@raybase/openai-subscription 0.0.0 → 0.1.0

package/dist/crypto.js

@@ -0,0 +1,86 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+export function validateOpenAISubscriptionSecret(secret) {
+    if (!secret?.trim())
+        throw new Error("RAYBASE_OPENAI_SUBSCRIPTION_KEY is not configured");
+    const normalized = secret.trim().replace(/-/g, "+").replace(/_/g, "/");
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) {
+        throw new Error("RAYBASE_OPENAI_SUBSCRIPTION_KEY must be base64 or base64url encoded");
+    }
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+    let bytes;
+    try {
+        bytes = Uint8Array.from(atob(padded), (value) => value.charCodeAt(0));
+    }
+    catch {
+        throw new Error("RAYBASE_OPENAI_SUBSCRIPTION_KEY is not valid base64");
+    }
+    if (bytes.byteLength < 32)
+        throw new Error("RAYBASE_OPENAI_SUBSCRIPTION_KEY must contain at least 256 bits of random key material");
+    if (new Set(bytes).size < 16)
+        throw new Error("RAYBASE_OPENAI_SUBSCRIPTION_KEY does not contain enough entropy");
+    return bytes;
+}
+export async function encryptOpenAISubscriptionEnvelope(secret, scope, value) {
+    const key = await deriveKey(validateOpenAISubscriptionSecret(secret));
+    const nonce = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: bufferSource(nonce), additionalData: bufferSource(aad(scope)) }, key, bufferSource(encoder.encode(JSON.stringify(value))));
+    return {
+        version: 1,
+        keyVersion: 1,
+        nonce: base64Url(nonce),
+        ciphertext: base64Url(new Uint8Array(ciphertext))
+    };
+}
+export async function decryptOpenAISubscriptionEnvelope(secret, scope, envelope) {
+    if (envelope.version !== 1 || envelope.keyVersion !== 1)
+        throw new Error("Unsupported OpenAI subscription credential envelope version");
+    try {
+        const plaintext = await crypto.subtle.decrypt({
+            name: "AES-GCM",
+            iv: bufferSource(fromBase64Url(envelope.nonce)),
+            additionalData: bufferSource(aad(scope))
+        }, await deriveKey(validateOpenAISubscriptionSecret(secret)), bufferSource(fromBase64Url(envelope.ciphertext)));
+        return JSON.parse(decoder.decode(plaintext));
+    }
+    catch {
+        throw new Error("OpenAI subscription credential could not be decrypted for this scope");
+    }
+}
+export async function openAISubscriptionScopeKey(scope) {
+    const digest = await crypto.subtle.digest("SHA-256", bufferSource(aad(scope)));
+    return base64Url(new Uint8Array(digest));
+}
+function aad(scope) {
+    return encoder.encode(JSON.stringify({
+        moduleId: "openai-subscription",
+        applicationScope: scope.applicationScope,
+        organizationId: scope.organizationId,
+        credentialMode: scope.mode,
+        subjectId: scope.subjectId,
+        envelopeVersion: 1
+    }));
+}
+async function deriveKey(secret) {
+    const source = await crypto.subtle.importKey("raw", bufferSource(secret), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: bufferSource(encoder.encode("raybase/openai-subscription/aes-256-gcm/v1")),
+        info: bufferSource(encoder.encode("credential-envelope"))
+    }, source, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function fromBase64Url(value) {
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
+}
+function bufferSource(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1D,MAAM,UAAU,gCAAgC,CAAC,MAA0B;IACzE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5E,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACpI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,KAAwC,EACxC,KAAc;IAEd,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EACtF,GAAG,EACH,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CACpD,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,CAAC;QACb,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;QACvB,UAAU,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,KAAwC,EACxC,QAA6C;IAE7C,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACxI,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/C,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACzC,EACD,MAAM,SAAS,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAAC,EACzD,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACjD,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAM,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAwC;IACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,GAAG,CAAC,KAAwC;IACnD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,QAAQ,EAAE,qBAAqB;QAC/B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,CAAC;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAkB;IACzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACxG,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAChF,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;KAC1D,EACD,MAAM,EACN,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACxG,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;AAClG,CAAC"}

