@openai-oauth/local 2.0.0-beta.2 → 2.0.0-beta.4

package/dist/auth-file-entry.d.ts

@@ -0,0 +1,3 @@
+export type { AuthLoaderOptions, EffectiveAuth, SaveAuthTokensOptions, SavedAuthTokens, } from "./auth-file.js";
+export { loadAuthTokens, resolveAuthFileCandidates, resolveCodexAuthFilePath, saveAuthTokens, } from "./auth-file.js";
+//# sourceMappingURL=auth-file-entry.d.ts.map

package/dist/auth-file-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-file-entry.d.ts","sourceRoot":"","sources":["../src/auth-file-entry.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,eAAe,GACf,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,GACd,MAAM,gBAAgB,CAAA"}

package/dist/auth-file-entry.js

@@ -0,0 +1 @@
+export { loadAuthTokens, resolveAuthFileCandidates, resolveCodexAuthFilePath, saveAuthTokens, } from "./auth-file.js";

package/dist/auth-file.d.ts

@@ -0,0 +1,33 @@
+import { type FetchFunction, type OpenAIOAuthTokenResponse } from "@openai-oauth/core";
+export type EffectiveAuth = {
+    accessToken: string;
+    accountId: string;
+    isFedRamp?: boolean;
+    idToken?: string;
+    refreshToken?: string;
+    sourcePath?: string;
+    lastRefresh?: string;
+};
+export type AuthLoaderOptions = {
+    clientId?: string;
+    issuer?: string;
+    tokenUrl?: string;
+    authFilePath?: string;
+    fetch: FetchFunction;
+    ensureFresh?: boolean;
+    now?: () => Date;
+};
+export type SaveAuthTokensOptions = {
+    token: OpenAIOAuthTokenResponse;
+    authFilePath?: string;
+    now?: () => Date;
+};
+export type SavedAuthTokens = {
+    path: string;
+    auth: EffectiveAuth;
+};
+export declare const resolveAuthFileCandidates: (authFilePath?: string) => string[];
+export declare const resolveCodexAuthFilePath: (authFilePath?: string) => string;
+export declare const saveAuthTokens: (options: SaveAuthTokensOptions) => Promise<SavedAuthTokens>;
+export declare const loadAuthTokens: (options: AuthLoaderOptions) => Promise<EffectiveAuth>;
+//# sourceMappingURL=auth-file.d.ts.map

package/dist/auth-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-file.d.ts","sourceRoot":"","sources":["../src/auth-file.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAG7B,MAAM,oBAAoB,CAAA;AAoB3B,MAAM,MAAM,aAAa,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,aAAa,CAAA;IACpB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,wBAAwB,CAAA;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,aAAa,CAAA;CACnB,CAAA;AAiED,eAAO,MAAM,yBAAyB,GAAI,eAAe,MAAM,KAAG,MAAM,EAgBvE,CAAA;AAsGD,eAAO,MAAM,wBAAwB,GAAI,eAAe,MAAM,KAAG,MAUhE,CAAA;AAED,eAAO,MAAM,cAAc,GAC1B,SAAS,qBAAqB,KAC5B,OAAO,CAAC,eAAe,CAwCzB,CAAA;AAsCD,eAAO,MAAM,cAAc,GAC1B,SAAS,iBAAiB,KACxB,OAAO,CAAC,aAAa,CA0FvB,CAAA"}

