@moxxy/plugin-provider-openai-codex 0.21.1

package/dist/provider.js

@@ -0,0 +1,306 @@
+import { webcrypto } from 'node:crypto';
+import { classifyHttpStatus, estimateTextTokens } from '@moxxy/sdk';
+import { isAuthRejection, withCredentialLock } from '@moxxy/plugin-oauth';
+import { CODEX_RESPONSES_URL, refreshTokens } from './oauth.js';
+import { codexModels, DEFAULT_CODEX_MODEL } from './models.js';
+import { toResponsesBody } from './translate.js';
+import { buildCodexHeaders } from './codex/headers.js';
+import { consumeResponsesSse, toErrorEvent } from './codex/stream-consumer.js';
+/**
+ * Internal idle timeout (ms). Guards the whole streaming path against a backend
+ * that accepts the POST but then stalls — pre-headers slow-loris, a dropped TCP
+ * with no RST, or a wedged proxy — when the caller supplied no AbortSignal. The
+ * watchdog is reset on every received byte, so a slow-but-alive reasoning stream
+ * is never killed; only a stream that goes silent for this long aborts.
+ */
+const CODEX_IDLE_TIMEOUT_MS = 120_000;
+/**
+ * Read the error-response body but cap how much we pull into memory: a hostile
+ * or broken backend (or MITM) could otherwise stream a multi-megabyte error body
+ * that we'd buffer in full and then interpolate into an error string.
+ */
+const MAX_ERROR_BODY_CHARS = 2048;
+/**
+ * Flat token estimate charged per non-text content block (image/document) in
+ * `countTokens`. A coarse stand-in for the provider's real multimodal token
+ * accounting — enough to keep pre-flight budgeting from treating a multimodal
+ * request as if it were nearly empty.
+ */
+const NON_TEXT_BLOCK_TOKENS = 256;
+/**
+ * LLMProvider implementation against the ChatGPT-plan Codex backend. Auth is
+ * an OAuth bearer plus the optional ChatGPT-Account-Id header; the rest of
+ * the request body is the OpenAI Responses-API shape.
+ *
+ * Request-param support: `req.maxTokens` maps to the Responses
+ * `max_output_tokens` field; `req.temperature` is NOT forwarded — the Codex
+ * backend only serves gpt-5-family reasoning models, which reject sampling
+ * params with a 400, so it is dropped (with a one-shot MOXXY_DEBUG note)
+ * instead of breaking the request. Reasoning effort is configurable via
+ * `CodexProviderConfig.reasoningEffort` (default `'medium'`).
+ */
+export class CodexProvider {
+    name = 'openai-codex';
+    models = codexModels;
+    tokens;
+    onTokensRefreshed;
+    reloadTokens;
+    defaultModel;
+    reasoningEffort;
+    fetchImpl;
+    sessionIdProvider;
+    idleTimeoutMs;
+    constructor(config = {}) {
+        if (config.tokens)
+            this.tokens = config.tokens;
+        if (config.onTokensRefreshed)
+            this.onTokensRefreshed = config.onTokensRefreshed;
+        if (config.reloadTokens)
+            this.reloadTokens = config.reloadTokens;
+        this.defaultModel = config.defaultModel ?? DEFAULT_CODEX_MODEL;
+        if (config.reasoningEffort)
+            this.reasoningEffort = config.reasoningEffort;
+        this.fetchImpl = config.fetch ?? fetch;
+        // Default to ONE id for the instance's lifetime, not a fresh uuid per call.
+        // The session id becomes the `prompt_cache_key`, so it must be stable
+        // across a session's turns for the Responses prefix cache to hit (and the
+        // `session_id` header should be stable for one logical session too).
+        const defaultSessionId = webcrypto.randomUUID();
+        this.sessionIdProvider = config.sessionIdProvider ?? (() => defaultSessionId);
+        this.idleTimeoutMs =
+            config.idleTimeoutMs && config.idleTimeoutMs > 0
+                ? config.idleTimeoutMs
+                : CODEX_IDLE_TIMEOUT_MS;
+    }
+    async *stream(req) {
+        const model = req.model || this.defaultModel;
+        yield { type: 'message_start', model };
+        try {
+            await this.ensureFresh();
+        }
+        catch (err) {
+            yield toErrorEvent(err);
+            return;
+        }
+        const sessionId = this.sessionIdProvider();
+        // Reasoning preview is gated by the per-provider toggle (`req.reasoning`):
+        // when off we behave exactly as before (discard reasoning). The per-call
+        // effort, when set, overrides the instance default from provider config.