package/dist/health.d.ts

@@ -0,0 +1,9 @@
+import { OpenAISubscriptionCredentialStore } from "./store.js";
+import type { OpenAISubscriptionCredentialScope, OpenAISubscriptionHealth, OpenAISubscriptionSafeStatus } from "./types.js";
+export type OpenAISubscriptionHealthTransitionContext = {
+    scope: OpenAISubscriptionCredentialScope;
+    store: OpenAISubscriptionCredentialStore;
+    onIncident?: (state: "reauth_required" | "protocol_update_required", generation: number, incidentId: string) => Promise<void>;
+};
+export declare function transitionOpenAISubscriptionHealth(input: OpenAISubscriptionHealthTransitionContext, state: OpenAISubscriptionHealth, generation: number, extra?: Partial<OpenAISubscriptionSafeStatus>): Promise<void>;
+//# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,KAAK,EACV,iCAAiC,EACjC,wBAAwB,EACxB,4BAA4B,EAC7B,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yCAAyC,GAAG;IACtD,KAAK,EAAE,iCAAiC,CAAC;IACzC,KAAK,EAAE,iCAAiC,CAAC;IACzC,UAAU,CAAC,EAAE,CACX,KAAK,EAAE,iBAAiB,GAAG,0BAA0B,EACrD,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,wBAAsB,kCAAkC,CACtD,KAAK,EAAE,yCAAyC,EAChD,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,OAAO,CAAC,4BAA4B,CAAM,GAChD,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/health.js

@@ -0,0 +1,22 @@
+export async function transitionOpenAISubscriptionHealth(input, state, generation, extra = {}) {
+    const previous = await input.store.status(input.scope);
+    await input.store.writeStatus(input.scope, {
+        ...previous,
+        ...extra,
+        state,
+        stateSince: previous.state === state ? previous.stateSince : new Date().toISOString(),
+        credentialMode: input.scope.mode,
+        compatibilityVersion: "codex-subscription-2026-07-29",
+        actionHref: "/admin/openai-subscription",
+        generation
+    });
+    if (state === "connected") {
+        await input.store.resolveIncidents(input.scope);
+    }
+    else if (state === "reauth_required" || state === "protocol_update_required") {
+        const incident = await input.store.openIncident(input.scope, generation, state);
+        if (incident.created)
+            await input.onIncident?.(state, generation, incident.id);
+    }
+}
+//# sourceMappingURL=health.js.map

package/dist/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAgD,EAChD,KAA+B,EAC/B,UAAkB,EAClB,QAA+C,EAAE;IAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE;QACzC,GAAG,QAAQ;QACX,GAAG,KAAK;QACR,KAAK;QACL,UAAU,EAAE,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrF,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QAChC,oBAAoB,EAAE,+BAA+B;QACrD,UAAU,EAAE,4BAA4B;QACxC,UAAU;KACX,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,0BAA0B,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAChF,IAAI,QAAQ,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./crypto.js";
+export { openaiSubscriptionModule } from "./module.js";
+export { createOpenAISubscriptionProviderFactory, resolveOpenAISubscriptionCredentialScope } from "./provider.js";
+export * from "./store.js";
+export * from "./system-tables.js";
+export * from "./types.js";
+export { OpenAISubscriptionTransportHttpError, createOpenAISubscriptionTransport } from "./transport.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,uCAAuC,EACvC,wCAAwC,EACzC,MAAM,eAAe,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,oCAAoC,EACpC,iCAAiC,EAClC,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export * from "./crypto.js";
+export { openaiSubscriptionModule } from "./module.js";
+export { createOpenAISubscriptionProviderFactory, resolveOpenAISubscriptionCredentialScope } from "./provider.js";
+export * from "./store.js";
+export * from "./system-tables.js";
+export * from "./types.js";
+export { OpenAISubscriptionTransportHttpError, createOpenAISubscriptionTransport } from "./transport.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,uCAAuC,EACvC,wCAAwC,EACzC,MAAM,eAAe,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EACL,oCAAoC,EACpC,iCAAiC,EAClC,MAAM,gBAAgB,CAAC"}

package/dist/module.d.ts

@@ -0,0 +1,6 @@
+import { type RaybaseModule } from "@raybase/core";
+import { type OpenAISubscriptionTransportOptions } from "./transport.js";
+import { type OpenAISubscriptionEnv, type OpenAISubscriptionModuleOptions } from "./types.js";
+export declare function openaiSubscriptionModule<Env extends OpenAISubscriptionEnv>(options: OpenAISubscriptionModuleOptions): RaybaseModule<Env>;
