@modelprofile.com/flexharness-providers 8.0.0 → 8.1.0

package/dist_ts_openai_auth/index.d.ts

@@ -1,6 +1,4 @@
-import type { IOpenAiModelConnection } from '@modelprofile.com/flexharness-providers/openai';
-import type { IOpenAiChatGptAuthCredentials } from './interfaces.js';
 export * from './interfaces.js';
 export * from './smartai.auth.openai.js';
+export * from './smartai.connection.openai.js';
 export * from './smartai.middleware.openai.js';
-export declare const createOpenAiChatGptModelConnection: (credentials: IOpenAiChatGptAuthCredentials) => IOpenAiModelConnection;

package/dist_ts_openai_auth/index.js

@@ -1,10 +1,5 @@
-import { createOpenAiChatGptProviderSettings } from './smartai.auth.openai.js';
-import { createOpenAiChatGptInstructionsMiddleware } from './smartai.middleware.openai.js';
 export * from './interfaces.js';
 export * from './smartai.auth.openai.js';
+export * from './smartai.connection.openai.js';
 export * from './smartai.middleware.openai.js';
-export const createOpenAiChatGptModelConnection = (credentials) => ({
-    settings: createOpenAiChatGptProviderSettings(credentials),
-    middleware: createOpenAiChatGptInstructionsMiddleware(),
-});
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19vcGVuYWlfYXV0aC9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsbUNBQW1DLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUMvRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUMzRixjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUUvQyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLFdBQTBDLEVBQTBCLEVBQUUsQ0FBQyxDQUFDO0lBQ3pILFFBQVEsRUFBRSxtQ0FBbUMsQ0FBQyxXQUFXLENBQUM7SUFDMUQsVUFBVSxFQUFFLHlDQUF5QyxFQUFFO0NBQ3hELENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19vcGVuYWlfYXV0aC9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLGdDQUFnQyxDQUFDIn0=

package/dist_ts_openai_auth/interfaces.d.ts

@@ -17,6 +17,30 @@ export interface IOpenAiChatGptAuthCredentials {
     tokenInfo?: IOpenAiChatGptTokenInfo;
     originator?: string;
 }
+export interface IOpenAiChatGptAccessIdentity {
+    /** Exact workspace claim expected on every resolved access token. */
+    readonly accountId: string | undefined;
+    /** Exact residency claim expected on every resolved access token. */
+    readonly isFedrampAccount: boolean;
+}
+export interface IOpenAiChatGptAccessRequest {
+    /** The provider request signal. A resolver should pass it through to its authority. */
+    readonly signal: AbortSignal;
+}
+/** Access-only result. Refresh and ID tokens are not part of the request-time contract. */
+export interface IOpenAiChatGptResolvedAccess {
+    readonly accessToken: string;
+}
+export interface IOpenAiChatGptDynamicModelConnectionOptions {
+    /** Pins the account and residency boundary for the lifetime of the connection. */
+    readonly expectedIdentity: IOpenAiChatGptAccessIdentity;
+    /** Stable provider originator header. Defaults to `smartai`. */
+    readonly originator?: string;
+    /** Resolves current access immediately before every provider network request. */
+    readonly resolveAccess: (request: IOpenAiChatGptAccessRequest) => Promise<IOpenAiChatGptResolvedAccess>;
+    /** Optional underlying transport. Defaults to the current global fetch. */
+    readonly fetch?: typeof fetch;
+}
 export interface IOpenAiChatGptTokenData extends IOpenAiChatGptAuthCredentials {
     refreshToken: string;
     tokenInfo: IOpenAiChatGptTokenInfo;

package/dist_ts_openai_auth/smartai.connection.openai.d.ts

@@ -0,0 +1,4 @@
+import type { IOpenAiModelConnection } from '@modelprofile.com/flexharness-providers/openai';
+import type { IOpenAiChatGptAuthCredentials, IOpenAiChatGptDynamicModelConnectionOptions } from './interfaces.js';
+export declare const createOpenAiChatGptModelConnection: (credentialsArg: IOpenAiChatGptAuthCredentials) => IOpenAiModelConnection;
+export declare const createOpenAiChatGptDynamicModelConnection: (optionsArg: IOpenAiChatGptDynamicModelConnectionOptions) => IOpenAiModelConnection;

