@moxxy/plugin-provider-openai-codex 0.21.1

package/dist/login.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Codex OAuth login — thin wrapper over `@moxxy/plugin-oauth`'s provider
+ * framework. Everything generic (loopback callback server, browser opener,
+ * device-flow polling, vault persistence, refresh) lives in plugin-oauth;
+ * this file only carries the codex-shaped mapping into `CodexTokens` that
+ * the provider class consumes.
+ */
+import { type OAuthVault } from '@moxxy/plugin-oauth';
+import type { ProviderAuthContext, ProviderOAuthResult, ProviderOAuthStatus } from '@moxxy/sdk';
+import type { CodexTokens } from './types.js';
+export declare function codexLogin(ctx: ProviderAuthContext): Promise<ProviderOAuthResult>;
+export declare function codexLogout(ctx: ProviderAuthContext): Promise<boolean>;
+export declare function codexStatus(ctx: ProviderAuthContext): Promise<ProviderOAuthStatus | null>;
+/**
+ * Read the stored token set in the legacy `CodexTokens` shape the provider
+ * class expects. Returns `null` if nothing is stored — the provider then
+ * reports the "run `moxxy login openai-codex`" error to the caller.
+ */
+export declare function readStoredTokens(vault: OAuthVault): Promise<CodexTokens | null>;
+/**
+ * Pre-request freshness gate consumed by `CodexProvider.ensureFresh`.
+ * Reads the stored creds, refreshes if near expiry, persists the rotated
+ * tokens BEFORE returning so a crash here can't strand a single-use
+ * refresh_token in memory.
+ */
+export declare function ensureFreshCodexTokens(vault: OAuthVault): Promise<CodexTokens>;
+/**
+ * Persist the provider's in-memory `CodexTokens` back into the vault after
+ * an in-flight refresh. Wires the `CodexProvider.onTokensRefreshed`
+ * callback to the same storage layout `runOauthLogin` writes.
+ */
+export declare function persistCodexTokens(vault: OAuthVault, tokens: CodexTokens): Promise<void>;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,UAAU,EAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAsB,UAAU,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CASvF;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO5E;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAQ/F;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAGrF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAWpF;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/login.js

