codexgpt 1.0.0

package/dist/auth/requestContext.js

@@ -0,0 +1,34 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { authConfigurationError } from "./errors.js";
+const requestContext = new AsyncLocalStorage();
+export function createOAuthRequestContext(verified) {
+    return Object.freeze({
+        ownerSubject: verified.ownerSubject,
+        ownerRef: verified.ownerRef,
+        clientId: verified.clientId,
+        clientRef: verified.clientRef,
+        resource: verified.resource,
+        bindingId: verified.bindingId,
+        incarnationId: verified.incarnationId,
+        grantId: verified.grantId,
+        grantRevision: verified.grantRevision,
+        scopes: Object.freeze([...verified.scopes]),
+        tokenId: verified.tokenId,
+        tokenFingerprint: verified.fingerprint,
+        expiresAt: verified.expiresAt
+    });
+}
+export function runWithOAuthRequestContext(context, action) {
+    return requestContext.run(context, action);
+}
+export function currentOAuthRequestContext() {
+    const context = requestContext.getStore();
+    if (!context) {
+        throw authConfigurationError("OAUTH_STATE_INVALID", "OAuth request identity is unavailable.");
+    }
+    return context;
+}
+export function maybeOAuthRequestContext() {
+    return requestContext.getStore();
+}
+//# sourceMappingURL=requestContext.js.map

package/dist/auth/requestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.js","sourceRoot":"","sources":["../../src/auth/requestContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAoBrD,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAiC,CAAC;AAE9E,MAAM,UAAU,yBAAyB,CAAC,QAA6B;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,gBAAgB,EAAE,QAAQ,CAAC,WAAW;QACtC,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAI,OAAsC,EAAE,MAAe;IACnG,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,sBAAsB,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC"}

