ldrouter 1.16.3 → 1.16.5

package/dist/server/gateway/runner.js

@@ -4,12 +4,14 @@ import { eq } from 'drizzle-orm';
 import { GatewayError } from '../errors.js';
 import { resolveRequestedModel, unwrapAlias } from '../routing/resolver.js';
 import { bareModelName, deriveRequiredCapabilities, describeRejections, firstMissingCapability } from '../routing/capabilities.js';
-import { loadCombo, selectCandidates, orderCandidates, shouldFallback } from '../routing/combo.js';
+import { loadCombo, selectCandidates, orderCandidates, shouldFallback, expandCodexAccountCandidates } from '../routing/combo.js';
+import { listCodexAccountsForProvider, setCodexAccountHealth } from '../db/repositories/codex-accounts.js';
 import { getEffectiveState, isOpen, recordSuccess, recordFailure, halfOpenProbeAllowed } from '../routing/circuit.js';
 import { checkRpm, checkTpm, acquireConcurrent, releaseConcurrent } from '../routing/ratelimit.js';
 import { checkDailyMonthly, consumeUsage } from '../routing/quota.js';
 import { keyAllowedFor } from '../auth/api-key.js';
 import { providerToUpstreamConfig, callUpstreamNonStreaming, callUpstreamStreaming, upstreamUrl, upstreamHttpError } from '../upstream/client.js';
+import { callCodexNonStreaming, callCodexStreaming } from '../providers/codex.js';
 import { canonicalToOpenAIRequest, openAIResponseToCanonical } from '../protocols/canonical.js';
 import { canonicalToAnthropicRequest, anthropicResponseToCanonical } from '../protocols/anthropic.js';
 import { uuid } from '../auth/ids.js';
@@ -129,7 +131,10 @@ export class GatewayRunner {
                     const s = describeRejections({ kind: 'combo', publicModelId: resolved.publicModelId }, rejected);
                     throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
                 }
-                candidates = orderCandidates(comboPlan, filtered);
+                candidates = orderCandidates(comboPlan, filtered).flatMap((candidate) => {
+                    const provider = getDb().select().from(schema.providers).where(eq(schema.providers.id, candidate.providerId)).get();
+                    return provider?.type === 'codex' ? expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(provider.id)) : [candidate];
+                });
                 debugHttp(ctx.requestId, 'CANDIDATES ORDERED', [
                     `mode=${comboPlan.mode}`,
                     ...candidates.map((c, i) => `candidate[${i}]: providerModelId=${c.modelId} publicModelId=${c.publicModelId}`),
@@ -199,7 +204,7 @@ export class GatewayRunner {
                     lastError = new GatewayError('upstream_unavailable', 'Provider circuit is open', { status: 502 });
                     break;
                 }
-                const cfg = providerToUpstreamConfig(provider);
+                const cfg = providerToUpstreamConfig(provider, candidate.codexAccountId);
                 const attemptStart = Date.now();
                 // docs/13 §11–§12: provider/account + upstream request summary
                 const upstreamModel = candidate.publicModelId.split('/').slice(1).join('/');
@@ -212,7 +217,7 @@ export class GatewayRunner {
                     `upstreamType=${cfg.type}`,
                     `baseUrl=${cfg.baseUrl}`,
                     `stream=${req.canonical.stream}`,
-                    `providerKeyFingerprint=${apiKeyFingerprint(cfg.apiKey)}`,
+                    `providerKeyFingerprint=${apiKeyFingerprint(cfg.apiKey ?? '')}`,
                 ]);
                 const attempt = {
                     attemptNumber: i + 1,
@@ -228,7 +233,8 @@ export class GatewayRunner {
                     usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, total: 0 },
                     streamStarted: false,
                     partialResponse: false,
-                    selectionReason: selectionReasons[0] ?? 'direct',
+                    selectionReason: candidate.selectionReason ?? selectionReasons[0] ?? 'direct',
+                    codexAccountId: candidate.codexAccountId,
                     failureReason: null,
                     sanitizedError: null,
                     upstreamRequestId: null,
@@ -261,6 +267,8 @@ export class GatewayRunner {
                     resultToolCalls = out.result.toolCalls;
                     resultFinishReason = out.result.finishReason;
                     recordSuccess(provider.id);
+                    if (candidate.codexAccountId)
+                        setCodexAccountHealth(candidate.codexAccountId, 'healthy');
                     getDb().update(schema.providers).set({ healthState: 'healthy', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
                     attempts.push(attempt);
                     sentToClient = out.streamStarted ?? false;
@@ -294,8 +302,12 @@ export class GatewayRunner {
                     }
                     attempts.push(attempt);
                     lastError = err;
-                    recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
-                    getDb().update(schema.providers).set({ healthState: 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
+                    if (isUpstreamHealthFailure(err)) {
+                        recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
+                        if (candidate.codexAccountId)
+                            setCodexAccountHealth(candidate.codexAccountId, 'down', redactString(err.message));
+                        getDb().update(schema.providers).set({ healthState: 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
+                    }
                     if (shouldRetry && i + 1 < maxAttempts) {
                         metrics.fallbackCount.inc();
                         continue;
@@ -404,6 +416,14 @@ export class GatewayRunner {
             `caps.image_input=${caps.image_input}`,
             `caps.structured_output=${caps.structured_output}`,
         ]);
+        // Codex providers route through their account pool: one candidate per
+        // eligible account, so fallback can move between accounts of the same model.
