@xopcai/xopc 0.0.368 → 0.0.370

package/dist/src/agent/mcp/oauth/mcp-oauth-store.d.ts

@@ -1,12 +0,0 @@
-import type { McpOAuthRecord } from './mcp-oauth-types.js';
-export declare function canonicalMcpServerUrl(input: string | URL): string;
-export declare function mcpOAuthServerKey(input: string | URL): string;
-export declare class McpOAuthStore {
-    private readonly identityScope?;
-    constructor(identityScope?: string);
-    pathFor(serverUrl: string | URL): string;
-    deleteScope(): Promise<void>;
-    load(serverUrlInput: string | URL): Promise<McpOAuthRecord | undefined>;
-    update(serverUrlInput: string | URL, update: (current: McpOAuthRecord | undefined) => McpOAuthRecord | undefined): Promise<McpOAuthRecord | undefined>;
-    delete(serverUrl: string | URL): Promise<void>;
-}

package/dist/src/agent/mcp/oauth/mcp-oauth-store.js

@@ -1,91 +0,0 @@
-import { init_write_file_atomic, writeTextAtomic } from "../../../infra/write-file-atomic.js";
-import { init_paths, resolveMcpOAuthPath } from "../../../config/paths.js";
-import { dirname, join } from "node:path";
-import { createHash } from "node:crypto";
-import { readFile, rm } from "node:fs/promises";
-//#region src/agent/mcp/oauth/mcp-oauth-store.ts
-init_paths();
-init_write_file_atomic();
-const writeTails = /* @__PURE__ */ new Map();
-function canonicalMcpServerUrl(input) {
-	const url = input instanceof URL ? new URL(input) : new URL(input);
-	url.hash = "";
-	return url.toString();
-}
-function mcpOAuthServerKey(input) {
-	return createHash("sha256").update(canonicalMcpServerUrl(input)).digest("hex");
-}
-function isStoredRecord(value, serverUrl) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-	const record = value;
-	if (record.version !== 1 || record.serverUrl !== serverUrl || typeof record.updatedAt !== "string") return false;
-	if (record.tokens !== void 0) {
-		const tokens = record.tokens;
-		if (typeof tokens.access_token !== "string" || typeof tokens.token_type !== "string") return false;
-	}
-	return true;
-}
-async function serializeWrite(key, operation) {
-	const previous = writeTails.get(key) ?? Promise.resolve();
-	let release;
-	const gate = new Promise((resolve) => {
-		release = resolve;
-	});
-	const tail = previous.catch(() => void 0).then(() => gate);
-	writeTails.set(key, tail);
-	await previous.catch(() => void 0);
-	try {
-		return await operation();
-	} finally {
-		release();
-		if (writeTails.get(key) === tail) writeTails.delete(key);
-	}
-}
-var McpOAuthStore = class {
-	constructor(identityScope) {
-		this.identityScope = identityScope;
-	}
-	pathFor(serverUrl) {
-		const endpoint = mcpOAuthServerKey(serverUrl);
-		return this.identityScope ? join(dirname(resolveMcpOAuthPath(endpoint)), createHash("sha256").update(this.identityScope).digest("hex"), `${endpoint}.json`) : resolveMcpOAuthPath(endpoint);
-	}
-	async deleteScope() {
-		if (!this.identityScope) throw new Error("Cannot remove unscoped MCP credentials");
-		await rm(dirname(this.pathFor("https://scope.invalid")), {
-			recursive: true,
-			force: true
-		});
-	}
-	async load(serverUrlInput) {
-		const serverUrl = canonicalMcpServerUrl(serverUrlInput);
-		try {
-			const parsed = JSON.parse(await readFile(this.pathFor(serverUrl), "utf8"));
-			return isStoredRecord(parsed, serverUrl) ? parsed : void 0;
-		} catch {
-			return;
-		}
-	}
-	async update(serverUrlInput, update) {
-		const serverUrl = canonicalMcpServerUrl(serverUrlInput);
-		return serializeWrite(mcpOAuthServerKey(serverUrl), async () => {
-			const next = update(await this.load(serverUrl));
-			if (!next) {
-				await rm(this.pathFor(serverUrl), { force: true });
-				return;
-			}
-			const normalized = {
-				...next,
-				version: 1,
-				serverUrl,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-			};
-			await writeTextAtomic(this.pathFor(serverUrl), JSON.stringify(normalized, null, 2));
-			return normalized;
-		});
-	}
-	async delete(serverUrl) {
-		await this.update(serverUrl, () => void 0);
-	}
-};
-//#endregion
-export { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey };

package/dist/src/agent/mcp/oauth/mcp-oauth-types.d.ts

@@ -1,22 +0,0 @@
-import type { OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
-import type { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-export type McpOAuthRecord = {
-    version: 1;
-    serverUrl: string;
-    clientInformation?: OAuthClientInformationMixed;
-    discoveryState?: OAuthDiscoveryState;
-    tokens?: OAuthTokens;
-    tokensSavedAt?: number;
-    updatedAt: string;
-};
-export type McpOAuthSessionStatus = 'starting' | 'waiting_browser' | 'exchanging_code' | 'connected' | 'failed' | 'expired' | 'cancelled';
-export type McpOAuthSessionSnapshot = {
-    id: string;
-    serverId: string;
-    serverUrl: string;
-    status: McpOAuthSessionStatus;
-    authorizationUrl?: string;
-    error?: string;
-    createdAt: number;
-    expiresAt: number;
-};

package/dist/src/agent/mcp/oauth/mcp-oauth-types.js

@@ -1 +0,0 @@
-export {};

package/dist/src/agent/mcp/plugin-http-fetch.d.ts

@@ -1,2 +0,0 @@
-import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
-export declare function createPluginHttpFetch(endpoint: URL, configuredHeaders: Record<string, string>): FetchLike;

package/dist/src/agent/source-context/mcp-resource-context.d.ts

@@ -1,8 +0,0 @@
-import type { Config } from '../../config/schema.js';
-import type { AgentSourceContext } from './types.js';
-export declare function buildMcpResourceAgentContext(params: {
-    workspaceDir: string;
-    config: Config;
-    sourceId: string;
-    expectedVersion?: string;
-}): Promise<AgentSourceContext | null>;

package/dist/src/agent/source-context/mcp-resource-context.js

@@ -1,30 +0,0 @@
-import { readBundleMcpResourceForGateway } from "../mcp/bundle-mcp-gateway.js";
-//#region src/agent/source-context/mcp-resource-context.ts
-const MAX_MCP_RESOURCE_CONTEXT_CHARS = 96e3;
-async function buildMcpResourceAgentContext(params) {
-	const resolved = await readBundleMcpResourceForGateway({
-		workspaceDir: params.workspaceDir,
-		cfg: params.config,
-		sourceId: params.sourceId
-	}).catch(() => null);
-	if (!resolved || params.expectedVersion && params.expectedVersion !== resolved.resource.version) return null;
-	const snapshot = resolved.contents.contents.map((content) => {
-		if ("text" in content) return content.text;
-		return JSON.stringify({
-			uri: content.uri,
-			mimeType: content.mimeType,
-			binary: true
-		});
-	}).join("\n\n");
-	const text = snapshot.slice(0, MAX_MCP_RESOURCE_CONTEXT_CHARS);
-	return {
-		kind: "mcp_resource",
-		sourceId: params.sourceId,
-		version: resolved.resource.version,
-		title: resolved.resource.title || resolved.resource.name,
-		text,
-		truncated: text.length < snapshot.length
-	};
-}
-//#endregion
-export { buildMcpResourceAgentContext };

package/dist/src/auth/oauth/openai-codex.d.ts

@@ -1,9 +0,0 @@
-/**
- * OpenAI Codex (ChatGPT) OAuth.
- *
- * Owns callback validation, manual prompt handling, and success/error pages.
- */
-import type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './types.js';
-export declare function loginOpenAICodex(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
-export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;
-export declare const openaiCodexOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/openai-codex.js

