@opengeni/codex 0.2.7 → 0.2.9

package/dist/api-client.d.ts

@@ -0,0 +1,55 @@
+import type { CodexFetch } from "./device-code";
+import { type CodexRateLimitResetConsumeResponse, type CodexRateLimitResetCreditsDetails } from "./reset-credits";
+export type CodexAuthHeaders = {
+    accessToken: string;
+    chatgptAccountId: string | null;
+    isFedramp: boolean;
+    clientVersion: string;
+};
+export type ResetCreditFetchFailureReason = "http_error" | "invalid_response" | "network_error" | "timeout";
+/** GET /codex/models — login-check + live catalog. A 200 means the token is accepted. spec §1.4/§F */
+export declare function fetchCodexModels(a: CodexAuthHeaders, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
+    ok: boolean;
+    status: number;
+    slugs: string[];
+}>;
+/** GET /wham/usage — authoritative limits. NB the WHAM base is /backend-api, NOT /codex (spec §1.8a). */
+export declare function fetchCodexUsage(a: CodexAuthHeaders, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
+    status: number;
+    payload: unknown;
+}>;
+/**
+ * GET /wham/rate-limit-reset-credits — detailed earned reset credits.
+ *
+ * A non-2xx or malformed body returns an explicit non-ok result. The caller may
+ * fall back to the count-only summary embedded in /wham/usage, but must never
+ * invent actionable rows from that count.
+ */
+export declare function fetchCodexRateLimitResetCredits(a: CodexAuthHeaders, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
+    ok: true;
+    status: number;
+    details: CodexRateLimitResetCreditsDetails;
+} | {
+    ok: false;
+    status: number;
+    reason: ResetCreditFetchFailureReason;
+}>;
+/**
+ * POST /wham/rate-limit-reset-credits/consume with the exact v0.144.6 body.
+ * `idempotencyKey` identifies one logical human redemption and MUST be reused
+ * by the server on retries. Supplying `creditId` is preferred; omission leaves
+ * provider selection in control and is therefore not used by OpenGeni's
+ * human-only flow.
+ */
+export declare function consumeCodexRateLimitResetCredit(a: CodexAuthHeaders, input: {
+    idempotencyKey: string;
+    creditId?: string | undefined;
+}, fetchImpl?: CodexFetch, timeoutMs?: number): Promise<{
+    ok: true;
+    status: number;
+    result: CodexRateLimitResetConsumeResponse;
+} | {
+    ok: false;
+    status: number;
+    reason: ResetCreditFetchFailureReason | "invalid_request";
+}>;

package/dist/billing.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Pure NECESSARY condition for a Codex-billed turn: the model id is namespaced
+ * for the Codex subscription provider (`codex/<slug>`).
+ *
+ * This is NOT sufficient to bypass billing — an active, connected workspace
+ * credential and the deployment flag (`settings.codexSubscriptionEnabled`) are
+ * ALSO required (see `isCodexBilledTurn`/`workspaceCodexSubscriptionActive` in
+ * `@opengeni/db`). Used only as a cheap, synchronous short-circuit so the common
+ * non-codex path never issues a credential read.
+ */
+export declare function isCodexBilledModel(model: string | null | undefined): boolean;

package/dist/bounded-operation.d.ts

@@ -0,0 +1,16 @@
+export type CodexOperationFailureReason = "network_error" | "timeout";
+/**
+ * Bound the complete provider operation, including response-body consumption.
+ *
+ * AbortController makes native fetch release its socket, while Promise.race is
+ * the backstop for injected/custom fetch implementations that ignore `signal`.
+ * The losing operation is rejection-handled and can never become an unhandled
+ * promise after the caller has received the timeout result.
+ */
+export declare function runBoundedCodexOperation<T>(operation: (signal: AbortSignal) => Promise<T>, timeoutMs: number): Promise<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    reason: CodexOperationFailureReason;
+}>;