@@ -0,0 +1,94 @@
+/**
+ * Codex OAuth login — thin wrapper over `@moxxy/plugin-oauth`'s provider
+ * framework. Everything generic (loopback callback server, browser opener,
+ * device-flow polling, vault persistence, refresh) lives in plugin-oauth;
+ * this file only carries the codex-shaped mapping into `CodexTokens` that
+ * the provider class consumes.
+ */
+import { clearStoredCreds, ensureFreshTokens, readStoredCreds, runOauthLogin, storeTokenSet, } from '@moxxy/plugin-oauth';
+import { CODEX_PROVIDER_ID, codexOauthProfile } from './profile.js';
+export async function codexLogin(ctx) {
+    const result = await runOauthLogin(codexOauthProfile, {
+        vault: ctx.vault,
+        headless: ctx.headless,
+        write: ctx.write,
+    });
+    return result.accountId
+        ? { accountId: result.accountId, expiresAt: result.tokens.expiresAt ?? 0 }
+        : { expiresAt: result.tokens.expiresAt ?? 0 };
+}
+export async function codexLogout(ctx) {
+    try {
+        const removed = await clearStoredCreds(ctx.vault, CODEX_PROVIDER_ID);
+        return removed > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function codexStatus(ctx) {
+    const stored = await readStoredCreds(ctx.vault, CODEX_PROVIDER_ID);
+    if (!stored)
+        return null;
+    return {
+        accountId: stored.extras.account_id ?? null,
+        expiresAt: stored.tokenSet.expiresAt ?? 0,
+        vaultKey: `oauth/${CODEX_PROVIDER_ID}/*`,
+    };
+}
+/**
+ * Read the stored token set in the legacy `CodexTokens` shape the provider
+ * class expects. Returns `null` if nothing is stored — the provider then
+ * reports the "run `moxxy login openai-codex`" error to the caller.
+ */
+export async function readStoredTokens(vault) {
+    const stored = await readStoredCreds(vault, CODEX_PROVIDER_ID);
+    return stored ? toCodexTokens(stored) : null;
+}
+/**
+ * Pre-request freshness gate consumed by `CodexProvider.ensureFresh`.
+ * Reads the stored creds, refreshes if near expiry, persists the rotated
+ * tokens BEFORE returning so a crash here can't strand a single-use
+ * refresh_token in memory.
+ */
+export async function ensureFreshCodexTokens(vault) {
+    const { tokens, extras } = await ensureFreshTokens(codexOauthProfile, vault);
+    if (!tokens.refreshToken) {
+        throw new Error('refreshed token set missing refresh_token');
+    }
+    return {
+        access: tokens.accessToken,
+        refresh: tokens.refreshToken,
+        expires: tokens.expiresAt ?? 0,
+        ...(extras.account_id ? { accountId: extras.account_id } : {}),
+    };
+}
+/**
+ * Persist the provider's in-memory `CodexTokens` back into the vault after
+ * an in-flight refresh. Wires the `CodexProvider.onTokensRefreshed`
+ * callback to the same storage layout `runOauthLogin` writes.
+ */
+export async function persistCodexTokens(vault, tokens) {
+    await storeTokenSet(vault, CODEX_PROVIDER_ID, {
+        accessToken: tokens.access,
+        refreshToken: tokens.refresh,
+        expiresAt: tokens.expires,
+        tokenType: 'Bearer',
+    }, {
+        clientId: codexOauthProfile.clientId,
+        tokenUrl: codexOauthProfile.tokenUrl,
+        extras: tokens.accountId ? { account_id: tokens.accountId } : {},
+    });
+}
+function toCodexTokens(stored) {
+    if (!stored.tokenSet.refreshToken) {
+        throw new Error(`Stored codex creds missing refresh_token under oauth/${CODEX_PROVIDER_ID}/`);
+    }
+    return {
+        access: stored.tokenSet.accessToken,
+        refresh: stored.tokenSet.refreshToken,
+        expires: stored.tokenSet.expiresAt ?? 0,
+        ...(stored.extras.account_id ? { accountId: stored.extras.account_id } : {}),
+    };
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,aAAa,GAGd,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAwB;IACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,iBAAiB,EAAE;QACpD,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,SAAS;QACrB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE;QAC1E,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAwB;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACrE,OAAO,OAAO,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAwB;IACxD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI;QAC3C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC;QACzC,QAAQ,EAAE,SAAS,iBAAiB,IAAI;KACzC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAiB;IAC5D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,WAAW;QAC1B,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,OAAO,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAiB,EACjB,MAAmB;IAEnB,MAAM,aAAa,CACjB,KAAK,EACL,iBAAiB,EACjB;QACE,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,YAAY,EAAE,MAAM,CAAC,OAAO;QAC5B,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ;KACpB,EACD;QACE,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;KACjE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wDAAwD,iBAAiB,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;QACnC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QACrC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC"}

package/dist/models.d.ts

@@ -0,0 +1,10 @@
+import type { ModelDescriptor } from '@moxxy/sdk';
+/**
+ * Models the ChatGPT-plan backend will serve. Mirrors opencode's ALLOWED_MODELS
+ * set (`packages/opencode/src/plugin/codex.ts`). The API-key OpenAI provider
+ * still exposes the full catalog; this list is the subset the Codex backend
+ * routes to ChatGPT-Pro/Plus subscribers without per-token billing.
+ */
+export declare const codexModels: ReadonlyArray<ModelDescriptor>;
+export declare const DEFAULT_CODEX_MODEL = "gpt-5.3-codex";
+//# sourceMappingURL=models.d.ts.map

package/dist/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;GAKG;AAIH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,eAAe,CAOtD,CAAC;AAEF,eAAO,MAAM,mBAAmB,kBAAkB,CAAC"}