@@ -1,414 +0,0 @@
-import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
-import { generatePKCE, init_pkce } from "./pkce.js";
-import { randomBytes } from "node:crypto";
-import http from "node:http";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
-//#region src/auth/oauth/openai-codex.ts
-/**
-* OpenAI Codex (ChatGPT) OAuth.
-*
-* Owns callback validation, manual prompt handling, and success/error pages.
-*/
-function requestSignal(signal) {
-	const timeout = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
-	return signal ? AbortSignal.any([signal, timeout]) : timeout;
-}
-function xopcOAuthHtml(params) {
-	const color = params.tone === "success" ? "#2563eb" : "#dc2626";
-	const escapedTitle = escapeHtml(params.title);
-	return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${escapedTitle}</title>
-  <style>
-    :root { color-scheme: light dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #f8fafc; color: #0f172a; }
-    @media (prefers-color-scheme: dark) { body { background: #020617; color: #e2e8f0; } .card { background: #0f172a !important; border-color: #1e293b !important; } .muted { color: #94a3b8 !important; } }
-    .card { width: min(520px, calc(100vw - 32px)); background: white; border: 1px solid #e2e8f0; border-radius: 20px; padding: 28px; box-sizing: border-box; }
-    .brand { display: flex; align-items: center; gap: 12px; margin-bottom: 20px; font-weight: 700; }
-    .logo { width: 36px; height: 36px; border-radius: 12px; display: grid; place-items: center; color: white; background: ${color}; font-weight: 800; letter-spacing: -0.04em; }
-    h1 { font-size: 22px; margin: 0 0 10px; }
-    p { margin: 0; line-height: 1.6; }
-    .muted { color: #64748b; margin-top: 14px; font-size: 14px; }
-  </style>
-</head>
-<body>
-  <main class="card">
-    <div class="brand"><div class="logo">x</div><div>xopc</div></div>
-    <h1>${escapedTitle}</h1>
-    <p>${escapeHtml(params.message)}</p>
-    <p class="muted">You can close this window and return to the terminal.</p>
-  </main>
-</body>
-</html>`;
-}
-function escapeHtml(value) {
-	return value.replace(/[&<>"]/g, (char) => ({
-		"&": "&amp;",
-		"<": "&lt;",
-		">": "&gt;",
-		"\"": "&quot;"
-	})[char] ?? char);
-}
-function createState() {
-	return randomBytes(16).toString("hex");
-}
-function waitForManualPromptDelay(signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) {
-			reject(/* @__PURE__ */ new Error("Login cancelled"));
-			return;
-		}
-		const timeout = setTimeout(() => resolve({ type: "unavailable" }), MANUAL_PROMPT_DELAY_MS);
-		timeout.unref?.();
-		const abort = () => {
-			clearTimeout(timeout);
-			reject(/* @__PURE__ */ new Error("Login cancelled"));
-		};
-		signal?.addEventListener("abort", abort, { once: true });
-	});
-}
-function parseOAuthAuthorizationInput(input) {
-	const trimmed = input.trim();
-	if (!trimmed) return {};
-	try {
-		const url = new URL(trimmed);
-		return {
-			code: url.searchParams.get("code") ?? void 0,
-			state: url.searchParams.get("state") ?? void 0
-		};
-	} catch {}
-	if (trimmed.includes("=")) {
-		const params = new URLSearchParams(trimmed.startsWith("?") ? trimmed.slice(1) : trimmed);
-		return {
-			code: params.get("code") ?? void 0,
-			state: params.get("state") ?? void 0
-		};
-	}
-	return { code: trimmed };
-}
-async function parsePromptedAuthorizationCode(inputPromise, state) {
-	const parsed = parseOAuthAuthorizationInput(await inputPromise);
-	if (parsed.state && parsed.state !== state) throw new Error("State mismatch. Paste the redirect URL from the most recent xopc OAuth login.");
-	if (!parsed.code) throw new Error("Missing authorization code");
-	return parsed.code;
-}
-async function createAuthorizationFlow() {
-	const { verifier, challenge } = await generatePKCE();
-	const state = createState();
-	const url = new URL(AUTHORIZE_URL);
-	url.searchParams.set("response_type", "code");
-	url.searchParams.set("client_id", CLIENT_ID);
