@tokensrc/codex 1.12.1

package/dist/errors.d.ts

@@ -0,0 +1,19 @@
+export type CodexErrorCode = "auth_error" | "login_required" | "http_error" | "insecure_codex_service" | "codex_service_unavailable" | "invalid_codex_service_response" | "codex_access_denied" | "codex_service_error" | "codex_account_not_found" | "codex_assignment_not_found" | "codex_account_reference_ambiguous" | "codex_account_needs_reauth" | "codex_runtime_missing" | "invalid_configuration" | (string & {});
+export declare function isCodexError(error: unknown): error is CodexError;
+export declare class CodexError extends Error {
+    readonly code: CodexErrorCode;
+    readonly status?: number | undefined;
+    constructor(message: string, code: CodexErrorCode, status?: number | undefined, options?: ErrorOptions);
+}
+export declare class CodexAuthError extends CodexError {
+    constructor(message: string, code?: "auth_error" | "login_required" | "http_error" | "issuer_mismatch", options?: ErrorOptions);
+}
+export declare class CodexLoginRequiredError extends CodexAuthError {
+    constructor(message?: string);
+}
+export declare class CodexServiceError extends CodexError {
+    constructor(message: string, code: CodexErrorCode, status?: number, options?: ErrorOptions);
+}
+export declare class CodexRuntimeError extends CodexError {
+    constructor(message: string, options?: ErrorOptions);
+}

package/dist/errors.js

@@ -0,0 +1,40 @@
+export function isCodexError(error) {
+    return error instanceof CodexError || Boolean(error && typeof error === "object" &&
+        typeof error.code === "string" &&
+        typeof error.message === "string");
+}
+export class CodexError extends Error {
+    code;
+    status;
+    constructor(message, code, status, options) {
+        super(message, options);
+        this.code = code;
+        this.status = status;
+        this.name = "CodexError";
+    }
+}
+export class CodexAuthError extends CodexError {
+    constructor(message, code = "auth_error", options) {
+        super(message, code, undefined, options);
+        this.name = "CodexAuthError";
+    }
+}
+export class CodexLoginRequiredError extends CodexAuthError {
+    constructor(message = "No usable OIDC login is available.") {
+        super(message, "login_required");
+        this.name = "CodexLoginRequiredError";
+    }
+}
+export class CodexServiceError extends CodexError {
+    constructor(message, code, status, options) {
+        super(message, code, status, options);
+        this.name = "CodexServiceError";
+    }
+}
+export class CodexRuntimeError extends CodexError {
+    constructor(message, options) {
+        super(message, "codex_runtime_missing", undefined, options);
+        this.name = "CodexRuntimeError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,UAAU,IAAI,OAAO,CAC3C,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAClC,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACtD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB,IAAI;IACJ,MAAM;IAHxB,YACE,OAAe,EACC,IAAoB,EACpB,MAAe,EAC/B,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAJR,IAAI;sBACJ,MAAM;QAItB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,YACE,OAAe,EACf,IAAI,GAAuE,YAAY,EACvF,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;IACzD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe,EAAE,IAAoB,EAAE,MAAe,EAAE,OAAsB;QACxF,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import type { CodexModule, CodexModuleOptions } from "./types.js";
+export declare function createCodexModule(options?: CodexModuleOptions): Promise<CodexModule>;
+export type * from "./types.js";
+export * from "./errors.js";
+export * from "./protocol.js";
+export * from "./client.js";
+export * from "./runtime.js";
+export * from "./console-status.js";
+export * from "./command-directory.js";
+export * from "./selection.js";
+export * from "./credentials.js";
+export * from "./shortcuts.js";
+export * from "./tui.js";
+export * from "./config.js";
+export * from "./quota-cache.js";
+export * from "./legacy-cleanup.js";
+export * from "./profile.js";
+export { registerCodexCommands } from "./commands.js";

