@raybase/openai-subscription 0.0.2 → 0.1.0

package/ARCHITECTURE.md

@@ -0,0 +1,80 @@
+# OpenAI subscription inference decision
+
+Status: accepted for the experimental `0.1.x` module line.
+
+Raybase Core exposes a named, request-scoped inference-provider factory. The
+optional `@raybase/openai-subscription` module registers exactly one provider,
+`openai-codex-subscription`. Apps select it explicitly through
+`appConfig.ai.provider`; duplicate or missing provider ids fail at startup.
+Chat and streaming never fall back after selection. The provider intentionally
+omits embeddings, so the existing explicit Workers AI embedding path remains
+available.
+
+The module owns the compatibility-sensitive Codex transport, hidden system
+tables, scope resolver, encrypted credential envelopes, connection routes, and
+health state. Core remains provider-neutral. Credential identity is the exact
+application, organization, mode, and subject tuple, authenticated as AES-GCM
+AAD. The existing organization-scoped Pro database is the primary tenant
+boundary; the tuple is an additional boundary.
+
+Production endpoints are fixed to the reviewed compatibility manifest.
+Unknown protocol shapes fail closed as `protocol_update_required`. A bounded,
+parseable Codex `400` with a usable machine `error.code` or `error.type` is
+instead a caller/request rejection with a sanitized
+`protocol:codex_400_<token>` fingerprint and no health transition. Empty,
+malformed, oversized, non-object, or machine-detail-free `400` bodies remain
+the conservative protocol fallback. Upstream free-form messages never cross
+the transport boundary. Credentials are never module options, settings, or
+manifest data. Background work is disabled unless its mode-specific execution
+scope is explicitly configured.
+
+This direct private-protocol adapter is isolated behind an internal transport
+boundary so a future reviewed broker or Codex app-server adapter can implement
+the same provider contract without changing application configuration.
+
+Origin validation and endpoint authorization are deliberately separate.
+Transport construction accepts only bare HTTPS origins; request dispatch then
+checks the configured origin and exact fixed method/path immediately before
+fetch. Arbitrary origins and fetchers exist only in the package's `./testing`
+entry point. Ordinary module and provider construction cannot change canonical
+destinations.
+
+Cloudflare Worker deployments can select a request-scoped VPC Network Fetcher
+binding for the canonical Codex responses endpoint. The binding is taken from
+the current provider or route environment, is structurally limited to
+`fetch()`, and is never captured as a global capability. Auth traffic remains
+direct; Codex traffic uses the VPC binding exactly once. Missing bindings,
+throws, redirects, declared non-SSE responses, and 403 HTML responses fail
+closed and never fall back to global fetch. The canonical Codex endpoint may
+omit `Content-Type`; only a missing or empty value is admitted to the same
+bounded strict SSE parser, which must still reach a completed response. A
+declared non-SSE response is rejected before body read. Diagnostics retain
+status, normalized content type, retry metadata, and safe `cf-ray` correlation
+only; bodies and credential or account data are discarded. A bounded
+`x-oai-request-id` may travel as opaque `oaiRequestId` metadata on a thrown
+error, independently of its fingerprint, but is not written into health,
+incident, notification, or audit state.
+
+Local workerd cannot reach the canonical Codex endpoint through its direct
+client fingerprint. Under `raybase dev`, apps instead select `local-relay`.
+The CLI owns an ephemeral Node server bound to IPv4 loopback and injects its
+URL plus a 256-bit per-boot secret into the local Worker. The transport accepts
+only a loopback relay URL while `RAYBASE_ENV=local`, adds the relay guard only
+to that hop, and leaves auth traffic direct. The relay strips its guard,
+allows only the fixed Codex responses method/path, forwards the original body
+and request headers, uses manual redirects, and streams the response. It emits
+no request logs. This capability is dev-only and never replaces the
+production VPC route.
+
+Core owns output-budget admission and accounting above this adapter. It passes
+the effective `maxOutputTokens` through the provider-neutral request so the
+reservation happens before dispatch, while the adapter omits the unsupported
+`max_output_tokens` subscription field. The existing 4 MB SSE limit is the
+remaining per-response size ceiling.
+
+The VPC mechanism follows Cloudflare's beta Workers VPC and Gateway egress
+documentation. Unit and mock Worker coverage cannot establish edge
+reachability: release acceptance requires the repository-owned source-checkout
+Worker fixture to finish a minimal `gpt-5.6-terra` SSE response through
+`network_id: "cf1:network"`. A remaining 403 is reported as a platform blocker,
+not treated as expired auth or an invitation to imitate a browser.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Itself & Co
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,199 @@
-# @raybase/openai-subscription
+# `@raybase/openai-subscription`
 
