@xandreed/plugin-models 0.14.0 → 0.15.0

package/dist/auth/localAuth.d.ts

@@ -1,9 +1,18 @@
 import { Layer } from "effect";
-import { AuthStore } from "@xandreed/core";
+import { AuthStore } from "../ports/auth-store.port.js";
 export declare const authPaths: (cwd: string, home: string, directory?: string) => ReadonlyArray<string>;
 /**
  * `LocalAuthStoreLive(cwd, home)` — read-through: every call re-reads disk,
  * so a credential added mid-session applies on the next request. A token
  * refresh goes through the `ModelsTransport` the layer is built over, if any.
+ *
+ * A file that cannot be read or is not a JSON object fails every call with
+ * an `AuthError` of code `auth.corrupt`; only a missing file reads as empty.
+ * Each write re-reads its file under that file's lock, which every store in
+ * the process shares, and replaces it through a temp file of its own. One
+ * refresh of a provider's token runs at a time, and stores its token only if
+ * the provider still holds the one it refreshed, so a login or logout made
+ * during the refresh wins. The locks hold within one process: two processes
+ * sharing these files can still lose an update.
  */
 export declare const LocalAuthStoreLive: (cwd: string, home: string, directory?: string, fallbackDirectory?: string) => Layer.Layer<AuthStore, never, never>;