+export declare function createOpenAISubscriptionModuleForTesting<Env extends OpenAISubscriptionEnv>(options: OpenAISubscriptionModuleOptions, transport: OpenAISubscriptionTransportOptions): RaybaseModule<Env>;
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,aAAa,EAGnB,MAAM,eAAe,CAAC;AAQvB,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,+BAA+B,EACrC,MAAM,YAAY,CAAC;AAEpB,wBAAgB,wBAAwB,CAAC,GAAG,SAAS,qBAAqB,EACxE,OAAO,EAAE,+BAA+B,GACvC,aAAa,CAAC,GAAG,CAAC,CAEpB;AAED,wBAAgB,wCAAwC,CAAC,GAAG,SAAS,qBAAqB,EACxF,OAAO,EAAE,+BAA+B,EACxC,SAAS,EAAE,kCAAkC,GAC5C,aAAa,CAAC,GAAG,CAAC,CAEpB"}

package/dist/module.js

@@ -0,0 +1,341 @@
+import { defineRaybaseModule, nowIso, RaybaseInferenceProviderError } from "@raybase/core";
+import { createOpenAISubscriptionProviderFactoryInternal, resolveOpenAISubscriptionCredentialScope } from "./provider.js";
+import { transitionOpenAISubscriptionHealth } from "./health.js";
+import { OpenAISubscriptionCredentialStore } from "./store.js";
+import { openaiSubscriptionSystemTables } from "./system-tables.js";
+import { createOpenAISubscriptionTransportInternal } from "./transport.js";
+import { openaiSubscriptionModuleId, openaiSubscriptionProviderId, validateOpenAISubscriptionOptions } from "./types.js";
+export function openaiSubscriptionModule(options) {
+    return createModule(options);
+}
+export function createOpenAISubscriptionModuleForTesting(options, transport) {
+    return createModule(options, transport);
+}
+function createModule(options, transportOptions) {
+    validateOpenAISubscriptionOptions(options);
+    const providerFactory = createOpenAISubscriptionProviderFactoryInternal(options, transportOptions);
+    const routes = createOpenAISubscriptionRoutes(options, transportOptions);
+    const adminRoutes = options.credentialMode === "user" ? [] : routes;
+    const userRoutes = options.credentialMode === "user" ? routes : [];
+    return defineRaybaseModule({
+        id: openaiSubscriptionModuleId,
+        packageName: "@raybase/openai-subscription",
+        version: "0.1.0",
+        runtime: () => ({
+            systemTables: openaiSubscriptionSystemTables,
+            notifications: { feed: { enabled: true } },
+            inferenceProviders: {
+                [openaiSubscriptionProviderId]: {
+                    id: openaiSubscriptionProviderId,
+                    capabilities: { chat: true, stream: true, embed: false },
+                    factory: providerFactory
+                }
+            },
+            routes: userRoutes,
+            adminRoutes,
+            manifest: {
+                id: openaiSubscriptionModuleId,
+                packageName: "@raybase/openai-subscription",
+                inferenceProviders: [{
+                        id: openaiSubscriptionProviderId,
+                        capabilities: { chat: true, stream: true, embed: false }
+                    }]
+            }
+        })
+    });
+}
+function createOpenAISubscriptionRoutes(options, transportOptions) {
+    const auth = options.credentialMode === "user" ? "user" : "admin";
+    const api = "/api/admin/openai-subscription";
+    return [
+        {
+            method: "GET",
+            path: "/admin/openai-subscription",
+            auth,
+            handle: () => adminPage(options.label ?? "OpenAI subscription (Codex)")
+        },
+        {
+            method: "GET",
+            path: `${api}/status`,
+            auth,
+            handle: async (ctx) => {
+                const { store, scope } = routeState(ctx, options);
+                return ctx.json({ status: await store.status(scope) });
+            }
+        },
+        {
+            method: "POST",
+            path: `${api}/connect`,
+            auth,
+            handle: async (ctx) => {
+                assertSmallRequest(ctx.request);
+                const { store, scope } = routeState(ctx, options);
+                const status = await store.status(scope);
+                const transport = createOpenAISubscriptionTransportInternal(options, ctx.env, transportOptions);
+                const started = await transport.startDeviceAuth(ctx.request.signal).catch((error) => persistAuthProtocolFailure(ctx, store, scope, status.generation, error));
+                const generation = status.generation + 1;
+                await store.writePending(scope, {
+                    deviceAuthId: started.deviceAuthId,
+                    userCode: started.userCode,
+                    verificationUrl: started.verificationUrl,
+                    expiresAt: started.expiresAt,
+                    intervalSeconds: started.intervalSeconds,
+                    nextPollAt: new Date(Date.now() + started.intervalSeconds * 1000).toISOString(),
+                    generation
+                });
+                await store.writeStatus(scope, {
