {
+    throw createSmartAiProviderError('CREDENTIAL_INVALID');
+  }
+  return {
+    accessToken: access.accessToken,
+    accountId: access.accountId,
+    isFedrampAccount: access.isFedrampAccount,
+  };
+};
+
 const toCredential = (
   tokenDataArg: IOpenAiChatGptTokenData,
   lastRefreshAtArg?: string,
@@ -849,6 +891,7 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
         success: false,
         credential: credentialArg,
         errorCode: waitOperation.timedOut ? 'TIMEOUT' : 'ABORTED',
+        requestOutcome: 'notSent',
       };
       waitOperation.cleanup();
       return failure;
@@ -888,6 +931,7 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
           success: false,
           credential: credentialArg,
           errorCode: waitOperation.timedOut ? 'TIMEOUT' : 'ABORTED',
+          requestOutcome: 'outcomeUnknown',
         });
         waitOperation.signal.addEventListener('abort', onAbort, { once: true });
       });
@@ -914,7 +958,12 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
       const tokenChanged = refreshed.accessToken !== input.accessToken
         || refreshed.refreshToken !== input.refreshToken;
       if (!tokenChanged || !refreshed.idToken) {
-        return { success: false, credential: credentialArg, errorCode: 'REFRESH_FAILED' };
+        return {
+          success: false,
+          credential: credentialArg,
+          errorCode: 'REFRESH_FAILED',
+          requestOutcome: 'outcomeUnknown',
+        };
       }
       const previous = credentialArg.lastRefreshAt === undefined
         ? 0
@@ -929,6 +978,15 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
         success: false,
         credential: credentialArg,
         errorCode: classifyOperationError(errorArg, operation, 'REFRESH_FAILED'),
+        requestOutcome: errorArg instanceof OpenAiChatGptAuthError
+          ? errorArg.requestOutcome ?? 'outcomeUnknown'
+          : 'outcomeUnknown',
+        ...(errorArg instanceof OpenAiChatGptAuthError && errorArg.status !== undefined
+          ? { responseStatus: errorArg.status }
+          : {}),
+        ...(errorArg instanceof OpenAiChatGptAuthError && errorArg.retryAfterMs !== undefined
+          ? { retryAfterMs: errorArg.retryAfterMs }
+          : {}),
       };
     } finally {
       this.operations.delete(operation.controller);
@@ -937,11 +995,10 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
   }
 
   private async fetchCatalog(
-    credentialArg: IOpenAiChatGptOAuthCredential,
+    accessArg: IOpenAiChatGptReadAccess,
     signalArg: AbortSignal,
   ): Promise<ISmartAiProviderModel[]> {
-    const tokenData = toTokenData(credentialArg);
-    const accountId = tokenData.tokenInfo.chatgptAccountId;
+    const accountId = accessArg.accountId;
     const url = `${OPENAI_CHATGPT_CODEX_BASE_URL}/models?client_version=${encodeURIComponent(defaultClientVersion)}`;
     let response: Response;
     let onAbort!: () => void;
@@ -952,9 +1009,9 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
         signal: signalArg,
         headers: {
           Accept: 'application/json',
-          Authorization: `Bearer ${credentialArg.accessToken}`,
+          Authorization: `Bearer ${accessArg.accessToken}`,
           ...(accountId ? { 'ChatGPT-Account-ID': accountId } : {}),
-          ...(tokenData.tokenInfo.chatgptAccountIsFedramp ? { 'X-OpenAI-Fedramp': 'true' } : {}),
+          ...(accessArg.isFedrampAccount ? { 'X-OpenAI-Fedramp': 'true' } : {}),
           originator: this.originator,
           version: defaultClientVersion,
         },
@@ -1023,18 +1080,18 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
   }
 
   public async listModels(
-    credentialArg: IOpenAiChatGptOAuthCredential,
+    credentialArg: TOpenAiChatGptReadCredential,
     optionsArg: ISmartAiProviderModelListOptions = {},
   ): Promise<TSmartAiProviderModelListResult> {
     this.requireOpen();
-    toTokenData(credentialArg);
+    const access = toReadAccess(credentialArg);
     const options = normalizeModelListOptions(optionsArg);
     const operation = createOperation(options, defaultOperationTimeoutMs);
     this.operations.add(operation.controller);
     try {
       let catalog: ISmartAiProviderModel[];
       try {
-        catalog = await this.fetchCatalog(credentialArg, operation.signal);
+        catalog = await this.fetchCatalog(access, operation.signal);
       } catch (errorArg) {
         if (!(errorArg instanceof ModelHttpError) || errorArg.status !== 401) throw errorArg;
         return { success: false, errorCode: 'CREDENTIAL_REFRESH_REQUIRED' };
@@ -1084,11 +1141,10 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
   }
 