package/dist/constants.d.ts

@@ -1,35 +1,33 @@
-declare const CODEX_ISSUER = "https://auth.openai.com";
-declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-declare const CODEX_AUTH_BASE = "https://auth.openai.com/api/accounts";
-declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
-declare const CODEX_DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
-declare const CODEX_DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
-declare const CODEX_RESPONSES_BASE = "https://chatgpt.com/backend-api/codex";
-declare const CODEX_WHAM_BASE = "https://chatgpt.com/backend-api";
-declare const CODEX_ORIGINATOR = "codex_cli_rs";
-declare const CODEX_ID_TOKEN_AUTH_CLAIM = "https://api.openai.com/auth";
-declare const CODEX_PROVIDER_ID = "codex-subscription";
-declare const CODEX_PROVIDER_BASE_URL = "https://chatgpt.com/backend-api";
-declare const CODEX_MODEL_ID_PREFIX = "codex/";
-declare const CODEX_FALLBACK_MODEL_SLUGS: readonly ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
-declare const CODEX_MODEL_CONTEXT_WINDOW_TOKENS = 272000;
-declare const CODEX_EFFECTIVE_CONTEXT_WINDOW_PERCENT = 95;
-declare const CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS: number;
-declare const CODEX_AUTO_COMPACTION_PERCENT = 90;
-declare const CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT: number;
-declare const CODEX_CLIENT_VERSION = "0.144.6";
-declare const CODEX_REFRESH_WINDOW_MS: number;
-declare const CODEX_REFRESH_FALLBACK_MS: number;
-declare const CODEX_RESPONSE_HEADERS_TIMEOUT_MS: number;
-declare const CODEX_RESPONSE_STREAM_IDLE_TIMEOUT_MS: number;
-declare const CODEX_RESPONSE_WHOLE_TIMEOUT_MS: number;
-declare const CODEX_RESPONSE_NO_BYTE_RETRIES = 0;
-declare const CODEX_RESPONSE_RETRY_BACKOFF_MS = 1000;
-declare const CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS: number;
-declare const CODEX_APPS_MCP_SERVER_ID = "codex_apps";
-declare const CODEX_APPS_MCP_SERVER_NAME = "codex_apps";
-declare const CODEX_APPS_MCP_URL = "https://chatgpt.com/backend-api/ps/mcp";
-declare const CODEX_APPS_STARTUP_TIMEOUT_MS = 30000;
-declare const CODEX_APPS_REQUIRED_SCOPES: readonly ["api.connectors.read", "api.connectors.invoke"];
-
-export { CODEX_APPS_MCP_SERVER_ID, CODEX_APPS_MCP_SERVER_NAME, CODEX_APPS_MCP_URL, CODEX_APPS_REQUIRED_SCOPES, CODEX_APPS_STARTUP_TIMEOUT_MS, CODEX_AUTH_BASE, CODEX_AUTO_COMPACTION_PERCENT, CODEX_CLIENT_ID, CODEX_CLIENT_VERSION, CODEX_DEVICE_REDIRECT_URI, CODEX_DEVICE_VERIFICATION_URL, CODEX_EFFECTIVE_CONTEXT_WINDOW_PERCENT, CODEX_FALLBACK_MODEL_SLUGS, CODEX_ID_TOKEN_AUTH_CLAIM, CODEX_ISSUER, CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT, CODEX_MODEL_CONTEXT_WINDOW_TOKENS, CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS, CODEX_MODEL_ID_PREFIX, CODEX_ORIGINATOR, CODEX_PROVIDER_BASE_URL, CODEX_PROVIDER_ID, CODEX_REFRESH_FALLBACK_MS, CODEX_REFRESH_WINDOW_MS, CODEX_RESPONSES_BASE, CODEX_RESPONSE_HEADERS_TIMEOUT_MS, CODEX_RESPONSE_NO_BYTE_RETRIES, CODEX_RESPONSE_RETRY_BACKOFF_MS, CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS, CODEX_RESPONSE_STREAM_IDLE_TIMEOUT_MS, CODEX_RESPONSE_WHOLE_TIMEOUT_MS, CODEX_TOKEN_URL, CODEX_WHAM_BASE };
+export declare const CODEX_ISSUER = "https://auth.openai.com";
+export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare const CODEX_AUTH_BASE = "https://auth.openai.com/api/accounts";
+export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
+export declare const CODEX_DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
+export declare const CODEX_DEVICE_REDIRECT_URI = "https://auth.openai.com/deviceauth/callback";
+export declare const CODEX_RESPONSES_BASE = "https://chatgpt.com/backend-api/codex";
+export declare const CODEX_WHAM_BASE = "https://chatgpt.com/backend-api";
+export declare const CODEX_ORIGINATOR = "codex_cli_rs";
+export declare const CODEX_ID_TOKEN_AUTH_CLAIM = "https://api.openai.com/auth";
+export declare const CODEX_PROVIDER_ID = "codex-subscription";
+export declare const CODEX_PROVIDER_BASE_URL = "https://chatgpt.com/backend-api";
+export declare const CODEX_MODEL_ID_PREFIX = "codex/";
+export declare const CODEX_FALLBACK_MODEL_SLUGS: readonly ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
+export declare const CODEX_MODEL_CONTEXT_WINDOW_TOKENS = 272000;
+export declare const CODEX_EFFECTIVE_CONTEXT_WINDOW_PERCENT = 95;
+export declare const CODEX_MODEL_EFFECTIVE_CONTEXT_WINDOW_TOKENS: number;
+export declare const CODEX_AUTO_COMPACTION_PERCENT = 90;
+export declare const CODEX_MODEL_AUTO_COMPACT_TOKEN_LIMIT: number;
+export declare const CODEX_CLIENT_VERSION = "0.144.6";
+export declare const CODEX_REFRESH_WINDOW_MS: number;
+export declare const CODEX_REFRESH_FALLBACK_MS: number;
+export declare const CODEX_RESPONSE_HEADERS_TIMEOUT_MS: number;
+export declare const CODEX_RESPONSE_STREAM_IDLE_TIMEOUT_MS: number;
+export declare const CODEX_RESPONSE_WHOLE_TIMEOUT_MS: number;
+export declare const CODEX_RESPONSE_NO_BYTE_RETRIES = 0;
+export declare const CODEX_RESPONSE_RETRY_BACKOFF_MS = 1000;
+export declare const CODEX_RESPONSE_SDK_OUTER_TIMEOUT_MS: number;
+export declare const CODEX_APPS_MCP_SERVER_ID = "codex_apps";
+export declare const CODEX_APPS_MCP_SERVER_NAME = "codex_apps";
+export declare const CODEX_APPS_MCP_URL = "https://chatgpt.com/backend-api/ps/mcp";
+export declare const CODEX_APPS_STARTUP_TIMEOUT_MS = 30000;
+export declare const CODEX_APPS_REQUIRED_SCOPES: readonly ["api.connectors.read", "api.connectors.invoke"];

