@agimon-ai/po-core 0.0.0-alpha.2 → 0.0.0-alpha.21

package/dist/src/services/chatgptAuth/index.d.mts

@@ -1,4 +1,3 @@
-import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 //#region src/services/chatgptAuth/index.d.ts
 /** The one ChatGPT sign-in every Po feature shares; separate from Pi's `openai-codex` model login. */
 export declare const CHATGPT_AUTH_PROVIDER_ID = "po-chatgpt";
@@ -20,22 +19,5 @@ export declare function chatgptCredentials(source: ChatgptAuthSource, loginMessa
   token: string;
   accountId: string;
 }>;
-/** Adds the shared sign-in to a Pi model runtime: its Providers row, /login entry, refresh and storage. */
-export declare function registerChatgptAuthProvider(runtime: Pick<ModelRuntime, 'registerProvider'>): void;
-/**
- * Reads the shared sign-in outside a session (Voice runs at the hub). It opens the same auth.json
- * a session uses; Pi's file lock keeps refreshes from different runtimes from racing.
- */
-export declare function createChatgptAuthReader(options: {
-  environment?: Readonly<Record<string, string | undefined>>;
-  homeDirectory?: string;
-}): {
-  /** Whether the shared sign-in exists on disk. No network call; the same check `credentials` runs first. */
-  signedIn(signal?: AbortSignal): Promise<boolean>;
-  credentials(loginMessage: string, signal?: AbortSignal): Promise<{
-    token: string;
-    accountId: string;
-  }>;
-};
 //#endregion
 //# sourceMappingURL=index.d.mts.map

package/dist/src/services/chatgptAuth/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/chatgptAuth/index.ts"],"mappings":";;;qBAca;qBACA;qBACA;;iBAoBI;EACf;EACA,QAAQ,SAAS,cAAc;IAAU;MAAQ;;;;;wBAQ7B,gBAAgB,UAAU,UAAU,eAAe,SAAS,cAAc;;wBAmC1E,mBACpB,QAAQ,mBACR,sBACA,SAAS,cACR;EAAU;EAAe;;;wBAsKZ,4BAA4B,SAAS,KAAK;;;;;wBAQ1C,wBAAwB;EACtC,cAAc,SAAS;EACvB;;;EAgCQ,SAAQ,SAAU,cAAc;EAGhC,YAAW,sBAAqB,SAAW,cAAc;IAAU;IAAe"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../src/services/chatgptAuth/index.ts"],"mappings":";;qBAMa;qBACA;qBACA;;iBAGI;EACf;EACA,QAAQ,SAAS,cAAc;IAAU;MAAQ;;;;;wBAQ7B,gBAAgB,UAAU,UAAU,eAAe,SAAS,cAAc;;wBAmC1E,mBACpB,QAAQ,mBACR,sBACA,SAAS,cACR;EAAU;EAAe"}

package/dist/src/services/chatgptAuth/index.mjs

@@ -1,25 +1,8 @@
-import { modelConfigDirectory, piAgentDirectory } from "../../../runtimePiSettings.mjs";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import path from "node:path";
-import { createServer } from "node:http";
-import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 //#region src/services/chatgptAuth/index.ts
 /** The one ChatGPT sign-in every Po feature shares; separate from Pi's `openai-codex` model login. */
 const CHATGPT_AUTH_PROVIDER_ID = "po-chatgpt";
 const CHATGPT_AUTH_PROVIDER_NAME = "ChatGPT for Po features";
 const CHATGPT_SIGN_IN_HINT = `Sign in to ${CHATGPT_AUTH_PROVIDER_NAME} under Settings > Providers, or with /login.`;
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const AUTH_ORIGIN = "https://auth.openai.com";
-const TOKEN_URL = `${AUTH_ORIGIN}/oauth/token`;
-/** Realtime voice needs the connector scopes that Pi's own ChatGPT login does not request. */
-const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
-const CALLBACK_HOST = "127.0.0.1";
-const CALLBACK_PORT = 1455;
-const CALLBACK_PATH = "/auth/callback";
-/** The redirect registered for this OAuth client; the browser reaches the listener through localhost. */
-const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
-const MAX_TOKEN_RESPONSE_BYTES = 1048576;
-const TOKEN_TIMEOUT_MS = 3e4;
 function record(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -74,206 +57,7 @@ async function chatgptCredentials(source, loginMessage, signal) {
 		accountId
 	};
 }
-async function requestTokens(body, previousRefresh, signal) {
-	const bounded = AbortSignal.any([AbortSignal.timeout(TOKEN_TIMEOUT_MS), ...signal ? [signal] : []]);
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		headers: { "content-type": "application/x-www-form-urlencoded" },
-		body,
-		redirect: "error",