+                    ...status,
+                    state: "connecting",
+                    stateSince: nowIso(),
+                    credentialMode: scope.mode,
+                    compatibilityVersion: "codex-subscription-2026-07-29",
+                    actionHref: "/admin/openai-subscription",
+                    generation
+                });
+                await ctx.audit({
+                    action: "openai-subscription.connect.started",
+                    target: { type: "openai_subscription_connection", id: scope.mode },
+                    metadata: { mode: scope.mode, generation }
+                });
+                return ctx.json({
+                    verificationUrl: started.verificationUrl,
+                    userCode: started.userCode,
+                    expiresAt: started.expiresAt,
+                    intervalSeconds: started.intervalSeconds,
+                    generation
+                });
+            }
+        },
+        {
+            method: "POST",
+            path: `${api}/poll`,
+            auth,
+            handle: async (ctx) => {
+                assertSmallRequest(ctx.request);
+                const { store, scope } = routeState(ctx, options);
+                const pending = await store.readPending(scope);
+                if (!pending)
+                    return ctx.json({ error: "No pending connection." }, 404);
+                if (Date.now() >= new Date(pending.expiresAt).getTime()) {
+                    await store.deletePending(scope, { generation: pending.generation });
+                    return ctx.json({ status: "expired" }, 410);
+                }
+                if (Date.now() < new Date(pending.nextPollAt).getTime()) {
+                    return ctx.json({
+                        status: "pending",
+                        retryAt: pending.nextPollAt,
+                        intervalSeconds: pending.intervalSeconds
+                    }, 429);
+                }
+                const pollLeaseOwner = `poll_${crypto.randomUUID()}`;
+                if (!await store.acquirePendingPollLease(scope, pending.generation, pollLeaseOwner)) {
+                    return ctx.json({
+                        status: "pending",
+                        retryAt: new Date(Date.now() + 1_000).toISOString(),
+                        intervalSeconds: pending.intervalSeconds
+                    }, 429);
+                }
+                const transport = createOpenAISubscriptionTransportInternal(options, ctx.env, transportOptions);
+                try {
+                    const result = await transport.pollDeviceAuth(pending.deviceAuthId, pending.userCode, pending.intervalSeconds, ctx.request.signal);
+                    if (result.status === "pending") {
+                        const nextPollAt = new Date(Date.now() + result.intervalSeconds * 1000).toISOString();
+                        const committed = await store.commitPendingPoll(scope, { ...pending, intervalSeconds: result.intervalSeconds, nextPollAt }, pollLeaseOwner);
+                        if (!committed) {
+                            return ctx.json({ error: "Connection was cancelled or replaced." }, 409);
+                        }
+                        return ctx.json({ status: "pending", intervalSeconds: result.intervalSeconds, retryAt: nextPollAt });
+                    }
+                    const tokens = await transport.exchangeDeviceCode(result, ctx.request.signal);
+                    const committed = await store.commitPendingAuthorization(scope, pending, pollLeaseOwner, tokens);
+                    if (!committed) {
+                        return ctx.json({ error: "Connection was cancelled or replaced." }, 409);
+                    }
+                    await store.resolveIncidents(scope);
+                    await ctx.audit({
+                        action: "openai-subscription.connect.completed",
+                        target: { type: "openai_subscription_connection", id: scope.mode },
+                        metadata: { mode: scope.mode, generation: pending.generation }
+                    });
+                    return ctx.json({ status: await store.status(scope) });
+                }
+                catch (error) {
+                    return persistAuthProtocolFailure(ctx, store, scope, pending.generation, error);
+                }
+                finally {
+                    await store.releasePendingPollLease(scope, pending.generation, pollLeaseOwner);
+                }
+            }
+        },
+        {
+            method: "POST",
+            path: `${api}/cancel`,
+            auth,
+            handle: async (ctx) => {
+                assertSmallRequest(ctx.request);
+                const { store, scope } = routeState(ctx, options);