package/dist/models.js

@@ -0,0 +1,19 @@
+/**
+ * Models the ChatGPT-plan backend will serve. Mirrors opencode's ALLOWED_MODELS
+ * set (`packages/opencode/src/plugin/codex.ts`). The API-key OpenAI provider
+ * still exposes the full catalog; this list is the subset the Codex backend
+ * routes to ChatGPT-Pro/Plus subscribers without per-token billing.
+ */
+// Every Codex-served model is a gpt-5-family reasoning model, so all advertise
+// `supportsReasoning` — the request already sends `reasoning.summary: 'auto'`;
+// the per-provider toggle decides whether the summary is surfaced.
+export const codexModels = [
+    { id: 'gpt-5.5', contextWindow: 1_000_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsImages: true, supportsDocuments: true, supportsReasoning: true },
+    { id: 'gpt-5.4', contextWindow: 1_000_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsImages: true, supportsDocuments: true, supportsReasoning: true },
+    { id: 'gpt-5.4-mini', contextWindow: 400_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsImages: true, supportsDocuments: true, supportsReasoning: true },
+    { id: 'gpt-5.3-codex', contextWindow: 400_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsImages: true, supportsDocuments: true, supportsReasoning: true },
+    { id: 'gpt-5.3-codex-spark', contextWindow: 400_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsImages: true, supportsDocuments: true, supportsReasoning: true },
+    { id: 'gpt-5.2', contextWindow: 400_000, maxOutputTokens: 128_000, supportsTools: true, supportsStreaming: true, supportsImages: true, supportsDocuments: true, supportsReasoning: true },
+];
+export const DEFAULT_CODEX_MODEL = 'gpt-5.3-codex';
+//# sourceMappingURL=models.js.map

package/dist/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,+EAA+E;AAC/E,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAmC;IACzD,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAC3L,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAC3L,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAC9L,EAAE,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAC/L,EAAE,EAAE,EAAE,qBAAqB,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;IACrM,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE;CAC1L,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC"}

package/dist/oauth.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Codex-specific OAuth pieces: constants, JWT-claim extraction, and thin
+ * wrappers that adapt `@moxxy/plugin-oauth`'s generic helpers into the
+ * `CodexTokens` shape the provider class consumes. The actual flow
+ * orchestration lives in `profile.ts` + `login.ts`.
+ */
+import { generateState as oauthGenerateState } from '@moxxy/plugin-oauth';
+import type { CodexTokens, PkceCodes } from './types.js';
+/**
+ * Public OAuth client id baked into the first-party Codex / OpenCode clients.
+ * Same value used by codex-rs (`codex-rs/login/src/auth/manager.rs`) and
+ * opencode (`packages/opencode/src/plugin/codex.ts`) — using it lets a moxxy
+ * login interoperate with credentials produced by either tool.
+ */
+export declare const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const ISSUER = "https://auth.openai.com";
+export declare const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+export declare const TOKEN_URL = "https://auth.openai.com/oauth/token";
+export declare const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+export declare const DEFAULT_CALLBACK_PORT = 1455;
+export declare const DEFAULT_REDIRECT_PATH = "/auth/callback";
+export declare const DEFAULT_REDIRECT_URI = "http://localhost:1455/auth/callback";