-		signal: bounded
-	});
-	if (!response.ok) {
-		await response.body?.cancel().catch(() => void 0);
-		throw new Error(`ChatGPT sign-in was rejected (HTTP ${response.status}). Sign in again.`);
-	}
-	const json = await readBoundedJson(response, MAX_TOKEN_RESPONSE_BYTES, bounded);
-	const access = record(json) ? json.access_token : void 0;
-	const refresh = record(json) ? json.refresh_token ?? previousRefresh : void 0;
-	const expiresIn = record(json) ? json.expires_in : void 0;
-	if (typeof access !== "string" || typeof refresh !== "string" || typeof expiresIn !== "number" || expiresIn <= 0) throw new Error("ChatGPT sign-in returned an invalid token response.");
-	const accountId = accountIdOf(access);
-	if (!accountId) throw new Error("ChatGPT sign-in did not include a ChatGPT account.");
-	return {
-		access,
-		refresh,
-		expires: Date.now() + expiresIn * 1e3,
-		accountId
-	};
-}
-function sameState(supplied, expected) {
-	const left = Buffer.from(supplied ?? "");
-	const right = Buffer.from(expected);
-	return left.length === right.length && timingSafeEqual(left, right);
-}
-/** The authorization code from a redirect URL; pasted input must carry the expected state. */
-function codeFromRedirect(url, state) {
-	for (const name of [
-		"state",
-		"code",
-		"error"
-	]) if (url.searchParams.getAll(name).length > 1) throw new Error("The sign-in address is invalid.");
-	if (!sameState(url.searchParams.get("state"), state)) throw new Error("The sign-in address does not match this attempt.");
-	if (url.searchParams.get("error")) throw new Error("ChatGPT sign-in was declined.");
-	const code = url.searchParams.get("code");
-	if (!code || code.trim() !== code) throw new Error("The sign-in address has no authorization code.");
-	return code;
-}
-/** Listens for the browser redirect on the registered loopback port; rejects when the port is taken. */
-async function listenForCode(state, signal) {
-	const server = createServer();
-	let resolveCode;
-	let rejectCode;
-	const code = new Promise((resolve, reject) => {
-		resolveCode = resolve;
-		rejectCode = reject;
-	});
-	code.catch(() => void 0);
-	server.on("request", (request, response) => {
-		const reply = (status, text) => {
-			response.writeHead(status, {
-				"content-type": "text/plain; charset=utf-8",
-				"cache-control": "no-store"
-			});
-			response.end(text);
-		};
-		const url = new URL(request.url ?? "/", REDIRECT_URI);
-		if (request.method !== "GET" || url.pathname !== CALLBACK_PATH) return reply(404, "Not found.");
-		try {
-			resolveCode(codeFromRedirect(url, state));
-			reply(200, "Signed in. You can close this page.");
-		} catch (error) {
-			if (sameState(url.searchParams.get("state"), state)) rejectCode(error);
-			reply(400, "Sign-in could not be completed.");
-		}
-	});
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen({
-			host: CALLBACK_HOST,
-			port: CALLBACK_PORT,
-			exclusive: true
-		}, () => {
-			server.off("error", reject);
-			resolve();
-		});
-	});
-	const close = () => {
-		server.close();
-		server.closeAllConnections();
-	};
-	signal?.addEventListener("abort", close, { once: true });
-	return {
-		code,
-		close
-	};
-}
-async function login(callbacks) {
-	const { signal } = callbacks;
-	const verifier = randomBytes(64).toString("base64url");
-	const state = randomBytes(32).toString("base64url");
-	const authorize = new URL(`${AUTH_ORIGIN}/oauth/authorize`);
-	authorize.search = new URLSearchParams({
-		response_type: "code",
-		client_id: CLIENT_ID,
-		redirect_uri: REDIRECT_URI,
-		scope: SCOPE,
-		code_challenge: createHash("sha256").update(verifier).digest("base64url"),
-		code_challenge_method: "S256",
-		id_token_add_organizations: "true",
-		state
-	}).toString();
-	const callback = await listenForCode(state, signal).catch(() => void 0);
-	try {
-		callbacks.onAuth({
-			url: authorize.toString(),
-			instructions: "Sign in in your browser. If it does not return here, paste the address it lands on."