   private async fetchAccountRateLimits(
-    credentialArg: IOpenAiChatGptOAuthCredential,
+    accessArg: IOpenAiChatGptReadAccess,
     signalArg: AbortSignal,
   ): Promise<ISmartAiProviderAccountRateLimits> {
-    const tokenData = toTokenData(credentialArg);
-    const accountId = tokenData.tokenInfo.chatgptAccountId;
+    const accountId = accessArg.accountId;
     let response: Response;
     let onAbort!: () => void;
     try {
@@ -1098,9 +1154,9 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
         signal: signalArg,
         headers: {
           Accept: 'application/json',
-          Authorization: `Bearer ${credentialArg.accessToken}`,
+          Authorization: `Bearer ${accessArg.accessToken}`,
           ...(accountId ? { 'ChatGPT-Account-Id': accountId } : {}),
-          ...(tokenData.tokenInfo.chatgptAccountIsFedramp ? { 'X-OpenAI-Fedramp': 'true' } : {}),
+          ...(accessArg.isFedrampAccount ? { 'X-OpenAI-Fedramp': 'true' } : {}),
           'User-Agent': this.originator,
         },
       });
@@ -1130,16 +1186,16 @@ export class OpenAiProviderAdapter implements ISmartAiProviderAdapter {
   }
 
   public async getAccountRateLimits(
-    credentialArg: IOpenAiChatGptOAuthCredential,
+    credentialArg: TOpenAiChatGptReadCredential,
     optionsArg: ISmartAiProviderOperationOptions = {},
   ): Promise<TSmartAiProviderAccountRateLimitsResult> {
     this.requireOpen();
-    toTokenData(credentialArg);
+    const access = toReadAccess(credentialArg);
     const operation = createOperation(optionsArg, defaultOperationTimeoutMs);
     this.operations.add(operation.controller);
     try {
       try {
-        const rateLimits = await this.fetchAccountRateLimits(credentialArg, operation.signal);
+        const rateLimits = await this.fetchAccountRateLimits(access, operation.signal);
         return { success: true, rateLimits };
       } catch (errorArg) {
         if (!(errorArg instanceof AccountRateLimitsHttpError) || errorArg.status !== 401) {

package/ts_openai_auth/index.ts

@@ -1,12 +1,4 @@
-import type { IOpenAiModelConnection } from '@modelprofile.com/flexharness-providers/openai';
-import type { IOpenAiChatGptAuthCredentials } from './interfaces.js';
-import { createOpenAiChatGptProviderSettings } from './smartai.auth.openai.js';
-import { createOpenAiChatGptInstructionsMiddleware } from './smartai.middleware.openai.js';
 export * from './interfaces.js';
 export * from './smartai.auth.openai.js';
+export * from './smartai.connection.openai.js';
 export * from './smartai.middleware.openai.js';
-
-export const createOpenAiChatGptModelConnection = (credentials: IOpenAiChatGptAuthCredentials): IOpenAiModelConnection => ({
-  settings: createOpenAiChatGptProviderSettings(credentials),
-  middleware: createOpenAiChatGptInstructionsMiddleware(),
-});

package/ts_openai_auth/interfaces.ts

@@ -13,10 +13,42 @@ export interface IOpenAiChatGptAuthCredentials {
   refreshToken?: string;
   idToken?: string;
   accountId?: string;
+  /** Verified from the current access token when tokenInfo is not supplied. */
+  isFedrampAccount?: boolean;
   tokenInfo?: IOpenAiChatGptTokenInfo;
   originator?: string;
 }
 