+export declare const SCOPES = "openid profile email offline_access";
+export declare const ORIGINATOR = "moxxy";
+/**
+ * PKCE pair for the Codex flow. Delegates to `@moxxy/plugin-oauth`'s shared
+ * primitives (S256 verifier -> challenge) instead of hand-rolling crypto;
+ * kept as a thin wrapper so it returns the `PkceCodes` shape and stays a
+ * stable public export.
+ */
+export declare function generatePKCE(): Promise<PkceCodes>;
+export declare const generateState: typeof oauthGenerateState;
+/**
+ * Thin wrapper over `@moxxy/plugin-oauth`'s generic `buildAuthUrl` that
+ * stamps in the Codex-specific extras. Exported because tests + downstream
+ * consumers may want to build URLs without running the full flow.
+ */
+export declare function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string): string;
+/**
+ * JWT-claim extraction — header.payload.signature with base64url-encoded
+ * segments. We never verify the signature: the access_token is only ever
+ * sent back to the issuer (or its API gateway), so trust is rooted in the
+ * fact that we received the token over TLS from the token endpoint. The
+ * only thing we use these claims for is plucking the chatgpt_account_id
+ * for the per-request header.
+ */
+export declare function parseJwtClaims(jwt: string): Record<string, unknown> | undefined;
+interface AccountIdSource {
+    readonly access_token?: string;
+    readonly id_token?: string;
+}
+/**
+ * Account-id priority order matches opencode's `extractAccountIdFromClaims`:
+ * the explicit top-level claim → the namespaced auth-bag claim → first
+ * organization id. Returning undefined is fine — the API just won't
+ * receive the optional ChatGPT-Account-Id header.
+ */
+export declare function extractAccountId(tokens: AccountIdSource): string | undefined;
+/**
+ * Wrapper around plugin-oauth's `exchangeCodeForToken` that returns the
+ * `CodexTokens` shape (with `accountId` plucked from the id_token JWT).
+ * Tests + downstream callers use it directly; the live login path goes
+ * through `runOauthLogin(codexOauthProfile, ...)`.
+ */
+export declare function exchangeCodeForTokens(code: string, redirectUri: string, pkce: PkceCodes, fetchImpl?: typeof fetch): Promise<CodexTokens>;
+/**
+ * Refresh both the access AND refresh tokens. The OAuth server issues a
+ * fresh refresh_token on every refresh and INVALIDATES the previous one —
+ * callers must persist the returned tokens BEFORE issuing any API call
+ * that might fail mid-flight, otherwise a crash will lock the user out.
+ */
+export declare function refreshTokens(refreshToken: string, fetchImpl?: typeof fetch): Promise<CodexTokens>;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAKL,aAAa,IAAI,kBAAkB,EAGpC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,SAAS,iCAAiC,CAAC;AACxD,eAAO,MAAM,MAAM,4BAA4B,CAAC;AAChD,eAAO,MAAM,aAAa,4CAA8B,CAAC;AACzD,eAAO,MAAM,SAAS,wCAA0B,CAAC;AACjD,eAAO,MAAM,mBAAmB,oDAAoD,CAAC;AACrF,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,eAAO,MAAM,oBAAoB,wCAAsE,CAAC;AACxG,eAAO,MAAM,MAAM,wCAAwC,CAAC;AAC5D,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC;;;;;GAKG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAGvD;AAED,eAAO,MAAM,aAAa,2BAAqB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAc7F;AAcD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiB/E;AAED,UAAU,eAAe;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAmB5E;AAkBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,SAAS,EACf,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,CAAC,CAYtB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,CAAC,CAQtB"}

