@tokensrc/codex 1.12.1

package/README.md

@@ -0,0 +1,74 @@
+# @tokensrc/codex
+
+Standalone Codex account selection, OIDC authentication and official Codex launcher.
+
+```sh
+npx @tokensrc/codex list
+npx @tokensrc/codex --server https://mail.tokensource.top --tenant-id numa-realm list
+npx @tokensrc/codex --profile-url https://mail.tokensource.top/public/v1/tenants/numa-realm/client-configuration list
+npx @tokensrc/codex use
+npx @tokensrc/codex run
+```
+
+The standalone command tree includes `login`, `logout`, `list`, `upload`, `use`,
+`run`, `app`, `auth-agent`, `admin`, `shortcut`, `status`, and `reset`. The
+`admin accounts` subtree lists tenant accounts, shows redacted credential-version
+diagnostics, and requests one server-side refresh; it never receives refresh
+tokens, ciphertext, or credential fingerprints. `admin assignments` lists
+bindings, binds an account to a verified Keycloak subject, and unbinds by
+assignment ID:
+
+```sh
+numa codex admin accounts list
+numa codex admin accounts credential-versions acct_xxx
+numa codex admin accounts refresh acct_xxx
+numa codex admin assignments list
+numa codex admin assignments bind acct_xxx keycloak-subject --default
+numa codex admin assignments unbind assignment_xxx
+```
+
+The client connects to
+`X-Tenant-Id: numa-realm`. With `--server` and `--tenant-id` it resolves RFC 9728
+protected-resource metadata, the tenant client-configuration, and OIDC discovery
+before login. `--profile-url` and `TOKENSRC_CODEX_PROFILE_URL` select the public
+configuration directly. Configuration priority is SDK/command options,
+`TOKENSRC_CODEX_*` environment variables, an explicit profile, local settings,
+automatic discovery, then legacy built-in defaults. Settings live under
+`~/.config/tokensrc-codex` on Unix-like systems and
+`%APPDATA%\tokensrc-codex` on Windows.
+
+Embedding applications can register the same commands with a Commander program:
+
+```ts
+import { createCodexModule } from "@tokensrc/codex";
+
+const codex = await createCodexModule({
+  auth: {
+    tokenProvider: async ({ forceRefresh }) => getAccessToken(forceRefresh)
+  },
+  connection: {
+    serverUrl: "https://platform.example/api",
+    tenantId: "numa-realm"
+  },
+  persistence: { configDirectory: applicationConfigDirectory }
+});
+
+codex.registerCommands(program, { nested: true });
+const local = await codex.status.loadLocal();
+const remote = await codex.status.loadRemote();
+```
+
+Hosts may instead inject a static access token or standalone OIDC settings, and
+can customize branding and launcher behavior. Injected access tokens and provider
+results remain in memory and are never persisted or included in log messages. A
+provider is forcibly refreshed once after HTTP 401; a second failure is returned
+without another retry. Numa and standalone OIDC settings delegate to the shared
+`@numa-tech/cli-auth` lifecycle, which serializes refresh-token rotation across
+processes. A rejected refresh grant becomes `login_required`; standalone users
+are directed to `tokensrc-codex login`, while transient identity-provider errors
+retain the cached session.
+
+The main export includes `createCodexModule`, stable error types, status/runtime
+helpers, `resolveCodexProfile`, and protocol types. Focused exports are also available at `./commands`,
+`./command-directory`, `./console-status`, `./runtime`, `./errors`, `./protocol`,
+`./config`, `./profile`, `./shortcuts`, and `./tui`.

package/dist/account-display.d.ts

@@ -0,0 +1,16 @@
+export interface CodexAccountDisplayInput {
+    accountId: string;
+    label?: string | null;
+    loginUsername?: string | null;
+    email?: string | null;
+    providerAccountId?: string | null;
+}
+export interface CodexAdminAccountIdentity {
+    id: string;
+    label?: string | null;
+    providerAccountId?: string | null;
+}
+export declare function shortCodexAccountId(accountId: string): string;
+export declare function resolveCodexAccountDisplayName(input: CodexAccountDisplayInput): string;
+export declare function formatCodexAccountDisplayIdentity(input: CodexAccountDisplayInput): string;
+export declare function resolveCodexAdminAccount<T extends CodexAdminAccountIdentity>(accounts: readonly T[], requested: string): T;