-This name is reserved for Raybase. Nothing is released under it yet, and this package holds no code.
+Experimental, explicitly opt-in Raybase module for ChatGPT/Codex
+subscription-backed Raybase Agent inference.
+
+This is compatibility code, not the public OpenAI API and not API-key billing.
+The Worker-native transport is pinned to the reviewed upstream Codex revision
+recorded in `compatibility/manifest.json`. Unknown protocol shapes fail closed
+as `protocol_update_required`.
+
+Codex `400` responses are classified only from bounded machine fields. A
+parseable `error.code`, or `error.type` when the code is absent or unusable,
+becomes a lowercase, punctuation-normalized token capped at 32 characters in a
+fingerprint such as `protocol:codex_400_invalid_json_schema`. This is a
+health-neutral request failure: it does not change a connected subscription or
+create a protocol incident. Free-form upstream `message` text is discarded,
+and `param` is used only by the exact `invalid_function_parameters` tool-schema
+case. Empty, malformed, oversized, non-object, and detail-free `400` bodies
+remain `protocol:unexpected_http_status_400` with
+`protocol_update_required` because ownership cannot be established safely.
+
+A trimmed, non-empty `x-oai-request-id` of at most 128 characters is retained
+as opaque `oaiRequestId` metadata on the thrown transport/request error. It is
+not part of the fingerprint and is not automatically persisted or displayed
+in subscription health, incidents, notifications, or audits.
+
+```ts
+import {
+  openaiSubscriptionModule,
+  type OpenAISubscriptionFetcher
+} from "@raybase/openai-subscription";
+import type { RaybaseEnv } from "@raybase/core/worker";
+
+type Env = RaybaseEnv & { CODEX_EGRESS: OpenAISubscriptionFetcher };
+
+openaiSubscriptionModule<Env>({
+  credentialMode: "user",
+  background: { strategy: "run-as-user" },
+  codexEgress: import.meta.env.DEV
+    ? { strategy: "local-relay" }
+    : { strategy: "cloudflare-vpc", binding: "CODEX_EGRESS" }
+});
+```
+
+For a production Cloudflare Worker, add the matching Workers VPC Network
+binding to `wrangler.jsonc`:
+
+```jsonc
+{
+  "vpc_networks": [
+    {
+      "binding": "CODEX_EGRESS",
+      "network_id": "cf1:network",
+      "remote": true
+    }
+  ]
+}
+```
+
+`raybase modules add openai-subscription` writes this binding to production.
+`raybase modules doctor` reports a missing or malformed production binding.
+
+For local development, the installed module selects `local-relay`.
+`raybase dev` starts an ephemeral Node relay bound to `127.0.0.1`, injects a
+per-boot URL and shared secret into the local Worker, and removes them on clean
+shutdown. Only Codex response traffic uses that relay; device and token traffic
+continues directly to `https://auth.openai.com`. The relay accepts only the
+Codex responses route and never logs request header values. `local-relay`
+fails closed outside a Worker whose `RAYBASE_ENV` is `local`.
+
+The binding is resolved from the active request's Worker environment. Codex
+response traffic goes only through `CODEX_EGRESS.fetch()`; device and token
+traffic remains on canonical `https://auth.openai.com` through normal fetch.
+A missing, malformed, throwing, or 403 VPC binding fails closed. There is no
+retry through global fetch. Standalone Node tools may omit `codexEgress` or use
+`{ strategy: "direct" }` for backward-compatible direct traffic.
+
+Cloudflare documents this public-Internet Gateway route in the