package/dist/auth/localAuth.js

@@ -1,88 +1,62 @@
-import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { Clock, Effect, Layer, Option, Redacted } from "effect";
-import { asJsonRecord, AuthError, AuthStore, parseJsonWarn } from "@xandreed/core";
-import { isUsableAt, refreshCredential } from "./credential-refresh.entity.functions.js";
+import { join } from "node:path";
+import { Effect, Layer, Option, Schema } from "effect";
+import { AuthError, AuthStore, Credential } from "../ports/auth-store.port.js";
+import { encodeCredential } from "./credential-input.entity.functions.js";
+import { isSameToken, resolveSlotKey } from "./credential-refresh.entity.functions.js";
 import { ModelsTransport } from "../ports/models-transport.port.js";
-const decodeCredential = (value) => {
-  if (typeof value === "string")
-    return Option.some({ type: "api_key", key: value });
-  if (typeof value !== "object" || value === null)
-    return Option.none();
-  const v = value;
-  if (v.type === "api_key" && typeof v.key === "string")
-    return Option.some({ type: "api_key", key: v.key });
-  if (v.type === "oauth" && typeof v.access === "string" && typeof v.refresh === "string" && typeof v.expires === "number")
-    return Option.some({
-      type: "oauth",
-      access: v.access,
-      refresh: v.refresh,
-      expires: v.expires,
-      ...typeof v.accountId === "string" ? { accountId: v.accountId } : {},
-      ...typeof v.installationId === "string" ? { installationId: v.installationId } : {}
-    });
-  if (v.type === "local")
-    return Option.some({
-      type: "local",
-      ...typeof v.baseUrl === "string" ? { baseUrl: v.baseUrl } : {}
-    });
-  return Option.none();
-}, readAuthFile = (path) => Effect.tryPromise({ try: () => readFile(path, "utf-8"), catch: () => "missing" }).pipe(Effect.flatMap((text) => parseJsonWarn(text, path)), Effect.map((parsed) => {
-  const record = asJsonRecord(parsed), entries = new Map(Object.entries(record).flatMap(([provider, raw]) => Option.match(decodeCredential(raw), {
-    onNone: () => [],
-    onSome: (cred) => [[provider, cred]]
-  })));
-  return { path, entries };
-}), Effect.orElseSucceed(() => ({ path, entries: new Map }))), writeAuthFile = (path, entries) => Effect.tryPromise({
-  try: async () => {
-    await mkdir(dirname(path), { recursive: !0 });
-    const tmp = `${path}.tmp-${process.pid}`;
-    await writeFile(tmp, JSON.stringify(Object.fromEntries(entries), null, 2), "utf-8");
-    await chmod(tmp, 384);
-    await rename(tmp, path);
-  },
-  catch: (e) => new AuthError({ provider: "*", message: `auth.json write failed: ${String(e)}` })
-});
+import { namedLock, readJsonObject, withFileLock, writeJsonObject } from "../storage/json-file.js";
+const decodeStored = Schema.decodeUnknownOption(Credential), decodeLegacyKey = Schema.decodeUnknownOption(Schema.String), decodeCredential = (raw) => Option.orElse(decodeStored(raw), () => Option.flatMap(decodeLegacyKey(raw), (key) => decodeStored({ type: "api_key", key }))), corrupt = (path) => (reason) => new AuthError({
+  provider: "*",
+  code: "auth.corrupt",
+  message: `${path} ${reason}: fix or remove it; nothing was read from it or written to it`
+}), readAuthFile = (path) => readJsonObject(path, corrupt(path)).pipe(Effect.map((record) => {
+  const decoded = Object.entries(Option.getOrElse(record, () => ({}))).map(([provider, raw]) => ({ provider, raw, credential: decodeCredential(raw) }));
+  return {
+    path,
+    entries: new Map(decoded.flatMap(({ provider, credential }) => Option.match(credential, {
+      onNone: () => [],
+      onSome: (found) => [[provider, found]]
+    }))),
+    unread: new Map(decoded.filter(({ credential }) => Option.isNone(credential)).map(({ provider, raw }) => [provider, raw]))
+  };
+})), writeAuthFile = (file, provider, credential) => {
+  const others = (entries) => [...entries].filter(([key]) => key !== provider), credentials = [...others(file.entries), ...Option.toArray(Option.map(credential, (value) => [provider, value]))];
+  return Effect.forEach(credentials, ([key, value]) => Effect.map(encodeCredential(key, value), (encoded) => [key, encoded]), { concurrency: 1 }).pipe(Effect.flatMap((encoded) => {
+    const record = Object.fromEntries([...others(file.unread), ...encoded]);
+    return writeJsonObject(file.path, record, Option.some(384), (reason) => new AuthError({ provider: "*", message: `auth.json write failed: ${reason}` }));
+  }));
+};
 export const authPaths = (cwd, home, directory = ".efferent") => [
   join(home, directory, "auth.json"),
   join(cwd, directory, "auth.json")
-], LocalAuthStoreLive = (cwd, home, directory = ".efferent", fallbackDirectory) => {
-  const paths = [...fallbackDirectory === void 0 ? [] : authPaths(cwd, home, fallbackDirectory), ...authPaths(cwd, home, directory)];
+];
+const holderOf = (files, provider) => Option.firstSomeOf([...files].reverse().map((file) => Option.map(Option.fromNullishOr(file.entries.get(provider)), (credential) => ({ file, credential }))));
+export const LocalAuthStoreLive = (cwd, home, directory = ".efferent", fallbackDirectory) => {
+  const writable = authPaths(cwd, home, directory), loginPath = writable[0] ?? join(home, directory, "auth.json"), paths = [...fallbackDirectory === void 0 ? [] : authPaths(cwd, home, fallbackDirectory), ...writable], readAll = Effect.forEach(paths, readAuthFile, { concurrency: 1 }), targetOf = (path) => writable.includes(path) ? path : loginPath;
   return Layer.effect(AuthStore, Effect.map(Effect.serviceOption(ModelsTransport), (transport) => {
-    const tokens = Option.match(transport, { onNone: () => ({}), onSome: ({ fetch }) => ({ fetch }) });
+    const tokens = Option.match(transport, { onNone: () => ({}), onSome: ({ fetch }) => ({ fetch }) }), slotOf = (provider) => ({
+      current: Effect.map(readAll, (files) => Option.map(holderOf(files, provider), ({ credential }) => credential)),
+      refreshLock: namedLock(loginPath, `refresh:${provider}`),
+      commit: (stale, fresh) => Effect.map(readAll, (files) => holderOf(files, provider)).pipe(Effect.flatMap(Option.match({
+        onNone: () => Effect.succeed(!1),
+        onSome: ({ file }) => {
+          const target = targetOf(file.path);
+          return withFileLock(target)(Effect.gen(function* () {
+            const now = holderOf(yield* readAll, provider);
+            if (!Option.exists(now, (held) => targetOf(held.file.path) === target && isSameToken(held.credential, stale)))
+              return !1;
+            yield* writeAuthFile(yield* readAuthFile(target), provider, Option.some(fresh));
+            return !0;
+          }));
+        }
+      })))
+    });
     return {
-      all: Effect.gen(function* () {
-        const files = yield* Effect.forEach(paths, readAuthFile);
-        return new Map(files.flatMap((f) => [...f.entries]));
-      }),
-      get: (provider) => Effect.gen(function* () {
-        const files = yield* Effect.forEach(paths, readAuthFile), merged = new Map(files.flatMap((f) => [...f.entries]));
-        return Option.fromNullishOr(merged.get(provider));
-      }),
-      resolveKey: (provider) => Effect.gen(function* () {
-        const holder = [...yield* Effect.forEach(paths, readAuthFile)].reverse().find((f) => f.entries.has(provider)), cred = holder?.entries.get(provider);
-        if (cred === void 0)
-          return Option.none();
-        if (cred.type === "api_key")
-          return Option.some(Redacted.make(cred.key));
-        if (cred.type === "local")
-          return Option.none();
-        if (isUsableAt(cred, yield* Clock.currentTimeMillis))
-          return Option.some(Redacted.make(cred.access));
-        const updated = yield* refreshCredential(provider, cred, tokens), target = holder !== void 0 && authPaths(cwd, home, directory).includes(holder.path) ? holder : yield* readAuthFile(authPaths(cwd, home, directory)[0] ?? "");
-        yield* writeAuthFile(target.path, new Map([...target.entries, [provider, updated]]));
-        return Option.some(Redacted.make(updated.access));
-      }),
-      set: (provider, credential) => Effect.gen(function* () {
-        const globalPath = authPaths(cwd, home, directory)[0] ?? "", file = yield* readAuthFile(globalPath);
-        yield* writeAuthFile(globalPath, new Map([...file.entries, [provider, credential]]));
-      }),
-      remove: (provider) => Effect.forEach(paths, (path) => Effect.gen(function* () {
-        const file = yield* readAuthFile(path);
-        if (!file.entries.has(provider))
-          return;
-        yield* writeAuthFile(path, new Map([...file.entries].filter(([p]) => p !== provider)));
-      })).pipe(Effect.asVoid)
+      all: Effect.map(readAll, (files) => new Map(files.flatMap((f) => [...f.entries]))),
+      get: (provider) => slotOf(provider).current,
+      resolveKey: (provider) => resolveSlotKey(provider, slotOf(provider), tokens),
+      set: (provider, credential) => withFileLock(loginPath)(readAuthFile(loginPath).pipe(Effect.flatMap((file) => writeAuthFile(file, provider, Option.some(credential))))),
+      remove: (provider) => readAll.pipe(Effect.andThen(Effect.forEach(paths, (path) => withFileLock(path)(readAuthFile(path).pipe(Effect.flatMap((file) => file.entries.has(provider) || file.unread.has(provider) ? writeAuthFile(file, provider, Option.none()) : Effect.void))), { concurrency: 1, discard: !0 })))
     };
   }));
 };