package/dist/account-display.js

@@ -0,0 +1,35 @@
+import { CodexServiceError } from "./errors.js";
+function present(value) {
+    const trimmed = value?.trim();
+    return trimmed || undefined;
+}
+export function shortCodexAccountId(accountId) {
+    const normalized = accountId.trim();
+    return normalized.length > 8 ? `${normalized.slice(0, 8)}…` : normalized;
+}
+export function resolveCodexAccountDisplayName(input) {
+    return present(input.label)
+        ?? present(input.loginUsername)
+        ?? present(input.email)
+        ?? present(input.providerAccountId)
+        ?? shortCodexAccountId(input.accountId);
+}
+export function formatCodexAccountDisplayIdentity(input) {
+    const displayName = resolveCodexAccountDisplayName(input);
+    const shortId = shortCodexAccountId(input.accountId);
+    return displayName === shortId ? shortId : `${displayName} (${shortId})`;
+}
+export function resolveCodexAdminAccount(accounts, requested) {
+    const key = requested.trim();
+    const exact = accounts.find((account) => account.id === key);
+    if (exact)
+        return exact;
+    const aliases = accounts.filter((account) => present(account.providerAccountId) === key || present(account.label) === key);
+    if (aliases.length === 1)
+        return aliases[0];
+    if (aliases.length > 1) {
+        throw new CodexServiceError(`账号选择 ${key} 不唯一，请使用完整 account id。`, "codex_account_reference_ambiguous", 409);
+    }
+    throw new CodexServiceError(`未找到 Codex 管理账号: ${key}`, "codex_account_not_found", 404);
+}
+//# sourceMappingURL=account-display.js.map

package/dist/account-display.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-display.js","sourceRoot":"","sources":["../src/account-display.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAgBhD,SAAS,OAAO,CAAC,KAAgC;IAC/C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAA+B;IAC5E,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;WACtB,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;WAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;WACpB,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC;WAChC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,KAA+B;IAC/E,MAAM,WAAW,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,OAAO,GAAG,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAsB,EACtB,SAAiB;IAEjB,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IAC7D,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAC1F,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,QAAQ,GAAG,wBAAwB,EACnC,mCAAmC,EACnC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,mBAAmB,GAAG,EAAE,EACxB,yBAAyB,EACzB,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/dist/bin-app.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin-app.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+const child = spawn(process.execPath, [fileURLToPath(new URL("./cli.js", import.meta.url)), "app", ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: process.env
+});
+process.exitCode = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve(signal ? 128 : (code ?? 1)));
+});
+//# sourceMappingURL=bin-app.js.map

package/dist/bin-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin-app.js","sourceRoot":"","sources":["../src/bin-app.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;IAC5H,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,OAAO,CAAC,GAAG;CACjB,CAAC,CAAC;AACH,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}

package/dist/bin-run.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin-run.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+const child = spawn(process.execPath, [fileURLToPath(new URL("./cli.js", import.meta.url)), "run", ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: process.env
+});
+process.exitCode = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve(signal ? 128 : (code ?? 1)));
+});
+//# sourceMappingURL=bin-run.js.map

package/dist/bin-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin-run.js","sourceRoot":"","sources":["../src/bin-run.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;IAC5H,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,OAAO,CAAC,GAAG;CACjB,CAAC,CAAC;AACH,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}

package/dist/branding.d.ts

@@ -0,0 +1,2 @@
+export declare const PACKAGE_NAME = "@tokensrc/codex";
+export declare const PACKAGE_VERSION: string;

package/dist/branding.js

@@ -0,0 +1,8 @@
+import { readFileSync } from "node:fs";
+const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+export const PACKAGE_NAME = "@tokensrc/codex";
+export const PACKAGE_VERSION = manifest.version ?? "0.0.0";
+if (manifest.name !== PACKAGE_NAME) {
+    throw new Error(`Package identity mismatch: expected ${PACKAGE_NAME}, received ${manifest.name ?? "unset"}`);
+}
+//# sourceMappingURL=branding.js.map