package/dist/index.js

@@ -0,0 +1,67 @@
+import { CodexServiceClient } from "./client.js";
+import { registerCodexCommands } from "./commands.js";
+import { resolveCodexConfig } from "./config.js";
+import { createCodexStatusLoader } from "./console-status.js";
+import { createAuthController } from "./oidc.js";
+import { resolveCodexRuntime, runCodexLaunch } from "./runtime.js";
+export async function createCodexModule(options = {}) {
+    const config = await resolveCodexConfig(options);
+    const env = options.env ?? process.env;
+    const fetchImpl = options.fetch ?? fetch;
+    const auth = createAuthController(config.auth, fetchImpl);
+    const client = new CodexServiceClient(config, auth, fetchImpl);
+    const clientFor = (connection = {}) => Object.keys(connection).length
+        ? new CodexServiceClient({ ...config, connection: { ...config.connection, ...connection } }, auth, fetchImpl)
+        : client;
+    const status = createCodexStatusLoader(config.persistence.configDirectory, client, env);
+    const resolveRuntime = (args = []) => resolveCodexRuntime(args, {
+        env,
+        binary: config.launcher.codexBinary,
+        binaryEnvNames: config.launcher.binaryEnvNames,
+        bundledEnvNames: config.launcher.bundledEnvNames,
+        launchMode: config.launcher.launchMode,
+        packageName: "@openai/codex"
+    });
+    const run = async (args = []) => runCodexLaunch(await resolveRuntime(args), env, config.launcher.binaryEnvNames[0]);
+    const app = (workspace = ".") => run(["app", workspace]);
+    const module = {
+        config,
+        client,
+        status,
+        registerCommands(program, commandOptions = {}) {
+            return registerCodexCommands(program, {
+                config,
+                auth,
+                client,
+                clientFor,
+                status,
+                run,
+                app,
+                output: options.output ?? process.stdout,
+                errorOutput: options.errorOutput ?? process.stderr,
+                jsonEnabled: options.jsonEnabled
+            }, commandOptions);
+        },
+        getConsoleStatus: () => status.load(),
+        resolveRuntime,
+        run,
+        app
+    };
+    return module;
+}
+export * from "./errors.js";
+export * from "./protocol.js";
+export * from "./client.js";
+export * from "./runtime.js";
+export * from "./console-status.js";
+export * from "./command-directory.js";
+export * from "./selection.js";
+export * from "./credentials.js";
+export * from "./shortcuts.js";
+export * from "./tui.js";
+export * from "./config.js";
+export * from "./quota-cache.js";
+export * from "./legacy-cleanup.js";
+export * from "./profile.js";
+export { registerCodexCommands } from "./commands.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAO,GAAuB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,UAAU,GAAwD,EAAE,EAAE,EAAE,CACzF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM;QAC5B,CAAC,CAAC,IAAI,kBAAkB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC;QAC7G,CAAC,CAAC,MAAM,CAAC;IACb,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,CAAC,IAAI,GAAa,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACxE,GAAG;QACH,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;QACnC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc;QAC9C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe;QAChD,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,GAAa,EAAE,EAAmB,EAAE,CAAC,cAAc,CACxE,MAAM,cAAc,CAAC,IAAI,CAAC,EAC1B,GAAG,EACH,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAClC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAgB;QAC1B,MAAM;QACN,MAAM;QACN,MAAM;QACN,gBAAgB,CAAC,OAAgB,EAAE,cAAc,GAAG,EAAE;YACpD,OAAO,qBAAqB,CAAC,OAAO,EAAE;gBACpC,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,SAAS;gBACT,MAAM;gBACN,GAAG;gBACH,GAAG;gBACH,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;gBACxC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM;gBAClD,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,EAAE,cAAc,CAAC,CAAC;QACrB,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;QACrC,cAAc;QACd,GAAG;QACH,GAAG;KACJ,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAGD,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/legacy-cleanup.d.ts