package/dist/oauth.js

@@ -0,0 +1,170 @@
+/**
+ * Codex-specific OAuth pieces: constants, JWT-claim extraction, and thin
+ * wrappers that adapt `@moxxy/plugin-oauth`'s generic helpers into the
+ * `CodexTokens` shape the provider class consumes. The actual flow
+ * orchestration lives in `profile.ts` + `login.ts`.
+ */
+import { Buffer } from 'node:buffer';
+import { buildAuthUrl, computeCodeChallenge, exchangeCodeForToken as oauthExchangeCodeForToken, generateCodeVerifier, generateState as oauthGenerateState, refreshAccessToken, } from '@moxxy/plugin-oauth';
+/**
+ * Public OAuth client id baked into the first-party Codex / OpenCode clients.
+ * Same value used by codex-rs (`codex-rs/login/src/auth/manager.rs`) and
+ * opencode (`packages/opencode/src/plugin/codex.ts`) — using it lets a moxxy
+ * login interoperate with credentials produced by either tool.
+ */
+export const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+export const ISSUER = 'https://auth.openai.com';
+export const AUTHORIZE_URL = `${ISSUER}/oauth/authorize`;
+export const TOKEN_URL = `${ISSUER}/oauth/token`;
+export const CODEX_RESPONSES_URL = 'https://chatgpt.com/backend-api/codex/responses';
+export const DEFAULT_CALLBACK_PORT = 1455;
+export const DEFAULT_REDIRECT_PATH = '/auth/callback';
+export const DEFAULT_REDIRECT_URI = `http://localhost:${DEFAULT_CALLBACK_PORT}${DEFAULT_REDIRECT_PATH}`;
+export const SCOPES = 'openid profile email offline_access';
+export const ORIGINATOR = 'moxxy';
+/**
+ * PKCE pair for the Codex flow. Delegates to `@moxxy/plugin-oauth`'s shared
+ * primitives (S256 verifier -> challenge) instead of hand-rolling crypto;
+ * kept as a thin wrapper so it returns the `PkceCodes` shape and stays a
+ * stable public export.
+ */
+export async function generatePKCE() {
+    const verifier = generateCodeVerifier();
+    return { verifier, challenge: computeCodeChallenge(verifier) };
+}
+export const generateState = oauthGenerateState;
+/**
+ * Thin wrapper over `@moxxy/plugin-oauth`'s generic `buildAuthUrl` that
+ * stamps in the Codex-specific extras. Exported because tests + downstream
+ * consumers may want to build URLs without running the full flow.
+ */
+export function buildAuthorizeUrl(redirectUri, pkce, state) {
+    return buildAuthUrl({
+        authUrl: AUTHORIZE_URL,
+        clientId: CLIENT_ID,
+        redirectUri,
+        scopes: SCOPES.split(' '),
+        codeChallenge: pkce.challenge,
+        state,
+        extraAuthParams: {
+            id_token_add_organizations: 'true',
+            codex_cli_simplified_flow: 'true',
+            originator: ORIGINATOR,
+        },
+    });
+}
+/**
+ * Hard cap on the base64url payload segment we'll decode + JSON.parse. A
+ * legitimate OAuth id_token/access_token JWT payload is a few hundred bytes to
+ * a couple KiB; 64 KiB is far beyond any real claim set. The cap is defense in
+ * depth: although the token reaches us over TLS from the issuer, a hostile or
+ * MITM'd token endpoint — or a tampered persisted vault entry replayed back in
+ * — could otherwise hand us a multi-megabyte/gigabyte segment that we'd
+ * base64-decode and `JSON.parse` in full. Over the cap we degrade to
+ * `undefined` (callers already treat a missing account-id claim as fine).
+ */
+const MAX_JWT_SEGMENT_CHARS = 64 * 1024;
+/**
+ * JWT-claim extraction — header.payload.signature with base64url-encoded
+ * segments. We never verify the signature: the access_token is only ever
+ * sent back to the issuer (or its API gateway), so trust is rooted in the
+ * fact that we received the token over TLS from the token endpoint. The
+ * only thing we use these claims for is plucking the chatgpt_account_id
+ * for the per-request header.
+ */
+export function parseJwtClaims(jwt) {
+    if (typeof jwt !== 'string')
+        return undefined;
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return undefined;
+    const payload = parts[1];
+    // Bound the decode: never allocate/parse an oversized payload segment.
+    if (payload.length > MAX_JWT_SEGMENT_CHARS)
+        return undefined;
+    try {
+        const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        // Guard against a payload that parses to a non-object (e.g. `"5"`, `[]`,
+        // `null`): downstream callers index it as a claim bag, so reject anything
+        // that isn't a plain object rather than returning a surprising value.
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Account-id priority order matches opencode's `extractAccountIdFromClaims`:
+ * the explicit top-level claim → the namespaced auth-bag claim → first
+ * organization id. Returning undefined is fine — the API just won't
+ * receive the optional ChatGPT-Account-Id header.