package/dist_ts_openai_auth/smartai.connection.openai.js

@@ -0,0 +1,98 @@
+import { createOpenAiChatGptProviderSettings, OPENAI_CHATGPT_CODEX_BASE_URL, OpenAiChatGptAuthError, } from './smartai.auth.openai.js';
+import { createOpenAiChatGptInstructionsMiddleware } from './smartai.middleware.openai.js';
+const codexBaseUrl = new URL(OPENAI_CHATGPT_CODEX_BASE_URL);
+function assertCodexRequestUrl(normalizedUrlArg) {
+    const url = new URL(normalizedUrlArg);
+    const isCodexPath = url.pathname === codexBaseUrl.pathname
+        || url.pathname.startsWith(`${codexBaseUrl.pathname}/`);
+    if (url.origin !== codexBaseUrl.origin
+        || url.username !== ''
+        || url.password !== ''
+        || !isCodexPath) {
+        throw new OpenAiChatGptAuthError('OpenAI ChatGPT inference URL is outside the Codex endpoint.');
+    }
+}
+function requireExpectedIdentity(optionsArg) {
+    const expectedIdentity = optionsArg.expectedIdentity;
+    if (!expectedIdentity
+        || (expectedIdentity.accountId !== undefined
+            && (typeof expectedIdentity.accountId !== 'string' || expectedIdentity.accountId.length === 0))
+        || typeof expectedIdentity.isFedrampAccount !== 'boolean') {
+        throw new OpenAiChatGptAuthError('OpenAI ChatGPT expected access identity is invalid.');
+    }
+    return Object.freeze({
+        accountId: expectedIdentity.accountId,
+        isFedrampAccount: expectedIdentity.isFedrampAccount,
+    });
+}
+function assertExpectedIdentity(settingsArg, expectedIdentityArg) {
+    const accountId = settingsArg.headers['ChatGPT-Account-ID'];
+    const isFedrampAccount = settingsArg.headers['X-OpenAI-Fedramp'] === 'true';
+    if (accountId !== expectedIdentityArg.accountId
+        || isFedrampAccount !== expectedIdentityArg.isFedrampAccount) {
+        throw new OpenAiChatGptAuthError('OpenAI ChatGPT resolved access identity does not match the connection.');
+    }
+}
+function applyAccessHeaders(headersArg, settingsArg) {
+    headersArg.set('Authorization', `Bearer ${settingsArg.apiKey}`);
+    headersArg.set('originator', settingsArg.headers.originator);
+    for (const name of ['ChatGPT-Account-ID', 'X-OpenAI-Fedramp']) {
+        const value = settingsArg.headers[name];
+        if (value === undefined) {
+            headersArg.delete(name);
+        }
+        else {
+            headersArg.set(name, value);
+        }
+    }
+}
+export const createOpenAiChatGptModelConnection = (credentialsArg) => ({
+    settings: createOpenAiChatGptProviderSettings(credentialsArg),
+    middleware: createOpenAiChatGptInstructionsMiddleware(),
+});
+export const createOpenAiChatGptDynamicModelConnection = (optionsArg) => {
+    if (!optionsArg || typeof optionsArg.resolveAccess !== 'function') {
+        throw new OpenAiChatGptAuthError('OpenAI ChatGPT access resolver is required.');
+    }
+    const expectedIdentity = requireExpectedIdentity(optionsArg);
+    const resolveAccess = optionsArg.resolveAccess;
+    const originator = optionsArg.originator;
+    const transport = optionsArg.fetch ?? globalThis.fetch;
+    if (typeof transport !== 'function') {
+        throw new OpenAiChatGptAuthError('fetch is not available for OpenAI ChatGPT inference.');
+    }
+    const fetchWithCurrentAccess = async (inputArg, initArg) => {