package/dist/branding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../src/branding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAOvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAC9C,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;AAE3D,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;IACnC,MAAM,IAAI,KAAK,CAAC,uCAAuC,YAAY,cAAc,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;AAC/G,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { PACKAGE_VERSION } from "./branding.js";
+import { createCodexModule } from "./index.js";
+import { isCodexError } from "./errors.js";
+import { CODEX_DISTRIBUTION_SCHEMA_VERSION } from "./protocol.js";
+function value(argv, option) {
+    const index = argv.indexOf(option);
+    if (index >= 0)
+        return argv[index + 1];
+    const prefix = `${option}=`;
+    return argv.find((item) => item.startsWith(prefix))?.slice(prefix.length);
+}
+const argv = process.argv.slice(2);
+const allowInsecureHttp = argv.includes("--insecure-http") || argv.includes("--insecure-poc");
+async function main() {
+    const module = await createCodexModule({
+        discoverProfile: true,
+        ...(value(argv, "--profile-url") ? { profileUrl: value(argv, "--profile-url") } : {}),
+        connection: {
+            ...(value(argv, "--server") ? { serverUrl: value(argv, "--server") } : {}),
+            ...(value(argv, "--tenant-id") ? { tenantId: value(argv, "--tenant-id") } : {}),
+            ...(value(argv, "--tenant-header-name")
+                ? { tenantHeaderName: value(argv, "--tenant-header-name") }
+                : {}),
+            ...(allowInsecureHttp ? { allowInsecureHttp: true } : {})
+        },
+        persistence: value(argv, "--config-dir")
+            ? { configDirectory: value(argv, "--config-dir") }
+            : undefined
+    });
+    const program = new Command()
+        .name("tokensrc-codex")
+        .description("Standalone Codex account selection and launcher")
+        .version(PACKAGE_VERSION)
+        .option("--json", "emit JSON")
+        .option("--server <url>", "Codex account service URL")
+        .option("--profile-url <url>", "public client-configuration URL")
+        .option("--tenant-id <id>", "tenant identifier")
+        .option("--tenant-header-name <name>", "tenant request header")
+        .option("--insecure-http", "allow non-loopback HTTP")
+        .option("--insecure-poc", "alias for --insecure-http")
+        .option("--config-dir <path>", "configuration directory");
+    module.registerCommands(program, { nested: false });
+    await program.parseAsync(process.argv);
+}
+try {
+    await main();
+}
+catch (error) {
+    const detail = isCodexError(error)
+        ? { code: error.code, message: error.message, status: error.status ?? null }
+        : { code: "command_failed", message: error instanceof Error ? error.message : String(error), status: null };
+    const result = {
+        schemaVersion: CODEX_DISTRIBUTION_SCHEMA_VERSION,
+        ok: false,
+        error: detail
+    };
+    if (argv.includes("--json"))
+        process.stderr.write(`${JSON.stringify(result)}\n`);
+    else {
+        process.stderr.write(`Error [${detail.code}]: ${detail.message}\n`);
+        if (detail.code === "login_required") {
+            process.stderr.write("Run: tokensrc-codex login\n");
+        }
+    }
+    process.exitCode = 1;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,iCAAiC,EAAE,MAAM,eAAe,CAAC;AAElE,SAAS,KAAK,CAAC,IAAc,EAAE,MAAc;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAE9F,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,eAAe,EAAE,IAAI;QACrB,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,UAAU,EAAE;YACV,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC;gBACrC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;QACD,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC;YACtC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;YAClD,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,gBAAgB,CAAC;SACtB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,OAAO,CAAC,eAAe,CAAC;SACxB,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC7B,MAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC;SACrD,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;SAChE,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;SAC/C,MAAM,CAAC,6BAA6B,EAAE,uBAAuB,CAAC;SAC9D,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;SACpD,MAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC;SACrD,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;IAC5D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,IAAI,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE;QAC5E,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,iCAAiC;QAChD,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,MAAM;KACd,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SAC5E,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,27 @@
+import type { CodexAuthController } from "./oidc.js";
+import { type CodexAdminAccountListResponse, type CodexAdminAssignmentDeleteResponse, type CodexAdminAssignmentListResponse, type CodexAdminAssignmentMutationResponse, type CodexAccountListResponse, type CodexCredentialVersionListResponse, type CodexImportResult, type CodexLoginCredentialsResponse, type CodexManualRefreshResponse, type CodexUploadBatch } from "./protocol.js";
+import type { ResolvedCodexConfig } from "./types.js";
+export declare function normalizeCodexServiceUrl(rawUrl: string, allowInsecureHttp?: boolean): string;
+export declare class CodexServiceClient {
+    private readonly config;
+    private readonly auth;
+    private readonly fetchImpl;
+    private readonly baseUrl;
+    get serviceUrl(): string;
+    constructor(config: ResolvedCodexConfig, auth: CodexAuthController, fetchImpl?: typeof fetch);
+    private request;
+    listAccounts(): Promise<CodexAccountListResponse>;
+    getLoginCredentials(accountId: string): Promise<CodexLoginCredentialsResponse>;
+    uploadAccounts(payload: CodexUploadBatch): Promise<CodexImportResult>;
+    listAdminAccounts(): Promise<CodexAdminAccountListResponse>;
+    listCredentialVersions(accountId: string): Promise<CodexCredentialVersionListResponse>;
+    refreshAdminAccount(accountId: string): Promise<CodexManualRefreshResponse>;
+    listAdminAssignments(): Promise<CodexAdminAssignmentListResponse>;
+    bindAdminAssignment(input: {
+        accountId: string;
+        userSubject: string;
+        isDefault: boolean;
+    }): Promise<CodexAdminAssignmentMutationResponse>;
+    unbindAdminAssignment(assignmentId: string): Promise<CodexAdminAssignmentDeleteResponse>;
+}
+export declare function codexImportRequestTimeoutMs(baseTimeoutMs: number, accountCount: number): number;