package/dist/auth/memory-auth.adapter.d.ts

@@ -1,8 +1,12 @@
 import { Layer } from "effect";
-import { AuthStore } from "@xandreed/core";
-import type { AuthError, Credential } from "@xandreed/core";
+import { AuthStore } from "../ports/auth-store.port.js";
+import type { AuthError, Credential } from "../ports/auth-store.port.js";
 import type { ModelsFetch } from "../ports/models-transport.port.js";
-/** How the in-memory store reaches the OAuth token endpoints. */
+/**
+ * How the in-memory store reaches the OAuth token endpoints.
+ *
+ * @public
+ */
 export interface MemoryAuthOptions {
     /** The fetch token refreshes go through; default: the `ModelsTransport`'s when the layer is built over one, else the global fetch. */
     readonly fetch?: ModelsFetch;
@@ -14,7 +18,9 @@ export interface MemoryAuthOptions {
  * `seed`. `resolveKey` refreshes a near-expiry anthropic or openai-codex
  * OAuth token in memory, one refresh per provider at a time (through the
  * `ModelsTransport` it was built over, so through the plugin's proxy), and
- * hands the new token to `HostCredentials.save`.
+ * hands the new token to `HostCredentials.save`. Secrets stay `Redacted`
+ * throughout; a `set` whose secrets are not (a plain string from untyped
+ * code) fails with an `AuthError`, as it does on the file store.
  *
  * A login or logout (`set`, `remove`) does not wait for a refresh's token
  * request; it waits only while a refreshed token is committed, which
@@ -23,5 +29,7 @@ export interface MemoryAuthOptions {
  * credential it refreshed (compare-and-set under the provider's lock): a
  * logout during a stalled token request stays a logout, and the host never
  * receives the refreshed token.
+ *
+ * @public
  */
 export declare const MemoryAuthStoreLive: (seed?: ReadonlyMap<string, Credential>, options?: MemoryAuthOptions) => Layer.Layer<AuthStore, AuthError>;