+        const emitReasoning = req.reasoning != null && req.reasoning !== false;
+        const reqEffort = typeof req.reasoning === 'object' ? req.reasoning.effort : undefined;
+        const reasoningEffort = reqEffort ?? this.reasoningEffort;
+        // Pass the session id as the Responses prefix-cache key so repeated turns
+        // in a session reuse the cached prefix (cheaper + faster). Codex DOES
+        // support this even though the Chat-Completions providers ignore cacheHints.
+        const body = toResponsesBody({ ...req, model }, {
+            sessionHint: sessionId,
+            ...(reasoningEffort ? { reasoningEffort } : {}),
+        });
+        // Internal idle watchdog: aborts the request if the backend stalls (accepts
+        // the POST but never sends headers/body, or goes silent mid-stream) so the
+        // turn can't hang forever when the caller supplied no AbortSignal. Composed
+        // with `req.signal` so a caller cancellation still wins, and reset on every
+        // received byte by `consumeResponsesSse`'s onActivity callback.
+        const idleController = new AbortController();
+        let idleTimer;
+        const armIdle = () => {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            idleTimer = setTimeout(() => idleController.abort(new Error('Codex request timed out (no response from server)')), this.idleTimeoutMs);
+            // A bare timer must not keep the event loop alive on its own.
+            idleTimer.unref?.();
+        };
+        const disarmIdle = () => {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            idleTimer = undefined;
+        };
+        const signal = req.signal
+            ? AbortSignal.any([req.signal, idleController.signal])
+            : idleController.signal;
+        try {
+            armIdle();
+            let response;
+            try {
+                response = await this.postCodex(body, sessionId, signal);
+            }
+            catch (err) {
+                yield toErrorEvent(err);
+                return;
+            }
+            if (response.status === 401) {
+                // Token might've been revoked between our pre-check and send; try one
+                // forced refresh and replay. A second 401 is fatal.
+                try {
+                    await this.refreshNow();
+                    armIdle();
+                    response = await this.postCodex(body, sessionId, signal);
+                }
+                catch (err) {
+                    yield toErrorEvent(err);
+                    return;
+                }
+                // A 401 that survives a forced refresh means the OAuth grant itself was
+                // rejected (expired/revoked), not a transient skew. Surface the same
+                // actionable re-auth guidance as ensureFresh rather than the generic
+                // "returned 401" HTTP message below.
+                if (response.status === 401) {
+                    yield {
+                        type: 'error',
+                        message: 'ChatGPT OAuth credentials were rejected after a token refresh. Run `moxxy login openai-codex` to re-authenticate.',
+                        retryable: false,
+                    };
+                    return;
+                }
+            }
+            if (!response.ok || !response.body) {
+                // Cap the buffered error body: a hostile/broken backend could otherwise
+                // stream a huge body that we'd hold in full and then put into a string.
+                const text = await readCappedText(response, MAX_ERROR_BODY_CHARS);
+                // Derive the retryable verdict from the SDK's status classifier so it
+                // stays consistent with the rest of moxxy (429 + 5xx are retryable).
+                const classified = classifyHttpStatus(response.status);
+                const retryable = classified?.code === 'PROVIDER_RATE_LIMITED' ||
+                    classified?.code === 'PROVIDER_SERVER_ERROR';
+                yield {
+                    type: 'error',
+                    message: `Codex /responses returned ${response.status}: ${text || response.statusText}`,
+                    retryable,
+                };
+                return;
+            }
+            yield* consumeResponsesSse(response.body, signal, emitReasoning, armIdle);
+        }
+        finally {
+            disarmIdle();
+        }
+    }
+    async countTokens(req) {
+        // Only sum text. For non-text blocks (image/document) we add a flat per-block
+        // estimate instead of JSON.stringify-ing the base64 `data`, which would be a
+        // multi-megabyte transient allocation AND a meaningless token count (base64
+        // char length, not visual tokens) that skews any pre-flight budgeting.