+        if (p.type === 'codex') {
+            const expanded = expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(p.id));
+            if (expanded.length === 0)
+                return { candidates: [], rejected: reject(m.publicModelId, 'codex_account_unavailable') };
+            return { candidates: expanded, rejected: [] };
+        }
         return { candidates: [candidate], rejected: [] };
     }
     async loadAllModels() {
@@ -433,6 +453,10 @@ export class GatewayRunner {
     }
     async runNonStreamingAttempt(req, candidate, cfg, ctx) {
         const upstreamModel = candidate.publicModelId.split('/').slice(1).join('/');
+        if (cfg.type === 'codex') {
+            const out = await callCodexNonStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel });
+            return { statusCode: out.status, ttftMs: null, upstreamRequestId: out.upstreamRequestId, usage: out.usage, result: { text: out.text, toolCalls: out.toolCalls, finishReason: out.finishReason } };
+        }
         let call;
         if (cfg.type === 'openai') {
             const payload = canonicalToOpenAIRequest(req.canonical, upstreamModel);
@@ -445,7 +469,7 @@ export class GatewayRunner {
             call = await callUpstreamNonStreaming(cfg, upstreamUrl(cfg, '/v1/messages'), payload, ctx.requestId);
         }
         if (!call.ok) {
-            throw upstreamHttpError(call.status, redactString(call.text.slice(0, 300)));
+            throw upstreamHttpError(call.status, redactString(call.text.slice(0, 300)), { status: call.status });
         }
         let parsed;
         try {
@@ -602,6 +626,26 @@ export class GatewayRunner {
             return;
         };
         try {
+            if (cfg.type === 'codex') {
+                const events = [];
+                let firstCodexEvent = true;
+                const meta = await callCodexStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel }, (event) => {
+                    if (event.text || event.isLast) {
+                        events.push(event);
+                        if (event.usage)
+                            Object.assign(usage, event.usage);
+                        chunkHandler({ data: codexStreamEventToClient(req.protocol, event, upstreamModel, ctx.requestId) }, firstCodexEvent);
+                        firstCodexEvent = false;
+                    }
+                });
+                if (!headWritten)
+                    writeHead();
+                pipe.write('data: [DONE]\n\n');
+                pipe.end();
+                if (!usage.total)
+                    usage.total = usage.input + usage.output;
+                return { statusCode: meta.status, ttftMs: events.length ? Date.now() - streamStartTs : null, upstreamRequestId: meta.upstreamRequestId, usage, result: { text: textBuf, toolCalls: toolBuf, finishReason } };
+            }
             const url = cfg.type === 'openai' ? upstreamUrl(cfg, '/v1/chat/completions') : upstreamUrl(cfg, '/v1/messages');
             const payload = cfg.type === 'openai' ? canonicalToOpenAIRequest(req.canonical, upstreamModel) : canonicalToAnthropicRequest(req.canonical, upstreamModel);
             logUpstreamRequest(ctx.requestId, cfg, url, payload, true);
@@ -837,6 +881,7 @@ export class GatewayRunner {
                 attemptNumber: a.attemptNumber,
                 providerId: a.providerId,
                 modelId: a.modelId,
+                codexAccountId: a.codexAccountId ?? null,
                 startedAt: a.startedAt,
                 completedAt: a.completedAt,
                 statusCode: a.statusCode,
@@ -859,7 +904,10 @@ export class GatewayRunner {
         emitRequestLogged(requestId);
     }
 }
-function classifyFailure(err) {
+export function isUpstreamHealthFailure(err) {
+    return ['connection_error', 'connect_timeout', 'first_token_timeout', 'http_status', 'upstream_rate_limit'].includes(classifyFailure(err));
+}
+export function classifyFailure(err) {
     switch (err.type) {
         case 'timeout_error':
             return err.message.includes('first token') ? 'first_token_timeout' : 'connect_timeout';
@@ -867,8 +915,10 @@ function classifyFailure(err) {
             return 'connection_error';
         case 'upstream_rate_limit':
             return 'http_status';
-        case 'upstream_error':
-            return err.status >= 500 ? 'http_status' : 'connection_error';
+        case 'upstream_error': {
+            const upstreamStatus = err.cause?.status;
+            return typeof upstreamStatus === 'number' && upstreamStatus >= 500 && upstreamStatus < 600 ? 'http_status' : 'unknown';
+        }
         default:
             return 'unknown';
     }
@@ -964,6 +1014,21 @@ function safeJsonParse(s) {
 function usageFromCache(u) {
     return u ? { ...u, total: u.input + u.output } : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, total: 0 };
 }
+// Map Codex's native response events to the public protocol stream shape.