package/dist/auth/memory-auth.adapter.js

@@ -1,47 +1,35 @@
-import { Clock, Effect, Layer, Match, Option, Redacted, Ref, Semaphore, SynchronizedRef } from "effect";
-import { AuthStore } from "@xandreed/core";
+import { Effect, Layer, Option, Ref, Semaphore, SynchronizedRef } from "effect";
+import { AuthStore } from "../ports/auth-store.port.js";
 import { HostCredentials } from "../ports/host-credentials.port.js";
 import { ModelsTransport } from "../ports/models-transport.port.js";
-import { toCredential, toCredentialInput } from "./credential-input.entity.functions.js";
-import { isUsableAt, refreshCredential } from "./credential-refresh.entity.functions.js";
+import { encodeCredential, toCredentialInput } from "./credential-input.entity.functions.js";
+import { isSameToken, resolveSlotKey } from "./credential-refresh.entity.functions.js";
 export const MemoryAuthStoreLive = (seed = new Map, options = {}) => Layer.effect(AuthStore, Effect.gen(function* () {
   const host = yield* Effect.serviceOption(HostCredentials), loaded = yield* Option.match(host, {
     onNone: () => Effect.succeed(new Map),
-    onSome: (credentials) => credentials.load.pipe(Effect.map((all) => new Map([...all].map(([provider, input]) => [provider, toCredential(input)]))))
+    onSome: (credentials) => credentials.load
   }), state = yield* Ref.make(new Map([...loaded, ...seed])), locks = yield* SynchronizedRef.make(new Map), transport = yield* Effect.serviceOption(ModelsTransport), tokens = Option.match(Option.orElse(Option.fromNullishOr(options.fetch), () => Option.map(transport, (found) => found.fetch)), {
     onNone: () => ({}),
     onSome: (fetch) => ({ fetch })
   }), locksOf = (provider) => SynchronizedRef.modifyEffect(locks, (all) => Option.match(Option.fromNullishOr(all.get(provider)), {
     onSome: (found) => Effect.succeed([found, all]),
-    onNone: () => Effect.all({ commit: Semaphore.make(1), refresh: Semaphore.make(1) }).pipe(Effect.map((made) => [made, new Map([...all, [provider, made]])]))
+    onNone: () => Effect.all({ commit: Semaphore.make(1), refresh: Semaphore.make(1) }, { concurrency: 1 }).pipe(Effect.map((made) => [made, new Map([...all, [provider, made]])]))
   })), current = (provider) => Ref.get(state).pipe(Effect.map((all) => Option.fromNullishOr(all.get(provider)))), save = (provider, credential) => Option.match(host, {
     onNone: () => Effect.void,
     onSome: (credentials) => credentials.save(provider, Option.map(credential, toCredentialInput))
   }), write = (provider, credential) => Ref.update(state, (all) => Option.match(credential, {
     onNone: () => new Map([...all].filter(([key]) => key !== provider)),
     onSome: (value) => new Map([...all, [provider, value]])
-  })), refreshing = (provider, stale) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.refresh.withPermit(Effect.gen(function* () {
-    const before = yield* current(provider);
-    if (!Option.exists(before, (held) => held === stale))
-      return { _tag: "Changed" };
-    const fresh = yield* refreshCredential(provider, stale, tokens);
-    return yield* lock.commit.withPermit(Effect.gen(function* () {
-      const now = yield* current(provider);
-      if (!Option.exists(now, (held) => held === stale))
-        return { _tag: "Changed" };
-      yield* write(provider, Option.some(fresh));
-      yield* save(provider, Option.some(fresh)).pipe(Effect.catch((error) => Effect.logWarning(`the refreshed ${provider} token is kept in memory, but the host did not save it: ${error.message}`)));
-      return { _tag: "Key", key: Redacted.make(fresh.access) };
-    }));
-  }))), Effect.flatMap((refreshed) => Match.value(refreshed).pipe(Match.tag("Key", ({ key }) => Effect.succeed(Option.some(key))), Match.tag("Changed", () => resolveKey(provider)), Match.exhaustive))), resolveKey = (provider) => current(provider).pipe(Effect.flatMap(Option.match({
-    onNone: () => Effect.succeed(Option.none()),
-    onSome: (credential) => Match.value(credential).pipe(Match.when({ type: "api_key" }, ({ key }) => Effect.succeed(Option.some(Redacted.make(key)))), Match.when({ type: "local" }, () => Effect.succeed(Option.none())), Match.when({ type: "oauth" }, (oauth) => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => isUsableAt(oauth, now) ? Effect.succeed(Option.some(Redacted.make(oauth.access))) : refreshing(provider, oauth)))), Match.exhaustive)
-  })));
+  })), slotOf = (provider) => ({
+    current: current(provider),
+    refreshLock: Effect.map(locksOf(provider), (lock) => lock.refresh),
+    commit: (stale, fresh) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.commit.withPermit(current(provider).pipe(Effect.flatMap((now) => !Option.exists(now, (held) => isSameToken(held, stale)) ? Effect.succeed(!1) : write(provider, Option.some(fresh)).pipe(Effect.andThen(save(provider, Option.some(fresh)).pipe(Effect.catch((error) => Effect.logWarning(`the refreshed ${provider} token is kept in memory, but the host did not save it: ${error.message}`)))), Effect.as(!0)))))))
+  });
   return AuthStore.of({
     all: Ref.get(state),
     get: current,
-    resolveKey,
-    set: (provider, credential) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.commit.withPermit(save(provider, Option.some(credential)).pipe(Effect.andThen(write(provider, Option.some(credential))))))),
+    resolveKey: (provider) => resolveSlotKey(provider, slotOf(provider), tokens),
+    set: (provider, credential) => encodeCredential(provider, credential).pipe(Effect.andThen(locksOf(provider)), Effect.flatMap((lock) => lock.commit.withPermit(save(provider, Option.some(credential)).pipe(Effect.andThen(write(provider, Option.some(credential))))))),
     remove: (provider) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.commit.withPermit(current(provider).pipe(Effect.flatMap((held) => Option.isNone(held) ? Effect.void : save(provider, Option.none()).pipe(Effect.andThen(write(provider, Option.none()))))))))
   });
 }));

package/dist/auth/openAiCodexOAuth.d.ts

@@ -1,17 +1,27 @@
-import { Effect, Option } from "effect";
-import { AuthError } from "@xandreed/core";
+import { Effect, Option, Redacted } from "effect";
+import { AuthError } from "../ports/auth-store.port.js";
 import type { TokenRequestOptions } from "./anthropicOAuth.js";
 /** ChatGPT Plus/Pro OAuth protocol used by the OpenAI Codex subscription. */
 export declare const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+/** The originator registered with `OPENAI_CODEX_CLIENT_ID`. The authorize
+ * request, the token and the subscription transports must all send it: the
+ * backend keys model entitlement to the client/originator pair. */
+export declare const OPENAI_CODEX_ORIGINATOR = "pi";
 export declare const OPENAI_CODEX_CALLBACK_PORT = 1455;
 export declare const OPENAI_CODEX_CALLBACK_PATH = "/auth/callback";
 export declare const OPENAI_CODEX_REDIRECT_URI = "http://localhost:1455/auth/callback";
+/**
+ * The tokens a sign-in or a refresh grants, `Redacted` from the token response on, and the account id read from the access token.
+ *
+ * @public
+ */
 export interface OpenAiCodexTokens {
-    readonly access: string;
-    readonly refresh: string;
+    readonly access: Redacted.Redacted<string>;
+    readonly refresh: Redacted.Redacted<string>;
     readonly expires: number;
     readonly accountId?: string;
 }
+/** @public */
 export interface OpenAiCodexOAuthBegin {
     readonly verifier: string;
     readonly state: string;
@@ -21,6 +31,17 @@ export interface OpenAiCodexOAuthBegin {
 }
 /** Extract the subscription account lane without exposing the token. */
 export declare const openAiCodexAccountId: (accessToken: string) => Option.Option<string>;
+/** @public */
 export declare const beginOpenAiCodexOAuth: Effect.Effect<OpenAiCodexOAuthBegin>;
+/**
+ * Exchange the authorization code for tokens, `Redacted` (ready for `AuthStore.set`).
+ *
+ * @public
+ */
 export declare const exchangeOpenAiCodexCode: (code: string, verifier: string, options?: TokenRequestOptions) => Effect.Effect<OpenAiCodexTokens, AuthError>;
-export declare const refreshOpenAiCodexToken: (refreshToken: string, options?: TokenRequestOptions) => Effect.Effect<OpenAiCodexTokens, AuthError>;
+/**
+ * Refresh an expired (or near-expiry) access token; the refresh token is unwrapped only into the request form.
+ *
+ * @public
+ */
+export declare const refreshOpenAiCodexToken: (refreshToken: Redacted.Redacted<string>, options?: TokenRequestOptions) => Effect.Effect<OpenAiCodexTokens, AuthError>;

