@velum-labs/routekit-accounts 1.3.2 → 1.4.0

package/README.md

@@ -10,11 +10,10 @@ runs against every healthy account; the provider publishes the union of models
 and tracks which accounts are eligible for each model.
 
 The first-launch RouteKit subscription kinds are `claude-code` and `codex`.
-They run the official provider login in isolated temporary state
-(`captureLoginCredential`) before enrolling. Any number of named accounts may
-join a provider; the first enrollment enables that provider in the effective
-router config. The RouteKit tool command is still `routekit claude`; tool names
-and subscription kinds are separate contracts.
+They run first-party OAuth (`captureLoginCredential`) before enrolling. Any
+number of named accounts may join a provider; the first enrollment enables that
+provider in the effective router config. The RouteKit tool command is still
+`routekit claude`; tool names and subscription kinds are separate contracts.
 
 Other registry entries and exported connector APIs are internal, unqualified,
 and non-contractual; they are not RouteKit onboarding or support.

package/dist/codex-originator.d.ts

@@ -0,0 +1,9 @@
+/** Supervised daemons copy this from the installing shell; login and relays read it at runtime. */
+export declare const CODEX_ORIGINATOR_ENV = "ROUTEKIT_CODEX_ORIGINATOR";
+/**
+ * Codex OAuth authorize param and upstream `originator` header.
+ *
+ * Defaults to the registry value (`routekit`). `ROUTEKIT_CODEX_ORIGINATOR`
+ * selects another token such as `codex_cli_rs`.
+ */
+export declare function resolvedCodexOriginator(env?: NodeJS.ProcessEnv): string;

package/dist/codex-originator.js

@@ -0,0 +1,29 @@
+import { subscriptionInfo } from "@velum-labs/routekit-registry";
+/** Supervised daemons copy this from the installing shell; login and relays read it at runtime. */
+export const CODEX_ORIGINATOR_ENV = "ROUTEKIT_CODEX_ORIGINATOR";
+const ORIGINATOR_TOKEN = /^[\w.-]+$/;
+function registryCodexOriginator() {
+    const info = subscriptionInfo("codex");
+    return (info.oauth.authorizeExtraParams?.originator ??
+        info.defaultHeaders?.originator ??
+        info.discovery.extraHeaders?.originator ??
+        "routekit");
+}
+/**
+ * Codex OAuth authorize param and upstream `originator` header.
+ *
+ * Defaults to the registry value (`routekit`). `ROUTEKIT_CODEX_ORIGINATOR`
+ * selects another token such as `codex_cli_rs`.
+ */
+export function resolvedCodexOriginator(env = process.env) {
+    const raw = env[CODEX_ORIGINATOR_ENV];
+    if (raw === undefined)
+        return registryCodexOriginator();
+    const value = raw.trim();
+    if (value.length === 0)
+        return registryCodexOriginator();
+    if (!ORIGINATOR_TOKEN.test(value)) {
+        throw new Error(`${CODEX_ORIGINATOR_ENV} must be a token (letters, numbers, dots, underscores, or hyphens)`);
+    }
+    return value;
+}

package/dist/connector.js

@@ -3,8 +3,9 @@
  *
  * The neutral account layer retains two connector mechanisms:
  *
- * - `native`: the official provider CLI login captured into RouteKit's own
- *   account store and served by provider-native relays (claude-code, codex).
+ * - `native`: first-party OAuth (or an imported official CLI file) captured
+ *   into RouteKit's own account store and served by provider-native relays
+ *   (claude-code, codex).
  * - `cliproxy`: the RouteKit-managed CLIProxyAPI sidecar, whose OAuth account
  *   store and ingress key live under RouteKit's home (gemini, grok, kimi).
  *