+export function codexStreamEventToClient(protocol, event, model, requestId) {
+    if (protocol === 'openai') {
+        return JSON.stringify({
+            id: `chatcmpl-${requestId}`,
+            object: 'chat.completion.chunk',
+            created: Math.floor(Date.now() / 1000),
+            model,
+            choices: [{ index: 0, delta: event.isLast ? {} : { content: event.text }, finish_reason: event.isLast ? 'stop' : null }],
+        });
+    }
+    return JSON.stringify(event.isLast
+        ? { type: 'message_delta', delta: { stop_reason: 'end_turn', stop_sequence: null }, usage: { output_tokens: 0 } }
+        : { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: event.text } });
+}
 // SSE encoders: canonical stream chunk -> client protocol event
 function openaiStreamEncoder(data, _event) {
     if (data === '[DONE]')

package/dist/server/providers/codex-autostart.js

@@ -0,0 +1,98 @@
+// Codex 5-hour window auto-start: pings opted-in accounts the moment their window resets
+// so a fresh 5h window opens immediately. Mirrors 9router's quota auto-ping (codex profile).
+//
+// Ruling: no separate in-memory reset cache. `last_pinged_reset_key` already guarantees one ping
+// per reset minute, and that survives restarts. A cache would add a second, weaker source of truth.
+import { getRawDb } from '../db/index.js';
+import { listCodexAutostartTargets, markCodexAccountPinged, saveCodexUsage, saveCodexUsageError } from '../db/repositories/codex-accounts.js';
+import { withCodexCredentials } from './codex-refresh.js';
+import { CODEX_AUTOSTART_MIN_INTERVAL_MS, fetchCodexUsage, pingCodexAccount } from './codex-usage.js';
+const TICK_MS = 60_000;
+let timer = null;
+let running = false;
+function providerFor(providerId) {
+    return getRawDb().prepare('SELECT id,base_url,total_timeout_ms FROM providers WHERE id=? AND enabled=1').get(providerId) ?? null;
+}
+function accountFor(accountId) {
+    return getRawDb().prepare('SELECT id,chatgpt_account_id FROM codex_accounts WHERE id=?').get(accountId) ?? null;
+}
+/** Reads fresh usage; stores the snapshot or a sanitized reason on failure. */
+export async function refreshStoredCodexUsage(accountId, provider, account) {
+    try {
+        const usage = await withCodexCredentials(accountId, (credentials) => fetchCodexUsage(credentials.accessToken, account.chatgpt_account_id ?? undefined, Math.min(provider.total_timeout_ms, 20_000)));
+        saveCodexUsage(accountId, usage);
+        return usage;
+    }
+    catch (error) {
+        saveCodexUsageError(accountId, error instanceof Error ? error.message : 'Codex usage unavailable');
+        return null;
+    }
+}
+/** Minute-precision reset key: guards against duplicate pings from clock drift. */
+function resetKey(resetAt) {
+    if (!resetAt)
+        return null;
+    const ms = Date.parse(resetAt);
+    return Number.isFinite(ms) ? new Date(Math.floor(ms / 60_000) * 60_000).toISOString() : resetAt;
+}
+/** One account: refresh usage, then ping if the window is exhausted and its reset already passed. */
+export async function runCodexAutostartForAccount(accountId, now = new Date()) {
+    const target = listCodexAutostartTargets().find((row) => row.id === accountId);
+    if (!target)
+        return 'skipped';
+    if (target.lastPingAt && now.getTime() - Date.parse(target.lastPingAt) < CODEX_AUTOSTART_MIN_INTERVAL_MS)
+        return 'skipped';
+    const provider = providerFor(target.providerId);
+    const account = accountFor(accountId);
+    if (!provider || !account)
+        return 'skipped';
+    const usage = await refreshStoredCodexUsage(accountId, provider, account);
+    if (!usage)
+        return 'failed';
+    const session = usage.quotas.session;
+    const key = resetKey(session?.resetAt ?? null);
+    const row = getRawDb().prepare('SELECT last_pinged_reset_key AS k FROM codex_accounts WHERE id=?').get(accountId);
+    if (row?.k && key && row.k === key)
+        return 'skipped';
+    // A blocking (weekly) window that is exhausted means a ping cannot open anything.