+                const status = await store.status(scope);
+                await store.deletePending(scope);
+                const existing = await store.read(scope);
+                const generation = status.generation + 1;
+                await store.writeStatus(scope, {
+                    ...status,
+                    state: existing ? "connected" : "disconnected",
+                    stateSince: nowIso(),
+                    credentialMode: scope.mode,
+                    compatibilityVersion: "codex-subscription-2026-07-29",
+                    actionHref: "/admin/openai-subscription",
+                    generation
+                });
+                return ctx.json({ status: await store.status(scope) });
+            }
+        },
+        {
+            method: "POST",
+            path: `${api}/reconnect`,
+            auth,
+            handle: async (ctx) => {
+                assertSmallRequest(ctx.request);
+                const { store, scope } = routeState(ctx, options);
+                const status = await store.status(scope);
+                await store.deletePending(scope);
+                const transport = createOpenAISubscriptionTransportInternal(options, ctx.env, transportOptions);
+                const started = await transport.startDeviceAuth(ctx.request.signal).catch((error) => persistAuthProtocolFailure(ctx, store, scope, status.generation, error));
+                const generation = status.generation + 1;
+                await store.writePending(scope, {
+                    deviceAuthId: started.deviceAuthId,
+                    userCode: started.userCode,
+                    verificationUrl: started.verificationUrl,
+                    expiresAt: started.expiresAt,
+                    intervalSeconds: started.intervalSeconds,
+                    nextPollAt: new Date(Date.now() + started.intervalSeconds * 1000).toISOString(),
+                    generation
+                });
+                await store.writeStatus(scope, {
+                    ...status,
+                    state: "connecting",
+                    stateSince: nowIso(),
+                    credentialMode: scope.mode,
+                    compatibilityVersion: "codex-subscription-2026-07-29",
+                    actionHref: "/admin/openai-subscription",
+                    generation
+                });
+                return ctx.json({
+                    verificationUrl: started.verificationUrl,
+                    userCode: started.userCode,
+                    expiresAt: started.expiresAt,
+                    intervalSeconds: started.intervalSeconds,
+                    generation
+                });
+            }
+        },
+        {
+            method: "POST",
+            path: `${api}/disconnect`,
+            auth,
+            handle: async (ctx) => {
+                assertSmallRequest(ctx.request);
+                const { store, scope } = routeState(ctx, options);
+                const generation = await store.disconnect(scope);
+                await ctx.audit({
+                    action: "openai-subscription.disconnect",
+                    target: { type: "openai_subscription_connection", id: scope.mode },
+                    metadata: { mode: scope.mode, generation }
+                });
+                return ctx.json({ status: await store.status(scope) });
+            }
+        }
+    ];
+}
+function routeState(ctx, options) {
+    const user = options.credentialMode === "user" ? ctx.requireUser() : ctx.requireAdmin();
+    const secret = ctx.env.RAYBASE_OPENAI_SUBSCRIPTION_KEY;
+    if (!secret)
+        throw new Error("RAYBASE_OPENAI_SUBSCRIPTION_KEY is not configured");
+    const principal = {
+        kind: "user",
+        user,
+        userId: user.identityId ?? user.id,
+        membershipId: user.membershipId ?? null,
+        organizationId: ctx.organizationId ?? user.organizationId ?? null,
+        roles: user.appRoles
+    };
+    const factoryContext = {
+        config: ctx.config,
+        principal,
+        organizationId: ctx.organizationId ?? undefined,
+        surface: "http"
+    };
+    return {
+        store: new OpenAISubscriptionCredentialStore(ctx.control, secret),
+        scope: resolveOpenAISubscriptionCredentialScope(options, factoryContext)
+    };
+}
+async function persistAuthProtocolFailure(ctx, store, scope, generation, error) {
+    if (error instanceof RaybaseInferenceProviderError && error.health === "protocol_update_required") {
+        await transitionOpenAISubscriptionHealth({
+            scope,
+            store,
+            onIncident: async (state, incidentGeneration, incidentId) => {
+                const actionHref = "/admin/openai-subscription";