package/dist/auth-file.js

@@ -0,0 +1,264 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { deriveAccountId, deriveChatGptAccountIsFedRamp, parseJwtClaims, refreshOpenAIOAuthTokens, } from "@openai-oauth/core";
+const AUTH_FILENAME = "auth.json";
+const REFRESH_EXPIRY_MARGIN_MS = 5 * 60 * 1000;
+const REFRESH_INTERVAL_MS = 55 * 60 * 1000;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseIsoDate = (value) => {
+    if (typeof value !== "string" || !value) {
+        return undefined;
+    }
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? undefined : date;
+};
+const shouldRefreshAccessToken = (accessToken, lastRefresh, now) => {
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+        return true;
+    }
+    const claims = parseJwtClaims(accessToken);
+    const exp = claims && typeof claims.exp === "number" ? claims.exp : undefined;
+    if (typeof exp === "number") {
+        const expiryMs = exp * 1000;
+        if (expiryMs <= now.getTime() + REFRESH_EXPIRY_MARGIN_MS) {
+            return true;
+        }
+    }
+    const refreshedAt = parseIsoDate(lastRefresh);
+    if (refreshedAt) {
+        return refreshedAt.getTime() <= now.getTime() - REFRESH_INTERVAL_MS;
+    }
+    return false;
+};
+const uniquePaths = (paths) => {
+    const seen = new Set();
+    const result = [];
+    for (const candidate of paths) {
+        if (!seen.has(candidate)) {
+            seen.add(candidate);
+            result.push(candidate);
+        }
+    }
+    return result;
+};
+export const resolveAuthFileCandidates = (authFilePath) => {
+    if (typeof authFilePath === "string" && authFilePath.length > 0) {
+        return [authFilePath];
+    }
+    const codexHome = process.env.CODEX_HOME;
+    return uniquePaths([
+        authFilePath,
+        codexHome ? path.join(codexHome, AUTH_FILENAME) : undefined,
+        path.join(os.homedir(), ".codex", AUTH_FILENAME),
+    ].filter((value) => typeof value === "string" && value.length > 0));
+};
+const resolveWritePath = (preferred) => {
+    if (preferred) {
+        return preferred;
+    }
+    const envHome = process.env.CODEX_HOME;
+    if (envHome) {
+        return path.join(envHome, AUTH_FILENAME);
+    }
+    return path.join(os.homedir(), ".codex", AUTH_FILENAME);
+};
+const toAuthFile = (input) => {
+    const auth = { ...input };
+    const tokensValue = input.tokens;
+    if (typeof input.OPENAI_API_KEY === "string" && input.OPENAI_API_KEY) {
+        auth.OPENAI_API_KEY = input.OPENAI_API_KEY;
+    }
+    else {
+        delete auth.OPENAI_API_KEY;
+    }
+    if (isRecord(tokensValue) && Object.keys(tokensValue).length > 0) {
+        auth.tokens = {
+            id_token: typeof tokensValue.id_token === "string"
+                ? tokensValue.id_token
+                : undefined,
+            access_token: typeof tokensValue.access_token === "string"
+                ? tokensValue.access_token
+                : undefined,
+            refresh_token: typeof tokensValue.refresh_token === "string"
+                ? tokensValue.refresh_token
+                : undefined,
+            account_id: typeof tokensValue.account_id === "string"
+                ? tokensValue.account_id
+                : undefined,
+        };
+    }
+    else {
+        delete auth.tokens;
+    }
+    if (typeof input.last_refresh === "string" && input.last_refresh) {
+        auth.last_refresh = input.last_refresh;
+    }
+    else {
+        delete auth.last_refresh;
+    }
+    return auth;
+};
+const readAuthFile = async (candidates) => {
+    for (const candidate of candidates) {
+        try {
+            const content = await fs.readFile(candidate, "utf-8");
+            const parsed = JSON.parse(content);
+            if (isRecord(parsed)) {
+                return { path: candidate, data: toAuthFile(parsed) };
+            }
+            throw new Error(`Auth file at ${candidate} must contain a JSON object.`);
+        }
+        catch (error) {
+            if (typeof error === "object" &&
+                error !== null &&
+                "code" in error &&
+                error.code === "ENOENT") {
+                continue;
+            }
+            if (error instanceof SyntaxError) {
+                throw new Error(`Auth file at ${candidate} is not valid JSON.`, {
+                    cause: error,
+                });
+            }
+            throw error;
+        }
+    }
+    return {};
+};
+const ensureDirectory = async (filePath) => {
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+};
+const writeAuthFile = async (filePath, data) => {
+    await ensureDirectory(filePath);
+    await fs.writeFile(filePath, JSON.stringify(data, null, 2), {
+        encoding: "utf-8",
+        mode: 0o600,
+    });
+};
+export const resolveCodexAuthFilePath = (authFilePath) => {
+    if (authFilePath) {
+        return authFilePath;
+    }
+    const codexHome = process.env.CODEX_HOME;