+        let blob = req.system ?? '';
+        let nonTextBlocks = 0;
+        for (const m of req.messages) {
+            for (const c of m.content) {
+                if ('text' in c && typeof c.text === 'string')
+                    blob += c.text;
+                else
+                    nonTextBlocks += 1;
+            }
+        }
+        blob += (req.tools ?? []).map((t) => t.name + t.description).join('');
+        return estimateTextTokens(blob) + nonTextBlocks * NON_TEXT_BLOCK_TOKENS;
+    }
+    postCodex(body, sessionId, signal) {
+        if (!this.tokens)
+            throw new Error('No tokens');
+        return this.fetchImpl(CODEX_RESPONSES_URL, {
+            method: 'POST',
+            headers: buildCodexHeaders(this.tokens, sessionId),
+            body: JSON.stringify(body),
+            ...(signal ? { signal } : {}),
+        });
+    }
+    async ensureFresh() {
+        if (!this.tokens) {
+            throw new Error('No ChatGPT OAuth credentials available. Run `moxxy login openai-codex` to sign in.');
+        }
+        // 60s skew window — refresh proactively if the token will die very soon.
+        if (this.tokens.expires > Date.now() + 60_000)
+            return;
+        await this.refreshNow();
+    }
+    /**
+     * Refresh + persist under the per-credential lock. The refresh token is
+     * SINGLE-USE (rotated + invalidated on every refresh), so concurrent
+     * refreshers — a second stream in this process, the whisper-stt
+     * transcriber sharing this credential, or another moxxy process — must
+     * serialize and coalesce: whoever holds the lock refreshes once, everyone
+     * queued behind it adopts the rotated bundle instead of burning it.
+     */
+    async refreshNow() {
+        const entry = this.tokens;
+        if (!entry) {
+            throw new Error('Cannot refresh — no stored tokens.');
+        }
+        await withCredentialLock(`oauth-${this.name}`, async () => {
+            // Coalesce in-process: another stream refreshed while we waited.
+            if (this.tokens && this.tokens.access !== entry.access)
+                return;
+            // Coalesce cross-process/cross-consumer: adopt a fresher persisted
+            // bundle (and at minimum its rotated refresh token) when available.
+            let attempt = this.tokens ?? entry;
+            if (this.reloadTokens) {
+                const latest = await this.reloadTokens().catch(() => null);
+                if (latest && latest.access !== attempt.access && latest.expires > Date.now() + 60_000) {
+                    this.tokens = withAccountId(latest, latest.accountId ?? attempt.accountId);
+                    return;
+                }
+                if (latest?.refresh)
+                    attempt = { ...attempt, refresh: latest.refresh };
+            }
+            let next;
+            try {
+                next = await refreshTokens(attempt.refresh, this.fetchImpl);
+            }
+            catch (err) {
+                // invalid_grant-style rejection: someone rotated our refresh token
+                // away after the reload above. Re-read once and retry with the
+                // fresher token before surfacing the failure.
+                const latest = isAuthRejection(err) && this.reloadTokens
+                    ? await this.reloadTokens().catch(() => null)
+                    : null;
+                if (!latest?.refresh || latest.refresh === attempt.refresh)
+                    throw err;
+                next = await refreshTokens(latest.refresh, this.fetchImpl);
+            }
+            // Preserve a previously known accountId if the refresh response didn't
+            // re-issue an id_token. Without this we'd silently lose the
+            // ChatGPT-Account-Id header on every refresh.
+            const merged = withAccountId(next, next.accountId ?? attempt.accountId);
+            this.tokens = merged;
+            if (this.onTokensRefreshed) {
+                // Persist BEFORE the caller issues the API call so a crash here
+                // doesn't strand an unwritten refresh token in memory.
+                await this.onTokensRefreshed(merged);
+            }
+        });
+    }
+}
+function withAccountId(tokens, accountId) {
+    return accountId
+        ? { access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, accountId }
+        : { access: tokens.access, refresh: tokens.refresh, expires: tokens.expires };
+}
+/**
+ * Read an error-response body but stop once `maxChars` is reached, then release
+ * the socket. Avoids pulling a hostile/broken multi-megabyte error body fully
+ * into memory just to put a prefix of it in an error message. Decode failures or
+ * a missing body yield `''` so the caller falls back to `response.statusText`.