package/dist/client.js

@@ -0,0 +1,177 @@
+import { CodexAuthError, CodexLoginRequiredError, CodexServiceError } from "./errors.js";
+import { CODEX_ACCOUNTS_IMPORT_PATH, CODEX_ACCOUNTS_LIST_PATH, CODEX_ADMIN_ACCOUNTS_PATH, CODEX_ADMIN_ASSIGNMENTS_PATH, CodexAdminAssignmentDeleteResponseSchema, CodexAdminAssignmentListResponseSchema, CodexAdminAssignmentMutationResponseSchema, CodexAdminAccountListResponseSchema, CodexAccountListResponseSchema, CodexCredentialVersionListResponseSchema, CodexImportResultSchema, CodexLoginCredentialsResponseSchema, CodexManualRefreshResponseSchema, codexAccountLoginCredentialsPath, codexAdminAssignmentPath, codexAdminCredentialVersionsPath, codexAdminRefreshPath } from "./protocol.js";
+export function normalizeCodexServiceUrl(rawUrl, allowInsecureHttp = false) {
+    const url = new URL(rawUrl);
+    const loopback = ["127.0.0.1", "localhost", "::1", "[::1]"].includes(url.hostname);
+    if (url.username || url.password) {
+        throw new CodexServiceError("Codex service URLs must not contain credentials.", "insecure_codex_service");
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
+        throw new CodexServiceError("Codex account service must use HTTPS; non-loopback HTTP requires allowInsecureHttp.", "insecure_codex_service");
+    }
+    if (!["http:", "https:"].includes(url.protocol)) {
+        throw new CodexServiceError("Codex account service must use HTTP(S).", "insecure_codex_service");
+    }
+    url.hash = "";
+    url.search = "";
+    return url.toString().replace(/\/+$/, "");
+}
+async function responseBody(response) {
+    const text = await response.text();
+    try {
+        return text ? JSON.parse(text) : {};
+    }
+    catch {
+        throw new CodexServiceError(`Codex service returned a non-JSON response (HTTP ${response.status}).`, "invalid_codex_service_response", response.status);
+    }
+}
+export class CodexServiceClient {
+    config;
+    auth;
+    fetchImpl;
+    baseUrl;
+    get serviceUrl() {
+        return this.baseUrl;
+    }
+    constructor(config, auth, fetchImpl = fetch) {
+        this.config = config;
+        this.auth = auth;
+        this.fetchImpl = fetchImpl;
+        this.baseUrl = normalizeCodexServiceUrl(config.connection.serverUrl, config.connection.allowInsecureHttp);
+    }
+    async request(path, request) {
+        const send = async (forceRefresh) => {
+            const token = await this.auth.getAccessToken(forceRefresh);
+            const headers = new Headers({
+                Accept: "application/json",
+                Authorization: `Bearer ${token}`,
+                [this.config.connection.tenantHeaderName]: this.config.connection.tenantId
+            });
+            if (request?.body !== undefined)
+                headers.set("Content-Type", "application/json");
+            return this.fetchImpl(`${this.baseUrl}${path}`, {
+                method: request?.method ?? "GET",
+                headers,
+                ...(request?.body !== undefined ? { body: JSON.stringify(request.body) } : {}),
+                signal: AbortSignal.timeout(request?.timeoutMs ?? this.config.connection.requestTimeoutMs)
+            });
+        };
+        let response;
+        try {
+            response = await send(false);
+            if (response.status === 401 && this.auth.kind !== "static") {
+                await response.body?.cancel().catch(() => undefined);
+                response = await send(true);
+            }
+        }
+        catch (error) {
+            if (error instanceof CodexAuthError)
+                throw error;
+            if (error?.code === "login_required") {
+                throw new CodexLoginRequiredError(error instanceof Error ? error.message : "Login is required.");
+            }
+            throw new CodexServiceError(`Unable to reach Codex account service: ${error instanceof Error ? error.message : String(error)}`, "codex_service_unavailable", undefined, { cause: error });
+        }
+        const body = await responseBody(response);
+        if (!response.ok) {
+            const problem = body && typeof body === "object"
+                ? body
+                : undefined;
+            const serviceCode = typeof problem?.code === "string" ? problem.code : undefined;
+            const detail = [problem?.detail, problem?.error, problem?.title]
+                .find((value) => typeof value === "string" && value.trim().length > 0)
+                ?? response.statusText;
+            const safeServiceCode = serviceCode && /^[a-z][a-z0-9_.-]{0,127}$/i.test(serviceCode)
+                ? serviceCode
+                : undefined;
+            const code = safeServiceCode
+                ?? (response.status === 401 || response.status === 403
+                    ? "codex_access_denied"
+                    : "codex_service_error");