+    if (usage.quotas.blocking && usage.quotas.blocking.remaining <= 0)
+        return 'skipped';
+    if (session && session.remaining > 0)
+        return 'skipped';
+    const ok = await withCodexCredentials(accountId, (credentials) => pingCodexAccount({
+        baseUrl: provider.base_url, accountId: account.chatgpt_account_id ?? '', accessToken: credentials.accessToken,
+        accountRecordId: accountId, customHeaders: {}, totalTimeoutMs: Math.min(provider.total_timeout_ms, 120_000),
+    }));
+    if (!ok)
+        return 'failed';
+    markCodexAccountPinged(accountId, session?.resetAt ?? null, key);
+    return 'pinged';
+}
+export async function runCodexAutostartTick() {
+    if (running)
+        return;
+    running = true;
+    try {
+        for (const target of listCodexAutostartTargets()) {
+            try {
+                await runCodexAutostartForAccount(target.id);
+            }
+            catch { /* per-account isolation */ }
+        }
+    }
+    finally {
+        running = false;
+    }
+}
+export function startCodexAutostart() {
+    if (timer)
+        return;
+    timer = setInterval(() => { void runCodexAutostartTick(); }, TICK_MS);
+    timer.unref?.();
+}
+export function stopCodexAutostart() {
+    if (!timer)
+        return;
+    clearInterval(timer);
+    timer = null;
+}

package/dist/server/providers/codex-import.js

@@ -0,0 +1,156 @@
+import { createHash } from 'node:crypto';
+const MAX_INPUT_BYTES = 2_000_000;
+const MAX_RECORDS = 500;
+const MAX_TOKEN_LENGTH = 200_000;
+const FALLBACK_TTL_MS = 10 * 24 * 60 * 60 * 1000;
+const stringValue = (value) => {
+    if (typeof value !== 'string')
+        return null;
+    const result = value.replace(/^\uFEFF/, '').trim();
+    return result || null;
+};
+const firstString = (...values) => {
+    for (const value of values) {
+        const result = stringValue(value);
+        if (result)
+            return result;
+    }
+    return null;
+};
+function objectValue(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function decodeJwt(token) {
+    const part = token.split('.')[1];
+    if (!part)
+        return {};
+    try {
+        const text = Buffer.from(part, 'base64url').toString('utf8');
+        return objectValue(JSON.parse(text)) ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+function parseExpiry(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        const date = new Date(value < 10_000_000_000 ? value * 1000 : value);
+        return Number.isFinite(date.getTime()) ? date.toISOString() : null;
+    }
+    const text = stringValue(value);
+    if (!text)
+        return null;
+    const numeric = Number(text);
+    if (Number.isFinite(numeric) && /^\d+(\.\d+)?$/.test(text) && text.length < 14)
+        return parseExpiry(numeric);
+    const date = new Date(text);
+    return Number.isFinite(date.getTime()) ? date.toISOString() : null;
+}
+function relativeExpiry(value, now) {
+    const numeric = typeof value === 'number' ? value : (typeof value === 'string' && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value) : NaN);
+    if (!Number.isFinite(numeric) || numeric < 0)
+        return null;
+    const timestamp = now.getTime() + numeric * 1000;
+    if (!Number.isFinite(timestamp))
+        return null;
+    const date = new Date(timestamp);
+    return Number.isFinite(date.getTime()) ? date.toISOString() : null;
+}
+function mask(value) {
+    if (!value)
+        return null;
+    if (value.length <= 8)
+        return `${value.slice(0, 2)}…${value.slice(-2)}`;
+    return `${value.slice(0, 4)}…${value.slice(-4)}`;
+}
+function stableIdentity(workspaceId, accountId, accessToken) {
+    if (accountId)
+        return `account:${accountId}`;
+    if (workspaceId)
+        return `workspace:${workspaceId}`;
+    return `token:${createHash('sha256').update(accessToken).digest('hex')}`;
+}
+export function normalizeCodexRecord(input, index, now = new Date(), source) {
+    const raw = objectValue(input);
+    if (!raw)