+[Workers VPC overview](https://developers.cloudflare.com/workers-vpc/),
+[binding API](https://developers.cloudflare.com/workers-vpc/api/), and
+[Gateway egress announcement](https://developers.cloudflare.com/changelog/post/2026-06-05-gateway-egress/).
+Workers VPC is currently beta, so re-check those documents before deployment.
+
+`maxOutputTokens` remains a Raybase admission and accounting input. Core
+reserves the effective value before provider dispatch and records observed
+usage, but the subscription wire does not send unsupported
+`max_output_tokens`. An admitted response is bounded by the transport's 4 MB
+SSE ceiling, not by server-side per-response token truncation.
+
+## Image inputs
+
+User messages may interleave text, HTTPS image URLs, and inline base64/data-URI
+images. The subscription adapter preserves that order and emits Responses
+`input_text` and `input_image` items; an image always uses the verified
+`input_image.image_url` field. Supported media types are PNG, JPEG, WEBP, and
+non-animated GIF. System, assistant, and tool message content remains
+string-only.
+
+This boundary is intentionally strict. Unsupported kinds such as audio or
+files, malformed MIME/base64/URL values, and extra fields are rejected before
+fetch with caller errors that name the kind or field. In particular, Raybase
+does not expose per-image `detail` or `quality`: it omits both and uses the
+endpoint's accepted omitted-field behavior. See the dated evidence and exact
+unsupported-kind inventory in
+`skills/raybase-openai-subscription/references/compatibility-and-testing.md`.
+
+## Live Worker verification
+
+Mock Fetcher tests prove routing and fail-closed behavior, not ChatGPT
+reachability. The fixture is a Raybase repository source-checkout acceptance
+gate under `packages/openai-subscription/test-worker/`; it is intentionally
+not included in the published package and published consumers receive no
+fixture scripts. From the repository root:
+
+1. Run `pnpm deploy:openai-subscription-worker-egress:remote` for the narrowly
+   named ephemeral Worker in
+   `packages/openai-subscription/test-worker/wrangler.jsonc`.
+2. Run `pnpm exec wrangler secret put OPENAI_SUBSCRIPTION_TOKEN --config packages/openai-subscription/test-worker/wrangler.jsonc`
+   and the same command for `OPENAI_SUBSCRIPTION_VERIFICATION_KEY`. Let
+   Wrangler prompt on stdin; never
+   put either value in configuration, source, command arguments, logs, or
+   output.
+3. POST `/verify` with the one-time key in the Authorization header. A pass
+   reports only route, model, status, the validated SSE protocol, and final
+   token counts. The canonical endpoint can omit `Content-Type`; a missing or
+   empty value is accepted only when the bounded strict SSE parser reaches a
+   completed response. A declared non-SSE media type fails before body read
+   and reports only normalized content type, `cf-ray` presence, and redirect
+   state; the upstream body remains unread and is cancelled.
+4. Immediately run `pnpm delete:openai-subscription-worker-egress:remote`. A 403
+   is a platform blocker; do not add browser headers or a direct-fetch retry.
+5. Toby must rotate the furnished development subscription token after the
+   verification evidence is captured.
+
+### The `cloudflare-vpc` lane, verified 2026-08-10
+
+Acceptance item **met**: one real turn through `CODEX_EGRESS` from a genuinely
+deployed Worker (`wrangler deploy`, binding `cf1:network`), carrying a