+            throw new CodexServiceError(safeServiceCode === "codex_account_needs_reauth"
+                ? "ChatGPT account credentials are invalid and must be re-imported by an administrator."
+                : `Codex account service request failed (HTTP ${response.status}): ${detail}`, code, response.status);
+        }
+        return body;
+    }
+    async listAccounts() {
+        const parsed = CodexAccountListResponseSchema.safeParse(await this.request(CODEX_ACCOUNTS_LIST_PATH));
+        if (!parsed.success) {
+            throw new CodexServiceError("Invalid Codex account list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async getLoginCredentials(accountId) {
+        const parsed = CodexLoginCredentialsResponseSchema.safeParse(await this.request(codexAccountLoginCredentialsPath(accountId)));
+        if (!parsed.success || parsed.data.account.id !== accountId) {
+            throw new CodexServiceError("Invalid or mismatched Codex login credentials response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async uploadAccounts(payload) {
+        const parsed = CodexImportResultSchema.safeParse(await this.request(CODEX_ACCOUNTS_IMPORT_PATH, {
+            method: "POST",
+            body: payload,
+            timeoutMs: codexImportRequestTimeoutMs(this.config.connection.requestTimeoutMs, payload.accounts.length)
+        }));
+        if (!parsed.success) {
+            throw new CodexServiceError("Invalid Codex account import response.", "invalid_codex_service_response");
+        }
+        if (parsed.data.accountIds.length !== payload.accounts.length
+            || parsed.data.credentials.length !== payload.accounts.length
+            || parsed.data.created + parsed.data.updated !== payload.accounts.length
+            || parsed.data.credentials.some((credential, index) => (credential.accountId !== parsed.data.accountIds[index]))) {
+            throw new CodexServiceError("Invalid or mismatched Codex account import response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listAdminAccounts() {
+        const parsed = CodexAdminAccountListResponseSchema.safeParse(await this.request(CODEX_ADMIN_ACCOUNTS_PATH));
+        if (!parsed.success) {
+            throw new CodexServiceError("Invalid Codex admin account list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listCredentialVersions(accountId) {
+        const parsed = CodexCredentialVersionListResponseSchema.safeParse(await this.request(codexAdminCredentialVersionsPath(accountId)));
+        if (!parsed.success || parsed.data.account.id !== accountId
+            || parsed.data.credentials.some((credential) => credential.accountId !== accountId)) {
+            throw new CodexServiceError("Invalid or mismatched Codex credential version response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async refreshAdminAccount(accountId) {
+        const parsed = CodexManualRefreshResponseSchema.safeParse(await this.request(codexAdminRefreshPath(accountId), { method: "POST" }));
+        if (!parsed.success || parsed.data.accountId !== accountId) {
+            throw new CodexServiceError("Invalid or mismatched Codex manual refresh response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async listAdminAssignments() {
+        const parsed = CodexAdminAssignmentListResponseSchema.safeParse(await this.request(CODEX_ADMIN_ASSIGNMENTS_PATH));
+        if (!parsed.success) {
+            throw new CodexServiceError("Invalid Codex assignment list response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async bindAdminAssignment(input) {
+        const parsed = CodexAdminAssignmentMutationResponseSchema.safeParse(await this.request(CODEX_ADMIN_ASSIGNMENTS_PATH, { method: "POST", body: input }));
+        if (!parsed.success || parsed.data.assignment.accountId !== input.accountId
+            || parsed.data.assignment.userSubject !== input.userSubject) {
+            throw new CodexServiceError("Invalid or mismatched Codex assignment response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+    async unbindAdminAssignment(assignmentId) {
+        const parsed = CodexAdminAssignmentDeleteResponseSchema.safeParse(await this.request(codexAdminAssignmentPath(assignmentId), { method: "DELETE" }));
+        if (!parsed.success || parsed.data.assignmentId !== assignmentId) {
+            throw new CodexServiceError("Invalid or mismatched Codex assignment deletion response.", "invalid_codex_service_response");
+        }
+        return parsed.data;
+    }
+}
+export function codexImportRequestTimeoutMs(baseTimeoutMs, accountCount) {
+    const validationWaves = Math.max(1, Math.ceil(accountCount / 8));
+    return Math.max(baseTimeoutMs, 30_000, validationWaves * 25_000);