+        return { index, source, error: 'Record must be a JSON object' };
+    const tokens = objectValue(raw.tokens);
+    const accessToken = firstString(raw.access_token, raw.accessToken, tokens?.access_token, tokens?.accessToken);
+    const refreshToken = firstString(raw.refresh_token, raw.refreshToken, tokens?.refresh_token, tokens?.refreshToken);
+    const idToken = firstString(raw.id_token, raw.idToken, tokens?.id_token, tokens?.idToken);
+    if (!accessToken)
+        return { index, source, error: 'Missing access token' };
+    if (!refreshToken)
+        return { index, source, error: 'Missing refresh token' };
+    if (accessToken.length > MAX_TOKEN_LENGTH || refreshToken.length > MAX_TOKEN_LENGTH || (idToken?.length ?? 0) > MAX_TOKEN_LENGTH)
+        return { index, source, error: 'Token exceeds maximum length' };
+    const accessClaims = decodeJwt(accessToken);
+    const idClaims = idToken ? decodeJwt(idToken) : {};
+    const accessAuth = objectValue(accessClaims['https://api.openai.com/auth']) ?? {};
+    const idAuth = objectValue(idClaims['https://api.openai.com/auth']) ?? {};
+    const accessProfile = objectValue(accessClaims['https://api.openai.com/profile']) ?? {};
+    const idProfile = objectValue(idClaims['https://api.openai.com/profile']) ?? {};
+    const auth = { ...idAuth, ...accessAuth };
+    const profile = { ...idProfile, ...accessProfile };
+    const email = firstString(profile.email, accessClaims.email, idClaims.email, raw.email);
+    const chatgptAccountId = firstString(auth.chatgpt_account_id, auth.account_id, raw.chatgpt_account_id, raw.chatgptAccountId, raw.account_id, raw.accountId);
+    const workspaceId = firstString(raw.workspace_id, raw.workspaceId, raw.organization_id, raw.organizationId, auth.workspace_id, auth.workspaceId);
+    const planType = firstString(auth.chatgpt_plan_type, auth.plan_type, raw.chatgpt_plan_type, raw.plan_type, raw.planType);
+    const explicitExpiryKey = ['expired', 'expires_at', 'expiresAt'].find((key) => Object.prototype.hasOwnProperty.call(raw, key));
+    const expiresAt = explicitExpiryKey
+        ? parseExpiry(raw[explicitExpiryKey])
+        : parseExpiry(accessClaims.exp) ?? parseExpiry(idClaims.exp) ?? (raw.expires_in !== undefined ? relativeExpiry(raw.expires_in, now) : null);
+    if (explicitExpiryKey && !expiresAt)
+        return { index, source, error: 'Invalid explicit expiry' };
+    if (!explicitExpiryKey && raw.expires_in !== undefined && !expiresAt)
+        return { index, source, error: 'Invalid relative expiry' };
+    const resolvedExpiresAt = expiresAt ?? new Date(now.getTime() + FALLBACK_TTL_MS).toISOString();
+    return { index, source, email, workspaceId, chatgptAccountId, planType, expiresAt: resolvedExpiresAt, accessToken, refreshToken, idToken, identity: stableIdentity(workspaceId, chatgptAccountId, accessToken) };
+}
+function expandRoot(value) {
+    const root = objectValue(value);
+    if (Array.isArray(value))
+        return value;
+    if (root && Array.isArray(root.accounts))
+        return root.accounts;
+    return [value];
+}
+export function parseCodexImportText(text, source, now = new Date()) {
+    if (Buffer.byteLength(text, 'utf8') > MAX_INPUT_BYTES)
+        return [{ index: 0, source, error: 'Input exceeds maximum size' }];
+    const cleaned = text.replace(/^\uFEFF/, '').trim();
+    if (!cleaned)
+        return [{ index: 0, source, error: 'Input is empty' }];
+    let roots;
+    try {
+        roots = expandRoot(JSON.parse(cleaned));
+    }
+    catch {
+        const lines = cleaned.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+        if (lines.length <= 1)
+            return [{ index: 0, source, error: 'Malformed JSON input' }];
+        roots = lines.map((line) => { try {
+            return JSON.parse(line);
+        }
+        catch {
+            return Symbol('malformed');
+        } });
+    }
+    const results = [];
+    for (const root of roots) {
+        for (const item of expandRoot(root)) {
