@theokit/sdk 4.11.0 → 4.12.0

package/dist/eval.cjs

@@ -569,10 +569,10 @@ function buildToolPrompt(prompt) {
 Respond by calling the \`output\` tool with the structured answer that matches the schema.`;
 }
 function setupStructuredOutput(schema, maxRetries) {
-  const z9 = requireZod();
+  const z10 = requireZod();
   const jsonSchema = toJsonSchema(schema, { unrepresentable: "any" });
   return {
-    z: z9,
+    z: z10,
     jsonSchema,
     maxRetries: maxRetries ?? 1,
     initialUsage: { inputTokens: 0, outputTokens: 0 }
@@ -11374,6 +11374,358 @@ var OPENAI = {
   hostname: "api.openai.com",
   fallbackModels: ["gpt-4o", "gpt-4o-mini"]
 };
+function credentialHome(config, env = {}) {
+  const override = config.homeEnvVar !== void 0 ? env[config.homeEnvVar]?.trim() : void 0;
+  return override !== void 0 && override.length > 0 ? override : path.join(config.home, config.dirName);
+}
+function authFilePath(config, env = {}) {
+  return path.join(credentialHome(config, env), config.fileName);
+}
+var CredentialError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialError";
+  }
+};
+var apiFileSchema = zod.z.object({
+  type: zod.z.literal("api").optional(),
+  provider: zod.z.string().min(1).optional(),
+  api_key: zod.z.string()
+}).strict();
+var oauthFileSchema = zod.z.object({
+  type: zod.z.literal("oauth"),
+  provider: zod.z.string().min(1),
+  access: zod.z.string().min(1),
+  refresh: zod.z.string().min(1),
+  expires: zod.z.number(),
+  account_id: zod.z.string().optional()
+}).strict();
+var fileSchema = zod.z.union([oauthFileSchema, apiFileSchema]);
+function assertSecureModes(dirPath, path) {
+  const dirMode = fs.statSync(dirPath).mode & 511;
+  if ((dirMode & 18) !== 0) {
+    throw new CredentialError(
+      `${dirPath} is writable by other users (mode ${dirMode.toString(8)}), so the credential file inside it can be replaced. Fix it with:  chmod 700 ${dirPath}`
+    );
+  }
+  const mode = fs.statSync(path).mode & 511;
+  if ((mode & 63) !== 0) {
+    throw new CredentialError(
+      `${path} is readable by other users (mode ${mode.toString(8)}). A credential file must not be. Fix it with:  chmod 600 ${path}`
+    );
+  }
+}
+function describeUnionError(parsed, err, path) {
+  const looksOAuth = typeof parsed === "object" && parsed !== null && parsed.type === "oauth";
+  const specific = looksOAuth ? oauthFileSchema.safeParse(parsed) : apiFileSchema.safeParse(parsed);
+  let issue;
+  if (!specific.success) {
+    issue = specific.error.issues[0];
+  } else if (err instanceof zod.z.ZodError) {
+    issue = err.issues[0];
+  }
+  return new CredentialError(
+    `${path}: ${issue?.message ?? String(err)} [${issue?.path.join(".") || "root"}]`
+  );
+}
+function parseStoredFile(raw, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new CredentialError(
+      `${path} is not valid JSON. Expected:  {"provider": "<name>", "api_key": "..."}`
+    );
+  }
+  try {
+    return fileSchema.parse(parsed);
+  } catch (err) {
+    throw describeUnionError(parsed, err, path);
+  }
+}
+function readAuthFile(config, env = {}) {
+  const path = authFilePath(config, env);
+  let raw;
+  try {
+    raw = fs.readFileSync(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new CredentialError(`cannot read ${path}: ${err.message}`);
+  }
+  assertSecureModes(credentialHome(config, env), path);
+  return parseStoredFile(raw, path);
+}
+function readStoredOAuth(config, env = {}) {
+  const stored = readAuthFile(config, env);
+  return stored !== void 0 && stored.type === "oauth" ? stored : void 0;
+}
+function isOAuthWrite(c) {
+  return "type" in c && c.type === "oauth";
+}
+function buildStorePayload(cred) {
+  if (isOAuthWrite(cred)) {
+    if (cred.access.length === 0 || cred.refresh.length === 0) {
+      throw new CredentialError(
+        "refusing to write an oauth credential with an empty access/refresh token"
+      );
+    }
+    return {
+      type: "oauth",
+      provider: cred.provider,
+      access: cred.access,
+      refresh: cred.refresh,
+      expires: cred.expires,
+      ...cred.account_id !== void 0 ? { account_id: cred.account_id } : {}
+    };
+  }
+  if (typeof cred.apiKey !== "string" || cred.apiKey.length === 0) {
+    throw new CredentialError("refusing to write an empty API key");
+  }
+  return { provider: cred.provider, api_key: cred.apiKey };
+}
+function writeCredential(cred, config, env = {}) {
+  const payload = buildStorePayload(cred);
+  const dir = credentialHome(config, env);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+  const path = authFilePath(config, env);