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEzF,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,wCAAwC,EACxC,sCAAsC,EACtC,0CAA0C,EAC1C,mCAAmC,EACnC,8BAA8B,EAC9B,wCAAwC,EACxC,uBAAuB,EACvB,mCAAmC,EACnC,gCAAgC,EAChC,gCAAgC,EAChC,wBAAwB,EACxB,gCAAgC,EAChC,qBAAqB,EAWtB,MAAM,eAAe,CAAC;AAGvB,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,iBAAiB,GAAG,KAAK;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,iBAAiB,CAAC,kDAAkD,EAAE,wBAAwB,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,iBAAiB,CACzB,qFAAqF,EACrF,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,wBAAwB,CAAC,CAAC;IACnG,CAAC;IACD,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,oDAAoD,QAAQ,CAAC,MAAM,IAAI,EACvE,gCAAgC,EAChC,QAAQ,CAAC,MAAM,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kBAAkB;IAQV,MAAM;IACN,IAAI;IACJ,SAAS;IATX,OAAO,CAAS;IAEjC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,YACmB,MAA2B,EAC3B,IAAyB,EACzB,SAAS,GAAiB,KAAK;sBAF/B,MAAM;oBACN,IAAI;yBACJ,SAAS;QAE1B,IAAI,CAAC,OAAO,GAAG,wBAAwB,CACrC,MAAM,CAAC,UAAU,CAAC,SAAS,EAC3B,MAAM,CAAC,UAAU,CAAC,iBAAiB,CACpC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,OAA2E;QAE3E,MAAM,IAAI,GAAG,KAAK,EAAE,YAAqB,EAAqB,EAAE;YAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;gBAC1B,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ;aAC3E,CAAC,CAAC;YACH,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACjF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBAC9C,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK;gBAChC,OAAO;gBACP,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC;aAC3F,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrD,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAK,KAAwC,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACzE,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClG,2BAA2B,EAC3B,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAC9C,CAAC,CAAC,IAA8E;gBAChF,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,OAAO,OAAO,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;iBAC7D,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;mBACpF,QAAQ,CAAC,UAAU,CAAC;YACzB,MAAM,eAAe,GAAG,WAAW,IAAI,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC;gBACnF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,IAAI,GAAG,eAAe;mBACvB,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;oBAClD,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CACzB,eAAe,KAAK,4BAA4B;gBAC9C,CAAC,CAAC,sFAAsF;gBACxF,CAAC,CAAC,8CAA8C,QAAQ,CAAC,MAAM,MAAM,MAAM,EAAE,EAC/E,IAAI,EACJ,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CACrD,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAC7C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,EAAE,gCAAgC,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAS,CAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC,CAChE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,iBAAiB,CACzB,yDAAyD,EACzD,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAyB;QAC5C,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,2BAA2B,CACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,EACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CACxB;SACF,CAAC,CACH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,EAAE,gCAAgC,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;eACxD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;eAC1D,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;eACrE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CACrD,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CACvD,CAAC,EAAE,CAAC;YACL,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,EACtD,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAS,CAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAC9C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,EAAE,gCAAgC,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,MAAM,GAAG,wCAAwC,CAAC,SAAS,CAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,SAAS,CAAC,CAAC,CAChE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS;eACtD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,iBAAiB,CACzB,0DAA0D,EAC1D,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CACvD,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACzE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,EACtD,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,MAAM,GAAG,sCAAsC,CAAC,SAAS,CAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CACjD,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,gCAAgC,CAAC,CAAC;QAC3G,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAIzB;QACC,MAAM,MAAM,GAAG,0CAA0C,CAAC,SAAS,CACjE,MAAM,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;eACtE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CACzB,kDAAkD,EAClD,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,YAAoB;QAC9C,MAAM,MAAM,GAAG,wCAAwC,CAAC,SAAS,CAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CACjF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CACzB,2DAA2D,EAC3D,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CAAC,aAAqB,EAAE,YAAoB;IACrF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,CAAC;AACnE,CAAC"}