package/dist/auth/openAiCodexOAuth.js

@@ -1,25 +1,17 @@
-import { Effect, Result, Option } from "effect";
-import { AuthError } from "@xandreed/core";
+import { Effect, Result, Option, Redacted, Schema } from "effect";
+import { Base64Url } from "effect/encoding";
+import { AuthError } from "../ports/auth-store.port.js";
 import { generatePkce, tokenTime } from "./anthropicOAuth.js";
 import { redactCredentials } from "../transport/http-proxy.entity.functions.js";
-export const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+import { decodeTokenResponse, tokenRefusalText } from "./token-response.entity.functions.js";
+export const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann", OPENAI_CODEX_ORIGINATOR = "pi";
 const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize", TOKEN_URL = "https://auth.openai.com/oauth/token";
 export const OPENAI_CODEX_CALLBACK_PORT = 1455, OPENAI_CODEX_CALLBACK_PATH = "/auth/callback", OPENAI_CODEX_REDIRECT_URI = `http://localhost:${OPENAI_CODEX_CALLBACK_PORT}${OPENAI_CODEX_CALLBACK_PATH}`;
-const SCOPE = "openid profile email offline_access", ACCOUNT_CLAIM = "https://api.openai.com/auth", oauthError = (stage, detail) => new AuthError({ provider: "openai-codex", message: `OAuth ${stage} failed: ${detail}` }), base64UrlJson = (segment) => {
-  const normalized = segment.replace(/-/g, "+").replace(/_/g, "/"), padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
-  return JSON.parse(atob(padded));
-};
-export const openAiCodexAccountId = (accessToken) => {
-  const segment = accessToken.split(".")[1];
-  return Option.flatMap(Option.fromNullishOr(segment), (encoded) => Option.flatMap(Result.getSuccess(Result.try(() => base64UrlJson(encoded))), (payload) => {
-    const claim = payload[ACCOUNT_CLAIM];
-    if (typeof claim !== "object" || claim === null)
-      return Option.none();
-    const accountId = claim.chatgpt_account_id;
-    return Option.filter(Option.fromNullishOr(typeof accountId === "string" ? accountId : void 0), (value) => value.length > 0);
-  }));
-};
-const postToken = (body, stage, options) => Effect.tryPromise({
+const SCOPE = "openid profile email offline_access", ACCOUNT_CLAIM = "https://api.openai.com/auth", oauthError = (stage, detail) => new AuthError({ provider: "openai-codex", message: `OAuth ${stage} failed: ${detail}` }), AccessTokenClaims = Schema.Struct({
+  [ACCOUNT_CLAIM]: Schema.optionalKey(Schema.Struct({ chatgpt_account_id: Schema.optionalKey(Schema.NonEmptyString) }))
+}), decodeClaims = Schema.decodeUnknownOption(Schema.fromJsonString(AccessTokenClaims)), claimsOf = (segment) => Option.flatMap(Result.getSuccess(Base64Url.decodeString(segment)), decodeClaims);
+export const openAiCodexAccountId = (accessToken) => Option.flatMap(Option.flatMap(Option.fromNullishOr(accessToken.split(".")[1]), claimsOf), (claims) => Option.fromNullishOr(claims[ACCOUNT_CLAIM]?.chatgpt_account_id));
+const postToken = (body, stage, options, previous) => Effect.tryPromise({
   try: async () => {
     const response = await (options.fetch ?? fetch)(TOKEN_URL, {
       method: "POST",
@@ -30,14 +22,11 @@ const postToken = (body, stage, options) => Effect.tryPromise({
     return { ok: response.ok, status: response.status, text: await response.text() };
   },
   catch: (error) => oauthError(stage, redactCredentials(String(error)))
-}).pipe(Effect.filterOrFail((response) => response.ok, (response) => oauthError(stage, `status ${response.status}: ${response.text.slice(0, 200)}`)), Effect.flatMap((response) => Effect.try({
-  try: () => JSON.parse(response.text),
-  catch: () => oauthError(stage, "the token response was not JSON")
-})), Effect.filterOrFail((token) => typeof token.access_token === "string" && typeof token.refresh_token === "string" && typeof token.expires_in === "number", () => oauthError(stage, "the token response omitted required fields")), Effect.flatMap((token) => Effect.map(tokenTime(options), (now) => ({
-  access: token.access_token,
-  refresh: token.refresh_token,
-  expires: now + token.expires_in * 1000,
-  ...Option.match(openAiCodexAccountId(token.access_token), { onNone: () => ({}), onSome: (accountId) => ({ accountId }) })
+}).pipe(Effect.filterOrFail((response) => response.ok, (response) => oauthError(stage, tokenRefusalText(response.status, response.text, body))), Effect.flatMap((response) => decodeTokenResponse(response.text, previous).pipe(Effect.mapError((reason) => oauthError(stage, reason)))), Effect.flatMap((issued) => Effect.map(tokenTime(options), (now) => ({
+  access: issued.access,
+  refresh: issued.refresh,
+  expires: now + issued.lifetimeMs,
+  ...Option.match(openAiCodexAccountId(Redacted.value(issued.access)), { onNone: () => ({}), onSome: (accountId) => ({ accountId }) })
 }))));
 export const beginOpenAiCodexOAuth = Effect.gen(function* () {
   const pkce = yield* generatePkce, stateBytes = new Uint8Array(16);
@@ -53,7 +42,7 @@ export const beginOpenAiCodexOAuth = Effect.gen(function* () {
     state,
     id_token_add_organizations: "true",
     codex_cli_simplified_flow: "true",
-    originator: "pi"
+    originator: OPENAI_CODEX_ORIGINATOR
   }).forEach(([key, value]) => url.searchParams.set(key, value));
   return { verifier: pkce.verifier, state, authorizeUrl: url.toString(), callbackPort: OPENAI_CODEX_CALLBACK_PORT, callbackPath: OPENAI_CODEX_CALLBACK_PATH };
-}), exchangeOpenAiCodexCode = (code, verifier, options = {}) => postToken({ grant_type: "authorization_code", client_id: OPENAI_CODEX_CLIENT_ID, code, code_verifier: verifier, redirect_uri: OPENAI_CODEX_REDIRECT_URI }, "code exchange", options), refreshOpenAiCodexToken = (refreshToken, options = {}) => postToken({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: OPENAI_CODEX_CLIENT_ID }, "token refresh", options);
+}), exchangeOpenAiCodexCode = (code, verifier, options = {}) => postToken({ grant_type: "authorization_code", client_id: OPENAI_CODEX_CLIENT_ID, code, code_verifier: verifier, redirect_uri: OPENAI_CODEX_REDIRECT_URI }, "code exchange", options, Option.none()), refreshOpenAiCodexToken = (refreshToken, options = {}) => postToken({ grant_type: "refresh_token", refresh_token: Redacted.value(refreshToken), client_id: OPENAI_CODEX_CLIENT_ID }, "token refresh", options, Option.some(refreshToken));