+ */
+async function readCappedText(response, maxChars) {
+    const body = response.body;
+    if (!body)
+        return '';
+    const reader = body.getReader();
+    const decoder = new TextDecoder('utf-8');
+    let out = '';
+    try {
+        while (out.length < maxChars) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            out += decoder.decode(value, { stream: true });
+        }
+        return out.slice(0, maxChars);
+    }
+    catch {
+        return out.slice(0, maxChars);
+    }
+    finally {
+        reader.cancel().catch(() => { });
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAMxC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/E;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAyClC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,cAAc,CAAC;IACtB,MAAM,GAAG,WAAW,CAAC;IAEtB,MAAM,CAA0B;IACvB,iBAAiB,CAA+C;IAChE,YAAY,CAAqC;IACjD,YAAY,CAAS;IACrB,eAAe,CAA6B;IAC5C,SAAS,CAAe;IACxB,iBAAiB,CAAe;IAChC,aAAa,CAAS;IAEvC,YAAY,SAA8B,EAAE;QAC1C,IAAI,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,CAAC,iBAAiB;YAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAChF,IAAI,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACjE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,mBAAmB,CAAC;QAC/D,IAAI,MAAM,CAAC,eAAe;YAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;QACvC,4EAA4E;QAC5E,sEAAsE;QACtE,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,gBAAgB,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC;gBAC9C,CAAC,CAAC,MAAM,CAAC,aAAa;gBACtB,CAAC,CAAC,qBAAqB,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,GAAoB;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC;QACvE,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,eAAe,GAAG,SAAS,IAAI,IAAI,CAAC,eAAe,CAAC;QAC1D,0EAA0E;QAC1E,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,IAAI,GAAG,eAAe,CAC1B,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EACjB;YACE,WAAW,EAAE,SAAS;YACtB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CACF,CAAC;QAEF,4EAA4E;QAC5E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,gEAAgE;QAChE,MAAM,cAAc,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,SAAoD,CAAC;QACzD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS,GAAG,UAAU,CACpB,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,EAC1F,IAAI,CAAC,aAAa,CACnB,CAAC;YACF,8DAA8D;YAC9D,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,GAAS,EAAE;YAC5B,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM;YACvB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;QAE1B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC;YACV,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,sEAAsE;gBACtE,oDAAoD;gBACpD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,OAAO,EAAE,CAAC;oBACV,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC3D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,wEAAwE;gBACxE,qEAAqE;gBACrE,qEAAqE;gBACrE,qCAAqC;gBACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM;wBACJ,IAAI,EAAE,OAAO;wBACb,OAAO,EACL,mHAAmH;wBACrH,SAAS,EAAE,KAAK;qBACjB,CAAC;oBACF,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,wEAAwE;gBACxE,wEAAwE;gBACxE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;gBAClE,sEAAsE;gBACtE,qEAAqE;gBACrE,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACvD,MAAM,SAAS,GACb,UAAU,EAAE,IAAI,KAAK,uBAAuB;oBAC5C,UAAU,EAAE,IAAI,KAAK,uBAAuB,CAAC;gBAC/C,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,6BAA6B,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE;oBACvF,SAAS;iBACV,CAAC;gBACF,OAAO;YACT,CAAC;YAED,KAAK,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC;gBAAS,CAAC;YACT,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,GAAqE;QAErE,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAAE,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC;;oBACzD,aAAa,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,aAAa,GAAG,qBAAqB,CAAC;IAC1E,CAAC;IAEO,SAAS,CAAC,IAAa,EAAE,SAAiB,EAAE,MAA+B;QACjF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAAE,OAAO;QACtD,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,UAAU;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,kBAAkB,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;YACxD,iEAAiE;YACjE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO;YAC/D,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;YACnC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3D,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;oBACvF,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACzE,CAAC;YACD,IAAI,IAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,+DAA+D;gBAC/D,8CAA8C;gBAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY;oBACtD,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;oBAC7C,CAAC,CAAC,IAAI,CAAC;gBACT,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC;gBACtE,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7D,CAAC;YACD,uEAAuE;YACvE,4DAA4D;YAC5D,8CAA8C;YAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,gEAAgE;gBAChE,uDAAuD;gBACvD,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,SAA6B;IACvE,OAAO,SAAS;QACd,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE;QACxF,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,QAAgB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/translate.d.ts