package/dist/command-directory.d.ts

@@ -0,0 +1,15 @@
+export interface CodexCommandDescriptor {
+    name: string;
+    description: string;
+    command: string;
+    summary: string;
+    access: "public" | "authenticated";
+    examples: string[];
+    standaloneOnly?: boolean;
+}
+export declare function createCodexCommandDirectory(options?: {
+    nested?: boolean;
+    cliName?: string;
+}): readonly CodexCommandDescriptor[];
+export declare const CODEX_COMMAND_DIRECTORY: readonly CodexCommandDescriptor[];
+export declare const NESTED_CODEX_COMMAND_DIRECTORY: readonly CodexCommandDescriptor[];

package/dist/command-directory.js

@@ -0,0 +1,28 @@
+const definitions = [
+    { name: "login", description: "Log in to the standalone OIDC provider", command: "login", summary: "登录独立 Codex CLI", access: "public", examples: ["tokensrc-codex login"], standaloneOnly: true },
+    { name: "logout", description: "Remove the standalone OIDC token cache", command: "logout", summary: "退出独立 Codex CLI", access: "public", examples: ["tokensrc-codex logout"], standaloneOnly: true },
+    { name: "list", description: "List available Codex accounts", command: "codex list [-u|--server <url>]", summary: "列出服务端 Codex 账号元数据，不传输 refresh token", access: "authenticated", examples: ["numa codex list --server https://platform.example/api"] },
+    { name: "upload", description: "Upload the local codex-multi-auth account pool", command: "codex upload [-u|--server <url>]", summary: "把 codex-multi-auth 管理的本地账号池批量上传到平台", access: "authenticated", examples: ["numa codex upload --server https://platform.example/api", "numa codex upload --storage ~/.codex/multi-auth/openai-codex-accounts.json"] },
+    { name: "use", description: "Select an account and install official Codex credentials", command: "codex use [account]", summary: "选择服务端账号并写入官方 ChatGPT auth.json", access: "authenticated", examples: ["numa codex use acct_xxx"] },
+    { name: "run", description: "Launch the official Codex CLI", command: "codex run [-s|--select-account|-a|--account <id>] [-u|--server <url>] [--] [codexArgs...]", summary: "选择或复用 ChatGPT 账号后启动官方 Codex；模型流量不经过宿主", access: "authenticated", examples: ["numa codex run -s", "numa codex run --account acct_xxx", "numa codex run -- exec \"完成长任务\""] },
+    { name: "app", description: "Launch the official Codex desktop app", command: "codex app [workspace] [-s|--select-account|-a|--account <id>] [-u|--server <url>]", summary: "使用官方 ChatGPT 登录启动 macOS/Windows 官方 Codex 桌面 App", access: "authenticated", examples: ["numa codex app . -s", "numa codex app . --account acct_xxx"] },
+    { name: "shortcut", description: "Install or remove launcher shortcuts", command: "codex shortcut [install|remove] [-t|--target run|app|both] [-s|--select-account]", summary: "安装或删除 macOS/Windows 的 Codex 快捷命令与桌面入口", access: "public", examples: ["numa codex shortcut install", "numa codex shortcut install --target app --workspace .", "numa codex shortcut remove"] },
+    { name: "auth-agent", description: "Continuously renew official Codex credentials", command: "codex auth-agent [account]", summary: "前台刷新短效 token 到官方 Codex 登录并输出完整状态日志", access: "authenticated", examples: ["numa codex auth-agent acct_xxx --replace-login", "numa codex auth-agent --replace-login --once"] },
+    { name: "admin", description: "Manage server-side Codex accounts and assignments", command: "codex admin <accounts|assignments>", summary: "管理员查看账号与凭据版本、触发刷新，并管理 Keycloak 用户账号绑定", access: "authenticated", examples: ["numa codex admin accounts list", "numa codex admin accounts credential-versions acct_xxx", "numa codex admin accounts refresh acct_xxx", "numa codex admin assignments list", "numa codex admin assignments bind acct_xxx user-subject --default", "numa codex admin assignments unbind assignment_xxx"] },
+    { name: "status", description: "Show selection and official credential status", command: "codex status", summary: "查看当前账号选择与官方 ChatGPT auth.json 状态", access: "public", examples: ["numa codex status --json"] },
+    { name: "reset", description: "Reset selection and managed credentials", command: "codex reset", summary: "重置本地账号选择和登录，并清理废弃的 provider 残留", access: "public", examples: ["numa codex reset"] }
+];
+export function createCodexCommandDirectory(options = {}) {
+    const nested = options.nested ?? false;
+    const cliName = options.cliName ?? (nested ? "numa" : "tokensrc-codex");
+    return definitions
+        .filter((item) => !nested || !item.standaloneOnly)
+        .map((item) => ({
+        ...item,
+        command: nested ? item.command : item.command.replace(/^codex\s+/u, ""),
+        examples: item.examples.map((example) => example.replace(/^numa\b/u, cliName))
+    }));
+}
+export const CODEX_COMMAND_DIRECTORY = createCodexCommandDirectory();
+export const NESTED_CODEX_COMMAND_DIRECTORY = createCodexCommandDirectory({ nested: true });
+//# sourceMappingURL=command-directory.js.map