package/dist/auth/resourceMiddleware.js

@@ -0,0 +1,147 @@
+import { applyNoStore } from "../http/securityHeaders.js";
+import { buildBearerChallenge } from "./challenges.js";
+import { AuthConfigurationError } from "./errors.js";
+import { createOAuthRequestContext, runWithOAuthRequestContext } from "./requestContext.js";
+import { OAuthBearerCapacityError } from "./tokenService.js";
+const CONTEXT_LOCAL = "codexgptOAuthRequestContext";
+const ALTERNATE_QUERY_KEYS = new Set(["access_token", "token", "codexgpt_token"]);
+const ALTERNATE_BODY_KEYS = new Set(["access_token", "token", "authorization", "bearer"]);
+function authorizationHeaderCount(req) {
+    let count = 0;
+    for (let index = 0; index < req.rawHeaders.length; index += 2) {
+        if (req.rawHeaders[index]?.toLocaleLowerCase("en-US") === "authorization")
+            count += 1;
+    }
+    return count;
+}
+function hasQueryCredential(req) {
+    const queryIndex = req.originalUrl.indexOf("?");
+    if (queryIndex < 0)
+        return false;
+    let params;
+    try {
+        params = new URLSearchParams(req.originalUrl.slice(queryIndex + 1));
+    }
+    catch {
+        return true;
+    }
+    for (const key of ALTERNATE_QUERY_KEYS)
+        if (params.has(key))
+            return true;
+    return false;
+}
+function hasCookieCredential(req) {
+    const raw = req.headers.cookie;
+    if (typeof raw !== "string")
+        return false;
+    if (Buffer.byteLength(raw, "utf8") > 4096)
+        return true;
+    return raw.split(";").some((part) => {
+        const key = part.trim().split("=", 1)[0]?.toLocaleLowerCase("en-US");
+        return key !== undefined && ALTERNATE_QUERY_KEYS.has(key);
+    });
+}
+function hasBodyCredential(body) {
+    if (!body || Array.isArray(body) || typeof body !== "object")
+        return false;
+    return Object.keys(body)
+        .some((key) => ALTERNATE_BODY_KEYS.has(key.toLocaleLowerCase("en-US")));
+}
+function challenge(res, status, value) {
+    applyNoStore(res);
+    res.setHeader("WWW-Authenticate", value);
+    res.status(status).json({
+        error: status === 401 ? "unauthorized" : "insufficient_scope"
+    });
+}
+function unavailable(res) {
+    applyNoStore(res);
+    res.status(503).json({ error: "temporarily_unavailable" });
+}
+export function createOAuthResourceMiddleware(options) {
+    const missingChallenge = buildBearerChallenge({
+        identity: options.identity,
+        scopes: options.enabledScopes,
+        kind: "missing"
+    });
+    const invalidChallenge = buildBearerChallenge({
+        identity: options.identity,
+        scopes: options.enabledScopes,
+        kind: "invalid_token"
+    });
+    const scopeChallenge = buildBearerChallenge({
+        identity: options.identity,
+        scopes: options.requiredScopes,
+        kind: "insufficient_scope"
+    });
+    const authenticate = async (req, res, next) => {
+        if (hasQueryCredential(req) || hasCookieCredential(req) || authorizationHeaderCount(req) > 1) {
+            challenge(res, 401, invalidChallenge);
+            return;
+        }
+        const raw = req.headers.authorization;
+        if (raw === undefined) {
+            challenge(res, 401, missingChallenge);
+            return;
+        }
+        if (typeof raw !== "string" || Buffer.byteLength(raw, "utf8") > 8192) {
+            challenge(res, 401, invalidChallenge);
+            return;
+        }
+        const match = /^Bearer ([\x21-\x7e]+)$/i.exec(raw);
+        if (!match) {
+            challenge(res, 401, invalidChallenge);
+            return;
+        }
+        try {
+            const verified = await options.tokens.verifyAccessToken(match[1], {
+                isEstablishedSession: options.isEstablishedSession
+                    ? (tokenFingerprint) => options.isEstablishedSession(req, tokenFingerprint)
+                    : undefined
+            });
+            if (options.requiredScopes.some((scope) => !verified.scopes.includes(scope))) {
+                challenge(res, 403, scopeChallenge);
+                return;
+            }
+            const context = createOAuthRequestContext(verified);
+            res.locals[CONTEXT_LOCAL] = context;
+            runWithOAuthRequestContext(context, next);
+        }
+        catch (error) {
+            if (error instanceof OAuthBearerCapacityError ||
+                (error && typeof error === "object" && error.name === "OAuthBearerCapacityError")) {
+                applyNoStore(res);
+                const retryAfter = error && typeof error === "object" &&
+                    Number.isInteger(error.retryAfterSeconds)
+                    ? Number(error.retryAfterSeconds)
+                    : 1;
+                res.setHeader("Retry-After", String(retryAfter));
+                res.status(429).json({ error: "temporarily_unavailable" });
+                return;
+            }
+            if (error instanceof AuthConfigurationError) {
+                unavailable(res);
+                return;
+            }
+            challenge(res, 401, invalidChallenge);
+        }
+    };
+    const rejectBodyCredentials = (req, res, next) => {
+        if (hasBodyCredential(req.body)) {
+            challenge(res, 401, invalidChallenge);
+            return;
+        }
+        next();
+    };
+    return Object.freeze({
+        authenticate,
+        rejectBodyCredentials,
+        context(res) {
+            const context = res.locals[CONTEXT_LOCAL];
+            if (!context)
+                throw new Error("OAuth request context is unavailable.");
+            return context;
+        }
+    });
+}
+//# sourceMappingURL=resourceMiddleware.js.map

package/dist/auth/resourceMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceMiddleware.js","sourceRoot":"","sources":["../../src/auth/resourceMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAA0B,MAAM,mBAAmB,CAAC;AAGrF,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAClF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;AAgB1F,SAAS,wBAAwB,CAAC,GAAY;IAC5C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,eAAe;YAAE,KAAK,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,oBAAoB;QAAE,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrE,OAAO,GAAG,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,IAA+B,CAAC;SAChD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,MAAiB,EAAE,KAAa;IAChE,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACtB,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAa;IAChC,YAAY,CAAC,GAAG,CAAC,CAAC;IAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAuC;IACnF,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,IAAI,EAAE,SAAS;KAChB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,cAAc;QAC9B,IAAI,EAAE,oBAAoB;KAC3B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC5F,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACrE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;oBAChD,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAqB,CAAC,GAAG,EAAE,gBAAgB,CAAC;oBAC5E,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC7E,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YACpD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;YACpC,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,wBAAwB;gBACzC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA4B,CAAC,IAAI,KAAK,0BAA0B,CAAC,EACzG,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;oBACnD,MAAM,CAAC,SAAS,CAAE,KAAyC,CAAC,iBAAiB,CAAC;oBAC9E,CAAC,CAAC,MAAM,CAAE,KAAuC,CAAC,iBAAiB,CAAC;oBACpE,CAAC,CAAC,CAAC,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QACtF,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,qBAAqB;QACrB,OAAO,CAAC,GAAa;YACnB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAA8C,CAAC;YACvF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACvE,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/runtimeStatus.js