+  const tmp = `${path}.tmp-${crypto.randomBytes(8).toString("hex")}`;
+  try {
+    const fd = fs.openSync(tmp, "wx", 384);
+    try {
+      fs.writeFileSync(fd, `${JSON.stringify(payload, null, 2)}
+`);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.chmodSync(tmp, 384);
+    fs.renameSync(tmp, path);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+    }
+    throw new CredentialError(`cannot write ${path}: ${err.message}`);
+  }
+  return path;
+}
+
+// src/server/auth/errors.ts
+var AuthCallbackError = class extends Error {
+  name = "AuthCallbackError";
+  code;
+  constructor(code, message) {
+    super(message ?? `OAuth callback error: ${code}`);
+    this.code = code;
+  }
+};
+
+// src/internal/auth/oauth-engine.ts
+var REFRESH_SKEW_MS = 6e4;
+function parseTokenResponse(body, now) {
+  const b = body;
+  if (typeof b.access_token !== "string" || b.access_token.length === 0) {
+    throw new AuthCallbackError(
+      "oauth_token_exchange_failed",
+      "token response had no access_token"
+    );
+  }
+  if (typeof b.refresh_token !== "string" || b.refresh_token.length === 0) {
+    throw new AuthCallbackError(
+      "oauth_token_exchange_failed",
+      "token response had no refresh_token"
+    );
+  }
+  const expiresIn = typeof b.expires_in === "number" ? b.expires_in : 3600;
+  return {
+    access: b.access_token,
+    refresh: b.refresh_token,
+    expires: now + expiresIn * 1e3,
+    ...typeof b.account_id === "string" ? { accountId: b.account_id } : {}
+  };
+}
+async function postGrant(config, form, deps) {
+  let res;
+  try {
+    res = await deps.fetch(config.tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams(form).toString()
+    });
+  } catch (err) {
+    throw new AuthCallbackError(
+      "oauth_token_exchange_failed",
+      `token endpoint request failed: ${err.message}`
+    );
+  }
+  if (!res.ok) {
+    throw new AuthCallbackError(
+      "oauth_token_exchange_failed",
+      `token endpoint returned HTTP ${res.status}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new AuthCallbackError("oauth_token_exchange_failed", "token response was not valid JSON");
+  }
+  return parseTokenResponse(json, deps.now());
+}
+function refreshOAuthTokens(config, refresh, deps) {
+  return postGrant(
+    config,
+    { grant_type: "refresh_token", refresh_token: refresh, client_id: config.clientId },
+    deps
+  );
+}
+function persistOAuthTokens(provider, tokens, store, env = {}) {
+  return writeCredential(
+    {
+      type: "oauth",
+      provider,
+      access: tokens.access,
+      refresh: tokens.refresh,
+      expires: tokens.expires,
+      ...tokens.accountId !== void 0 ? { account_id: tokens.accountId } : {}
+    },
+    store,
+    env
+  );
+}
+var inFlightRefresh = /* @__PURE__ */ new Map();
+async function ensureFreshCredential(resolved, opts, deps) {
+  if (resolved.kind !== "oauth") return resolved;
+  const now = deps.now();
+  if (resolved.expiresAt !== void 0 && resolved.expiresAt > now + REFRESH_SKEW_MS) {
+    return resolved;
+  }
+  const env = opts.env ?? {};
+  const path = authFilePath(opts.store, env);
+  let refresh = inFlightRefresh.get(path);
+  if (refresh === void 0) {
+    refresh = (async () => {
+      const stored = readStoredOAuth(opts.store, env);
+      if (stored === void 0) {
+        throw new AuthCallbackError(
+          "oauth_token_exchange_failed",
+          "no stored oauth credential to refresh"
+        );
+      }
+      const fresh2 = await refreshOAuthTokens(opts.config, stored.refresh, deps);
+      const merged = {
+        ...fresh2,
+        accountId: fresh2.accountId ?? stored.account_id
+      };
+      persistOAuthTokens(resolved.provider, merged, opts.store, env);
+      return merged;
+    })();
+    inFlightRefresh.set(path, refresh);
+    refresh.finally(() => inFlightRefresh.delete(path)).catch(() => {
+    });
+  }
+  const fresh = await refresh;
+  return {
+    kind: "oauth",
+    provider: resolved.provider,
+    apiKey: fresh.access,
+    source: resolved.source,
+    inferred: false,
+    expiresAt: fresh.expires
+  };
+}
+
+// src/internal/auth/resolve-credential.ts
+async function resolveOAuth(stored, path, opts, env) {
+  if (stored.provider !== opts.provider) return void 0;
+  const base = {
+    kind: "oauth",
+    provider: opts.provider,
+    apiKey: stored.access,
+    source: path,
+    inferred: false,
+    expiresAt: stored.expires
+  };
+  if (opts.oauth === void 0) return base;
+  const deps = {
+    fetch: opts.deps?.fetch ?? fetch,