package/dist/device-code.d.ts

@@ -0,0 +1,36 @@
+export type CodexFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export type CodexDeviceStart = {
+    deviceAuthId: string;
+    userCode: string;
+    verificationUri: string;
+    intervalSeconds: number;
+};
+export type CodexTokens = {
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+};
+export type CodexPollResult = {
+    status: "pending";
+} | {
+    status: "expired";
+} | {
+    status: "authorized";
+    authorizationCode: string;
+    codeVerifier: string;
+};
+export declare class CodexDeviceError extends Error {
+    constructor(message: string);
+}
+/** Step 1: POST {auth}/deviceauth/usercode {client_id}. device_code_auth.rs:67-95 */
+export declare function startDeviceCode(fetchImpl?: CodexFetch): Promise<CodexDeviceStart>;
+/** Step 3 (single, non-blocking): POST {auth}/deviceauth/token. 403/404 => pending. device_code_auth.rs:106-145 */
+export declare function pollDeviceCode(input: {
+    deviceAuthId: string;
+    userCode: string;
+}, fetchImpl?: CodexFetch): Promise<CodexPollResult>;
+/** Step 4: POST {issuer}/oauth/token form-encoded grant_type=authorization_code. server.rs:732-766 */
+export declare function exchangeDeviceCode(input: {
+    authorizationCode: string;
+    codeVerifier: string;
+}, fetchImpl?: CodexFetch): Promise<CodexTokens>;