+        const request = new Request(inputArg, {
+            ...initArg,
+            redirect: 'error',
+        });
+        assertCodexRequestUrl(request.url);
+        request.signal.throwIfAborted();
+        const access = await resolveAccess({ signal: request.signal });
+        request.signal.throwIfAborted();
+        const settings = createOpenAiChatGptProviderSettings({
+            accessToken: access.accessToken,
+            originator,
+        });
+        if (settings.baseURL !== OPENAI_CHATGPT_CODEX_BASE_URL) {
+            throw new OpenAiChatGptAuthError('OpenAI ChatGPT inference endpoint is invalid.');
+        }
+        assertExpectedIdentity(settings, expectedIdentity);
+        const headers = new Headers(request.headers);
+        applyAccessHeaders(headers, settings);
+        const authenticatedRequest = new Request(request, {
+            headers,
+        });
+        authenticatedRequest.signal.throwIfAborted();
+        return transport(authenticatedRequest);
+    };
+    return {
+        settings: {
+            apiKey: '',
+            baseURL: OPENAI_CHATGPT_CODEX_BASE_URL,
+            fetch: fetchWithCurrentAccess,
+        },
+        middleware: createOpenAiChatGptInstructionsMiddleware(),
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRhaS5jb25uZWN0aW9uLm9wZW5haS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX29wZW5haV9hdXRoL3NtYXJ0YWkuY29ubmVjdGlvbi5vcGVuYWkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBS0EsT0FBTyxFQUNMLG1DQUFtQyxFQUNuQyw2QkFBNkIsRUFDN0Isc0JBQXNCLEdBQ3ZCLE1BQU0sMEJBQTBCLENBQUM7QUFDbEMsT0FBTyxFQUFFLHlDQUF5QyxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFFM0YsTUFBTSxZQUFZLEdBQUcsSUFBSSxHQUFHLENBQUMsNkJBQTZCLENBQUMsQ0FBQztBQUU1RCxTQUFTLHFCQUFxQixDQUFDLGdCQUF3QjtJQUNyRCxNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQyxRQUFRLEtBQUssWUFBWSxDQUFDLFFBQVE7V0FDckQsR0FBRyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsR0FBRyxZQUFZLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztJQUMxRCxJQUNFLEdBQUcsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLE1BQU07V0FDL0IsR0FBRyxDQUFDLFFBQVEsS0FBSyxFQUFFO1dBQ25CLEdBQUcsQ0FBQyxRQUFRLEtBQUssRUFBRTtXQUNuQixDQUFDLFdBQVcsRUFDZixDQUFDO1FBQ0QsTUFBTSxJQUFJLHNCQUFzQixDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDbEcsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLHVCQUF1QixDQUFDLFVBQXVEO0lBSXRGLE1BQU0sZ0JBQWdCLEdBQUcsVUFBVSxDQUFDLGdCQUFnQixDQUFDO0lBQ3JELElBQ0UsQ0FBQyxnQkFBZ0I7V0FDZCxDQUNELGdCQUFnQixDQUFDLFNBQVMsS0FBSyxTQUFTO2VBQ3JDLENBQUMsT0FBTyxnQkFBZ0IsQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLGdCQUFnQixDQUFDLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQy9GO1dBQ0UsT0FBTyxnQkFBZ0IsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTLEVBQ3pELENBQUM7UUFDRCxNQUFNLElBQUksc0JBQXNCLENBQUMscURBQXFELENBQUMsQ0FBQztJQUMxRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ25CLFNBQVMsRUFBRSxnQkFBZ0IsQ0FBQyxTQUFTO1FBQ3JDLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQjtLQUNwRCxDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQsU0FBUyxzQkFBc0IsQ0FDN0IsV0FBbUUsRUFDbkUsbUJBR0U7SUFFRixNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDNUQsTUFBTSxnQkFBZ0IsR0FBRyxXQUFXLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDLEtBQUssTUFBTSxDQUFDO0lBQzVFLElBQ0UsU0FBUyxLQUFLLG1CQUFtQixDQUFDLFNBQVM7V0FDeEMsZ0JBQWdCLEtBQUssbUJBQW1CLENBQUMsZ0JBQWdCLEVBQzVELENBQUM7UUFDRCxNQUFNLElBQUksc0JBQXNCLENBQzlCLHdFQUF3RSxDQUN6RSxDQUFDO0lBQ0osQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLGtCQUFrQixDQUN6QixVQUFtQixFQUNuQixXQUFtRTtJQUVuRSxVQUFVLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxVQUFVLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ2hFLFVBQVUsQ0FBQyxHQUFHLENBQUMsWUFBWSxFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFFN0QsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLG9CQUFvQixFQUFFLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3hDLElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3hCLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDMUIsQ0FBQzthQUFNLENBQUM7WUFDTixVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM5QixDQUFDO0lBQ0gsQ0FBQztBQUNILENBQUM7QUFFRCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxjQUE2QyxFQUNyQixFQUFFLENBQUMsQ0FBQztJQUM1QixRQUFRLEVBQUUsbUNBQW1DLENBQUMsY0FBYyxDQUFDO0lBQzdELFVBQVUsRUFBRSx5Q0FBeUMsRUFBRTtDQUN4RCxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxVQUF1RCxFQUMvQixFQUFFO0lBQzFCLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLENBQUMsYUFBYSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ2xFLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxNQUFNLGdCQUFnQixHQUFHLHVCQUF1QixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdELE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxhQUFhLENBQUM7SUFDL0MsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLFVBQVUsQ0FBQztJQUN6QyxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUMsS0FBSyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUM7SUFDdkQsSUFBSSxPQUFPLFNBQVMsS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUNwQyxNQUFNLElBQUksc0JBQXNCLENBQUMsc0RBQXNELENBQUMsQ0FBQztJQUMzRixDQUFDO0lBRUQsTUFBTSxzQkFBc0IsR0FBaUIsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsRUFBRTtRQUN2RSxNQUFNLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxRQUFRLEVBQUU7WUFDcEMsR0FBRyxPQUFPO1lBQ1YsUUFBUSxFQUFFLE9BQU87U0FDbEIsQ0FBQyxDQUFDO1FBQ0gscUJBQXFCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ25DLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFFaEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxhQUFhLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDL0QsT0FBTyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNoQyxNQUFNLFFBQVEsR0FBRyxtQ0FBbUMsQ0FBQztZQUNuRCxXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7WUFDL0IsVUFBVTtTQUNYLENBQUMsQ0FBQztRQUNILElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyw2QkFBNkIsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxzQkFBc0IsQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7UUFDRCxzQkFBc0IsQ0FBQyxRQUFRLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUVuRCxNQUFNLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDN0Msa0JBQWtCLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3RDLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxPQUFPLENBQUMsT0FBTyxFQUFFO1lBQ2hELE9BQU87U0FDUixDQUFDLENBQUM7UUFDSCxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDN0MsT0FBTyxTQUFTLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUN6QyxDQUFDLENBQUM7SUFFRixPQUFPO1FBQ0wsUUFBUSxFQUFFO1lBQ1IsTUFBTSxFQUFFLEVBQUU7WUFDVixPQUFPLEVBQUUsNkJBQTZCO1lBQ3RDLEtBQUssRUFBRSxzQkFBc0I7U0FDOUI7UUFDRCxVQUFVLEVBQUUseUNBQXlDLEVBQUU7S0FDeEQsQ0FBQztBQUNKLENBQUMsQ0FBQyJ9