+    return path.join(codexHome ?? path.join(os.homedir(), ".codex"), AUTH_FILENAME);
+};
+export const saveAuthTokens = async (options) => {
+    const filePath = resolveCodexAuthFilePath(options.authFilePath);
+    const existing = (await readAuthFile([filePath])).data ?? {};
+    const now = options.now ?? (() => new Date());
+    const savedAt = now().toISOString();
+    const accountId = options.token.accountId ??
+        deriveAccountId(options.token.idToken) ??
+        deriveAccountId(options.token.accessToken);
+    if (!accountId) {
+        throw new Error("ChatGPT account id not found in OpenAI OAuth token response.");
+    }
+    await writeAuthFile(filePath, {
+        ...existing,
+        auth_mode: "chatgpt",
+        tokens: {
+            id_token: options.token.idToken,
+            access_token: options.token.accessToken,
+            refresh_token: options.token.refreshToken,
+            account_id: accountId,
+        },
+        last_refresh: savedAt,
+    });
+    return {
+        path: filePath,
+        auth: {
+            accessToken: options.token.accessToken,
+            accountId,
+            isFedRamp: options.token.isFedRamp,
+            idToken: options.token.idToken,
+            refreshToken: options.token.refreshToken,
+            sourcePath: filePath,
+            lastRefresh: savedAt,
+        },
+    };
+};
+const refreshChatGptTokens = async (refreshToken, clientId, issuer, tokenUrl, fetchFn) => {
+    const refreshed = await refreshOpenAIOAuthTokens({
+        refreshToken,
+        clientId,
+        issuer,
+        tokenUrl,
+        fetch: fetchFn,
+    });
+    return {
+        accessToken: refreshed.accessToken,
+        idToken: refreshed.idToken,
+        refreshToken: refreshed.refreshToken ?? refreshToken,
+        accountId: refreshed.accountId,
+        isFedRamp: refreshed.isFedRamp,
+    };
+};
+const normalizeTokens = (tokens) => {
+    const maybeString = (value) => typeof value === "string" && value.length > 0 ? value : undefined;
+    return {
+        id_token: maybeString(tokens?.id_token),
+        access_token: maybeString(tokens?.access_token),
+        refresh_token: maybeString(tokens?.refresh_token),
+        account_id: maybeString(tokens?.account_id),
+    };
+};
+export const loadAuthTokens = async (options) => {
+    const { clientId, issuer, tokenUrl, authFilePath, fetch, ensureFresh = true, now = () => new Date(), } = options;
+    if (typeof fetch !== "function") {
+        throw new Error("A fetch implementation is required to refresh ChatGPT tokens.");
+    }
+    const readResult = await readAuthFile(resolveAuthFileCandidates(authFilePath));
+    const authData = readResult.data ?? {};
+    const tokens = normalizeTokens(authData.tokens);
+    let accessToken = tokens.access_token;
+    let idToken = tokens.id_token;
+    let refreshToken = tokens.refresh_token;
+    let accountId = tokens.account_id ?? deriveAccountId(idToken);
+    let isFedRamp = deriveChatGptAccountIsFedRamp(idToken) ||
+        deriveChatGptAccountIsFedRamp(accessToken);
+    let lastRefresh = authData.last_refresh;
+    const needsRefresh = ensureFresh &&
+        typeof refreshToken === "string" &&
+        shouldRefreshAccessToken(accessToken, lastRefresh, now());
+    if (needsRefresh && typeof refreshToken === "string") {
+        const refreshed = await refreshChatGptTokens(refreshToken, clientId, issuer, tokenUrl, fetch);
+        accessToken = refreshed.accessToken;
+        idToken = refreshed.idToken ?? idToken;
+        refreshToken = refreshed.refreshToken ?? refreshToken;
+        accountId = refreshed.accountId ?? accountId;
+        isFedRamp =
+            isFedRamp ||
+                refreshed.isFedRamp === true ||
+                deriveChatGptAccountIsFedRamp(idToken) ||
+                deriveChatGptAccountIsFedRamp(accessToken);
+        lastRefresh = now().toISOString();
+        const writePath = resolveWritePath(readResult.path ?? authFilePath);
+        await writeAuthFile(writePath, {
+            ...authData,
+            auth_mode: "chatgpt",
+            tokens: {
+                id_token: idToken,
+                access_token: accessToken,
+                refresh_token: refreshToken,
+                account_id: accountId,
+            },
+            last_refresh: lastRefresh,
+        });
+    }
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+        throw new Error("ChatGPT access token not found. Run `npx openai-oauth login` to sign in.");
+    }
+    if (typeof accountId !== "string" || accountId.length === 0) {
+        throw new Error("ChatGPT account id not found in auth.json. Run `npx openai-oauth login` to sign in again.");
+    }
+    return {
+        accessToken,
+        accountId,
+        isFedRamp,
+        idToken,
+        refreshToken,
+        sourcePath: readResult.path ?? resolveWritePath(authFilePath),
+        lastRefresh,
+    };
+};