+ */
+export function extractAccountId(tokens) {
+    for (const candidate of [tokens.id_token, tokens.access_token]) {
+        if (!candidate)
+            continue;
+        const claims = parseJwtClaims(candidate);
+        if (!claims)
+            continue;
+        const direct = claims['chatgpt_account_id'];
+        if (typeof direct === 'string' && direct)
+            return direct;
+        const authBag = claims['https://api.openai.com/auth'];
+        if (authBag && typeof authBag === 'object') {
+            const fromBag = authBag['chatgpt_account_id'];
+            if (typeof fromBag === 'string' && fromBag)
+                return fromBag;
+        }
+        const orgs = claims['organizations'];
+        if (Array.isArray(orgs) && orgs.length > 0) {
+            const first = orgs[0];
+            if (first && typeof first.id === 'string' && first.id)
+                return first.id;
+        }
+    }
+    return undefined;
+}
+function toCodexTokens(set) {
+    if (!set.refreshToken) {
+        throw new Error('OAuth token response missing refresh_token');
+    }
+    const accountId = extractAccountId({
+        ...(set.idToken ? { id_token: set.idToken } : {}),
+        access_token: set.accessToken,
+    });
+    return {
+        access: set.accessToken,
+        refresh: set.refreshToken,
+        expires: set.expiresAt ?? Date.now() + 3600_000,
+        ...(accountId ? { accountId } : {}),
+    };
+}
+/**
+ * Wrapper around plugin-oauth's `exchangeCodeForToken` that returns the
+ * `CodexTokens` shape (with `accountId` plucked from the id_token JWT).
+ * Tests + downstream callers use it directly; the live login path goes
+ * through `runOauthLogin(codexOauthProfile, ...)`.
+ */
+export async function exchangeCodeForTokens(code, redirectUri, pkce, fetchImpl = fetch) {
+    const set = await oauthExchangeCodeForToken({
+        tokenUrl: TOKEN_URL,
+        code,
+        redirectUri,
+        clientId: CLIENT_ID,
+        codeVerifier: pkce.verifier,
+    }, fetchImpl);
+    return toCodexTokens(set);
+}
+/**
+ * Refresh both the access AND refresh tokens. The OAuth server issues a
+ * fresh refresh_token on every refresh and INVALIDATES the previous one —
+ * callers must persist the returned tokens BEFORE issuing any API call
+ * that might fail mid-flight, otherwise a crash will lock the user out.
+ */
+export async function refreshTokens(refreshToken, fetchImpl = fetch) {
+    const set = await refreshAccessToken({ tokenUrl: TOKEN_URL, clientId: CLIENT_ID, refreshToken }, fetchImpl);
+    return toCodexTokens(set.refreshToken ? set : { ...set, refreshToken });
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,IAAI,yBAAyB,EACjD,oBAAoB,EACpB,aAAa,IAAI,kBAAkB,EACnC,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAG7B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACxD,MAAM,CAAC,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAChD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,MAAM,kBAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,MAAM,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,iDAAiD,CAAC;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,qBAAqB,GAAG,qBAAqB,EAAE,CAAC;AACxG,MAAM,CAAC,MAAM,MAAM,GAAG,qCAAqC,CAAC;AAC5D,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,IAAe,EAAE,KAAa;IACnF,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,SAAS;QACnB,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QACzB,aAAa,EAAE,IAAI,CAAC,SAAS;QAC7B,KAAK;QACL,eAAe,EAAE;YACf,0BAA0B,EAAE,MAAM;YAClC,yBAAyB,EAAE,MAAM;YACjC,UAAU,EAAE,UAAU;SACvB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC1B,uEAAuE;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACzF,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACtD,KAAK,MAAM,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAI,OAAmC,CAAC,oBAAoB,CAAC,CAAC;YAC3E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAqB,CAAC;YAC1C,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,GAAa;IAClC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,YAAY,EAAE,GAAG,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,WAAW;QACvB,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,OAAO,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;QAC/C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,WAAmB,EACnB,IAAe,EACf,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,yBAAyB,CACzC;QACE,QAAQ,EAAE,SAAS;QACnB,IAAI;QACJ,WAAW;QACX,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,IAAI,CAAC,QAAQ;KAC5B,EACD,SAAS,CACV,CAAC;IACF,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,EAC1D,SAAS,CACV,CAAC;IACF,OAAO,aAAa,CAClB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,CAClD,CAAC;AACJ,CAAC"}