package/dist/index.d.ts

@@ -3,11 +3,12 @@
  *
  * A cohesive, typed surface for pooling Claude Code and Codex OAuth
  * subscriptions behind one provider-native proxy: resolve an account set from
- * the official CLI login / an enrolled directory / explicit paths, select and
- * refresh members with quota-aware routing, and expose it over the gateway wire
- * protocols. `startSubscriptionProxy` is the one-call programmatic entrypoint;
- * `SubscriptionProxyClient` reads a running proxy's usage over a typed wire
- * contract. Product CLIs can wrap this module without owning account logic.
+ * first-party OAuth / an imported official CLI login / an enrolled directory /
+ * explicit paths, select and refresh members with quota-aware routing, and
+ * expose it over the gateway wire protocols. `startSubscriptionProxy` is the
+ * one-call programmatic entrypoint; `SubscriptionProxyClient` reads a running
+ * proxy's usage over a typed wire contract. Product CLIs can wrap this module
+ * without owning account logic.
  */
 export type { CoordinatorResource, RedeemResetCreditInput, RedeemResetCreditResult, SubscriptionAccountSetOptions, SubscriptionExecutionObserver } from "./account-set/types.js";
 export { SUBSCRIPTION_SSE_BUFFER_CAP_BYTES, SubscriptionAccountSet, SubscriptionAccountSetAuthError, SubscriptionAccountSetAuthRecoveryError, SubscriptionAccountSetExhaustedError } from "./account-set.js";
@@ -25,6 +26,7 @@ export type { SubscriptionProxyClientOptions } from "./client.js";
 export { SubscriptionProxyClient, SubscriptionProxyClientError } from "./client.js";
 export type { CliproxyInstallResult, CliproxyStatus } from "./cliproxy.js";
 export { CLIPROXY_API_KEY_ENV, CLIPROXY_BASE_URL_ENV, CLIPROXY_HOME_ENV, CLIPROXY_PINNED_VERSION, cliproxyApiKey, cliproxyAssetName, cliproxyBaseUrl, cliproxyBinaryPath, cliproxyConfigPath, cliproxyHome, cliproxyManagedPort, cliproxyStatus, ensureCliproxyConfig, installCliproxy, spawnCliproxy, writeCliproxyLoginConfig } from "./cliproxy.js";
+export { CODEX_ORIGINATOR_ENV, resolvedCodexOriginator } from "./codex-originator.js";
 export type { CodexCatalogEntry, CodexRelayAuth, CodexRelayAuthSource, CodexRelayOptions, CodexStockEntry, ProviderRelayLogger } from "./codex-relay.js";
 export { CodexBackendRelay, codexRelayAuth } from "./codex-relay.js";
 export type { AccountStoreEntry, CapturedCliproxyCredential, CliproxyAccountEntry, CliproxyLoginInvocation, CliproxyLoginOptions, ResolvedAccountKind } from "./connector.js";
@@ -34,8 +36,8 @@ export { defaultSubscriptionAccountDirectory, defaultSubscriptionCredentialPath,
 export type { OpenSubscriptionRelaysOptions, OpenSubscriptionRelaysResult, SubscriptionAccountConfigs, SubscriptionAccountSets } from "./gateway.js";
 export { closeSubscriptionAccountSets, openSubscriptionAccountSets, openSubscriptionRelays, relayPorts, subscriptionRelaysFromAccountSets } from "./gateway.js";
 export type { SubscriptionGateway, SubscriptionGatewayBackend, SubscriptionGatewayBackendRequestOptions, SubscriptionGatewayFactory, SubscriptionGatewayModelCatalogRelay, SubscriptionGatewayOptions, SubscriptionGatewayRelayDialect, SubscriptionGatewayRelayLifecycle, SubscriptionGatewayRelayPorts, SubscriptionGatewayRequestRelay, SubscriptionGatewayTokenCountRelay } from "./gateway-port.js";
-export type { ManagedAccountLoginInvocation, ManagedAccountLoginOptions, ManagedLoginKeychain } from "./managed-login.js";
-export { browserOpenerStubDirectory, captureLoginCredential, claudeProfileKeychainService, parseAccountMode } from "./managed-login.js";
+export type { AuthorizationCallbackInput, ManagedAccountLoginOptions } from "./managed-login.js";
+export { captureLoginCredential, parseAccountMode } from "./managed-login.js";
 export type { AdminUsageCost, AdminUsageRange, ConsumeResetCreditInput, ConsumeResetCreditResult, SubscriptionProvider, SubscriptionRefreshFailure, SubscriptionStreamOutcome } from "./provider.js";
 export { SubscriptionProviderRequestError, SubscriptionRefreshError, subscriptionProvider } from "./provider.js";
 export type { SubscriptionProviderBackend, SubscriptionProviderBackendFactory, SubscriptionProviderBackendOptions, SubscriptionProviderTransport, SubscriptionResponseMode } from "./provider-port.js";