+export interface IOpenAiChatGptAccessIdentity {
+  /** Exact workspace claim expected on every resolved access token. */
+  readonly accountId: string | undefined;
+  /** Exact residency claim expected on every resolved access token. */
+  readonly isFedrampAccount: boolean;
+}
+
+export interface IOpenAiChatGptAccessRequest {
+  /** The provider request signal. A resolver should pass it through to its authority. */
+  readonly signal: AbortSignal;
+}
+
+/** Access-only result. Refresh and ID tokens are not part of the request-time contract. */
+export interface IOpenAiChatGptResolvedAccess {
+  readonly accessToken: string;
+}
+
+export interface IOpenAiChatGptDynamicModelConnectionOptions {
+  /** Pins the account and residency boundary for the lifetime of the connection. */
+  readonly expectedIdentity: IOpenAiChatGptAccessIdentity;
+  /** Stable provider originator header. Defaults to `smartai`. */
+  readonly originator?: string;
+  /** Resolves current access immediately before every provider network request. */
+  readonly resolveAccess: (
+    request: IOpenAiChatGptAccessRequest,
+  ) => Promise<IOpenAiChatGptResolvedAccess>;
+  /** Optional underlying transport. Defaults to the current global fetch. */
+  readonly fetch?: typeof fetch;
+}
+
 export interface IOpenAiChatGptTokenData extends IOpenAiChatGptAuthCredentials {
   refreshToken: string;
   tokenInfo: IOpenAiChatGptTokenInfo;
@@ -37,6 +69,9 @@ export interface IOpenAiChatGptAuthOptions {
   safeErrors?: boolean;
 }
 
+/** A failed refresh is replayable only when no request was handed to fetch. */
+export type TOpenAiChatGptRequestOutcome = 'notSent' | 'outcomeUnknown';
+
 export interface IOpenAiChatGptBrowserAuthorizationOptions extends IOpenAiChatGptAuthOptions {
   redirectUri: string;
   originator?: string;
@@ -86,4 +121,3 @@ export interface IOpenAiChatGptDeviceCodePollOptions extends IOpenAiChatGptAuthO
 export interface IOpenAiChatGptCompleteDeviceCodeOptions extends IOpenAiChatGptDeviceCodePollOptions {
   forcedChatGptWorkspaceId?: string;
 }
-

package/ts_openai_auth/readme.md

@@ -11,6 +11,26 @@ pnpm add @modelprofile.com/flexharness-providers
 See the [toolbox usage and migration guide](https://code.foss.global/modelprofile.com/flexharness#readme)
 for composition examples and the SmartAI/SmartAgent migration map.
 
+The refresh helper preserves safe request-outcome metadata on
+`OpenAiChatGptAuthError`: `requestOutcome` is `notSent` only before the HTTP
+request is handed to `fetch`, and `outcomeUnknown` afterward. An observed
+response can also supply `status` and a bounded `retryAfterMs`. A 429 response
+does not prove that a rotating grant remained usable. The default safe-error
+mode omits provider response bodies.
+
+`createOpenAiChatGptModelConnection()` derives account and FedRAMP headers from
+the current access token. The token must contain an unexpired `exp` claim;
+supplied `accountId`, `isFedrampAccount`, and `tokenInfo` must agree with its
+claims. A saved ID-token snapshot cannot override current access-token facts.
+
+Use `createOpenAiChatGptDynamicModelConnection()` for delegated access owned by
+an external authority. Pin its exact account and FedRAMP identity, then provide
+an async `resolveAccess({ signal })` callback. The connection resolves and
+validates current access immediately before every provider HTTP request, so
+multi-step tool runs do not retain the token that admitted the run. Resolution,
+identity, expiry, endpoint, redirect, and abort failures stop before the
+underlying transport is called.
+
 ## Issue Reporting and Security
 
 Report issues and security concerns through [community.foss.global](https://community.foss.global).

package/ts_openai_auth/smartai.auth.openai.ts

@@ -13,6 +13,7 @@ import type {
   IOpenAiChatGptTokenData,
   IOpenAiChatGptTokenInfo,
   TOpenAiChatGptBrowserCallback,
+  TOpenAiChatGptRequestOutcome,
 } from './interfaces.js';
 
 export const OPENAI_CHATGPT_AUTH_ISSUER = 'https://auth.openai.com';
@@ -43,12 +44,21 @@ const utf8ByteLength = (valueArg: string): number => textEncoder.encode(valueArg
 export class OpenAiChatGptAuthError extends Error {
   public status?: number;
   public body?: string;
-
-  constructor(message: string, options: { status?: number; body?: string } = {}) {
+  public requestOutcome?: TOpenAiChatGptRequestOutcome;
+  public retryAfterMs?: number;
+
+  constructor(message: string, options: {
+    status?: number;
+    body?: string;
+    requestOutcome?: TOpenAiChatGptRequestOutcome;
+    retryAfterMs?: number;
+  } = {}) {
     super(message);
     this.name = 'OpenAiChatGptAuthError';
     this.status = options.status;
     this.body = options.body;
+    this.requestOutcome = options.requestOutcome;
+    this.retryAfterMs = options.retryAfterMs;
   }
 }
 