package/dist/profile.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `OAuthProviderProfile` for the OpenAI Codex (ChatGPT Pro/Plus) provider.
+ * Drives both `runOauthLogin` (interactive) and `ensureFreshTokens`
+ * (pre-request refresh) from `@moxxy/plugin-oauth`. Codex-specific
+ * concerns:
+ *   - the non-standard OpenAI device-flow dialect (via `openaiDeviceFlow`)
+ *   - `chatgpt_account_id` extraction from id_token / access_token JWTs
+ *   - the bundled-CLI auth flags (`id_token_add_organizations`, etc.)
+ */
+import { type OAuthProviderProfile } from '@moxxy/plugin-oauth';
+export declare const CODEX_PROVIDER_ID = "openai-codex";
+export declare const codexOauthProfile: OAuthProviderProfile;
+//# sourceMappingURL=profile.d.ts.map

package/dist/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAoB,KAAK,oBAAoB,EAAiB,MAAM,qBAAqB,CAAC;AAajG,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,eAAO,MAAM,iBAAiB,EAAE,oBA0B/B,CAAC"}

package/dist/profile.js

@@ -0,0 +1,39 @@
+/**
+ * `OAuthProviderProfile` for the OpenAI Codex (ChatGPT Pro/Plus) provider.
+ * Drives both `runOauthLogin` (interactive) and `ensureFreshTokens`
+ * (pre-request refresh) from `@moxxy/plugin-oauth`. Codex-specific
+ * concerns:
+ *   - the non-standard OpenAI device-flow dialect (via `openaiDeviceFlow`)
+ *   - `chatgpt_account_id` extraction from id_token / access_token JWTs
+ *   - the bundled-CLI auth flags (`id_token_add_organizations`, etc.)
+ */
+import { openaiDeviceFlow } from '@moxxy/plugin-oauth';
+import { AUTHORIZE_URL, CLIENT_ID, DEFAULT_CALLBACK_PORT, DEFAULT_REDIRECT_PATH, ISSUER, ORIGINATOR, SCOPES, TOKEN_URL, extractAccountId, } from './oauth.js';
+export const CODEX_PROVIDER_ID = 'openai-codex';
+export const codexOauthProfile = {
+    id: CODEX_PROVIDER_ID,
+    displayName: 'ChatGPT Pro/Plus',
+    authUrl: AUTHORIZE_URL,
+    tokenUrl: TOKEN_URL,
+    clientId: CLIENT_ID,
+    scopes: SCOPES.split(' '),
+    // These flags are what codex-rs / opencode pass; without them the
+    // returned id_token won't carry the chatgpt_account_id / organizations
+    // claims we need to populate the ChatGPT-Account-Id header.
+    extraAuthParams: {
+        id_token_add_organizations: 'true',
+        codex_cli_simplified_flow: 'true',
+        originator: ORIGINATOR,
+    },
+    redirect: { port: DEFAULT_CALLBACK_PORT, path: DEFAULT_REDIRECT_PATH },
+    deviceFlow: openaiDeviceFlow({
+        issuer: ISSUER,
+        tokenUrl: TOKEN_URL,
+        verificationUri: `${ISSUER}/codex/device`,
+    }),
+    extractAccountId: (tokens) => extractAccountId({
+        ...(tokens.idToken ? { id_token: tokens.idToken } : {}),
+        access_token: tokens.accessToken,
+    }),
+};
+//# sourceMappingURL=profile.js.map