package/dist/auth/token-response.entity.d.ts

@@ -0,0 +1,21 @@
+import { Schema } from "effect";
+/**
+ * A token endpoint's answer, as both subscription providers send it: the
+ * access token, its lifetime in seconds, and a refresh token. A refresh may
+ * leave the refresh token out, when the provider does not rotate it. The
+ * tokens decode `Redacted`, so from the response on they print as
+ * `<redacted>` in errors, logs and fingerprints.
+ */
+export declare const TokenResponse: Schema.Struct<{
+    readonly access_token: Schema.RedactedFromValue<Schema.NonEmptyString>;
+    readonly expires_in: Schema.Finite;
+    readonly refresh_token: Schema.OptionFromOptional<Schema.RedactedFromValue<Schema.String>>;
+}>;
+export type TokenResponse = typeof TokenResponse.Type;
+/** The tokens a response grants, `Redacted`: the access token, the refresh token to keep, and the access token's lifetime in ms. */
+export declare const IssuedTokens: Schema.Struct<{
+    readonly access: Schema.Redacted<Schema.String>;
+    readonly refresh: Schema.Redacted<Schema.String>;
+    readonly lifetimeMs: Schema.Number;
+}>;
+export type IssuedTokens = typeof IssuedTokens.Type;

package/dist/auth/token-response.entity.functions.d.ts

@@ -0,0 +1,20 @@
+import { Effect, Option, Redacted } from "effect";
+import type { IssuedTokens } from "./token-response.entity.js";
+/** How much of a refused token request's response body an error quotes. */
+export declare const TOKEN_ERROR_BODY_CHARS = 200;
+/**
+ * What an error says of a token endpoint's refusal: its status and the
+ * start of its body, every secret the request sent (`SECRET_FIELDS` of
+ * `sent`) replaced by `<redacted>` first, so an endpoint that echoes the
+ * request never puts a token into an error, a log or the model's view.
+ */
+export declare const tokenRefusalText: (status: number, body: string, sent: Readonly<Record<string, string>>) => string;
+/**
+ * Decode a token endpoint's answer, its tokens `Redacted`. `previous` is
+ * the refresh token a refresh sent: a response without one keeps it. A code
+ * exchange sends none, so its response must carry a refresh token. A
+ * response that is not JSON, has no access token or no lifetime above zero
+ * seconds fails with a reason that never quotes the response, which holds
+ * secrets.
+ */
+export declare const decodeTokenResponse: (text: string, previous: Option.Option<Redacted.Redacted<string>>) => Effect.Effect<IssuedTokens, string>;