@@ -215,6 +225,17 @@ async function readJson(
   }
 }
 
+const parseRetryAfterMs = (headerArg: string | null): number | undefined => {
+  if (!headerArg || headerArg.length > 128) return undefined;
+  const maximumDelayMs = 24 * 60 * 60 * 1000;
+  if (/^\d{1,10}$/.test(headerArg)) {
+    return Math.min(Number(headerArg) * 1000, maximumDelayMs);
+  }
+  const retryAt = Date.parse(headerArg);
+  if (!Number.isFinite(retryAt)) return undefined;
+  return Math.min(Math.max(0, retryAt - Date.now()), maximumDelayMs);
+};
+
 async function runFetch<TResult>(
   url: string,
   init: RequestInit,
@@ -225,9 +246,14 @@ async function runFetch<TResult>(
   ) => Promise<TResult>,
   timeoutMsArg = AUTH_REQUEST_TIMEOUT_MS,
 ): Promise<TResult> {
-  throwIfAborted(options);
+  if (options.signal?.aborted) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT authentication was aborted.', {
+      requestOutcome: 'notSent',
+    });
+  }
   const controller = new AbortController();
   let response: Response | undefined;
+  let requestStarted = false;
   const onExternalAbort = (): void => controller.abort();
   const onRequestAbort = (): void => {
     void response?.body?.cancel().catch(() => undefined);
@@ -245,7 +271,9 @@ async function runFetch<TResult>(
   try {
     return await Promise.race([
       (async () => {
-        response = await getFetch(options)(url, {
+        const fetchImplementation = getFetch(options);
+        requestStarted = true;
+        response = await fetchImplementation(url, {
           ...init,
           redirect: 'error',
           signal: controller.signal,
@@ -259,13 +287,29 @@ async function runFetch<TResult>(
       aborted,
     ]);
   } catch (error) {
-    if (error instanceof OpenAiChatGptAuthError) throw error;
+    const requestOutcome: TOpenAiChatGptRequestOutcome = requestStarted
+      ? 'outcomeUnknown'
+      : 'notSent';
+    const retryAfterMs = response ? parseRetryAfterMs(response.headers.get('retry-after')) : undefined;
+    if (error instanceof OpenAiChatGptAuthError) {
+      throw new OpenAiChatGptAuthError(error.message, {
+        ...(error.status !== undefined ? { status: error.status }
+          : response ? { status: response.status } : {}),
+        ...(error.body !== undefined ? { body: error.body } : {}),
+        requestOutcome,
+        ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+      });
+    }
     if (!usesSafeErrors(options)) throw error;
-    throw authError(
+    throw new OpenAiChatGptAuthError(
       options.signal?.aborted
         ? 'OpenAI ChatGPT authentication was aborted.'
         : 'OpenAI ChatGPT authentication request failed.',
-      options,
+      {
+        requestOutcome,
+        ...(response ? { status: response.status } : {}),
+        ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+      },
     );
   } finally {
     clearTimeout(timer);
@@ -370,7 +414,9 @@ export function parseOpenAiChatGptTokenInfo(token: string): IOpenAiChatGptTokenI
     chatgptUserId: asOptionalString(auth?.chatgpt_user_id) ?? asOptionalString(auth?.user_id),
     chatgptAccountId: asOptionalString(auth?.chatgpt_account_id),
     chatgptAccountIsFedramp: auth?.chatgpt_account_is_fedramp === true,
-    expiresAt: expiresAtSeconds ? new Date(expiresAtSeconds * 1000).toISOString() : undefined,
+    expiresAt: expiresAtSeconds !== undefined
+      ? new Date(expiresAtSeconds * 1000).toISOString()
+      : undefined,
     rawJwt: token,
   };
 }
@@ -760,16 +806,40 @@ export function createOpenAiChatGptProviderSettings(credentials: IOpenAiChatGptA
   baseURL: string;
   headers: Record<string, string>;
 } {
-  const tokenAccountId = credentials.tokenInfo?.chatgptAccountId;
+  const currentTokenInfo = parseOpenAiChatGptTokenInfo(credentials.accessToken);
+  if (
+    currentTokenInfo.expiresAt === undefined
+    || Date.parse(currentTokenInfo.expiresAt) <= Date.now()
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT access token has no valid future expiry.');
+  }
+  const tokenAccountId = currentTokenInfo.chatgptAccountId;
   if (
     credentials.accountId !== undefined
-    && tokenAccountId !== undefined
     && credentials.accountId !== tokenAccountId
   ) {
     throw new OpenAiChatGptAuthError('OpenAI ChatGPT account ID does not match the token claim.');
   }
-  const accountId = tokenAccountId ?? credentials.accountId;
-  const isFedrampAccount = credentials.tokenInfo?.chatgptAccountIsFedramp === true;
+  if (
+    credentials.tokenInfo !== undefined
+    && (
+      credentials.tokenInfo.chatgptAccountId !== tokenAccountId
+      || credentials.tokenInfo.chatgptAccountIsFedramp !== currentTokenInfo.chatgptAccountIsFedramp
+    )
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT token information does not match the current access token.');
+  }
+  if (
+    credentials.isFedrampAccount !== undefined
+    && (
+      typeof credentials.isFedrampAccount !== 'boolean'
+      || credentials.isFedrampAccount !== currentTokenInfo.chatgptAccountIsFedramp
+    )
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT FedRAMP status does not match the token claim.');
+  }
+  const accountId = tokenAccountId;
+  const isFedrampAccount = currentTokenInfo.chatgptAccountIsFedramp;
   const headers: Record<string, string> = {
     originator: credentials.originator ?? OPENAI_CHATGPT_DEFAULT_ORIGINATOR,
   };