@@ -0,0 +1,5 @@
+export interface LegacyCodexProviderCleanup {
+    changed: boolean;
+    configPath: string;
+}
+export declare function cleanupLegacyCodexProvider(configPath?: string): Promise<LegacyCodexProviderCleanup>;

package/dist/legacy-cleanup.js

@@ -0,0 +1,36 @@
+import { readFile } from "node:fs/promises";
+import { getCodexCliConfigPath } from "codex-multi-auth/cli";
+import { writePrivateText } from "./private-file.js";
+export async function cleanupLegacyCodexProvider(configPath = getCodexCliConfigPath()) {
+    let source;
+    try {
+        source = await readFile(configPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { changed: false, configPath };
+        throw error;
+    }
+    const lines = source.split(/(?<=\n)/u);
+    let insideLegacy = false;
+    let changed = false;
+    const kept = [];
+    for (const line of lines) {
+        const section = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?(?:\r?\n)?$/u)?.[1]?.trim();
+        if (section)
+            insideLegacy = section === "model_providers.mcex-codex";
+        if (insideLegacy) {
+            changed = true;
+            continue;
+        }
+        if (/^\s*model_provider\s*=\s*["']mcex-codex["']/u.test(line)) {
+            changed = true;
+            continue;
+        }
+        kept.push(line);
+    }
+    if (changed)
+        await writePrivateText(configPath, kept.join("").replace(/\n{3,}/g, "\n\n"));
+    return { changed, configPath };
+}
+//# sourceMappingURL=legacy-cleanup.js.map

package/dist/legacy-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-cleanup.js","sourceRoot":"","sources":["../src/legacy-cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAOrD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAU,GAAG,qBAAqB,EAAE;IAEpC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACpD,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC9F,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACnF,IAAI,OAAO;YAAE,YAAY,GAAG,OAAO,KAAK,4BAA4B,CAAC;QACrE,IAAI,YAAY,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/C,IAAI,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAO;QAAE,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,26 @@
+import type { CodexAuthOptions } from "./types.js";
+export interface ResolvedOidcOptions {
+    discoveryUrl: string;
+    issuerUrl?: string;
+    clientId: string;
+    tenantId?: string;
+    audience?: string;
+    clientSecret?: string;
+    scope: string;
+    redirectHost: string;
+    redirectPort: number;
+    redirectPath: string;
+    openBrowser: boolean;
+    tokenFile: string;
+}
+export interface OidcLoginResult {
+    expiresAt: number;
+    scope: string;
+}
+export interface CodexAuthController {
+    readonly kind: "static" | "provider" | "oidc";
+    getAccessToken(forceRefresh?: boolean): Promise<string>;
+    login?(): Promise<OidcLoginResult>;
+    logout?(): Promise<void>;
+}
+export declare function createAuthController(auth: CodexAuthOptions, fetchImpl?: typeof fetch): CodexAuthController;