package/dist/index.js

@@ -3,11 +3,12 @@
  *
  * A cohesive, typed surface for pooling Claude Code and Codex OAuth
  * subscriptions behind one provider-native proxy: resolve an account set from
- * the official CLI login / an enrolled directory / explicit paths, select and
- * refresh members with quota-aware routing, and expose it over the gateway wire
- * protocols. `startSubscriptionProxy` is the one-call programmatic entrypoint;
- * `SubscriptionProxyClient` reads a running proxy's usage over a typed wire
- * contract. Product CLIs can wrap this module without owning account logic.
+ * first-party OAuth / an imported official CLI login / an enrolled directory /
+ * explicit paths, select and refresh members with quota-aware routing, and
+ * expose it over the gateway wire protocols. `startSubscriptionProxy` is the
+ * one-call programmatic entrypoint; `SubscriptionProxyClient` reads a running
+ * proxy's usage over a typed wire contract. Product CLIs can wrap this module
+ * without owning account logic.
  */
 export { SUBSCRIPTION_SSE_BUFFER_CAP_BYTES, SubscriptionAccountSet, SubscriptionAccountSetAuthError, SubscriptionAccountSetAuthRecoveryError, SubscriptionAccountSetExhaustedError } from "./account-set.js";
 // Account sources (canonical / directory / explicit)
@@ -21,6 +22,7 @@ export { SubscriptionAccountBackend } from "./backend.js";
 export { SubscriptionProxyClient, SubscriptionProxyClientError } from "./client.js";
 // Managed CLIProxyAPI lifecycle
 export { CLIPROXY_API_KEY_ENV, CLIPROXY_BASE_URL_ENV, CLIPROXY_HOME_ENV, CLIPROXY_PINNED_VERSION, cliproxyApiKey, cliproxyAssetName, cliproxyBaseUrl, cliproxyBinaryPath, cliproxyConfigPath, cliproxyHome, cliproxyManagedPort, cliproxyStatus, ensureCliproxyConfig, installCliproxy, spawnCliproxy, writeCliproxyLoginConfig } from "./cliproxy.js";
+export { CODEX_ORIGINATOR_ENV, resolvedCodexOriginator } from "./codex-originator.js";
 // Relays (provider-native forwarding)
 export { CodexBackendRelay, codexRelayAuth } from "./codex-relay.js";
 // Account connectors: one login surface over native + cliproxy mechanisms
@@ -29,8 +31,8 @@ export { accountStoreEntries, captureCliproxyLoginCredentials, cliproxyAccountEn
 export { defaultSubscriptionAccountDirectory, defaultSubscriptionCredentialPath, enrollCurrentSubscription, loadSubscriptionCredential, persistSubscriptionCredential, removeSubscriptionAccount, renameSubscriptionAccount, sanitizeSubscriptionLabel, subscriptionCredentialFingerprint, subscriptionCredentialLabel } from "./credentials.js";
 // Gateway relay construction
 export { closeSubscriptionAccountSets, openSubscriptionAccountSets, openSubscriptionRelays, relayPorts, subscriptionRelaysFromAccountSets } from "./gateway.js";
-// Native-connector managed logins (official CLI in an isolated profile)
-export { browserOpenerStubDirectory, captureLoginCredential, claudeProfileKeychainService, parseAccountMode } from "./managed-login.js";
+// First-party OAuth enrollment for native Claude Code / Codex subscriptions
+export { captureLoginCredential, parseAccountMode } from "./managed-login.js";
 // Provider adapters
 export { SubscriptionProviderRequestError, SubscriptionRefreshError, subscriptionProvider } from "./provider.js";
 // Programmatic proxy + typed client