package/ts_openai_auth/smartai.connection.openai.ts

@@ -0,0 +1,143 @@
+import type { IOpenAiModelConnection } from '@modelprofile.com/flexharness-providers/openai';
+import type {
+  IOpenAiChatGptAuthCredentials,
+  IOpenAiChatGptDynamicModelConnectionOptions,
+} from './interfaces.js';
+import {
+  createOpenAiChatGptProviderSettings,
+  OPENAI_CHATGPT_CODEX_BASE_URL,
+  OpenAiChatGptAuthError,
+} from './smartai.auth.openai.js';
+import { createOpenAiChatGptInstructionsMiddleware } from './smartai.middleware.openai.js';
+
+const codexBaseUrl = new URL(OPENAI_CHATGPT_CODEX_BASE_URL);
+
+function assertCodexRequestUrl(normalizedUrlArg: string): void {
+  const url = new URL(normalizedUrlArg);
+  const isCodexPath = url.pathname === codexBaseUrl.pathname
+    || url.pathname.startsWith(`${codexBaseUrl.pathname}/`);
+  if (
+    url.origin !== codexBaseUrl.origin
+    || url.username !== ''
+    || url.password !== ''
+    || !isCodexPath
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT inference URL is outside the Codex endpoint.');
+  }
+}
+
+function requireExpectedIdentity(optionsArg: IOpenAiChatGptDynamicModelConnectionOptions): {
+  accountId: string | undefined;
+  isFedrampAccount: boolean;
+} {
+  const expectedIdentity = optionsArg.expectedIdentity;
+  if (
+    !expectedIdentity
+    || (
+      expectedIdentity.accountId !== undefined
+      && (typeof expectedIdentity.accountId !== 'string' || expectedIdentity.accountId.length === 0)
+    )
+    || typeof expectedIdentity.isFedrampAccount !== 'boolean'
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT expected access identity is invalid.');
+  }
+  return Object.freeze({
+    accountId: expectedIdentity.accountId,
+    isFedrampAccount: expectedIdentity.isFedrampAccount,
+  });
+}
+
+function assertExpectedIdentity(
+  settingsArg: ReturnType<typeof createOpenAiChatGptProviderSettings>,
+  expectedIdentityArg: Readonly<{
+    accountId: string | undefined;
+    isFedrampAccount: boolean;
+  }>,
+): void {
+  const accountId = settingsArg.headers['ChatGPT-Account-ID'];
+  const isFedrampAccount = settingsArg.headers['X-OpenAI-Fedramp'] === 'true';
+  if (
+    accountId !== expectedIdentityArg.accountId
+    || isFedrampAccount !== expectedIdentityArg.isFedrampAccount
+  ) {
+    throw new OpenAiChatGptAuthError(
+      'OpenAI ChatGPT resolved access identity does not match the connection.',
+    );
+  }
+}
+
+function applyAccessHeaders(
+  headersArg: Headers,
+  settingsArg: ReturnType<typeof createOpenAiChatGptProviderSettings>,
+): void {
+  headersArg.set('Authorization', `Bearer ${settingsArg.apiKey}`);
+  headersArg.set('originator', settingsArg.headers.originator);
+
+  for (const name of ['ChatGPT-Account-ID', 'X-OpenAI-Fedramp']) {
+    const value = settingsArg.headers[name];
+    if (value === undefined) {
+      headersArg.delete(name);
+    } else {
+      headersArg.set(name, value);
+    }
+  }
+}
+
+export const createOpenAiChatGptModelConnection = (
+  credentialsArg: IOpenAiChatGptAuthCredentials,
+): IOpenAiModelConnection => ({
+  settings: createOpenAiChatGptProviderSettings(credentialsArg),
+  middleware: createOpenAiChatGptInstructionsMiddleware(),
+});
+
+export const createOpenAiChatGptDynamicModelConnection = (