@@ -0,0 +1,77 @@
+import { type ProviderMessage, type ProviderRequest, type ToolDef } from '@moxxy/sdk';
+/**
+ * Responses-API "input" item shape. We only emit the subset codex uses:
+ * - `message` items with role + a string-or-rich content
+ * - `function_call` items (assistant tool invocations replayed back)
+ * - `function_call_output` items (tool results)
+ */
+type ResponsesInputItem = {
+    type: 'message';
+    role: 'user' | 'assistant' | 'system';
+    content: ReadonlyArray<ResponsesContent>;
+} | {
+    type: 'function_call';
+    call_id: string;
+    name: string;
+    arguments: string;
+} | {
+    type: 'function_call_output';
+    call_id: string;
+    output: string;
+};
+type ResponsesContent = {
+    type: 'input_text';
+    text: string;
+} | {
+    type: 'output_text';
+    text: string;
+} | {
+    type: 'input_image';
+    image_url: string;
+} | {
+    type: 'input_file';
+    filename?: string;
+    file_data: string;
+};
+interface ResponsesTool {
+    type: 'function';
+    name: string;
+    description: string;
+    parameters: unknown;
+    strict?: boolean;
+}
+export interface ResponsesBody {
+    model: string;
+    instructions?: string;
+    input: ResponsesInputItem[];
+    tools?: ResponsesTool[];
+    parallel_tool_calls?: boolean;
+    reasoning?: {
+        effort?: 'low' | 'medium' | 'high';
+        summary?: 'auto' | 'detailed';
+    };
+    store?: boolean;
+    stream: true;
+    prompt_cache_key?: string;
+    include?: string[];
+}
+/**
+ * Extract any system-role text from a message array. Used to hoist the
+ * system prompt into the top-level `instructions` field — the Responses
+ * API rejects requests with a missing/empty `instructions`, and our
+ * upstream loop helpers push the system prompt in as a `role: 'system'`
+ * message. `explicitSystem` (`ProviderRequest.system`) is the
+ * hook-injection side channel — extra per-request system text appended
+ * AFTER the message-derived prompt, matching how the other providers
+ * deliver it.
+ */
+export declare function extractSystemText(messages: ReadonlyArray<ProviderMessage>, explicitSystem?: string): string;
+export declare function toResponsesInput(messages: ReadonlyArray<ProviderMessage>): ResponsesInputItem[];
+export declare function toResponsesTools(tools: ReadonlyArray<ToolDef>): ResponsesTool[];
+export interface BuildBodyOptions {
+    readonly sessionHint?: string;
+    readonly reasoningEffort?: 'low' | 'medium' | 'high';
+}
+export declare function toResponsesBody(req: ProviderRequest, opts?: BuildBodyOptions): ResponsesBody;
+export {};
+//# sourceMappingURL=translate.d.ts.map

package/dist/translate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.d.ts","sourceRoot":"","sources":["../src/translate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEvG;;;;;GAKG;AACH,KAAK,kBAAkB,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAA;CAAE,GACpG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,KAAK,gBAAgB,GACjB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,UAAU,aAAa;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAC;IAClF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,IAAI,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CAMpB;AAuBD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,EACxC,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,CAUR;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,kBAAkB,EAAE,CAmD/F;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,aAAa,EAAE,CAO/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtD;AAkDD,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,GAAE,gBAAqB,GAAG,aAAa,CAiBhG"}

package/dist/translate.js

@@ -0,0 +1,172 @@
+import { zodToJsonSchema } from '@moxxy/sdk';
+function contentBlocksToInputText(role, blocks) {
+    const out = [];
+    for (const block of blocks) {
+        if (block.type === 'text') {
+            out.push(role === 'assistant' ? { type: 'output_text', text: block.text } : { type: 'input_text', text: block.text });
+        }
+        else if (block.type === 'image') {
+            out.push({ type: 'input_image', image_url: `data:${block.mediaType};base64,${block.data}` });
+        }
+        else if (block.type === 'document') {
+            out.push({
+                type: 'input_file',
+                ...(block.name ? { filename: block.name } : {}),
+                file_data: `data:${block.mediaType};base64,${block.data}`,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Extract any system-role text from a message array. Used to hoist the
+ * system prompt into the top-level `instructions` field — the Responses
+ * API rejects requests with a missing/empty `instructions`, and our
+ * upstream loop helpers push the system prompt in as a `role: 'system'`
+ * message. `explicitSystem` (`ProviderRequest.system`) is the
+ * hook-injection side channel — extra per-request system text appended
+ * AFTER the message-derived prompt, matching how the other providers
+ * deliver it.