+credential minted by this module's own device-code flow, returned inner status
+`200`, validated SSE, `gpt-5.6-terra`, usage 11 in / 5 out. The spike ran from
+committed `75dfca7` — that is, **without** the outbound header allowlist below
+— which is what makes it decisive: neither the Workers runtime nor Cloudflare's
+VPC egress decorates those subrequests with the headers that block the front
+door. Production device-auth traffic was never affected.
+
+chatgpt.com sits behind Cloudflare, and its front door blocks any request
+carrying Cloudflare's own hop metadata. `cf-worker` — which workerd stamps on
+every outbound subrequest — plus `cf-connecting-ip` and `cf-visitor` each
+return `403 text/html` with the blocked page and **no `x-oai-request-id`**,
+because the request never reaches the Codex API. (`cf-ray` and `cf-ipcountry`
+do not trigger it.) This, not any property of the credential, is what blocked
+the local lane through August 2026: `raybase dev`'s relay moved the TCP client
+to Node but forwarded workerd's `cf-worker` header unchanged.
+
+Two boundaries now guard this: the relay strips that header class at its own
+edge, and the transport authors its outbound header set from an allowlist
+(`content-type`, `authorization`, `chatgpt-account-id`, `originator`,
+`accept`) for every egress strategy.
+
+The allowlist is a guard, not a repair: the module has never authored a `cf-*`
+header on any strategy, and the deploy above proves the runtime does not add
+one either. It exists so a future edit cannot reintroduce the dev failure on
+the VPC path, which has no relay boundary to catch it.
+
+**What still cannot be observed locally:** headers appended after `fetch()`
+leaves the module. That is now evidenced rather than assumed, but the evidence
+is a point-in-time deploy — re-run the turn above if Cloudflare changes VPC
+egress behaviour, since Workers VPC is still beta.
+
+A `403` there is diagnosable in one glance: `codex_egress_forbidden`
+(`disconnected`) is the front door and names the hop-header cause;
+`codex_account_forbidden` (`reauth_required`) is the Codex API refusing the
+account. Per step 4 above, a front-door 403 is a platform blocker — do not
+answer it with browser headers or a direct-fetch retry.
+
+Set `appConfig.ai.provider` to `openai-codex-subscription`. Create
+`RAYBASE_OPENAI_SUBSCRIPTION_KEY` with at least 32 random bytes encoded as
+base64/base64url and store it only as a local/deployed Worker secret. Never add
+its value to Wrangler configuration, settings, source, or manifests.
+
+Credential modes are explicit:
+
+- `operator`: one designated responsible operator subject.
+- `user`: each signed-in user links their own eligible subscription.
+- `organization`: an organization-controlled account, scoped to the resolved
+  organization runtime.
+
+`protocol_update_required` means update to a newly published
+`@raybase/openai-subscription` version containing a reviewed upstream
+pin/schema/fixture update. Do not edit the production allowlist or retry
+blindly. A `protocol:codex_400_<token>` fingerprint without a health field is a
+request rejection instead: fix the caller-owned request or schema and use a
+bounded `oaiRequestId`, when present on the thrown error, for upstream support
+correlation. For key rotation, deploy the reviewed replacement key and
+reconnect each scope; old ciphertext is intentionally not decryptable under an
+unrelated key.
+
+The module informs operators about usage scope; it does not certify or enforce
+eligibility.