package/package.json

@@ -2,7 +2,7 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "name": "@modelprofile.com/flexharness-providers",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "type": "module",
   "description": "Model providers, authentication, account management, media and research integrations in one package.",
   "main": "./dist_ts_providers/index.js",
@@ -75,7 +75,7 @@
     "@ai-sdk/provider": "^4.0.8",
     "@ai-sdk/xai": "^4.0.44",
     "@anthropic-ai/sdk": "0.95.2",
-    "@modelprofile.com/flexharness-models": "8.0.0",
+    "@modelprofile.com/flexharness-models": "8.1.0",
     "ai": "^7.0.79",
     "openai": "^6.37.0",
     "proper-lockfile": "^4.1.2"

package/readme.md

@@ -36,7 +36,11 @@ Provider SDKs are installed together. Authentication, file access and vendor med
 are separate entrypoints and are not imported by the provider factory root. For
 ChatGPT authentication, pass
 `connection: createOpenAiChatGptModelConnection(credentials)` from `/auth` to the
-OpenAI model options. API-key inference needs no authentication setup.
+OpenAI model options. Delegated runtimes use
+`createOpenAiChatGptDynamicModelConnection({ expectedIdentity, resolveAccess })`
+instead; it resolves current access at every provider HTTP request while keeping
+account and residency identity fixed for the connection. API-key inference
+needs no authentication setup.
 
 The package includes the applicable OpenAI Codex license and third-party notices.
 

package/ts_openai_auth/index.ts

@@ -1,12 +1,4 @@
-import type { IOpenAiModelConnection } from '@modelprofile.com/flexharness-providers/openai';
-import type { IOpenAiChatGptAuthCredentials } from './interfaces.js';
-import { createOpenAiChatGptProviderSettings } from './smartai.auth.openai.js';
-import { createOpenAiChatGptInstructionsMiddleware } from './smartai.middleware.openai.js';
 export * from './interfaces.js';
 export * from './smartai.auth.openai.js';
+export * from './smartai.connection.openai.js';
 export * from './smartai.middleware.openai.js';
-
-export const createOpenAiChatGptModelConnection = (credentials: IOpenAiChatGptAuthCredentials): IOpenAiModelConnection => ({
-  settings: createOpenAiChatGptProviderSettings(credentials),
-  middleware: createOpenAiChatGptInstructionsMiddleware(),
-});

package/ts_openai_auth/interfaces.ts

@@ -19,6 +19,36 @@ export interface IOpenAiChatGptAuthCredentials {
   originator?: string;
 }
 
+export interface IOpenAiChatGptAccessIdentity {
+  /** Exact workspace claim expected on every resolved access token. */
+  readonly accountId: string | undefined;
+  /** Exact residency claim expected on every resolved access token. */
+  readonly isFedrampAccount: boolean;
+}
+
+export interface IOpenAiChatGptAccessRequest {
+  /** The provider request signal. A resolver should pass it through to its authority. */
+  readonly signal: AbortSignal;
+}
+
+/** Access-only result. Refresh and ID tokens are not part of the request-time contract. */
+export interface IOpenAiChatGptResolvedAccess {
+  readonly accessToken: string;
+}
+
+export interface IOpenAiChatGptDynamicModelConnectionOptions {
+  /** Pins the account and residency boundary for the lifetime of the connection. */
+  readonly expectedIdentity: IOpenAiChatGptAccessIdentity;
+  /** Stable provider originator header. Defaults to `smartai`. */
+  readonly originator?: string;
+  /** Resolves current access immediately before every provider network request. */
+  readonly resolveAccess: (
+    request: IOpenAiChatGptAccessRequest,
+  ) => Promise<IOpenAiChatGptResolvedAccess>;
+  /** Optional underlying transport. Defaults to the current global fetch. */
+  readonly fetch?: typeof fetch;
+}
+
 export interface IOpenAiChatGptTokenData extends IOpenAiChatGptAuthCredentials {
   refreshToken: string;
   tokenInfo: IOpenAiChatGptTokenInfo;

package/ts_openai_auth/readme.md

@@ -23,6 +23,14 @@ the current access token. The token must contain an unexpired `exp` claim;
 supplied `accountId`, `isFedrampAccount`, and `tokenInfo` must agree with its
 claims. A saved ID-token snapshot cannot override current access-token facts.
 