-	url.searchParams.set("redirect_uri", REDIRECT_URI);
-	url.searchParams.set("scope", SCOPE);
-	url.searchParams.set("code_challenge", challenge);
-	url.searchParams.set("code_challenge_method", "S256");
-	url.searchParams.set("state", state);
-	url.searchParams.set("id_token_add_organizations", "true");
-	url.searchParams.set("codex_cli_simplified_flow", "true");
-	url.searchParams.set("originator", "xopc");
-	return {
-		verifier,
-		state,
-		url: url.toString()
-	};
-}
-async function startLocalOAuthServer(state) {
-	let settleWait;
-	const waitForCodePromise = new Promise((resolve) => {
-		let settled = false;
-		settleWait = (value) => {
-			if (settled) return;
-			settled = true;
-			resolve(value);
-		};
-	});
-	const server = http.createServer((req, res) => {
-		try {
-			const url = new URL(req.url || "", "http://localhost");
-			res.setHeader("Content-Type", "text/html; charset=utf-8");
-			if (url.pathname !== CALLBACK_PATH) {
-				res.statusCode = 404;
-				res.end(xopcOAuthHtml({
-					title: "Callback route not found",
-					message: "This xopc OAuth callback URL is not valid.",
-					tone: "error"
-				}));
-				return;
-			}
-			const code = url.searchParams.get("code");
-			if (!code) {
-				res.statusCode = 400;
-				res.end(xopcOAuthHtml({
-					title: "Authentication failed",
-					message: "OpenAI did not return an authorization code.",
-					tone: "error"
-				}));
-				return;
-			}
-			if (url.searchParams.get("state") !== state) {
-				res.statusCode = 400;
-				res.end(xopcOAuthHtml({
-					title: "Authentication needs manual confirmation",
-					message: "This callback belongs to a different xopc OAuth attempt. Copy the full URL from the address bar and paste it in the terminal prompt for the latest login.",
-					tone: "error"
-				}));
-				settleWait?.({ type: "unavailable" });
-				return;
-			}
-			res.statusCode = 200;
-			res.end(xopcOAuthHtml({
-				title: "OpenAI authentication complete",
-				message: "xopc received the authorization callback successfully.",
-				tone: "success"
-			}));
-			settleWait?.({
-				type: "code",
-				code
-			});
-		} catch {
-			res.statusCode = 500;
-			res.setHeader("Content-Type", "text/html; charset=utf-8");
-			res.end(xopcOAuthHtml({
-				title: "Authentication failed",
-				message: "xopc could not process the OAuth callback.",
-				tone: "error"
-			}));
-		}
-	});
-	return new Promise((resolve) => {
-		server.listen(CALLBACK_PORT, () => {
-			resolve({
-				available: true,
-				close: () => server.close(),
-				cancelWait: () => settleWait?.({ type: "unavailable" }),
-				waitForCode: () => waitForCodePromise
-			});
-		}).on("error", () => {
-			resolve({
-				available: false,
-				close: () => {},
-				cancelWait: () => settleWait?.({ type: "unavailable" }),
-				waitForCode: async () => ({ type: "unavailable" })
-			});
-		});
-	});
-}
-async function postTokenForm(body, signal) {
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			Accept: "application/json"
-		},
-		body,
-		signal: requestSignal(signal)
-	});
-	const contentType = response.headers.get("content-type") ?? "";
-	const text = await response.text();
-	if (!response.ok) throw new Error(`OpenAI Codex token request failed (${response.status}): ${text || response.statusText}`);
-	if (!contentType.toLowerCase().includes("application/json")) throw new Error(`OpenAI Codex token response was not JSON: ${contentType || "missing content-type"}`);
-	return JSON.parse(text);
-}
-async function exchangeAuthorizationCode(code, verifier, signal, redirectUri = REDIRECT_URI) {
-	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
-		grant_type: "authorization_code",
-		client_id: CLIENT_ID,
-		code,
-		code_verifier: verifier,
-		redirect_uri: redirectUri
-	}), signal));
-}
-async function requestDeviceCode(signal) {
-	const response = await fetch(DEVICE_USER_CODE_URL, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			Accept: "application/json"