package/compatibility/fixtures/device-usercode.json

@@ -0,0 +1,5 @@
+{
+  "device_auth_id": "fixture-device-id",
+  "user_code": "ABCD-EFGH",
+  "interval": "5"
+}

package/compatibility/fixtures/responses-function-call.sse

@@ -0,0 +1,23 @@
+event: response.created
+data: {"type":"response.created","sequence_number":0,"response":{"id":"resp_function_fixture","status":"in_progress","output":[]}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","sequence_number":1,"output_index":0,"item":{"id":"fc_function_fixture","type":"function_call","status":"in_progress","arguments":"","call_id":"call_function_fixture","name":"lookup_customer"}}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":2,"item_id":"fc_function_fixture","output_index":0,"delta":"{\"customerId\":"}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":3,"item_id":"fc_function_fixture","output_index":0,"delta":"\"cust_fixture\","}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":4,"item_id":"fc_function_fixture","output_index":0,"delta":"\"includeOrders\":true}"}
+
+event: response.function_call_arguments.done
+data: {"type":"response.function_call_arguments.done","sequence_number":5,"item_id":"fc_function_fixture","output_index":0,"name":"lookup_customer","arguments":"{\"customerId\":\"cust_fixture\",\"includeOrders\":true}"}
+
+event: response.output_item.done
+data: {"type":"response.output_item.done","sequence_number":6,"output_index":0,"item":{"id":"fc_function_fixture","type":"function_call","status":"completed","arguments":"{\"customerId\":\"cust_fixture\",\"includeOrders\":true}","call_id":"call_function_fixture","name":"lookup_customer"}}
+
+event: response.completed
+data: {"type":"response.completed","sequence_number":7,"response":{"id":"resp_function_fixture","status":"completed","output":[{"id":"fc_function_fixture","type":"function_call","status":"completed","arguments":"{\"customerId\":\"cust_fixture\",\"includeOrders\":true}","call_id":"call_function_fixture","name":"lookup_customer"}],"usage":{"input_tokens":12,"input_tokens_details":{"cached_tokens":0},"output_tokens":8,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":20}}}

package/compatibility/fixtures/responses-image-input.sse

@@ -0,0 +1,15 @@
+event: response.created
+data: {"type":"response.created","response":{"id":"resp_image_fixture","status":"in_progress"}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","item":{"id":"msg_image_fixture","type":"message","role":"assistant"}}
+
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","delta":"fixture image answer"}
+
+event: response.output_text.done
+data: {"type":"response.output_text.done","text":"fixture image answer"}
+
+event: response.completed
+data: {"type":"response.completed","response":{"id":"resp_image_fixture","status":"completed","usage":{"input_tokens":19,"output_tokens":3}}}
+

package/compatibility/fixtures/responses-image-request.json

@@ -0,0 +1,32 @@
+{
+  "model": "gpt-5.6-terra",
+  "instructions": "Answer briefly.",
+  "input": [
+    {
+      "role": "user",
+      "content": [
+        {
+          "type": "input_text",
+          "text": "Compare these images: "
+        },
+        {
+          "type": "input_image",
+          "image_url": "https://example.test/fixture.png"
+        },
+        {
+          "type": "input_text",
+          "text": " and "
+        },
+        {
+          "type": "input_image",
+          "image_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII="
+        }
+      ]
+    }
+  ],
+  "tools": [],
+  "tool_choice": "none",
+  "parallel_tool_calls": true,
+  "stream": true,
+  "store": false
+}

package/compatibility/fixtures/responses-invalid-function-parameters.json

@@ -0,0 +1,8 @@
+{
+  "error": {
+    "message": "Fixture function parameter schema is invalid.",
+    "type": "invalid_request_error",
+    "param": "tools[3].parameters",
+    "code": "invalid_function_parameters"
+  }
+}

package/compatibility/fixtures/responses-invalid-json-schema.json

@@ -0,0 +1,8 @@
+{
+  "error": {
+    "message": "Fixture response format schema is invalid.",
+    "type": "invalid_request_error",
+    "param": "text.format.schema",
+    "code": "invalid_json_schema"
+  }
+}