+Use `createOpenAiChatGptDynamicModelConnection()` for delegated access owned by
+an external authority. Pin its exact account and FedRAMP identity, then provide
+an async `resolveAccess({ signal })` callback. The connection resolves and
+validates current access immediately before every provider HTTP request, so
+multi-step tool runs do not retain the token that admitted the run. Resolution,
+identity, expiry, endpoint, redirect, and abort failures stop before the
+underlying transport is called.
+
 ## Issue Reporting and Security
 
 Report issues and security concerns through [community.foss.global](https://community.foss.global).

package/ts_openai_auth/smartai.connection.openai.ts

@@ -0,0 +1,143 @@
+import type { IOpenAiModelConnection } from '@modelprofile.com/flexharness-providers/openai';
+import type {
+  IOpenAiChatGptAuthCredentials,
+  IOpenAiChatGptDynamicModelConnectionOptions,
+} from './interfaces.js';
+import {
+  createOpenAiChatGptProviderSettings,
+  OPENAI_CHATGPT_CODEX_BASE_URL,
+  OpenAiChatGptAuthError,
+} from './smartai.auth.openai.js';
+import { createOpenAiChatGptInstructionsMiddleware } from './smartai.middleware.openai.js';
+
+const codexBaseUrl = new URL(OPENAI_CHATGPT_CODEX_BASE_URL);
+
+function assertCodexRequestUrl(normalizedUrlArg: string): void {
+  const url = new URL(normalizedUrlArg);
+  const isCodexPath = url.pathname === codexBaseUrl.pathname
+    || url.pathname.startsWith(`${codexBaseUrl.pathname}/`);
+  if (
+    url.origin !== codexBaseUrl.origin
+    || url.username !== ''
+    || url.password !== ''
+    || !isCodexPath
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT inference URL is outside the Codex endpoint.');
+  }
+}
+
+function requireExpectedIdentity(optionsArg: IOpenAiChatGptDynamicModelConnectionOptions): {
+  accountId: string | undefined;
+  isFedrampAccount: boolean;
+} {
+  const expectedIdentity = optionsArg.expectedIdentity;
+  if (
+    !expectedIdentity
+    || (
+      expectedIdentity.accountId !== undefined
+      && (typeof expectedIdentity.accountId !== 'string' || expectedIdentity.accountId.length === 0)
+    )
+    || typeof expectedIdentity.isFedrampAccount !== 'boolean'
+  ) {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT expected access identity is invalid.');
+  }
+  return Object.freeze({
+    accountId: expectedIdentity.accountId,
+    isFedrampAccount: expectedIdentity.isFedrampAccount,
+  });
+}
+
+function assertExpectedIdentity(
+  settingsArg: ReturnType<typeof createOpenAiChatGptProviderSettings>,
+  expectedIdentityArg: Readonly<{
+    accountId: string | undefined;
+    isFedrampAccount: boolean;
+  }>,
+): void {
+  const accountId = settingsArg.headers['ChatGPT-Account-ID'];
+  const isFedrampAccount = settingsArg.headers['X-OpenAI-Fedramp'] === 'true';
+  if (
+    accountId !== expectedIdentityArg.accountId
+    || isFedrampAccount !== expectedIdentityArg.isFedrampAccount
+  ) {
+    throw new OpenAiChatGptAuthError(
+      'OpenAI ChatGPT resolved access identity does not match the connection.',
+    );
+  }
+}
+
+function applyAccessHeaders(
+  headersArg: Headers,
+  settingsArg: ReturnType<typeof createOpenAiChatGptProviderSettings>,
+): void {
+  headersArg.set('Authorization', `Bearer ${settingsArg.apiKey}`);
+  headersArg.set('originator', settingsArg.headers.originator);
+
+  for (const name of ['ChatGPT-Account-ID', 'X-OpenAI-Fedramp']) {
+    const value = settingsArg.headers[name];
+    if (value === undefined) {
+      headersArg.delete(name);
+    } else {
+      headersArg.set(name, value);
+    }
+  }
+}
+
+export const createOpenAiChatGptModelConnection = (
+  credentialsArg: IOpenAiChatGptAuthCredentials,
+): IOpenAiModelConnection => ({
+  settings: createOpenAiChatGptProviderSettings(credentialsArg),
+  middleware: createOpenAiChatGptInstructionsMiddleware(),
+});
+
+export const createOpenAiChatGptDynamicModelConnection = (
+  optionsArg: IOpenAiChatGptDynamicModelConnectionOptions,
+): IOpenAiModelConnection => {
+  if (!optionsArg || typeof optionsArg.resolveAccess !== 'function') {
+    throw new OpenAiChatGptAuthError('OpenAI ChatGPT access resolver is required.');
+  }
+  const expectedIdentity = requireExpectedIdentity(optionsArg);
+  const resolveAccess = optionsArg.resolveAccess;
+  const originator = optionsArg.originator;
+  const transport = optionsArg.fetch ?? globalThis.fetch;
+  if (typeof transport !== 'function') {
+    throw new OpenAiChatGptAuthError('fetch is not available for OpenAI ChatGPT inference.');
+  }
+
+  const fetchWithCurrentAccess: typeof fetch = async (inputArg, initArg) => {
+    const request = new Request(inputArg, {
+      ...initArg,
+      redirect: 'error',
+    });
+    assertCodexRequestUrl(request.url);
+    request.signal.throwIfAborted();
+
+    const access = await resolveAccess({ signal: request.signal });
+    request.signal.throwIfAborted();
+    const settings = createOpenAiChatGptProviderSettings({
+      accessToken: access.accessToken,
+      originator,
+    });
+    if (settings.baseURL !== OPENAI_CHATGPT_CODEX_BASE_URL) {
+      throw new OpenAiChatGptAuthError('OpenAI ChatGPT inference endpoint is invalid.');
+    }
+    assertExpectedIdentity(settings, expectedIdentity);
+
+    const headers = new Headers(request.headers);
+    applyAccessHeaders(headers, settings);
+    const authenticatedRequest = new Request(request, {
+      headers,
+    });
+    authenticatedRequest.signal.throwIfAborted();
+    return transport(authenticatedRequest);
+  };
+
+  return {
+    settings: {
+      apiKey: '',
+      baseURL: OPENAI_CHATGPT_CODEX_BASE_URL,
+      fetch: fetchWithCurrentAccess,
+    },
+    middleware: createOpenAiChatGptInstructionsMiddleware(),
+  };
+};