package/dist/command-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-directory.js","sourceRoot":"","sources":["../src/command-directory.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,GAAsC;IACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACjM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACpM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,qCAAqC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,uDAAuD,CAAC,EAAE;IACvP,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gDAAgD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yDAAyD,EAAE,4EAA4E,CAAC,EAAE;IAC3V,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACnO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,2FAA2F,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,mCAAmC,EAAE,kCAAkC,CAAC,EAAE;IACxV,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,mFAAmF,EAAE,OAAO,EAAE,iDAAiD,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,EAAE;IAClU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,sCAAsC,EAAE,OAAO,EAAE,kFAAkF,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,6BAA6B,EAAE,wDAAwD,EAAE,4BAA4B,CAAC,EAAE;IAC7W,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gDAAgD,EAAE,8CAA8C,CAAC,EAAE;IACjT,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mDAAmD,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,uCAAuC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gCAAgC,EAAE,wDAAwD,EAAE,4CAA4C,EAAE,mCAAmC,EAAE,mEAAmE,EAAE,oDAAoD,CAAC,EAAE;IACngB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,0BAA0B,CAAC,EAAE;IAChN,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,EAAE;CACtL,CAAC;AAEX,MAAM,UAAU,2BAA2B,CACzC,OAAO,GAA2C,EAAE;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;SACjD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACvE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC/E,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,EAAE,CAAC;AACrE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,25 @@
+import type { Command } from "commander";
+import type { CodexServiceClient } from "./client.js";
+import type { CodexStatusLoader } from "./console-status.js";
+import type { CodexAuthController } from "./oidc.js";
+import type { ResolvedCodexConfig } from "./types.js";
+export interface CodexCommandDependencies {
+    config: ResolvedCodexConfig;
+    auth: CodexAuthController;
+    client: CodexServiceClient;
+    clientFor(connection?: {
+        serverUrl?: string;
+        allowInsecureHttp?: boolean;
+    }): CodexServiceClient;
+    status: CodexStatusLoader;
+    run(args: string[]): Promise<number>;
+    app(workspace?: string): Promise<number>;
+    output: NodeJS.WritableStream;
+    errorOutput: NodeJS.WritableStream;
+    jsonEnabled?: (command: Command) => boolean | Promise<boolean>;
+}
+export declare const NO_AVAILABLE_CHATGPT_ACCOUNT_MESSAGE = "\u5F53\u524D\u7528\u6237\u6CA1\u6709\u7ED1\u5B9A\u53EF\u7528\u7684 ChatGPT \u8D26\u53F7\u3002\u8BF7\u524D\u5F80 OA \u7CFB\u7EDF\u63D0\u4EA4 IT11 \u5DE5\u5355\uFF0C\u7533\u8BF7\u72EC\u4EAB\u6216\u5171\u4EAB\u7684 ChatGPT \u4E2A\u4EBA\u8D26\u53F7\u3002";
+export declare function registerCodexCommands(program: Command, deps: CodexCommandDependencies, options?: {
+    nested?: boolean;
+    includeAuthCommands?: boolean;
+}): Command;