-		});
-		const pasted = (callbacks.onManualCodeInput?.() ?? callbacks.onPrompt({
-			message: "Paste the address your browser lands on",
-			placeholder: REDIRECT_URI
-		})).then((input) => {
-			if (!URL.canParse(input.trim())) throw new Error("Paste the full address from your browser.");
-			return codeFromRedirect(new URL(input.trim()), state);
-		});
-		const code = await (callback ? Promise.race([callback.code, pasted]) : pasted);
-		signal?.throwIfAborted();
-		return await requestTokens(new URLSearchParams({
-			grant_type: "authorization_code",
-			client_id: CLIENT_ID,
-			code,
-			code_verifier: verifier,
-			redirect_uri: REDIRECT_URI
-		}), void 0, signal);
-	} finally {
-		callback?.close();
-	}
-}
-const chatgptAuthProvider = {
-	name: CHATGPT_AUTH_PROVIDER_NAME,
-	oauth: {
-		name: CHATGPT_AUTH_PROVIDER_NAME,
-		isSubscription: true,
-		login,
-		refreshToken: (credentials, signal) => requestTokens(new URLSearchParams({
-			grant_type: "refresh_token",
-			client_id: CLIENT_ID,
-			refresh_token: credentials.refresh
-		}), credentials.refresh, signal),
-		getApiKey: (credentials) => credentials.access
-	}
-};
-/** Adds the shared sign-in to a Pi model runtime: its Providers row, /login entry, refresh and storage. */
-function registerChatgptAuthProvider(runtime) {
-	runtime.registerProvider(CHATGPT_AUTH_PROVIDER_ID, chatgptAuthProvider);
-}
-/**
-* Reads the shared sign-in outside a session (Voice runs at the hub). It opens the same auth.json
-* a session uses; Pi's file lock keeps refreshes from different runtimes from racing.
-*/
-function createChatgptAuthReader(options) {
-	let loading;
-	const runtime = () => {
-		loading ??= (async () => {
-			const agentDirectory = piAgentDirectory(options.environment, options.homeDirectory);
-			const directory = modelConfigDirectory(agentDirectory, options.homeDirectory);
-			const created = await ModelRuntime.create({
-				authPath: path.join(directory, "auth.json"),
-				modelsPath: path.join(directory, "models.json"),
-				refreshOnCreate: false
-			});
-			registerChatgptAuthProvider(created);
-			return created;
-		})().catch((error) => {
-			loading = void 0;
-			throw error;
-		});
-		return loading;
-	};
-	const fresh = async (signal) => {
-		const current = await runtime();
-		await current.refresh({
-			allowNetwork: false,
-			providers: [CHATGPT_AUTH_PROVIDER_ID],
-			...signal ? { signal } : {}
-		});
-		return current;
-	};
-	return {
-		/** Whether the shared sign-in exists on disk. No network call; the same check `credentials` runs first. */
-		async signedIn(signal) {
-			return (await fresh(signal)).isUsingSubscription(CHATGPT_AUTH_PROVIDER_ID);
-		},
-		async credentials(loginMessage, signal) {
-			const current = await fresh(signal);
-			return chatgptCredentials({
-				available: () => current.isUsingSubscription(CHATGPT_AUTH_PROVIDER_ID),
-				getAuth: (authSignal) => current.getAuth(CHATGPT_AUTH_PROVIDER_ID, authSignal ? { signal: authSignal } : {})
-			}, loginMessage, signal);
-		}
-	};
-}
 //#endregion
-export { CHATGPT_AUTH_PROVIDER_ID, CHATGPT_AUTH_PROVIDER_NAME, CHATGPT_SIGN_IN_HINT, chatgptCredentials, createChatgptAuthReader, readBoundedJson, registerChatgptAuthProvider };
+export { CHATGPT_AUTH_PROVIDER_ID, CHATGPT_AUTH_PROVIDER_NAME, CHATGPT_SIGN_IN_HINT, accountIdOf, chatgptCredentials, readBoundedJson };
 
 //# sourceMappingURL=index.mjs.map