+ */
+export function extractSystemText(messages, explicitSystem) {
+    const parts = [];
+    for (const msg of messages) {
+        if (msg.role !== 'system')
+            continue;
+        for (const block of msg.content) {
+            if (block.type === 'text' && block.text)
+                parts.push(block.text);
+        }
+    }
+    if (explicitSystem && explicitSystem.trim())
+        parts.push(explicitSystem);
+    return parts.join('\n\n');
+}
+export function toResponsesInput(messages) {
+    const out = [];
+    for (const msg of messages) {
+        if (msg.role === 'system') {
+            // System prompt is hoisted to top-level `instructions` by
+            // `toResponsesBody`; don't duplicate it as an input message too.
+            continue;
+        }
+        if (msg.role === 'user') {
+            const content = contentBlocksToInputText('user', msg.content);
+            if (content.length > 0) {
+                out.push({ type: 'message', role: 'user', content });
+            }
+            else if (msg.content.length > 0) {
+                // The message carried blocks but none translated (unhandled block types):
+                // keep the turn with an empty input_text so we don't silently drop it
+                // from the request and lose conversational context.
+                out.push({ type: 'message', role: 'user', content: [{ type: 'input_text', text: '' }] });
+            }
+            continue;
+        }
+        if (msg.role === 'assistant') {
+            const text = msg.content
+                .filter((c) => c.type === 'text')
+                .map((c) => c.text)
+                .join('');
+            if (text)
+                out.push({ type: 'message', role: 'assistant', content: [{ type: 'output_text', text }] });
+            for (const block of msg.content) {
+                if (block.type === 'tool_use') {
+                    out.push({
+                        type: 'function_call',
+                        call_id: block.id,
+                        name: block.name,
+                        arguments: JSON.stringify(block.input ?? {}),
+                    });
+                }
+            }
+            continue;
+        }
+        if (msg.role === 'tool_result') {
+            for (const block of msg.content) {
+                if (block.type === 'tool_result') {
+                    out.push({
+                        type: 'function_call_output',
+                        call_id: block.toolUseId,
+                        output: block.content,
+                    });
+                }
+            }
+        }
+    }
+    return out;
+}
+export function toResponsesTools(tools) {
+    return tools.map((t) => ({
+        type: 'function',
+        name: t.name,
+        description: t.description,
+        parameters: (t.inputJsonSchema ?? zodToJsonSchema(t.inputSchema)),
+    }));
+}
+/**
+ * Default `instructions` value used when the caller supplies neither
+ * `req.system` nor a system-role message. The Codex backend rejects
+ * requests with an empty `instructions` field (`400: Instructions are
+ * required`), so we always send something — falling back to a minimal
+ * agent identity matches what codex-rs does for plain `codex exec` runs.
+ */
+const DEFAULT_INSTRUCTIONS = 'You are a helpful coding assistant.';
+/**
+ * One-shot debug note for the unsupported `temperature` param. The Codex
+ * backend only serves gpt-5-family reasoning models, which reject
+ * sampling params with `400: Unsupported parameter: 'temperature'` — so
+ * rather than forward it and break every request, we drop it and (once
+ * per process, only with MOXXY_DEBUG set) say so instead of silently
+ * eating the option.
+ */
+let temperatureNoteShown = false;
+function noteTemperatureUnsupported() {
+    if (temperatureNoteShown)
+        return;
+    temperatureNoteShown = true;
+    if (process.env.MOXXY_DEBUG) {
+        console.debug('[openai-codex] ProviderRequest.temperature is not supported by the Codex ' +
+            'Responses backend (gpt-5 reasoning models reject sampling params); ignoring it.');
+    }
+}
+/**
+ * One-shot debug note for the unsupported `maxTokens` param. Unlike the
+ * platform Responses API, the ChatGPT-plan Codex backend rejects
+ * `max_output_tokens` with `400: {"detail":"Unsupported parameter:
+ * max_output_tokens"}` — observed live when `workflow_create` passed a draft
+ * budget. Same policy as temperature: drop it instead of breaking the request.