package/dist/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAA4C,MAAM,qBAAqB,CAAC;AACjG,OAAO,EACL,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,EACN,UAAU,EACV,MAAM,EACN,SAAS,EACT,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,MAAM,CAAC,MAAM,iBAAiB,GAAyB;IACrD,EAAE,EAAE,iBAAiB;IACrB,WAAW,EAAE,kBAAkB;IAC/B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IACzB,kEAAkE;IAClE,uEAAuE;IACvE,4DAA4D;IAC5D,eAAe,EAAE;QACf,0BAA0B,EAAE,MAAM;QAClC,yBAAyB,EAAE,MAAM;QACjC,UAAU,EAAE,UAAU;KACvB;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACtE,UAAU,EAAE,gBAAgB,CAAC;QAC3B,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,SAAS;QACnB,eAAe,EAAE,GAAG,MAAM,eAAe;KAC1C,CAAC;IACF,gBAAgB,EAAE,CAAC,MAAgB,EAAE,EAAE,CACrC,gBAAgB,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,YAAY,EAAE,MAAM,CAAC,WAAW;KACjC,CAAC;CACL,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,79 @@
+import type { LLMProvider, ProviderEvent, ProviderRequest } from '@moxxy/sdk';
+import type { CodexTokens } from './types.js';
+export interface CodexProviderConfig {
+    readonly tokens?: CodexTokens;
+    /**
+     * Called with the new token bundle whenever an in-process refresh happens.
+     * The CLI's setup wires this to a vault writeback so the refreshed
+     * refresh_token (single-use, rotates on every refresh) is persisted
+     * before the next API call goes out.
+     */
+    readonly onTokensRefreshed?: (next: CodexTokens) => void | Promise<void>;
+    /**
+     * Re-reads the persisted token bundle (the vault) and returns it, or null
+     * when nothing is stored. The refresh token is SINGLE-USE and rotates on
+     * every refresh, so when another consumer/process refreshes first, this is
+     * how the provider picks up the rotated bundle instead of burning a dead
+     * token: it's consulted under the per-credential lock before refreshing,
+     * and once more to retry after an invalid_grant-style rejection.
+     */
+    readonly reloadTokens?: () => Promise<CodexTokens | null>;
+    readonly defaultModel?: string;
+    /**
+     * Reasoning effort sent with every request (`reasoning.effort`).
+     * Defaults to `'medium'`. Reaches here from `provider.config` in
+     * moxxy.config.ts (e.g. `{ reasoningEffort: 'high' }`); the CLI's
+     * credential resolution merges that config through to `createClient`.
+     */
+    readonly reasoningEffort?: 'low' | 'medium' | 'high';
+    /** Test seam — when omitted we use the global `fetch`. */
+    readonly fetch?: typeof fetch;
+    /** Test seam — when omitted we use crypto.randomUUID for the per-request session id. */
+    readonly sessionIdProvider?: () => string;
+    /**
+     * Idle timeout (ms) for the streaming request: the watchdog aborts the call if
+     * the backend goes silent for this long (stalled handshake or mid-stream
+     * silence). Reset on every received byte, so slow-but-alive streams survive.
+     * Defaults to {@link CODEX_IDLE_TIMEOUT_MS}; mainly a test seam.
+     */
+    readonly idleTimeoutMs?: number;
+}
+/**
+ * LLMProvider implementation against the ChatGPT-plan Codex backend. Auth is
+ * an OAuth bearer plus the optional ChatGPT-Account-Id header; the rest of
+ * the request body is the OpenAI Responses-API shape.
+ *
+ * Request-param support: `req.maxTokens` maps to the Responses
+ * `max_output_tokens` field; `req.temperature` is NOT forwarded — the Codex
+ * backend only serves gpt-5-family reasoning models, which reject sampling
+ * params with a 400, so it is dropped (with a one-shot MOXXY_DEBUG note)
+ * instead of breaking the request. Reasoning effort is configurable via
+ * `CodexProviderConfig.reasoningEffort` (default `'medium'`).
+ */
+export declare class CodexProvider implements LLMProvider {
+    readonly name = "openai-codex";
+    readonly models: readonly import("@moxxy/sdk").ModelDescriptor[];
+    private tokens;
+    private readonly onTokensRefreshed?;
+    private readonly reloadTokens?;
+    private readonly defaultModel;
+    private readonly reasoningEffort?;
+    private readonly fetchImpl;
+    private readonly sessionIdProvider;
+    private readonly idleTimeoutMs;
+    constructor(config?: CodexProviderConfig);
+    stream(req: ProviderRequest): AsyncIterable<ProviderEvent>;
+    countTokens(req: Pick<ProviderRequest, 'model' | 'messages' | 'system' | 'tools'>): Promise<number>;
+    private postCodex;
+    private ensureFresh;
+    /**
+     * Refresh + persist under the per-credential lock. The refresh token is
+     * SINGLE-USE (rotated + invalidated on every refresh), so concurrent
+     * refreshers — a second stream in this process, the whisper-stt
+     * transcriber sharing this credential, or another moxxy process — must
+     * serialize and coalesce: whoever holds the lock refreshes once, everyone
+     * queued behind it adopts the rotated bundle instead of burning it.
+     */
+    private refreshNow;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,eAAe,EAChB,MAAM,YAAY,CAAC;AAQpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA0B9C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrD,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,YAAW,WAAW;IAC/C,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,MAAM,kDAAe;IAE9B,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA8C;IACjF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAoC;IAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAA4B;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAe;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,GAAE,mBAAwB;IAmBrC,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,aAAa,CAAC,aAAa,CAAC;IAiH3D,WAAW,CACf,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC,GACpE,OAAO,CAAC,MAAM,CAAC;IAiBlB,OAAO,CAAC,SAAS;YAUH,WAAW;IAWzB;;;;;;;OAOG;YACW,UAAU;CA4CzB"}