package/dist/auth/token-response.entity.functions.js

@@ -0,0 +1,10 @@
+import { Effect, Option, Redacted, Schema } from "effect";
+import { TokenResponse } from "./token-response.entity.js";
+const decodeResponse = Schema.decodeUnknownEffect(Schema.fromJsonString(TokenResponse)), isNonEmpty = (token) => Redacted.value(token).length > 0, SECRET_FIELDS = ["refresh_token", "code", "code_verifier"];
+export const TOKEN_ERROR_BODY_CHARS = 200, tokenRefusalText = (status, body, sent) => {
+  const redacted = SECRET_FIELDS.flatMap((field) => Option.toArray(Option.filter(Option.fromNullishOr(sent[field]), (value) => value.length > 0))).reduce((text, secret) => text.replaceAll(secret, "<redacted>"), body);
+  return `status ${status}: ${redacted.slice(0, TOKEN_ERROR_BODY_CHARS)}`;
+}, decodeTokenResponse = (text, previous) => decodeResponse(text).pipe(Effect.mapError(() => "the token response did not hold an access token and its lifetime (expires_in, in seconds, above 0)"), Effect.flatMap((response) => Option.match(Option.orElse(Option.filter(response.refresh_token, isNonEmpty), () => previous), {
+  onNone: () => Effect.fail("the token response did not hold a refresh token"),
+  onSome: (refresh) => Effect.succeed({ access: response.access_token, refresh, lifetimeMs: response.expires_in * 1000 })
+})));

package/dist/auth/token-response.entity.js

@@ -0,0 +1,10 @@
+import { Schema } from "effect";
+export const TokenResponse = Schema.Struct({
+  access_token: Schema.RedactedFromValue(Schema.NonEmptyString),
+  expires_in: Schema.Finite.check(Schema.isGreaterThan(0)),
+  refresh_token: Schema.OptionFromOptional(Schema.RedactedFromValue(Schema.String))
+}), IssuedTokens = Schema.Struct({
+  access: Schema.Redacted(Schema.String),
+  refresh: Schema.Redacted(Schema.String),
+  lifetimeMs: Schema.Number
+});

package/dist/compat/index.d.ts

@@ -0,0 +1,2 @@
+export { makeCompatLanguageModel, promptWithImageLabels, toChatMessages } from "../llm/compat.js";
+export type { ChatMessageOptions, CompatConfig } from "../llm/compat.js";

package/dist/compat/index.js

@@ -0,0 +1 @@
+export { makeCompatLanguageModel, promptWithImageLabels, toChatMessages } from "../llm/compat.js";

package/dist/conformance/index.d.ts

@@ -0,0 +1,6 @@
+export { authStoreConformance } from "../auth/auth-store.conformance.js";
+export type { AuthStoreConformanceOptions, AuthStoreRefreshProbe } from "../auth/auth-store.conformance.js";
+export { settingsStoreConformance } from "../settings/settings-store.conformance.js";
+export type { SettingsStoreConformanceOptions } from "../settings/settings-store.conformance.js";
+export { modelRequestConformance } from "../transport/model-request.conformance.js";
+export type { ModelRequestSubject } from "../transport/model-request.conformance.js";

package/dist/conformance/index.js

@@ -0,0 +1,3 @@
+export { authStoreConformance } from "../auth/auth-store.conformance.js";
+export { settingsStoreConformance } from "../settings/settings-store.conformance.js";
+export { modelRequestConformance } from "../transport/model-request.conformance.js";