+            if (results.length >= MAX_RECORDS) {
+                results.push({ index: results.length, source, error: 'Input exceeds maximum record count' });
+                return results;
+            }
+            results.push(normalizeCodexRecord(item, results.length, now, source));
+        }
+    }
+    return results;
+}
+export function toCodexPreview(record, duplicateOf = null) {
+    return { index: record.index, source: record.source, valid: true, email: record.email, accountIdMasked: mask(record.chatgptAccountId), workspaceIdMasked: mask(record.workspaceId), planType: record.planType, expiresAt: record.expiresAt, duplicateOf };
+}
+export function toCodexImportResult(records, failures = []) {
+    return { records: records.map((record) => toCodexPreview(record)), failures: failures.map(({ index, source }) => ({ index, source, error: 'Invalid record' })) };
+}

package/dist/server/providers/codex-oauth.js

@@ -0,0 +1,77 @@
+// Codex OAuth (PKCE) authorization-code flow, mirroring the Codex CLI client:
+// fixed loopback port, S256 challenge, and a form-encoded token exchange.
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { normalizeCodexRecord } from './codex-import.js';
+export const CODEX_OAUTH = {
+    clientId: 'app_EMoamEEZ73f0CkXaXp7hrann',
+    authorizeUrl: 'https://auth.openai.com/oauth/authorize',
+    tokenUrl: 'https://auth.openai.com/oauth/token',
+    scope: 'openid profile email offline_access',
+    codeChallengeMethod: 'S256',
+    /** Codex CLI registers http://localhost:1455/auth/callback, so the port is not negotiable. */
+    callbackUrl: 'http://localhost:1455/auth/callback',
+};
+/** Server-side auth URL: challenge always derives from the verifier the exchange will use. */
+export function buildCodexAuthorizeUrl(verifier, state) {
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: CODEX_OAUTH.clientId,
+        redirect_uri: CODEX_OAUTH.callbackUrl,
+        scope: CODEX_OAUTH.scope,
+        code_challenge: challenge,
+        code_challenge_method: CODEX_OAUTH.codeChallengeMethod,
+        id_token_add_organizations: 'true',
+        codex_cli_simplified_flow: 'true',
+        originator: 'codex_cli_rs',
+        state,
+    });
+    return `${CODEX_OAUTH.authorizeUrl}?${params.toString()}`;
+}
+export function newCodexPkce() {
+    return { verifier: randomBytes(64).toString('base64url'), state: randomUUID().replace(/-/g, '') };
+}
+/** The browser lands on the loopback redirect; operators may paste that URL or just its code. */
+export function extractCodeFromCallback(input) {
+    const text = input.trim();
+    if (!text)
+        return null;
+    try {
+        const code = new URL(text).searchParams.get('code');
+        if (code)
+            return code;
+    }
+    catch { /* not a URL — fall through to the bare-code case */ }
+    return /^[\w.~-]{8,}$/.test(text) ? text : null;
+}
+/** Exchanges the authorization code for tokens; never echoes the code or token values. */
+export async function exchangeCodexCode({ code, verifier, fetchImpl = fetch, timeoutMs = 30_000 }) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(CODEX_OAUTH.tokenUrl, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: CODEX_OAUTH.callbackUrl,
+                client_id: CODEX_OAUTH.clientId,
+                code_verifier: verifier,
+            }),
+            signal: controller.signal,
+        });
+        const body = await response.json().catch(() => null);
+        if (!response.ok || !body) {
+            // Deliberately generic: provider error bodies can echo the authorization code.
+            throw Object.assign(new Error(`Codex authorization failed (HTTP ${response.status})`), { status: response.status });
+        }
+        const record = normalizeCodexRecord(body, 0, new Date(), 'oauth');
+        if ('error' in record)
+            throw new Error('Codex token response did not contain usable credentials');
+        return record;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}