package/dist/src/services/chatgptAuth/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/chatgptAuth/index.ts"],"sourcesContent":["/*\n * Portions of this file are adapted from OpenAI Codex at commit 5ecb3afd1b, by way of po-voice.\n * Copyright OpenAI. Licensed under the Apache License, Version 2.0.\n */\n\nimport { createHash, randomBytes, timingSafeEqual } from 'node:crypto';\nimport { createServer } from 'node:http';\nimport path from 'node:path';\n\nimport { ModelRuntime, type ProviderConfig } from '@earendil-works/pi-coding-agent';\n\nimport { modelConfigDirectory, piAgentDirectory } from '../piSettings';\n\n/** The one ChatGPT sign-in every Po feature shares; separate from Pi's `openai-codex` model login. */\nexport const CHATGPT_AUTH_PROVIDER_ID = 'po-chatgpt';\nexport const CHATGPT_AUTH_PROVIDER_NAME = 'ChatGPT for Po features';\nexport const CHATGPT_SIGN_IN_HINT = `Sign in to ${CHATGPT_AUTH_PROVIDER_NAME} under Settings > Providers, or with /login.`;\n\nconst CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';\nconst AUTH_ORIGIN = 'https://auth.openai.com';\nconst TOKEN_URL = `${AUTH_ORIGIN}/oauth/token`;\n/** Realtime voice needs the connector scopes that Pi's own ChatGPT login does not request. */\nconst SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';\nconst CALLBACK_HOST = '127.0.0.1';\nconst CALLBACK_PORT = 1455;\nconst CALLBACK_PATH = '/auth/callback';\n/** The redirect registered for this OAuth client; the browser reaches the listener through localhost. */\nconst REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;\nconst MAX_TOKEN_RESPONSE_BYTES = 1024 * 1024;\nconst TOKEN_TIMEOUT_MS = 30_000;\n\ntype ChatgptOAuth = NonNullable<ProviderConfig['oauth']>;\ntype LoginCallbacks = Parameters<ChatgptOAuth['login']>[0];\ntype OAuthCredentials = Awaited<ReturnType<ChatgptOAuth['login']>>;\n\n/** Where a feature reads the shared sign-in: a session's or the hub's Pi model runtime. */\nexport interface ChatgptAuthSource {\n  available(): boolean;\n  getAuth(signal?: AbortSignal): Promise<{ auth: { apiKey?: string } } | undefined>;\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** Reads a JSON body without buffering more than `limit` bytes. Errors are generic; callers map them. */\nexport async function readBoundedJson(response: Response, limit: number, signal?: AbortSignal): Promise<unknown> {\n  if (!response.body) throw new Error('Response has no body.');\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    while (true) {\n      signal?.throwIfAborted();\n      const { value, done } = await reader.read();\n      if (done) break;\n      length += value.length;\n      if (length > limit) throw new Error('Response body is too large.');\n      chunks.push(value);\n    }\n    signal?.throwIfAborted();\n    return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown;\n  } finally {\n    await reader.cancel().catch(() => undefined); // Response cleanup never replaces the operation error.\n    reader.releaseLock();\n  }\n}\n\n/** The ChatGPT account claim of an access token, or undefined when it is missing or malformed. */\nfunction accountIdOf(token: string): string | undefined {\n  try {\n    const payload: unknown = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'));\n    const auth = record(payload) ? payload['https://api.openai.com/auth'] : undefined;\n    const id = record(auth) ? auth.chatgpt_account_id : undefined;\n    return typeof id === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(id) ? id : undefined;\n  } catch {\n    return undefined; // Documented fallback: a malformed token has no account, which callers treat as signed out.