package/compatibility/fixtures/responses-mixed.sse

@@ -0,0 +1,41 @@
+event: response.created
+data: {"type":"response.created","sequence_number":0,"response":{"id":"resp_mixed_fixture","status":"in_progress","output":[]}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","sequence_number":1,"output_index":0,"item":{"id":"msg_mixed_fixture","type":"message","status":"in_progress","role":"assistant","content":[]}}
+
+event: response.content_part.added
+data: {"type":"response.content_part.added","sequence_number":2,"item_id":"msg_mixed_fixture","output_index":0,"content_index":0,"part":{"type":"output_text","text":"","annotations":[]}}
+
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","sequence_number":3,"item_id":"msg_mixed_fixture","output_index":0,"content_index":0,"delta":"I'll check "}
+
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","sequence_number":4,"item_id":"msg_mixed_fixture","output_index":0,"content_index":0,"delta":"the order."}
+
+event: response.output_text.done
+data: {"type":"response.output_text.done","sequence_number":5,"item_id":"msg_mixed_fixture","output_index":0,"content_index":0,"text":"I'll check the order."}
+
+event: response.content_part.done
+data: {"type":"response.content_part.done","sequence_number":6,"item_id":"msg_mixed_fixture","output_index":0,"content_index":0,"part":{"type":"output_text","text":"I'll check the order.","annotations":[]}}
+
+event: response.output_item.done
+data: {"type":"response.output_item.done","sequence_number":7,"output_index":0,"item":{"id":"msg_mixed_fixture","type":"message","status":"completed","role":"assistant","content":[{"type":"output_text","text":"I'll check the order.","annotations":[]}]}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","sequence_number":8,"output_index":1,"item":{"id":"fc_mixed_fixture","type":"function_call","status":"in_progress","arguments":"","call_id":"call_mixed_fixture","name":"lookup_order"}}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":9,"item_id":"fc_mixed_fixture","output_index":1,"delta":"{\"orderId\":"}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":10,"item_id":"fc_mixed_fixture","output_index":1,"delta":"\"order_fixture\"}"}
+
+event: response.function_call_arguments.done
+data: {"type":"response.function_call_arguments.done","sequence_number":11,"item_id":"fc_mixed_fixture","output_index":1,"name":"lookup_order","arguments":"{\"orderId\":\"order_fixture\"}"}
+
+event: response.output_item.done
+data: {"type":"response.output_item.done","sequence_number":12,"output_index":1,"item":{"id":"fc_mixed_fixture","type":"function_call","status":"completed","arguments":"{\"orderId\":\"order_fixture\"}","call_id":"call_mixed_fixture","name":"lookup_order"}}
+
+event: response.completed
+data: {"type":"response.completed","sequence_number":13,"response":{"id":"resp_mixed_fixture","status":"completed","output":[{"id":"msg_mixed_fixture","type":"message","status":"completed","role":"assistant","content":[{"type":"output_text","text":"I'll check the order.","annotations":[]}]},{"id":"fc_mixed_fixture","type":"function_call","status":"completed","arguments":"{\"orderId\":\"order_fixture\"}","call_id":"call_mixed_fixture","name":"lookup_order"}],"usage":{"input_tokens":21,"input_tokens_details":{"cached_tokens":4},"output_tokens":14,"output_tokens_details":{"reasoning_tokens":3},"total_tokens":35}}}