+    now: opts.deps?.now ?? (() => Date.now())
+  };
+  return ensureFreshCredential(base, { config: opts.oauth, store: opts.store, env }, deps);
+}
+async function resolveCredential(opts) {
+  const env = opts.env ?? {};
+  const stored = readAuthFile(opts.store, env);
+  if (stored === void 0) return void 0;
+  const path = authFilePath(opts.store, env);
+  if (stored.type === "oauth") {
+    return resolveOAuth(stored, path, opts, env);
+  }
+  if (stored.api_key.length === 0) return void 0;
+  if (stored.provider !== opts.provider) return void 0;
+  return {
+    kind: "api",
+    provider: opts.provider,
+    apiKey: stored.api_key,
+    source: path,
+    inferred: false
+  };
+}
+
+// src/internal/providers/builtin/openai-chatgpt.ts
+var DEFAULT_STORE = {
+  home: os.homedir(),
+  dirName: ".theokit",
+  fileName: "auth.json",
+  homeEnvVar: "THEOKIT_HOME"
+};
+var OPENAI_OAUTH_CONFIG = {
+  provider: "openai",
+  authorizeEndpoint: "https://auth.openai.com/oauth/authorize",
+  tokenEndpoint: "https://auth.openai.com/oauth/token",
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  scopes: ["openid", "profile", "email", "offline_access"],
+  redirectUri: "https://auth.openai.com/deviceauth/callback"
+};
+function codexFetch() {
+  return (async (input, init) => {
+    const env = process.env;
+    const resolved = await resolveCredential({
+      provider: "openai",
+      store: DEFAULT_STORE,
+      oauth: OPENAI_OAUTH_CONFIG,
+      env
+    });
+    if (resolved === void 0) {
+      throw new Error(
+        'openai-chatgpt: no ChatGPT credential found \u2014 run the OpenAI device login (e.g. "/login openai") first.'
+      );
+    }
+    const accountId = readStoredOAuth(DEFAULT_STORE, env)?.account_id;
+    const headers = new Headers(init?.headers);
+    headers.set("authorization", `Bearer ${resolved.apiKey}`);
+    if (accountId !== void 0) headers.set("ChatGPT-Account-Id", accountId);
+    return fetch(input, { ...init, headers });
+  });
+}
+var OPENAI_CHATGPT = {
+  name: "openai-chatgpt",
+  apiMode: "responses_api",
+  authType: "oauth_device_code",
+  baseUrl: "https://chatgpt.com/backend-api/codex",
+  envVars: [],
+  fallbackModels: [
+    "openai-chatgpt/gpt-5.4",
+    "openai-chatgpt/gpt-5.4-mini",
+    "openai-chatgpt/gpt-5.5"
+  ],
+  extraHeaders: { originator: "codex_cli_rs" },
+  transform: {
+    // Only `fetch` (async) can await the credential refresh; `headers` is sync and cannot.
+    fetch: () => codexFetch()
+  }
+};
 
 // src/internal/providers/builtin/openrouter.ts
 var OPENROUTER = {
@@ -11427,6 +11779,7 @@ function registerBuiltins() {
   registered2 = true;
   registerProvider(ANTHROPIC);
   registerProvider(OPENAI);
+  registerProvider(OPENAI_CHATGPT);
   registerProvider(OPENROUTER);
   registerProvider(GEMINI);
   registerProvider(OLLAMA);
@@ -13689,6 +14042,15 @@ function selectTransport(profile, apiKey) {
     const ctx = { apiKey };
     return { fetch: profile.transform.fetch?.(ctx), headers: profile.transform.headers?.(ctx) };
   };
+  const assertOAuthResolved = (t) => {
+    if (apiKey !== "__oauth_lazy_token__") return;
+    const auth = t.headers?.authorization ?? t.headers?.Authorization;
+    if (t.fetch === void 0 && auth === void 0) {
+      throw new ConfigurationError(
+        `provider "${profile.name}" uses OAuth (authType: ${profile.authType}) but no credential was resolved. Register a ProviderProfile.transform whose fetch (or headers.authorization) supplies the bearer \u2014 typically via resolveCredential() from "@theokit/sdk/auth".`
+      );
+    }
+  };
   if (profile.apiMode === "chat_completions") {
     if (profile.name === "ollama") {
       const ollamaBase = process.env.OLLAMA_HOST ?? profile.baseUrl;
@@ -13706,6 +14068,7 @@ function selectTransport(profile, apiKey) {
     const envOverride = resolveBaseUrlEnvOverride(profile.name);
     if (envOverride !== void 0) opts.baseUrl = envOverride;
     const t = applyTransform();
+    assertOAuthResolved(t);
     if (t.fetch !== void 0) opts.fetch = t.fetch;
     const merged = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
     if (merged !== void 0) opts.extraHeaders = merged;
@@ -13726,6 +14089,7 @@ function selectTransport(profile, apiKey) {
   }
   if (profile.apiMode === "responses_api") {
     const t = applyTransform();
+    assertOAuthResolved(t);
     const mergedHeaders = profile.extraHeaders !== void 0 || t.headers !== void 0 ? { ...profile.extraHeaders, ...t.headers } : void 0;
     return new ResponsesApiClient({
       apiKey,