\n  }\n}\n\n/** Resolves the subscription token and account claim; every failure becomes `loginMessage` unless aborted. */\nexport async function chatgptCredentials(\n  source: ChatgptAuthSource,\n  loginMessage: string,\n  signal?: AbortSignal,\n): Promise<{ token: string; accountId: string }> {\n  if (!source.available()) throw new Error(loginMessage);\n  let token: string | undefined;\n  try {\n    token = (await source.getAuth(signal))?.auth.apiKey;\n  } catch {\n    signal?.throwIfAborted();\n    throw new Error(loginMessage);\n  }\n  signal?.throwIfAborted();\n  const accountId = token ? accountIdOf(token) : undefined;\n  if (!token || !accountId) throw new Error(loginMessage);\n  return { token, accountId };\n}\n\nasync function requestTokens(\n  body: URLSearchParams,\n  previousRefresh: string | undefined,\n  signal: AbortSignal | undefined,\n): Promise<OAuthCredentials> {\n  const bounded = AbortSignal.any([AbortSignal.timeout(TOKEN_TIMEOUT_MS), ...(signal ? [signal] : [])]);\n  const response = await fetch(TOKEN_URL, {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body,\n    redirect: 'error',\n    signal: bounded,\n  });\n  if (!response.ok) {\n    await response.body?.cancel().catch(() => undefined); // The body may echo tokens; it is never read.\n    throw new Error(`ChatGPT sign-in was rejected (HTTP ${response.status}). Sign in again.`);\n  }\n  const json = await readBoundedJson(response, MAX_TOKEN_RESPONSE_BYTES, bounded);\n  const access = record(json) ? json.access_token : undefined;\n  const refresh = record(json) ? (json.refresh_token ?? previousRefresh) : undefined;\n  const expiresIn = record(json) ? json.expires_in : undefined;\n  if (typeof access !== 'string' || typeof refresh !== 'string' || typeof expiresIn !== 'number' || expiresIn <= 0)\n    throw new Error('ChatGPT sign-in returned an invalid token response.');\n  const accountId = accountIdOf(access);\n  if (!accountId) throw new Error('ChatGPT sign-in did not include a ChatGPT account.');\n  return { access, refresh, expires: Date.now() + expiresIn * 1000, accountId };\n}\n\nfunction sameState(supplied: string | null, expected: string): boolean {\n  const left = Buffer.from(supplied ?? '');\n  const right = Buffer.from(expected);\n  return left.length === right.length && timingSafeEqual(left, right);\n}\n\n/** The authorization code from a redirect URL; pasted input must carry the expected state. */\nfunction codeFromRedirect(url: URL, state: string): string {\n  for (const name of ['state', 'code', 'error'])\n    if (url.searchParams.getAll(name).length > 1) throw new Error('The sign-in address is invalid.');\n  if (!sameState(url.searchParams.get('state'), state))\n    throw new Error('The sign-in address does not match this attempt.');\n  if (url.searchParams.get('error')) throw new Error('ChatGPT sign-in was declined.');\n  const code = url.searchParams.get('code');\n  if (!code || code.trim() !== code) throw new Error('The sign-in address has no authorization code.');\n  return code;\n}\n\n/** Listens for the browser redirect on the registered loopback port; rejects when the port is taken. */\nasync function listenForCode(state: string, signal: AbortSignal | undefined) {\n  const server = createServer();\n  let resolveCode!: (code: string) => void;\n  let rejectCode!: (error: Error) => void;\n  const code = new Promise<string>((resolve, reject) => {\n    resolveCode = resolve;\n    rejectCode = reject;\n  });\n  code.catch(() => undefined); // Observed by the caller's race; never an unhandled rejection.