package/dist/managed-login.d.ts

@@ -1,41 +1,49 @@
-import type { SubscriptionMode } from "@velum-labs/routekit-registry";
-/** Directory under the temp profile that shadows OS browser openers. */
-export declare function browserOpenerStubDirectory(profileDirectory: string): string;
+import { type SubscriptionMode } from "@velum-labs/routekit-registry";
 /** Narrow a user-supplied kind to a native subscription kind. */
 export declare function parseAccountMode(value: string): SubscriptionMode;
-export type ManagedAccountLoginInvocation = {
-    command: string;
-    args: readonly string[];
-    env: Readonly<Record<string, string>>;
-    profileDirectory: string;
-    sourcePath: string;
-};
-export type ManagedLoginKeychain = {
-    read(service: string): Promise<string>;
-    remove(service: string): Promise<void>;
+export type AuthorizationCallbackInput = {
+    authorizeUrl: string;
+    redirectUri: string;
+    state: string;
+    subscriptionKind: SubscriptionMode;
 };
 export type ManagedAccountLoginOptions = {
-    temporaryParent?: string;
     /**
-     * Prefer a browserless login flow: Codex uses its device-code flow
-     * (`codex login --device-auth`). Claude Code has no native device-code
-     * flag, so RouteKit shadows `open`/`xdg-open` and sets `BROWSER` to force
-     * its built-in copyable-URL + pasted-code fallback.
+     * Prefer a browserless login flow: Codex uses ChatGPT deviceauth;
+     * Claude Code prints a copyable authorize URL and accepts a pasted code.
      */
     noBrowser?: boolean;
-    runLogin?: (invocation: ManagedAccountLoginInvocation) => Promise<number>;
-    platform?: NodeJS.Platform;
-    keychain?: ManagedLoginKeychain;
+    fetch?: typeof fetch;
+    /** Process environment used for Codex originator resolution. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    onProgress?: (message: string) => void;
+    waitForAuthorizationCode?: (input: AuthorizationCallbackInput) => Promise<string>;
+    listenForCallback?: (input: {
+        redirectUri: string;
+        state: string;
+        signal?: AbortSignal;
+        onReady?: () => void;
+    }) => Promise<URL>;
+    openBrowser?: (url: string) => Promise<void>;
+    readPastedCode?: (prompt: string, signal?: AbortSignal) => Promise<string>;
+    sleep?: (ms: number) => Promise<void>;
+};
+type LoopbackWaitInput = {
+    redirectUri: string;
+    state: string;
+    signal?: AbortSignal;
+    onReady?: () => void;
 };
-export declare function claudeProfileKeychainService(profileDirectory: string): string;
+export declare function defaultListenForCallback(input: LoopbackWaitInput): Promise<URL>;
 /**
- * Run the interactive provider login in an isolated local profile and return
- * the credential blob instead of writing RouteKit state. The singleton daemon
- * is the sole account-store writer; the thin CLI sends this blob over its
- * authenticated control channel.
+ * Run first-party OAuth for a native subscription kind and return the credential
+ * blob instead of writing RouteKit state. The singleton daemon is the sole
+ * account-store writer; the thin CLI sends this blob over its authenticated
+ * control channel.
  */
 export declare function captureLoginCredential(subscriptionKindInput: string, label: string, options?: ManagedAccountLoginOptions): Promise<{
     subscriptionKind: SubscriptionMode;
     label: string;
     credential: unknown;
 }>;
+export {};