package/compatibility/fixtures/responses-multi-tool.sse

@@ -0,0 +1,35 @@
+event: response.created
+data: {"type":"response.created","sequence_number":0,"response":{"id":"resp_multi_tool_fixture","status":"in_progress","output":[]}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","sequence_number":1,"output_index":0,"item":{"id":"fc_weather_fixture","type":"function_call","status":"in_progress","arguments":"","call_id":"call_weather_fixture","name":"lookup_weather"}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","sequence_number":2,"output_index":1,"item":{"id":"fc_time_fixture","type":"function_call","status":"in_progress","arguments":"","call_id":"call_time_fixture","name":"lookup_time"}}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":3,"item_id":"fc_weather_fixture","output_index":0,"delta":"{\"city\":\"Par"}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":4,"item_id":"fc_time_fixture","output_index":1,"delta":"{\"timezone\":"}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":5,"item_id":"fc_weather_fixture","output_index":0,"delta":"is\",\"units\":\"celsius\"}"}
+
+event: response.function_call_arguments.delta
+data: {"type":"response.function_call_arguments.delta","sequence_number":6,"item_id":"fc_time_fixture","output_index":1,"delta":"\"Europe/Paris\"}"}
+
+event: response.function_call_arguments.done
+data: {"type":"response.function_call_arguments.done","sequence_number":7,"item_id":"fc_time_fixture","output_index":1,"name":"lookup_time","arguments":"{\"timezone\":\"Europe/Paris\"}"}
+
+event: response.function_call_arguments.done
+data: {"type":"response.function_call_arguments.done","sequence_number":8,"item_id":"fc_weather_fixture","output_index":0,"name":"lookup_weather","arguments":"{\"city\":\"Paris\",\"units\":\"celsius\"}"}
+
+event: response.output_item.done
+data: {"type":"response.output_item.done","sequence_number":9,"output_index":1,"item":{"id":"fc_time_fixture","type":"function_call","status":"completed","arguments":"{\"timezone\":\"Europe/Paris\"}","call_id":"call_time_fixture","name":"lookup_time"}}
+
+event: response.output_item.done
+data: {"type":"response.output_item.done","sequence_number":10,"output_index":0,"item":{"id":"fc_weather_fixture","type":"function_call","status":"completed","arguments":"{\"city\":\"Paris\",\"units\":\"celsius\"}","call_id":"call_weather_fixture","name":"lookup_weather"}}
+
+event: response.completed
+data: {"type":"response.completed","sequence_number":11,"response":{"id":"resp_multi_tool_fixture","status":"completed","output":[{"id":"fc_weather_fixture","type":"function_call","status":"completed","arguments":"{\"city\":\"Paris\",\"units\":\"celsius\"}","call_id":"call_weather_fixture","name":"lookup_weather"},{"id":"fc_time_fixture","type":"function_call","status":"completed","arguments":"{\"timezone\":\"Europe/Paris\"}","call_id":"call_time_fixture","name":"lookup_time"}],"usage":{"input_tokens":31,"input_tokens_details":{"cached_tokens":6},"output_tokens":19,"output_tokens_details":{"reasoning_tokens":2},"total_tokens":50}}}

package/compatibility/fixtures/responses.sse

@@ -0,0 +1,26 @@
+event: response.created
+data: {"type":"response.created","sequence_number":0,"response":{"id":"resp_text_fixture","status":"in_progress","output":[]}}
+
+event: response.in_progress
+data: {"type":"response.in_progress","sequence_number":1,"response":{"id":"resp_text_fixture","status":"in_progress","output":[]}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","sequence_number":2,"output_index":0,"item":{"id":"msg_text_fixture","type":"message","status":"in_progress","role":"assistant","content":[]}}
+
+event: response.content_part.added
+data: {"type":"response.content_part.added","sequence_number":3,"item_id":"msg_text_fixture","output_index":0,"content_index":0,"part":{"type":"output_text","text":"","annotations":[]}}
+
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","sequence_number":4,"item_id":"msg_text_fixture","output_index":0,"content_index":0,"delta":"fixture"}
+
+event: response.output_text.done
+data: {"type":"response.output_text.done","sequence_number":5,"item_id":"msg_text_fixture","output_index":0,"content_index":0,"text":"fixture"}
+
+event: response.content_part.done
+data: {"type":"response.content_part.done","sequence_number":6,"item_id":"msg_text_fixture","output_index":0,"content_index":0,"part":{"type":"output_text","text":"fixture","annotations":[]}}
+
+event: response.output_item.done
+data: {"type":"response.output_item.done","sequence_number":7,"output_index":0,"item":{"id":"msg_text_fixture","type":"message","status":"completed","role":"assistant","content":[{"type":"output_text","text":"fixture","annotations":[]}]}}
+
+event: response.completed
+data: {"type":"response.completed","sequence_number":8,"response":{"id":"resp_text_fixture","status":"completed","output":[{"id":"msg_text_fixture","type":"message","status":"completed","role":"assistant","content":[{"type":"output_text","text":"fixture","annotations":[]}]}],"usage":{"input_tokens":3,"input_tokens_details":{"cached_tokens":0},"output_tokens":1,"output_tokens_details":{"reasoning_tokens":0},"total_tokens":4}}}