@@ -0,0 +1,51 @@
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { AtomicJsonFileStore } from "../transactions/atomicStateFile.js";
+export const OAuthRuntimeStatusV1Schema = z.object({
+    schemaVersion: z.literal(1),
+    profileId: z.string().regex(/^[a-f0-9]{24}$/),
+    canonicalRoot: z.string().min(1).max(32768),
+    bindingId: z.string().regex(/^binding_[a-f0-9]{32}$/),
+    incarnationId: z.string().regex(/^incarnation_[a-f0-9]{32}$/),
+    serverId: z.string().regex(/^[a-f0-9]{32}$/),
+    pid: z.number().int().positive().safe(),
+    processCreationTime: z.string().datetime({ offset: true }),
+    localAdminOrigin: z.string().regex(/^http:\/\/127\.0\.0\.1:\d{1,5}$/),
+    startedAt: z.string().datetime({ offset: true })
+}).strict();
+function runtimeDirectory(oauthStateRoot) {
+    return path.join(path.resolve(oauthStateRoot), "runtime", "profiles");
+}
+export function oauthRuntimeStatusPath(oauthStateRoot, profileId) {
+    if (!/^[a-f0-9]{24}$/.test(profileId))
+        throw new Error("OAUTH_RUNTIME_STATUS_INVALID");
+    return path.join(runtimeDirectory(oauthStateRoot), `${profileId}.json`);
+}
+export function writeOAuthRuntimeStatus(oauthStateRoot, value) {
+    const parsed = OAuthRuntimeStatusV1Schema.parse(value);
+    const filePath = oauthRuntimeStatusPath(oauthStateRoot, parsed.profileId);
+    const store = new AtomicJsonFileStore(path.resolve(oauthStateRoot), OAuthRuntimeStatusV1Schema);
+    store.write(filePath, parsed);
+    return filePath;
+}
+export function readOAuthRuntimeStatus(oauthStateRoot, profileId) {
+    const filePath = oauthRuntimeStatusPath(oauthStateRoot, profileId);
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const store = new AtomicJsonFileStore(path.resolve(oauthStateRoot), OAuthRuntimeStatusV1Schema);
+        return store.read(filePath);
+    }
+    catch {
+        return null;
+    }
+}
+export function removeOAuthRuntimeStatus(oauthStateRoot, profileId, expected) {
+    const current = readOAuthRuntimeStatus(oauthStateRoot, profileId);
+    if (!current || current.pid !== expected.pid || current.serverId !== expected.serverId)
+        return false;
+    fs.rmSync(oauthRuntimeStatusPath(oauthStateRoot, profileId), { force: true });
+    return true;
+}
+//# sourceMappingURL=runtimeStatus.js.map

package/dist/auth/runtimeStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeStatus.js","sourceRoot":"","sources":["../../src/auth/runtimeStatus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAiC,CAAC;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,SAAS,gBAAgB,CAAC,cAAsB;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,cAAsB,EAAE,SAAiB;IAC9E,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,cAAsB,EACtB,KAA2B;IAE3B,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAChG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,cAAsB,EACtB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAChG,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,cAAsB,EACtB,SAAiB,EACjB,QAA2C;IAE3C,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrG,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/schemas.js