+                await ctx.audit({
+                    action: `openai-subscription.${state}`,
+                    target: { type: "openai_subscription_connection", id: scope.mode },
+                    metadata: {
+                        state,
+                        credentialMode: scope.mode,
+                        generation: incidentGeneration,
+                        actionHref
+                    }
+                }).catch(() => undefined);
+                await ctx.notifications.send({
+                    to: scope.mode === "user" ? [{ kind: "current-user" }] : [{ kind: "operator" }],
+                    title: "Update OpenAI subscription module",
+                    body: "The pinned Codex compatibility protocol changed. Install a reviewed module update.",
+                    kind: "openai-subscription.protocol_update_required",
+                    severity: "warning",
+                    target: { href: actionHref },
+                    channels: ["feed"],
+                    dedupeKey: `openai-subscription:${incidentId}`,
+                    metadata: {
+                        state,
+                        credentialMode: scope.mode,
+                        generation: incidentGeneration
+                    }
+                }).then(() => store.markIncidentNotified(incidentId)).catch(() => undefined);
+            }
+        }, "protocol_update_required", generation);
+    }
+    throw error;
+}
+function assertSmallRequest(request) {
+    const length = Number(request.headers.get("content-length") ?? "0");
+    if (length > 4096)
+        throw new Error("OpenAI subscription request body is too large");
+    const origin = request.headers.get("origin");
+    if (origin && origin !== new URL(request.url).origin)
+        throw new Error("OpenAI subscription request origin is not allowed");
+}
+function adminPage(title) {
+    const safeTitle = escapeHtml(title);
+    return new Response(`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${safeTitle}</title>
+<style>body{font:15px system-ui;max-width:720px;margin:3rem auto;padding:0 1rem;color:#18181b}button{padding:.55rem .8rem;margin:.25rem}code{font-size:1.25rem}#status{padding:1rem;background:#f4f4f5;border-radius:.5rem}</style></head>
+<body><h1>${safeTitle}</h1><p>Experimental, compatibility-sensitive ChatGPT/Codex subscription inference.</p>
+<div id="status" aria-live="polite">Loading safe connection status…</div>
+<p><button id="connect">Connect or reconnect</button><button id="poll" hidden>Check connection</button><button id="cancel" hidden>Cancel</button><button id="disconnect">Disconnect</button></p>
+<script type="module">
+const api="/api/admin/openai-subscription";
+const status=document.querySelector("#status"),poll=document.querySelector("#poll"),cancel=document.querySelector("#cancel");
+async function call(path){const r=await fetch(api+path,{method:path==="/status"?"GET":"POST",headers:{"accept":"application/json"}});const v=await r.json();render(v);return v}
+function render(v){const s=v.status??v;status.textContent="State: "+(s.state??s.status??"unknown")+(s.plan?" · Plan: "+s.plan:"");if(v.userCode){status.replaceChildren(document.createTextNode("Open "),Object.assign(document.createElement("a"),{href:v.verificationUrl,target:"_blank",rel:"noopener",textContent:v.verificationUrl}),document.createTextNode(" and enter "),Object.assign(document.createElement("code"),{textContent:v.userCode}));poll.hidden=false;cancel.hidden=false}}
+document.querySelector("#connect").onclick=()=>call("/reconnect");poll.onclick=()=>call("/poll");cancel.onclick=()=>call("/cancel");document.querySelector("#disconnect").onclick=()=>call("/disconnect");call("/status");
+</script></body></html>`, { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (character) => ({
+        "&": "&amp;", "<": "&lt;", ">": "&gt;", "\"": "&quot;", "'": "&#39;"
+    })[character] ?? character);
+}
+//# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,MAAM,EACN,6BAA6B,EAK9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,+CAA+C,EAC/C,wCAAwC,EACzC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACL,yCAAyC,EAE1C,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,iCAAiC,EAIlC,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,wBAAwB,CACtC,OAAwC;IAExC,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,OAAwC,EACxC,SAA6C;IAE7C,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CACnB,OAAwC,EACxC,gBAAqD;IAErD,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,+CAA+C,CAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,mBAAmB,CAAC;QACzB,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,YAAY,EAAE,8BAA8B;YAC5C,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC1C,kBAAkB,EAAE;gBAClB,CAAC,4BAA4B,CAAC,EAAE;oBAC9B,EAAE,EAAE,4BAA4B;oBAChC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;oBACxD,OAAO,EAAE,eAAe;iBACzB;aACF;YACD,MAAM,EAAE,UAAU;YAClB,WAAW;YACX,QAAQ,EAAE;gBACR,EAAE,EAAE,0BAA0B;gBAC9B,WAAW,EAAE,8BAA8B;gBAC3C,kBAAkB,EAAE,CAAC;wBACnB,EAAE,EAAE,4BAA4B;wBAChC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;qBACzD,CAAC;aACH;SACF,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,8BAA8B,CACrC,OAAwC,EACxC,gBAAqD;IAErD,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,OAAgB,CAAC;IACpF,MAAM,GAAG,GAAG,gCAAgC,CAAC;IAC7C,OAAO;QACL;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,4BAA4B;YAClC,IAAI;YACJ,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,6BAA6B,CAAC;SACxE;QACD;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,GAAG,SAAS;YACrB,IAAI;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,UAAU;YACtB,IAAI;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,yCAAyC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBAChG,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAClF,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CACxE,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE;oBAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC/E,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;oBAC7B,GAAG,MAAM;oBACT,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,MAAM,EAAE;oBACpB,cAAc,EAAE,KAAK,CAAC,IAAI;oBAC1B,oBAAoB,EAAE,+BAA+B;oBACrD,UAAU,EAAE,4BAA4B;oBACxC,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,KAAK,CAAC;oBACd,MAAM,EAAE,qCAAqC;oBAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;oBAClE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE;iBAC3C,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,OAAO;YACnB,IAAI;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC/C,IAAI,CAAC,OAAO;oBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACxE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxD,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;oBACrE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC9C,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxD,OAAO,GAAG,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,SAAS;wBACjB,OAAO,EAAE,OAAO,CAAC,UAAU;wBAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;qBACzC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;gBACD,MAAM,cAAc,GAAG,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBACrD,IAAI,CAAC,MAAM,KAAK,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;oBACpF,OAAO,GAAG,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,SAAS;wBACjB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;wBACnD,eAAe,EAAE,OAAO,CAAC,eAAe;qBACzC,EAAE,GAAG,CAAC,CAAC;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,yCAAyC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBAChG,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAC3C,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,eAAe,EACvB,GAAG,CAAC,OAAO,CAAC,MAAM,CACnB,CAAC;oBACF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAChC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;wBACtF,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAC7C,KAAK,EACL,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,EACnE,cAAc,CACf,CAAC;wBACF,IAAI,CAAC,SAAS,EAAE,CAAC;4BACf,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,GAAG,CAAC,CAAC;wBAC3E,CAAC;wBACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;oBACvG,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC9E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,0BAA0B,CACtD,KAAK,EACL,OAAO,EACP,cAAc,EACd,MAAM,CACP,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC3E,CAAC;oBACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBACpC,MAAM,GAAG,CAAC,KAAK,CAAC;wBACd,MAAM,EAAE,uCAAuC;wBAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;wBAClE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;qBAC/D,CAAC,CAAC;oBACH,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAClF,CAAC;wBAAS,CAAC;oBACT,MAAM,KAAK,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,SAAS;YACrB,IAAI;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;oBAC7B,GAAG,MAAM;oBACT,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;oBAC9C,UAAU,EAAE,MAAM,EAAE;oBACpB,cAAc,EAAE,KAAK,CAAC,IAAI;oBAC1B,oBAAoB,EAAE,+BAA+B;oBACrD,UAAU,EAAE,4BAA4B;oBACxC,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,YAAY;YACxB,IAAI;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,yCAAyC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBAChG,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAClF,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CACxE,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;gBACzC,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE;oBAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC/E,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