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import type { FetchFunction, OpenAIOAuth } from "@openai-oauth/core";
-import { type AuthLoaderOptions } from "@openai-oauth/core";
+import { type AuthLoaderOptions } from "./auth-file.js";
 export type LocalOpenAIOAuthOptions = Omit<AuthLoaderOptions, "fetch"> & {
     fetch?: FetchFunction;
     baseURL?: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,aAAa,EACb,WAAW,EAEX,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,oBAAoB,CAAA;AAE3B,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IACxE,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAqBD,eAAO,MAAM,iBAAiB,GAC7B,UAAS,uBAA4B,KACnC,WA+BD,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,aAAa,EACb,WAAW,EAEX,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,gBAAgB,CAAA;AAEvB,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IACxE,KAAK,CAAC,EAAE,aAAa,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAqBD,eAAO,MAAM,iBAAiB,GAC7B,UAAS,uBAA4B,KACnC,WAmBD,CAAA"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { loadAuthTokens, } from "@openai-oauth/core";
+import { loadAuthTokens, } from "./auth-file.js";
 const pickFetch = (customFetch) => {
     if (typeof customFetch === "function") {
         return customFetch;
@@ -32,13 +32,4 @@ export const openaiCredentials = (options = {}) => ({
         now: options.now,
         tokenUrl: options.tokenUrl,
     })),
-    refreshSession: async () => toSession(await loadAuthTokens({
-        authFilePath: options.authFilePath,
-        clientId: options.clientId,
-        ensureFresh: true,
-        fetch: pickFetch(options.fetch),
-        issuer: options.issuer,
-        now: options.now,
-        tokenUrl: options.tokenUrl,
-    })),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@openai-oauth/local",
-	"version": "2.0.0-beta.2",
+	"version": "2.0.0-beta.4",
 	"description": "Local Codex auth-file auth handle for openai-oauth.",
 	"keywords": [
 		"openai",
@@ -11,6 +11,9 @@
 		"credentials"
 	],
 	"type": "module",
+	"engines": {
+		"node": ">=20"
+	},
 	"sideEffects": false,
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -19,6 +22,11 @@
 			"types": "./dist/index.d.ts",
 			"import": "./dist/index.js",
 			"default": "./dist/index.js"
+		},
+		"./auth-file": {
+			"types": "./dist/auth-file-entry.d.ts",
+			"import": "./dist/auth-file-entry.js",
+			"default": "./dist/auth-file-entry.js"
 		}
 	},
 	"files": [
@@ -27,7 +35,7 @@
 		"LICENSE"
 	],
 	"scripts": {
-		"build": "tsc -p tsconfig.build.json",
+		"build": "node ../../scripts/clean-dist.mjs && tsc -p tsconfig.build.json",
 		"prepublishOnly": "bun run build",
 		"typecheck": "tsc --noEmit",
 		"test": "vitest run"
@@ -36,12 +44,12 @@
 		"access": "public"
 	},
 	"dependencies": {
-		"@openai-oauth/core": "2.0.0-beta.2"
+		"@openai-oauth/core": "2.0.0-beta.4"
 	},
 	"devDependencies": {
 		"@types/node": "20.17.24",
-		"typescript": "latest",
-		"vitest": "latest"
+		"typescript": "5.9.2",
+		"vitest": "4.1.10"
 	},
 	"author": "EvanZhouDev",
 	"license": "AGPL-3.0-only",