\n  server.on('request', (request, response) => {\n    const reply = (status: number, text: string): void => {\n      response.writeHead(status, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' });\n      response.end(text);\n    };\n    const url = new URL(request.url ?? '/', REDIRECT_URI);\n    if (request.method !== 'GET' || url.pathname !== CALLBACK_PATH) return reply(404, 'Not found.');\n    try {\n      resolveCode(codeFromRedirect(url, state));\n      reply(200, 'Signed in. You can close this page.');\n    } catch (error) {\n      // A stray or forged request must not end the attempt; only a matching declined redirect does.\n      if (sameState(url.searchParams.get('state'), state)) rejectCode(error as Error);\n      reply(400, 'Sign-in could not be completed.');\n    }\n  });\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject);\n    server.listen({ host: CALLBACK_HOST, port: CALLBACK_PORT, exclusive: true }, () => {\n      server.off('error', reject);\n      resolve();\n    });\n  });\n  const close = (): void => {\n    server.close();\n    server.closeAllConnections();\n  };\n  signal?.addEventListener('abort', close, { once: true });\n  return { code, close };\n}\n\nasync function login(callbacks: LoginCallbacks): Promise<OAuthCredentials> {\n  const { signal } = callbacks;\n  const verifier = randomBytes(64).toString('base64url');\n  const state = randomBytes(32).toString('base64url');\n  const authorize = new URL(`${AUTH_ORIGIN}/oauth/authorize`);\n  authorize.search = new URLSearchParams({\n    response_type: 'code',\n    client_id: CLIENT_ID,\n    redirect_uri: REDIRECT_URI,\n    scope: SCOPE,\n    code_challenge: createHash('sha256').update(verifier).digest('base64url'),\n    code_challenge_method: 'S256',\n    id_token_add_organizations: 'true',\n    state,\n  }).toString();\n  // Port 1455 is shared with Codex and Pi's own ChatGPT login; when it is taken, the pasted address still works.\n  const callback = await listenForCode(state, signal).catch(() => undefined);\n  try {\n    callbacks.onAuth({\n      url: authorize.toString(),\n      instructions: 'Sign in in your browser. If it does not return here, paste the address it lands on.',\n    });\n    const pasted = (\n      callbacks.onManualCodeInput?.() ??\n      callbacks.onPrompt({ message: 'Paste the address your browser lands on', placeholder: REDIRECT_URI })\n    ).then((input) => {\n      if (!URL.canParse(input.trim())) throw new Error('Paste the full address from your browser.');\n      return codeFromRedirect(new URL(input.trim()), state);\n    });\n    const code = await (callback ? Promise.race([callback.code, pasted]) : pasted);\n    signal?.throwIfAborted();\n    return await requestTokens(\n      new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: CLIENT_ID,\n        code,\n        code_verifier: verifier,\n        redirect_uri: REDIRECT_URI,\n      }),\n      undefined,\n      signal,\n    );\n  } finally {\n    callback?.close();\n  }\n}\n\nconst chatgptAuthProvider: ProviderConfig = {\n  name: CHATGPT_AUTH_PROVIDER_NAME,\n  oauth: {\n    name: CHATGPT_AUTH_PROVIDER_NAME,\n    isSubscription: true,\n    login,\n    refreshToken: (credentials, signal) =>\n      requestTokens(\n        new URLSearchParams({ grant_type: 'refresh_token', client_id: CLIENT_ID, refresh_token: credentials.refresh }),\n        credentials.refresh,\n        signal,\n      ),\n    getApiKey: (credentials) => credentials.access,\n  },\n};\n\n/** Adds the shared sign-in to a Pi model runtime: its Providers row, /login entry, refresh and storage. */\nexport function registerChatgptAuthProvider(runtime: Pick<ModelRuntime, 'registerProvider'>): void {\n  runtime.registerProvider(CHATGPT_AUTH_PROVIDER_ID, chatgptAuthProvider);\n}\n\n/**\n * Reads the shared sign-in outside a session (Voice runs at the hub). It opens the same auth.json\n * a session uses; Pi's file lock keeps refreshes from different runtimes from racing.