package/dist/oidc.js

@@ -0,0 +1,154 @@
+import { AuthError as SharedAuthError, blockingBrowserLogin, deleteTokenCache, ensureAccessToken, LoginRequiredError as SharedLoginRequiredError, readTokenCache } from "@numa-tech/cli-auth";
+import { CodexAuthError, CodexLoginRequiredError } from "./errors.js";
+function normalizeProviderToken(value) {
+    const token = typeof value === "string" ? value : value.accessToken;
+    if (!token.trim())
+        throw new CodexLoginRequiredError("The access token provider returned an empty token.");
+    return token;
+}
+class StaticAuthController {
+    token;
+    kind = "static";
+    constructor(token) {
+        this.token = token;
+    }
+    async getAccessToken() {
+        if (!this.token.trim())
+            throw new CodexLoginRequiredError("The configured access token is empty.");
+        return this.token;
+    }
+}
+class ProviderAuthController {
+    provider;
+    loginProvider;
+    isLoginRequired;
+    loginHint;
+    kind = "provider";
+    constructor(provider, loginProvider, isLoginRequired, loginHint) {
+        this.provider = provider;
+        this.loginProvider = loginProvider;
+        this.isLoginRequired = isLoginRequired;
+        this.loginHint = loginHint;
+    }
+    async getAccessToken(forceRefresh = false) {
+        try {
+            return normalizeProviderToken(await this.provider({ forceRefresh }));
+        }
+        catch (error) {
+            const required = this.isLoginRequired?.(error)
+                ?? (error?.code === "login_required");
+            if (!required || !this.loginProvider)
+                throw error;
+            await this.loginProvider();
+            try {
+                return normalizeProviderToken(await this.provider({ forceRefresh: false }));
+            }
+            catch (retryError) {
+                const retryRequired = this.isLoginRequired?.(retryError)
+                    ?? (retryError?.code === "login_required");
+                if (retryRequired) {
+                    throw new CodexLoginRequiredError(this.loginHint ?? "Login is required.");
+                }
+                throw retryError;
+            }
+        }
+    }
+}
+function sharedConfig(options) {
+    return {
+        discoveryUrl: options.discoveryUrl,
+        ...(options.issuerUrl ? { issuerUrl: options.issuerUrl } : {}),
+        clientId: options.clientId,
+        ...(options.tenantId ? { profileTenantId: options.tenantId } : {}),
+        ...(options.audience ? { resourceAudience: options.audience } : {}),
+        ...(options.clientSecret ? { clientSecret: options.clientSecret } : {}),
+        scope: options.scope,
+        tokenFile: options.tokenFile,
+        redirectHost: options.redirectHost,
+        redirectPort: options.redirectPort,
+        redirectPath: options.redirectPath,
+        openBrowser: options.openBrowser
+    };
+}
+function translateSharedAuthError(error) {
+    if (error instanceof SharedLoginRequiredError) {
+        throw new CodexLoginRequiredError(error.message);
+    }
+    if (error instanceof SharedAuthError) {
+        const code = error.code === "http_error"
+            ? "http_error"
+            : error.code === "issuer_mismatch" ? "issuer_mismatch" : "auth_error";
+        throw new CodexAuthError(error.message, code, { cause: error });
+    }
+    throw error;
+}
+class OidcAuthController {
+    fetchImpl;
+    kind = "oidc";
+    config;
+    constructor(options, fetchImpl) {
+        this.fetchImpl = fetchImpl;
+        this.config = sharedConfig(options);
+    }
+    async getAccessToken(forceRefresh = false) {
+        try {
+            return await ensureAccessToken(this.config, forceRefresh, { fetch: this.fetchImpl });
+        }
+        catch (error) {
+            translateSharedAuthError(error);
+        }
+    }
+    async login() {
+        try {
+            await blockingBrowserLogin(this.config, { loadUserinfo: false }, { fetch: this.fetchImpl });
+            const cache = await readTokenCache(this.config);
+            if (!cache)
+                throw new CodexLoginRequiredError("OIDC login did not create a token cache.");
+            return { expiresAt: cache.expiresAt, scope: cache.scope };
+        }
+        catch (error) {
+            if (error instanceof CodexLoginRequiredError)
+                throw error;
+            translateSharedAuthError(error);
+        }
+    }
+    async logout() {
+        try {
+            await deleteTokenCache(this.config);
+        }
+        catch (error) {
+            translateSharedAuthError(error);
+        }
+    }
+}
+function resolveOidcOptions(options) {
+    const issuerUrl = options.issuerUrl?.replace(/\/+$/, "");
+    const discoveryUrl = options.discoveryUrl
+        ?? (issuerUrl ? `${issuerUrl}/.well-known/openid-configuration` : undefined);
+    if (!discoveryUrl || !options.clientId || !options.tokenFile) {
+        throw new CodexAuthError("OIDC discoveryUrl, clientId and tokenFile are required.", "auth_error");
+    }
+    return {
+        discoveryUrl,
+        ...(issuerUrl ? { issuerUrl } : {}),
+        clientId: options.clientId,
+        ...(options.tenantId ? { tenantId: options.tenantId } : {}),
+        ...(options.audience ? { audience: options.audience } : {}),
+        ...(options.clientSecret ? { clientSecret: options.clientSecret } : {}),
+        scope: options.scope ?? "openid profile email offline_access",
+        redirectHost: options.redirectHost ?? "127.0.0.1",
+        redirectPort: options.redirectPort ?? 8765,
+        redirectPath: options.redirectPath ?? "/callback",
+        openBrowser: options.openBrowser ?? true,
+        tokenFile: options.tokenFile
+    };
+}
+export function createAuthController(auth, fetchImpl = fetch) {
+    if ("accessToken" in auth)
+        return new StaticAuthController(auth.accessToken);
+    if ("tokenProvider" in auth) {
+        return new ProviderAuthController(auth.tokenProvider, auth.loginProvider, auth.isLoginRequired, auth.loginHint);
+    }
+    return new OidcAuthController(resolveOidcOptions(auth.oidc), fetchImpl);
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,IAAI,wBAAwB,EAC9C,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AA8BtE,SAAS,sBAAsB,CAAC,KAAiC;IAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,oDAAoD,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,oBAAoB;IAEK,KAAK;IADzB,IAAI,GAAG,QAAiB,CAAC;IAClC,YAA6B,KAAa;qBAAb,KAAK;IAAW,CAAC;IAC9C,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;QACnG,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,MAAM,sBAAsB;IAGP,QAAQ;IACR,aAAa;IACb,eAAe;IACf,SAAS;IALnB,IAAI,GAAG,UAAmB,CAAC;IACpC,YACmB,QAA6B,EAC7B,aAAmC,EACnC,eAA6C,EAC7C,SAAkB;wBAHlB,QAAQ;6BACR,aAAa;+BACb,eAAe;yBACf,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,YAAY,GAAG,KAAK;QACvC,IAAI,CAAC;YACH,OAAO,sBAAsB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC;mBACzC,CAAE,KAAwC,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC;YAC5E,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,sBAAsB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC;uBACnD,CAAE,UAA6C,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC;gBACjF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC,CAAC;gBAC5E,CAAC;gBACD,MAAM,UAAU,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,MAAM,IAAI,GAAoD,KAAK,CAAC,IAAI,KAAK,YAAY;YACvF,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;QACxE,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,MAAM,kBAAkB;IAMH,SAAS;IALnB,IAAI,GAAG,MAAe,CAAC;IACf,MAAM,CAAmB;IAE1C,YACE,OAA4B,EACX,SAAuB;yBAAvB,SAAS;QAE1B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,YAAY,GAAG,KAAK;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,oBAAoB,CACxB,IAAI,CAAC,MAAM,EACX,EAAE,YAAY,EAAE,KAAK,EAAE,EACvB,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAC1B,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC1D,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,OAAwB;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY;WACpC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,cAAc,CAAC,yDAAyD,EAAE,YAAY,CAAC,CAAC;IACpG,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,qCAAqC;QAC7D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,WAAW;QACjD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,WAAW;QACjD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAsB,EACtB,SAAS,GAAiB,KAAK;IAE/B,IAAI,aAAa,IAAI,IAAI;QAAE,OAAO,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,IAAI,sBAAsB,CAC/B,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC"}