@@ -0,0 +1,84 @@
+import { z } from "zod";
+import { authConfigurationError } from "./errors.js";
+import { KNOWN_OAUTH_SCOPES } from "./types.js";
+export const HttpAuthModeSchema = z.enum(["legacy", "oauth"]);
+export const OAuthScopeSchema = z.enum(KNOWN_OAUTH_SCOPES);
+const hostnameSchema = z.string()
+    .min(1)
+    .max(253)
+    .regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))+$/);
+const profileIdSchema = z.string().regex(/^[a-f0-9]{24}$/);
+const opaqueIdSchema = z.string().min(16).max(160).regex(/^[A-Za-z][A-Za-z0-9_-]+$/);
+export const OAuthDeploymentIdentitySchema = z.object({
+    issuer: z.string().url(),
+    resource: z.string().url(),
+    hostname: hostnameSchema,
+    profileId: profileIdSchema,
+    bindingId: opaqueIdSchema,
+    incarnationId: opaqueIdSchema,
+    recoveryEpoch: opaqueIdSchema
+}).strict();
+export const OAuthListenerConfigSchema = z.object({
+    publicHost: z.literal("127.0.0.1"),
+    publicPort: z.number().int().min(1).max(65535),
+    localAdminHost: z.literal("127.0.0.1"),
+    localAdminPort: z.number().int().min(1).max(65535)
+}).strict().superRefine((value, context) => {
+    if (value.publicPort === value.localAdminPort) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["localAdminPort"],
+            message: "The public and local-admin ports must be distinct."
+        });
+    }
+});
+export function parseHttpAuthMode(value, source) {
+    const parsed = HttpAuthModeSchema.safeParse(value.trim());
+    if (!parsed.success) {
+        throw authConfigurationError("AUTH_MODE_INVALID", `${source} must be exactly legacy or oauth.`);
+    }
+    return parsed.data;
+}
+export function assertEnabledOAuthScopes(input) {
+    if (input.length < 1 || input.length > KNOWN_OAUTH_SCOPES.length) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth scopes are outside the supported Core vocabulary.");
+    }
+    const seen = new Set();
+    let previousIndex = -1;
+    for (const raw of input) {
+        const parsed = OAuthScopeSchema.safeParse(raw);
+        if (!parsed.success || seen.has(raw)) {
+            throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth scopes must be known and duplicate-free.");
+        }
+        const index = KNOWN_OAUTH_SCOPES.indexOf(parsed.data);
+        if (index <= previousIndex) {
+            throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth scopes must use read, write, execute order.");
+        }
+        seen.add(raw);
+        previousIndex = index;
+    }
+    if (input[0] !== "codexgpt:read") {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth scope sets must begin with codexgpt:read.");
+    }
+    return Object.isFrozen(input) ? input : Object.freeze([...input]);
+}
+export function createOAuthDeploymentIdentity(input) {
+    const parsed = OAuthDeploymentIdentitySchema.safeParse(input);
+    if (!parsed.success) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth deployment identity is invalid.");
+    }
+    const expectedIssuer = `https://${parsed.data.hostname}`;
+    const expectedResource = `${expectedIssuer}/mcp`;
+    if (parsed.data.issuer !== expectedIssuer || parsed.data.resource !== expectedResource) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth issuer and resource must derive exactly from the saved hostname.");
+    }
+    return Object.freeze({ ...parsed.data });
+}
+export function createOAuthListenerConfig(input) {
+    const parsed = OAuthListenerConfigSchema.safeParse(input);
+    if (!parsed.success) {
+        throw authConfigurationError("OAUTH_DEPLOYMENT_INVALID", "OAuth listener configuration is invalid.");
+    }
+    return Object.freeze({ ...parsed.data });
+}
+//# sourceMappingURL=schemas.js.map

package/dist/auth/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,kBAAkB,EAKnB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAE3D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE;KAC9B,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,wGAAwG,CAAC,CAAC;AACnH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAC3D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,eAAe;IAC1B,SAAS,EAAE,cAAc;IACzB,aAAa,EAAE,cAAc;IAC7B,aAAa,EAAE,cAAc;CAC9B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC9C,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACtC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACnD,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,sBAAsB,CAC1B,mBAAmB,EACnB,GAAG,MAAM,mCAAmC,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,yDAAyD,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,gDAAgD,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,KAAK,IAAI,aAAa,EAAE,CAAC;YAC3B,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,mDAAmD,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,iDAAiD,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAA8B,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAA0B,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAA8B;IAC1E,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,cAAc,GAAG,WAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzD,MAAM,gBAAgB,GAAG,GAAG,cAAc,MAAM,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACvF,MAAM,sBAAsB,CAC1B,0BAA0B,EAC1B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA0B;IAClE,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,sBAAsB,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC"}