+  optionsArg: IOpenAiChatGptDynamicModelConnectionOptions,
+): IOpenAiModelConnection => {
+  if (!optionsArg || typeof optionsArg.resolveAccess !== 'function') {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT access resolver is required.');
+  }
+  const expectedIdentity = requireExpectedIdentity(optionsArg);
+  const resolveAccess = optionsArg.resolveAccess;
+  const originator = optionsArg.originator;
+  const transport = optionsArg.fetch ?? globalThis.fetch;
+  if (typeof transport !== 'function') {
+    throw new OpenAiChatGptAuthError('fetch is not available for OpenAI ChatGPT inference.');
+  }
+
+  const fetchWithCurrentAccess: typeof fetch = async (inputArg, initArg) => {
+    const request = new Request(inputArg, {
+      ...initArg,
+      redirect: 'error',
+    });
+    assertCodexRequestUrl(request.url);
+    request.signal.throwIfAborted();
+
+    const access = await resolveAccess({ signal: request.signal });
+    request.signal.throwIfAborted();
+    const settings = createOpenAiChatGptProviderSettings({
+      accessToken: access.accessToken,
+      originator,
+    });
+    if (settings.baseURL !== OPENAI_CHATGPT_CODEX_BASE_URL) {
+      throw new OpenAiChatGptAuthError('OpenAI ChatGPT inference endpoint is invalid.');
+    }
+    assertExpectedIdentity(settings, expectedIdentity);
+
+    const headers = new Headers(request.headers);
+    applyAccessHeaders(headers, settings);
+    const authenticatedRequest = new Request(request, {
+      headers,
+    });
+    authenticatedRequest.signal.throwIfAborted();
+    return transport(authenticatedRequest);
+  };
+
+  return {
+    settings: {
+      apiKey: '',
+      baseURL: OPENAI_CHATGPT_CODEX_BASE_URL,
+      fetch: fetchWithCurrentAccess,
+    },
+    middleware: createOpenAiChatGptInstructionsMiddleware(),
+  };
+};

package/ts_providers/openai/readme.md

@@ -11,6 +11,11 @@ pnpm add @modelprofile.com/flexharness-providers
 See the [toolbox usage and migration guide](https://code.foss.global/modelprofile.com/flexharness#readme)
 for composition examples and the SmartAI/SmartAgent migration map.
 
+ChatGPT connections come from the `/auth` subpath. Use the dynamic connection
+factory for delegated authority access so every provider HTTP request resolves
+a current token while the connection retains its pinned account and residency
+identity.
+
 ## Issue Reporting and Security
 
 Report issues and security concerns through [community.foss.global](https://community.foss.global).

package/ts_providers/readme.md

@@ -36,7 +36,11 @@ Provider SDKs are installed together. Authentication, file access and vendor med
 are separate entrypoints and are not imported by the provider factory root. For
 ChatGPT authentication, pass
 `connection: createOpenAiChatGptModelConnection(credentials)` from `/auth` to the
-OpenAI model options. API-key inference needs no authentication setup.
+OpenAI model options. Delegated runtimes use
+`createOpenAiChatGptDynamicModelConnection({ expectedIdentity, resolveAccess })`
+instead; it resolves current access at every provider HTTP request while keeping
+account and residency identity fixed for the connection. API-key inference
+needs no authentication setup.
 
 The package includes the applicable OpenAI Codex license and third-party notices.