-		},
-		body: JSON.stringify({ client_id: CLIENT_ID }),
-		signal: requestSignal(signal)
-	});
-	const body = await response.json().catch(() => ({}));
-	if (!response.ok) {
-		if (response.status === 404) throw new Error("OpenAI Codex device code login is not enabled. Enable it in ChatGPT security or workspace settings, or use browser login.");
-		throw new Error(body.error_description ?? body.error ?? `OpenAI Codex device code request failed (${response.status})`);
-	}
-	if (!body.device_auth_id || !body.user_code) throw new Error("OpenAI Codex device code response is incomplete");
-	const intervalSeconds = Number(body.interval);
-	return {
-		deviceAuthId: body.device_auth_id,
-		userCode: body.user_code,
-		intervalMs: Math.max(1, Number.isFinite(intervalSeconds) ? intervalSeconds : 5) * 1e3
-	};
-}
-async function pollDeviceAuthorization(params) {
-	const expiresAt = Date.now() + DEVICE_AUTH_TIMEOUT_MS;
-	while (Date.now() < expiresAt) {
-		if (params.signal?.aborted) throw params.signal.reason instanceof Error ? params.signal.reason : /* @__PURE__ */ new Error("OpenAI Codex login cancelled");
-		const response = await fetch(DEVICE_TOKEN_URL, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				Accept: "application/json"
-			},
-			body: JSON.stringify({
-				device_auth_id: params.deviceAuthId,
-				user_code: params.userCode
-			}),
-			signal: requestSignal(params.signal)
-		});
-		const body = await response.json().catch(() => ({}));
-		if (response.ok) {
-			if (!body.authorization_code || !body.code_verifier) throw new Error("OpenAI Codex device authorization response is incomplete");
-			return {
-				code: body.authorization_code,
-				verifier: body.code_verifier
-			};
-		}
-		if (response.status !== 403 && response.status !== 404) throw new Error(body.error_description ?? body.error ?? `OpenAI Codex device authorization failed (${response.status})`);
-		const remainingMs = expiresAt - Date.now();
-		await setTimeout$1(Math.min(params.intervalMs, remainingMs), void 0, params.signal ? { signal: params.signal } : void 0);
-	}
-	throw new Error("OpenAI Codex device authorization timed out");
-}
-async function loginOpenAICodexWithDeviceCode(callbacks) {
-	const device = await requestDeviceCode(callbacks.signal);
-	callbacks.onDeviceCode({
-		userCode: device.userCode,
-		verificationUri: DEVICE_VERIFICATION_URL,
-		intervalSeconds: device.intervalMs / 1e3,
-		expiresInSeconds: DEVICE_AUTH_TIMEOUT_MS / 1e3
-	});
-	const authorization = await pollDeviceAuthorization({
-		...device,
-		signal: callbacks.signal
-	});
-	return exchangeAuthorizationCode(authorization.code, authorization.verifier, callbacks.signal, DEVICE_REDIRECT_URI);
-}
-async function refreshAccessToken(refreshToken) {
-	return normalizeTokenResponse(await postTokenForm(new URLSearchParams({
-		grant_type: "refresh_token",
-		client_id: CLIENT_ID,
-		refresh_token: refreshToken
-	})));
-}
-function normalizeTokenResponse(json) {
-	if (!json.access_token || !json.refresh_token || typeof json.expires_in !== "number") {
-		const missing = [
-			!json.access_token ? "access_token" : "",
-			!json.refresh_token ? "refresh_token" : "",
-			typeof json.expires_in !== "number" ? "expires_in" : ""
-		].filter(Boolean).join(", ");
-		throw new Error(`OpenAI Codex token response missing fields: ${missing}`);
-	}
-	const accountId = getAccountId(json.access_token);
-	if (!accountId) throw new Error("Failed to extract accountId from token");
-	return {
-		access: json.access_token,
-		refresh: json.refresh_token,
-		expires: Date.now() + json.expires_in * 1e3,
-		accountId
-	};
-}
-function getAccountId(accessToken) {
-	const [, payload] = accessToken.split(".");
-	if (!payload) return null;
-	try {
-		const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
-		const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
-		const json = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