package/dist/fetch.d.ts

@@ -0,0 +1,84 @@
+import { type CodexUsageHeaderSnapshot } from "./request-context";
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/**
+ * Internal provenance marker copied onto buffered non-OK Codex responses.
+ * OpenAI's APIError preserves response headers, which lets the worker
+ * distinguish a model-provider refusal from an unrelated sandbox/MCP HTTP
+ * error that happened during the same Codex turn.
+ */
+export declare const CODEX_TRANSPORT_ERROR_HEADER = "x-opengeni-codex-transport-error";
+/** True only for an error produced from this Codex transport's non-OK response. */
+export declare function isCodexTransportError(error: unknown): boolean;
+export type CodexEncryptedArtifactRejection = {
+    status: 400;
+    kind: "encrypted_content_rejected";
+};
+/**
+ * Classify only the provider's definitive request rejection for an opaque
+ * reasoning artifact that it can no longer decrypt/parse. A Codex transport
+ * marker plus HTTP 400 proves this request was rejected before inference; the
+ * semantic match prevents unrelated malformed prompts from entering recovery.
+ */
+export declare function classifyCodexEncryptedArtifactRejection(error: unknown): CodexEncryptedArtifactRejection | null;
+/**
+ * Multi-account P4 (Part A): scrape the full usage snapshot the codex backend
+ * stamps on every `/codex/responses` response in `x-codex-primary-*` /
+ * `x-codex-secondary-*` headers (integer-identical to GET /wham/usage, for free).
+ *
+ * CRITICAL clobber-fix: return null unless BOTH windows expose a valid used-percent
+ * integer. recordCodexAccountUsage writes all five columns unconditionally, so a
+ * primary-only snapshot would null the weekly column. Both windows are always
+ * emitted together on `/codex/responses`; gating on both makes every write a full
+ * 5-column snapshot byte-identical to the poll path, and a malformed/absent header
+ * set simply no-ops (the /wham/usage poll fallback still covers it).
+ */
+export declare function parseCodexUsageHeaders(headers: Headers): CodexUsageHeaderSnapshot | null;
+export declare function codexSubscriptionFetch(base?: FetchLike): FetchLike;
+/** The codex backend's hard-cap error type (ChatGPT/Codex usage limit reached). */
+export declare const CODEX_USAGE_LIMIT_ERROR_TYPE = "usage_limit_reached";
+export type CodexUsageLimitInfo = {
+    /** Seconds until the usage cap resets, when the backend reported it. */
+    resetsInSeconds: number | null;
+};
+/**
+ * Classify a thrown error as a ChatGPT/Codex usage-cap (429 usage_limit_reached)
+ * and extract the reset window. The SDK surfaces the codex backend's 429 as an
+ * OpenAI APIError whose `.type` (and `.error.type`) is `usage_limit_reached` and
+ * whose `.error.resets_in_seconds` carries the cap reset. Walks the cause chain
+ * and tolerates the message-only shape so it survives any SDK re-wrapping.
+ * Returns null for anything that is not a usage cap.
+ */
+export declare function classifyCodexUsageLimitError(error: unknown): CodexUsageLimitInfo | null;
+export type CodexSseFailureProjection = {
+    status: number;
+    error: {
+        type: string;
+        code: string;
+        message: string;
+        param?: string;
+        event_type?: string;
+        response_id?: string;
+        response_status?: string;
+        diagnostic_truncated?: true;
+    };
+    headers: Headers;
+};
+/**
+ * A provider terminal carried inside an accepted HTTP-200 stream. The OpenAI
+ * SDK cannot turn that late terminal into a non-2xx APIError because headers
+ * have already been accepted, so the body transform throws this equivalent
+ * bounded shape. Provider-supplied message/param text is intentionally absent:
+ * the worker may persist Error.message, while identifiers/classifications are
+ * sufficient for retry, compaction, and incident diagnostics.
+ */
+export declare class CodexStreamingTerminalError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly type: string;
+    readonly eventType?: string;
+    readonly responseId?: string;
+    readonly responseStatus?: string;
+    readonly headers: Headers;
+    readonly error: Record<string, unknown>;
+    constructor(projection: CodexSseFailureProjection, publicMessage: string);
+}