+ */
+let maxTokensNoteShown = false;
+function noteMaxTokensUnsupported() {
+    if (maxTokensNoteShown)
+        return;
+    maxTokensNoteShown = true;
+    if (process.env.MOXXY_DEBUG) {
+        console.debug('[openai-codex] ProviderRequest.maxTokens is not supported by the Codex ' +
+            'Responses backend (400 Unsupported parameter: max_output_tokens); ignoring it.');
+    }
+}
+export function toResponsesBody(req, opts = {}) {
+    const instructions = extractSystemText(req.messages, req.system) || DEFAULT_INSTRUCTIONS;
+    const body = {
+        model: req.model,
+        instructions,
+        input: toResponsesInput(req.messages),
+        stream: true,
+        store: false,
+        parallel_tool_calls: true,
+        reasoning: { effort: opts.reasoningEffort ?? 'medium', summary: 'auto' },
+        include: ['reasoning.encrypted_content'],
+    };
+    if (req.tools && req.tools.length > 0)
+        body.tools = toResponsesTools(req.tools);
+    if (opts.sessionHint)
+        body.prompt_cache_key = opts.sessionHint;
+    if (req.maxTokens !== undefined)
+        noteMaxTokensUnsupported();
+    if (req.temperature !== undefined)
+        noteTemperatureUnsupported();
+    return body;
+}
+//# sourceMappingURL=translate.js.map

package/dist/translate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"translate.js","sourceRoot":"","sources":["../src/translate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA4D,MAAM,YAAY,CAAC;AA6CvG,SAAS,wBAAwB,CAC/B,IAA0B,EAC1B,MAAkC;IAElC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,YAAY;gBAClB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,SAAS,EAAE,QAAQ,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC,IAAI,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwC,EACxC,cAAuB;IAEvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACpC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAwC;IACvE,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,0DAA0D;YAC1D,iEAAiE;YACjE,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,0EAA0E;gBAC1E,sEAAsE;gBACtE,oDAAoD;gBACpD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO;iBACrB,MAAM,CAAC,CAAC,CAAC,EAAuC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;iBACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACrG,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;qBAC7C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACjC,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,KAAK,CAAC,SAAS;wBACxB,MAAM,EAAE,KAAK,CAAC,OAAO;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,UAAmB;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAY;KAC7E,CAAC,CAAC,CAAC;AACN,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAEnE;;;;;;;GAOG;AACH,IAAI,oBAAoB,GAAG,KAAK,CAAC;AACjC,SAAS,0BAA0B;IACjC,IAAI,oBAAoB;QAAE,OAAO;IACjC,oBAAoB,GAAG,IAAI,CAAC;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,2EAA2E;YACzE,iFAAiF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAC/B,SAAS,wBAAwB;IAC/B,IAAI,kBAAkB;QAAE,OAAO;IAC/B,kBAAkB,GAAG,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,yEAAyE;YACvE,gFAAgF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,OAAyB,EAAE;IAC/E,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC;IACzF,MAAM,IAAI,GAAkB;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY;QACZ,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,KAAK;QACZ,mBAAmB,EAAE,IAAI;QACzB,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,IAAI,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACxE,OAAO,EAAE,CAAC,6BAA6B,CAAC;KACzC,CAAC;IACF,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC;IAC/D,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,wBAAwB,EAAE,CAAC;IAC5D,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,0BAA0B,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * OAuth credentials for the OpenAI Codex (ChatGPT Pro/Plus) provider.
+ * `expires` is an absolute epoch-millis timestamp so a paused process resumes
+ * with a correct refresh decision regardless of clock drift across runs.
+ */
+export interface CodexTokens {
+    readonly access: string;
+    readonly refresh: string;
+    readonly expires: number;
+    readonly accountId?: string;
+}
+export interface PkceCodes {
+    readonly verifier: string;
+    readonly challenge: string;
+}
+/**
+ * Raw shape returned by https://auth.openai.com/oauth/token. Used internally
+ * by `exchangeCodeForTokens` / `refreshTokens` before normalization.
+ */
+export interface OAuthTokenResponse {
+    readonly id_token?: string;
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly expires_in?: number;
+    readonly token_type?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}