package/dist/index.d.ts

@@ -1,37 +1,37 @@
-export { ANTHROPIC_OAUTH_BETA, beginAnthropicOAuth, CLAUDE_CODE_SYSTEM, exchangeAnthropicCode, generatePkce, parseAuthorizationInput, refreshAnthropicToken, } from "./auth/anthropicOAuth.js";
-export type { AuthRedirect, OAuthBegin, Pkce, RefreshedTokens, TokenRequestOptions } from "./auth/anthropicOAuth.js";
-export { beginOpenAiCodexOAuth, exchangeOpenAiCodexCode, OPENAI_CODEX_CALLBACK_PATH, OPENAI_CODEX_CALLBACK_PORT, OPENAI_CODEX_CLIENT_ID, OPENAI_CODEX_REDIRECT_URI, openAiCodexAccountId, refreshOpenAiCodexToken, } from "./auth/openAiCodexOAuth.js";
+export { beginAnthropicOAuth, exchangeAnthropicCode, parseAuthorizationInput, refreshAnthropicToken } from "./auth/anthropicOAuth.js";
+export type { AuthRedirect, OAuthBegin, RefreshedTokens, TokenRequestOptions } from "./auth/anthropicOAuth.js";
+export { beginOpenAiCodexOAuth, exchangeOpenAiCodexCode, refreshOpenAiCodexToken } from "./auth/openAiCodexOAuth.js";
 export type { OpenAiCodexOAuthBegin, OpenAiCodexTokens } from "./auth/openAiCodexOAuth.js";
-export { authPaths, LocalAuthStoreLive } from "./auth/localAuth.js";
+export { LocalAuthStoreLive } from "./auth/localAuth.js";
 export { MemoryAuthStoreLive } from "./auth/memory-auth.adapter.js";
 export type { MemoryAuthOptions } from "./auth/memory-auth.adapter.js";
-export { CredentialInput, CredentialInputs } from "./auth/credential-input.entity.js";
-export { credentialsOf, toCredential, toCredentialInput } from "./auth/credential-input.entity.functions.js";
+export { AccountId, CredentialInput, CredentialInputs, InstallationId } from "./auth/credential-input.entity.js";
 export { RefreshableProvider } from "./auth/credential-refresh.entity.js";
 export type { OAuthCredential } from "./auth/credential-refresh.entity.js";
 export { isUsableAt, REFRESH_SKEW_MS, refreshCredential } from "./auth/credential-refresh.entity.functions.js";
 export { HostCredentials } from "./ports/host-credentials.port.js";
+export { AuthError, AuthStore, Credential } from "./ports/auth-store.port.js";
+export { EngineSettings, SETTINGS_KEYS, SettingsError, SettingsStore } from "./ports/settings-store.port.js";
+export type { ModelRole, SettingsKey } from "./ports/settings-store.port.js";
 export { LocalSettingsStoreLive } from "./settings/localSettings.js";
 export { MemorySettingsStoreLive } from "./settings/memory-settings.adapter.js";
 export { RoleField, SettingValue } from "./settings/settings-value.entity.js";
 export { applyRole, applySetting, coerceSettingValue, ROLE_FIELDS, roleSelection, settingsFromRecord } from "./settings/settings-value.entity.functions.js";
 export { roleModelView } from "./settings/roleView.js";
-export { fromChatCompletion, makeCompatLanguageModel, promptWithImageLabels, toChatMessages, toChatTools, } from "./llm/compat.js";
-export type { ChatMessageOptions, CompatConfig } from "./llm/compat.js";
-export type { UsageReading } from "./llm/sse.js";
-export { makeOpenAiCodexLanguageModel, OPENAI_CODEX_API_URL, toOpenAiCodexRequestBody } from "./llm/openAiCodex.js";
-export { makeOpenAiCodexWebSocketHttpClient, normalizeOpenAiCodexWebSocketEvent, openAiCodexRefusal, openAiCodexUuidV7, OpenAiCodexWebSocketHttpClient } from "./llm/openAiCodexWebSocket.js";
-export { buildProvider, chatCompletionsUrl, endpointOwnKey, OPENCODE_CHAT_URL, OPENCODE_RESPONSES_API_URL, prependClaudeCode, usesOpenCodeResponses, withAnthropicCacheBreakpoints, } from "./llm/providers.js";
-export { classifyLlmError, LLM_REQUEST_TIMEOUT_MS, MAX_HONORED_RETRY_AFTER_MS, rejectEmptyResponse, retryableLlm, } from "./llm/retry.js";
-export type { ErrorClass } from "./llm/retry.js";
-export { generateWith, LanguageModelLive, LanguageModelSelectionLive } from "./llm/router.js";
-export { configuredModelCatalog, ConfiguredModelCatalogLive, imageInputFor, reasoningEffortsFor, } from "./llm/modelCatalog.js";
+export { makeOpenAiCodexWebSocketHttpClient } from "./llm/openAiCodexWebSocket.js";
+export { LLM_CALL_BUDGET_MS, LLM_REQUEST_TIMEOUT_MS } from "./llm/retry.js";
+export { ModelRetryPolicy, modelRetryDefaults } from "./llm/model-retry-policy.entity.js";
+export { CurrentModelRetryPolicy } from "./ports/model-retry-policy.port.js";
+export { LanguageModelLive, LanguageModelSelectionLive } from "./llm/router.js";
+export { ConfiguredModelCatalogLive, imageInputFor, reasoningEffortsFor } from "./llm/modelCatalog.js";
 export type { ReasoningEffort } from "./llm/modelCatalog.js";
 export { UtilityLlmLive } from "./llm/utilityLlm.js";
 export { modelsPlugin, default } from "./plugin.adapter.js";
 export { CurrentModelEndpoints, ModelEndpoint, ModelEndpoints } from "./ports/model-endpoints.port.js";
 export { ModelsTransport } from "./ports/models-transport.port.js";
 export type { ModelsFetch, WebSocketProxy } from "./ports/models-transport.port.js";
-export { ModelsTransportLive, transportFetch } from "./transport/models-transport.adapter.js";
-export { BUN_WEBSOCKET_PROXY_VERSION, HttpProxyOptions, NODE_WEBSOCKET_PROXY_VERSION, NoProxyRule, PROXY_VARIABLES, ProxyConfig, ProxyEnvironment, ProxyInvalid, ProxyUnsupported, ProxyUrlOption, } from "./transport/http-proxy.entity.js";
-export { bypassesProxy, isLoopback, parseNoProxy, proxyFor, redactCredentials, resolveProxy } from "./transport/http-proxy.entity.functions.js";
+export { ModelsTransportLive } from "./transport/models-transport.adapter.js";
+export { HttpProxyOptions, ProxyInvalid, ProxyUnsupported, ProxyUrlOption } from "./transport/http-proxy.entity.js";
+export { ModelThinking, ModelSettings, ModelSettingsMap, ModelSettingsError } from "./llm/model-settings.entity.js";
+export { PromptCacheSettings } from "./llm/prompt-cache.entity.js";
+export { CurrentModelSettings } from "./ports/model-settings.port.js";