package/dist/private-file.d.ts

@@ -0,0 +1,3 @@
+export declare function writePrivateText(path: string, content: string): Promise<void>;
+export declare function writePrivateJson(path: string, value: unknown): Promise<void>;
+export declare function readJsonIfExists(path: string): Promise<unknown | undefined>;

package/dist/private-file.js

@@ -0,0 +1,30 @@
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+export async function writePrivateText(path, content) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${path}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+    try {
+        await writeFile(temporaryPath, content, { encoding: "utf8", mode: 0o600 });
+        await rename(temporaryPath, path);
+        if (process.platform !== "win32")
+            await chmod(path, 0o600);
+    }
+    finally {
+        await rm(temporaryPath, { force: true }).catch(() => undefined);
+    }
+}
+export async function writePrivateJson(path, value) {
+    await writePrivateText(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+export async function readJsonIfExists(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+//# sourceMappingURL=private-file.js.map

package/dist/private-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-file.js","sourceRoot":"","sources":["../src/private-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAClE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IACjE,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/profile.d.ts

@@ -0,0 +1,29 @@
+export interface ResolvedCodexProfile {
+    sourceUrl: string;
+    profileId: string;
+    revision: number;
+    environment: string;
+    tenantId: string;
+    tenantHeaderName: string;
+    serverUrl: string;
+    resource: string;
+    audience: string;
+    roleClientId: string;
+    authority: {
+        issuer: string;
+        discoveryUrl: string;
+        clientId: string;
+        scope: string;
+    };
+    stale: boolean;
+}
+export interface ResolveCodexProfileOptions {
+    profileUrl?: string;
+    serverUrl?: string;
+    tenantId?: string;
+    fetch?: typeof globalThis.fetch;
+    configDirectory?: string;
+    now?: () => number;
+    onWarning?: (message: string) => void;
+}
+export declare function resolveCodexProfile(options: ResolveCodexProfileOptions): Promise<ResolvedCodexProfile>;