-		const authClaim = json["https://api.openai.com/auth"];
-		if (authClaim && typeof authClaim === "object") {
-			const accountId = authClaim.chatgpt_account_id;
-			if (typeof accountId === "string" && accountId.length > 0) return accountId;
-		}
-		return typeof json.sub === "string" && json.sub.length > 0 ? json.sub : null;
-	} catch {
-		return null;
-	}
-}
-async function loginOpenAICodexWithBrowser(callbacks) {
-	const { verifier, state, url } = await createAuthorizationFlow();
-	const server = await startLocalOAuthServer(state);
-	try {
-		callbacks.onAuth({
-			url,
-			instructions: server.available ? "A browser window should open. Complete login to finish. If it does not complete automatically, paste the final redirect URL in the terminal." : "Open this URL and paste the final redirect URL in the terminal. xopc could not bind localhost:1455 for the automatic callback."
-		});
-		let code;
-		if (server.available) {
-			const callback = await Promise.race([server.waitForCode(), waitForManualPromptDelay(callbacks.signal)]);
-			if (callback.type === "code") code = callback.code;
-		}
-		if (!code) {
-			const manualCode = parsePromptedAuthorizationCode(callbacks.onManualCodeInput ? callbacks.onManualCodeInput() : callbacks.onPrompt({ message: "Paste the authorization code (or full redirect URL):" }), state).then((value) => {
-				server.cancelWait();
-				return {
-					type: "code",
-					code: value
-				};
-			});
-			const callback = await Promise.race([server.waitForCode(), manualCode]);
-			if (callback.type === "code") code = callback.code;
-		}
-		if (!code) throw new Error("Missing authorization code");
-		return await exchangeAuthorizationCode(code, verifier, callbacks.signal);
-	} finally {
-		server.close();
-	}
-}
-async function loginOpenAICodex(callbacks) {
-	return await callbacks.onSelect({
-		message: "Choose how to authorize OpenAI Codex",
-		options: [{
-			id: "browser",
-			label: "Browser (recommended for this device)"
-		}, {
-			id: "device_code",
-			label: "Device code (remote or headless)"
-		}]
-	}) === "device_code" ? loginOpenAICodexWithDeviceCode(callbacks) : loginOpenAICodexWithBrowser(callbacks);
-}
-async function refreshOpenAICodexToken(refreshToken) {
-	return refreshAccessToken(refreshToken);
-}
-var CLIENT_ID, AUTH_BASE_URL, AUTHORIZE_URL, TOKEN_URL, DEVICE_USER_CODE_URL, DEVICE_TOKEN_URL, DEVICE_VERIFICATION_URL, DEVICE_REDIRECT_URI, CALLBACK_PORT, CALLBACK_PATH, REDIRECT_URI, SCOPE, MANUAL_PROMPT_DELAY_MS, TOKEN_REQUEST_TIMEOUT_MS, DEVICE_AUTH_TIMEOUT_MS, openaiCodexOAuthProvider;
-var init_openai_codex = __esmMin((() => {
-	init_pkce();
-	CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-	AUTH_BASE_URL = "https://auth.openai.com";
-	AUTHORIZE_URL = `${AUTH_BASE_URL}/oauth/authorize`;
-	TOKEN_URL = `${AUTH_BASE_URL}/oauth/token`;
-	DEVICE_USER_CODE_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/usercode`;
-	DEVICE_TOKEN_URL = `${AUTH_BASE_URL}/api/accounts/deviceauth/token`;
-	DEVICE_VERIFICATION_URL = `${AUTH_BASE_URL}/codex/device`;
-	DEVICE_REDIRECT_URI = `${AUTH_BASE_URL}/deviceauth/callback`;
-	CALLBACK_PORT = 1455;
-	CALLBACK_PATH = "/auth/callback";
-	REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
-	SCOPE = "openid profile email offline_access";
-	MANUAL_PROMPT_DELAY_MS = 15e3;
-	TOKEN_REQUEST_TIMEOUT_MS = 3e4;
-	DEVICE_AUTH_TIMEOUT_MS = 15 * 6e4;
-	openaiCodexOAuthProvider = {
-		id: "openai-codex",
-		name: "OpenAI Codex",
-		usesCallbackServer: true,
-		loginMethods: ["browser", "device_code"],
-		async login(callbacks) {
-			return loginOpenAICodex(callbacks);
-		},
-		async refreshToken(credentials) {
-			return refreshOpenAICodexToken(credentials.refresh);
-		},
-		getApiKey(credentials) {
-			return credentials.access;
-		}
-	};
-}));
-//#endregion
-init_openai_codex();
-export { init_openai_codex, loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken };

package/dist/src/browser/policy/approval-store.d.ts

@@ -1,17 +0,0 @@
-import type { BrowserActionInput, BrowserRiskLevel } from '@xopcai/browser-control-contract';
-export type BrowserApprovalStatus = 'pending' | 'approved' | 'denied' | 'consumed' | 'expired';
-export interface BrowserApproval {
-    id: string;
-    conversationId: string;
-    risk: BrowserRiskLevel;
-    action: BrowserActionInput['action'];
-    summary: string;
-    argumentsHash: string;
-    status: BrowserApprovalStatus;
-    createdAt: string;
-    expiresAt: string;
-}
-export declare function createBrowserApproval(conversationId: string, input: BrowserActionInput, risk: BrowserRiskLevel, summary: string): BrowserApproval;
-export declare function listBrowserApprovals(conversationId?: string): BrowserApproval[];
-export declare function decideBrowserApproval(id: string, decision: 'approved' | 'denied'): BrowserApproval | undefined;
-export declare function consumeBrowserApproval(id: string | undefined, conversationId: string, input: BrowserActionInput): boolean;

package/dist/src/browser/policy/approval-store.js

@@ -1,62 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-//#region src/browser/policy/approval-store.ts
-const TTL_MS = 600 * 1e3;
-const approvals = /* @__PURE__ */ new Map();
-function createBrowserApproval(conversationId, input, risk, summary) {
-	expireApprovals();
-	const argumentsHash = browserArgumentsHash(input);
-	const existing = [...approvals.values()].find((approval) => approval.conversationId === conversationId && approval.argumentsHash === argumentsHash && approval.status === "pending");
-	if (existing) return existing;
-	const now = Date.now();
-	const approval = {
-		id: randomUUID(),
-		conversationId,
-		risk,
-		action: input.action,
-		summary,
-		argumentsHash,
-		status: "pending",
-		createdAt: new Date(now).toISOString(),
-		expiresAt: new Date(now + TTL_MS).toISOString()
-	};
-	approvals.set(approval.id, approval);
-	return approval;
-}
-function listBrowserApprovals(conversationId) {
-	expireApprovals();
-	return [...approvals.values()].filter((approval) => !conversationId || approval.conversationId === conversationId).sort((left, right) => right.createdAt.localeCompare(left.createdAt));
-}
-function decideBrowserApproval(id, decision) {
-	expireApprovals();
-	const approval = approvals.get(id);
-	if (!approval || approval.status !== "pending") return approval;
-	approval.status = decision;
-	return approval;
-}
-function consumeBrowserApproval(id, conversationId, input) {
-	expireApprovals();
-	const argumentsHash = browserArgumentsHash(input);
-	const approval = id ? approvals.get(id) : [...approvals.values()].find((candidate) => candidate.conversationId === conversationId && candidate.argumentsHash === argumentsHash && candidate.status === "approved");
-	if (!approval || approval.status !== "approved") return false;
-	if (approval.conversationId !== conversationId || approval.argumentsHash !== argumentsHash) return false;
-	approval.status = "consumed";
-	return true;
-}
-function browserArgumentsHash(input) {
-	const canonical = {
-		...input,
-		approvalId: void 0
-	};
-	return createHash("sha256").update(JSON.stringify(sortRecursively(canonical))).digest("hex");
-}
-function sortRecursively(value) {
-	if (Array.isArray(value)) return value.map(sortRecursively);
-	if (!value || typeof value !== "object") return value;
-	return Object.fromEntries(Object.entries(value).filter(([, child]) => child !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, sortRecursively(child)]));
-}
-function expireApprovals() {
-	const now = Date.now();
-	for (const approval of approvals.values()) if ((approval.status === "pending" || approval.status === "approved") && Date.parse(approval.expiresAt) <= now) approval.status = "expired";
-}
-//#endregion
-export { consumeBrowserApproval, createBrowserApproval, decideBrowserApproval, listBrowserApprovals };