;oBAC7B,GAAG,MAAM;oBACT,KAAK,EAAE,YAAY;oBACnB,UAAU,EAAE,MAAM,EAAE;oBACpB,cAAc,EAAE,KAAK,CAAC,IAAI;oBAC1B,oBAAoB,EAAE,+BAA+B;oBACrD,UAAU,EAAE,4BAA4B;oBACxC,UAAU;iBACX,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC;oBACd,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,aAAa;YACzB,IAAI;YACJ,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,GAAG,CAAC,KAAK,CAAC;oBACd,MAAM,EAAE,gCAAgC;oBACxC,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;oBAClE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE;iBAC3C,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,GAAmC,EACnC,OAAwC;IAExC,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;IACxF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG;QAChB,IAAI,EAAE,MAAe;QACrB,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE;QAClC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;QACvC,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI;QACjE,KAAK,EAAE,IAAI,CAAC,QAAQ;KACrB,CAAC;IACF,MAAM,cAAc,GAGhB;QACF,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS;QACT,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC/C,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,OAAO;QACL,KAAK,EAAE,IAAI,iCAAiC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QACjE,KAAK,EAAE,wCAAwC,CAAC,OAAO,EAAE,cAAc,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,GAAmC,EACnC,KAAwC,EACxC,KAAwC,EACxC,UAAkB,EAClB,KAAc;IAEd,IAAI,KAAK,YAAY,6BAA6B,IAAI,KAAK,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAClG,MAAM,kCAAkC,CAAC;YACvC,KAAK;YACL,KAAK;YACL,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE;gBAC1D,MAAM,UAAU,GAAG,4BAA4B,CAAC;gBAChD,MAAM,GAAG,CAAC,KAAK,CAAC;oBACd,MAAM,EAAE,uBAAuB,KAAK,EAAE;oBACtC,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE;oBAClE,QAAQ,EAAE;wBACR,KAAK;wBACL,cAAc,EAAE,KAAK,CAAC,IAAI;wBAC1B,UAAU,EAAE,kBAAkB;wBAC9B,UAAU;qBACX;iBACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC;oBAC3B,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;oBAC/E,KAAK,EAAE,mCAAmC;oBAC1C,IAAI,EAAE,oFAAoF;oBAC1F,IAAI,EAAE,8CAA8C;oBACpD,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC5B,QAAQ,EAAE,CAAC,MAAM,CAAC;oBAClB,SAAS,EAAE,uBAAuB,UAAU,EAAE;oBAC9C,QAAQ,EAAE;wBACR,KAAK;wBACL,cAAc,EAAE,KAAK,CAAC,IAAI;wBAC1B,UAAU,EAAE,kBAAkB;qBAC/B;iBACF,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/E,CAAC;SACF,EAAE,0BAA0B,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;AAC7H,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,QAAQ,CAAC;;SAEb,SAAS;;YAEN,SAAS;;;;;;;;;wBASG,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/C,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO;KACrE,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC;AAC9B,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,8 @@
+import { type RaybaseInferenceProviderFactory, type RaybaseInferenceProviderFactoryContext } from "@raybase/core";
+import { type OpenAISubscriptionTransportOptions } from "./transport.js";
+import type { OpenAISubscriptionCredentialScope, OpenAISubscriptionEnv, OpenAISubscriptionModuleOptions } from "./types.js";
+export declare function createOpenAISubscriptionProviderFactory<Env extends OpenAISubscriptionEnv>(options: OpenAISubscriptionModuleOptions): RaybaseInferenceProviderFactory<Env>;
+export declare function createOpenAISubscriptionProviderFactoryForTesting<Env extends OpenAISubscriptionEnv>(options: OpenAISubscriptionModuleOptions, transportOptions: OpenAISubscriptionTransportOptions): RaybaseInferenceProviderFactory<Env>;
+export declare function createOpenAISubscriptionProviderFactoryInternal<Env extends OpenAISubscriptionEnv>(options: OpenAISubscriptionModuleOptions, transportOptions?: OpenAISubscriptionTransportOptions): RaybaseInferenceProviderFactory<Env>;
+export declare function resolveOpenAISubscriptionCredentialScope<Env>(options: OpenAISubscriptionModuleOptions, context: Pick<RaybaseInferenceProviderFactoryContext<Env>, "config" | "principal" | "organizationId" | "surface">): OpenAISubscriptionCredentialScope;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,+BAA+B,EACpC,KAAK,sCAAsC,EAC5C,MAAM,eAAe,CAAC;AAOvB,OAAO,EAIL,KAAK,kCAAkC,EACxC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,iCAAiC,EACjC,qBAAqB,EACrB,+BAA+B,EAEhC,MAAM,YAAY,CAAC;AAKpB,wBAAgB,uCAAuC,CAAC,GAAG,SAAS,qBAAqB,EACvF,OAAO,EAAE,+BAA+B,GACvC,+BAA+B,CAAC,GAAG,CAAC,CAEtC;AAED,wBAAgB,iDAAiD,CAAC,GAAG,SAAS,qBAAqB,EACjG,OAAO,EAAE,+BAA+B,EACxC,gBAAgB,EAAE,kCAAkC,GACnD,+BAA+B,CAAC,GAAG,CAAC,CAEtC;AAED,wBAAgB,+CAA+C,CAAC,GAAG,SAAS,qBAAqB,EAC/F,OAAO,EAAE,+BAA+B,EACxC,gBAAgB,CAAC,EAAE,kCAAkC,GACpD,+BAA+B,CAAC,GAAG,CAAC,CA2DtC;AAED,wBAAgB,wCAAwC,CAAC,GAAG,EAC1D,OAAO,EAAE,+BAA+B,EACxC,OAAO,EAAE,IAAI,CACX,sCAAsC,CAAC,GAAG,CAAC,EAC3C,QAAQ,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,CACtD,GACA,iCAAiC,CAoCnC"}