package/ts_providers/openai/readme.md

@@ -11,6 +11,11 @@ pnpm add @modelprofile.com/flexharness-providers
 See the [toolbox usage and migration guide](https://code.foss.global/modelprofile.com/flexharness#readme)
 for composition examples and the SmartAI/SmartAgent migration map.
 
+ChatGPT connections come from the `/auth` subpath. Use the dynamic connection
+factory for delegated authority access so every provider HTTP request resolves
+a current token while the connection retains its pinned account and residency
+identity.
+
 ## Issue Reporting and Security
 
 Report issues and security concerns through [community.foss.global](https://community.foss.global).

package/ts_providers/readme.md

@@ -36,7 +36,11 @@ Provider SDKs are installed together. Authentication, file access and vendor med
 are separate entrypoints and are not imported by the provider factory root. For
 ChatGPT authentication, pass
 `connection: createOpenAiChatGptModelConnection(credentials)` from `/auth` to the
-OpenAI model options. API-key inference needs no authentication setup.
+OpenAI model options. Delegated runtimes use
+`createOpenAiChatGptDynamicModelConnection({ expectedIdentity, resolveAccess })`
+instead; it resolves current access at every provider HTTP request while keeping
+account and residency identity fixed for the connection. API-key inference
+needs no authentication setup.
 
 The package includes the applicable OpenAI Codex license and third-party notices.