package/compatibility/manifest.json

@@ -0,0 +1,50 @@
+{
+  "schemaVersion": 1,
+  "moduleProtocolVersion": "codex-subscription-2026-07-29",
+  "observedAt": "2026-07-29",
+  "upstream": {
+    "repository": "https://github.com/openai/codex",
+    "commit": "df326d31cda41a84f0641ec6519db08020248281",
+    "evidence": [
+      "codex-rs/login/src/device_code_auth.rs",
+      "codex-rs/login/src/auth/manager.rs",
+      "codex-rs/model-provider-info/src/lib.rs",
+      "codex-rs/model-provider/src/auth.rs",
+      "codex-rs/codex-api/src/endpoint/responses.rs",
+      "codex-rs/codex-api/src/sse/responses.rs"
+    ]
+  },
+  "productionAllowlist": [
+    { "origin": "https://auth.openai.com", "method": "POST", "path": "/api/accounts/deviceauth/usercode" },
+    { "origin": "https://auth.openai.com", "method": "POST", "path": "/api/accounts/deviceauth/token" },
+    { "origin": "https://auth.openai.com", "method": "POST", "path": "/oauth/token" },
+    { "origin": "https://chatgpt.com", "method": "POST", "path": "/backend-api/codex/responses" }
+  ],
+  "requestContentEvidence": {
+    "observedAt": "2026-08-11",
+    "scope": "Redacted local image-input probe only; authentication and SSE protocol pins were not re-reviewed.",
+    "wireField": "input_image.image_url",
+    "completedMediaTypes": ["image/png", "image/jpeg", "image/webp", "image/gif"],
+    "completedDetailValues": ["omitted", "auto", "low", "high", "original"],
+    "qualityResult": "400 unknown_parameter",
+    "largestCompletedEncodedRequestBytes": 19573864,
+    "largestCompletedDecodedImageBytes": 14680144,
+    "exactPrivateLimitVerified": false,
+    "fixtures": ["responses-image-request.json", "responses-image-input.sse"]
+  },
+  "fixtures": {
+    "provenance": "Sanitized synthetic fixtures derived from the pinned Rust response structs, SSE event matches, and observed machine-readable Codex refusal envelopes. They contain no live credentials, identifiers, prompts, completions, schema names, or request IDs.",
+    "inventory": {
+      "successfulSse": [
+        "responses.sse",
+        "responses-function-call.sse",
+        "responses-mixed.sse",
+        "responses-multi-tool.sse"
+      ],
+      "sanitizedErrorEnvelopes": [
+        "responses-invalid-json-schema.json",
+        "responses-invalid-function-parameters.json"
+      ]
+    }
+  }
+}

package/dist/crypto.d.ts

@@ -0,0 +1,12 @@
+import type { OpenAISubscriptionCredentialScope } from "./types.js";
+export type OpenAISubscriptionEncryptedEnvelope = {
+    version: 1;
+    keyVersion: 1;
+    nonce: string;
+    ciphertext: string;
+};
+export declare function validateOpenAISubscriptionSecret(secret: string | undefined): Uint8Array;
+export declare function encryptOpenAISubscriptionEnvelope(secret: string, scope: OpenAISubscriptionCredentialScope, value: unknown): Promise<OpenAISubscriptionEncryptedEnvelope>;
+export declare function decryptOpenAISubscriptionEnvelope<T>(secret: string, scope: OpenAISubscriptionCredentialScope, envelope: OpenAISubscriptionEncryptedEnvelope): Promise<T>;
+export declare function openAISubscriptionScopeKey(scope: OpenAISubscriptionCredentialScope): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,MAAM,mCAAmC,GAAG;IAChD,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,CAAC,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAKF,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAgBvF;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,iCAAiC,EACxC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,mCAAmC,CAAC,CAc9C;AAED,wBAAsB,iCAAiC,CAAC,CAAC,EACvD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,iCAAiC,EACxC,QAAQ,EAAE,mCAAmC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAgBZ;AAED,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1G"}