\n */\nexport function createChatgptAuthReader(options: {\n  environment?: Readonly<Record<string, string | undefined>>;\n  homeDirectory?: string;\n}) {\n  let loading: Promise<ModelRuntime> | undefined;\n  const runtime = (): Promise<ModelRuntime> => {\n    loading ??= (async () => {\n      const agentDirectory = piAgentDirectory(options.environment, options.homeDirectory);\n      const directory = modelConfigDirectory(agentDirectory, options.homeDirectory);\n      const created = await ModelRuntime.create({\n        authPath: path.join(directory, 'auth.json'),\n        modelsPath: path.join(directory, 'models.json'),\n        refreshOnCreate: false,\n      });\n      registerChatgptAuthProvider(created);\n      return created;\n    })().catch((error: unknown) => {\n      loading = undefined; // A failed open is retried on the next use rather than pinned.\n      throw error;\n    });\n    return loading;\n  };\n  // Sign-in happens in another runtime (the Providers page or a session), so re-read the file first.\n  const fresh = async (signal?: AbortSignal): Promise<ModelRuntime> => {\n    const current = await runtime();\n    await current.refresh({\n      allowNetwork: false,\n      providers: [CHATGPT_AUTH_PROVIDER_ID],\n      ...(signal ? { signal } : {}),\n    });\n    return current;\n  };\n  return {\n    /** Whether the shared sign-in exists on disk. No network call; the same check `credentials` runs first. */\n    async signedIn(signal?: AbortSignal): Promise<boolean> {\n      return (await fresh(signal)).isUsingSubscription(CHATGPT_AUTH_PROVIDER_ID);\n    },\n    async credentials(loginMessage: string, signal?: AbortSignal): Promise<{ token: string; accountId: string }> {\n      const current = await fresh(signal);\n      return chatgptCredentials(\n        {\n          available: () => current.isUsingSubscription(CHATGPT_AUTH_PROVIDER_ID),\n          getAuth: (authSignal) => current.getAuth(CHATGPT_AUTH_PROVIDER_ID, authSignal ? { signal: authSignal } : {}),\n        },\n        loginMessage,\n        signal,\n      );\n    },\n  };\n}\n"],"mappings":";;;;;;;AAcA,MAAa,2BAA2B;AACxC,MAAa,6BAA6B;AAC1C,MAAa,uBAAuB,cAAc,2BAA2B;AAE7E,MAAM,YAAY;AAClB,MAAM,cAAc;AACpB,MAAM,YAAY,GAAG,YAAY;;AAEjC,MAAM,QAAQ;AACd,MAAM,gBAAgB;AACtB,MAAM,gBAAgB;AACtB,MAAM,gBAAgB;;AAEtB,MAAM,eAAe,oBAAoB,gBAAgB;AACzD,MAAM,2BAA2B;AACjC,MAAM,mBAAmB;AAYzB,SAAS,OAAO,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,eAAsB,gBAAgB,UAAoB,OAAe,QAAwC;CAC/G,IAAI,CAAC,SAAS,MAAM,MAAM,IAAI,MAAM,uBAAuB;CAC3D,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,SAAuB,CAAC;CAC9B,IAAI,SAAS;CACb,IAAI;EACF,OAAO,MAAM;GACX,QAAQ,eAAe;GACvB,MAAM,EAAE,OAAO,SAAS,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,UAAU,MAAM;GAChB,IAAI,SAAS,OAAO,MAAM,IAAI,MAAM,6BAA6B;GACjE,OAAO,KAAK,KAAK;EACnB;EACA,QAAQ,eAAe;EACvB,OAAO,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC;CAC1D,UAAU;EACR,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;EAC3C,OAAO,YAAY;CACrB;AACF;;AAGA,SAAS,YAAY,OAAmC;CACtD,IAAI;EACF,MAAM,UAAmB,KAAK,MAAM,OAAO,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACxG,MAAM,OAAO,OAAO,OAAO,IAAI,QAAQ,iCAAiC,KAAA;EACxE,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,qBAAqB,KAAA;EACpD,OAAO,OAAO,OAAO,YAAY,yBAAyB,KAAK,EAAE,IAAI,KAAK,KAAA;CAC5E,QAAQ;EACN;CACF;AACF;;AAGA,eAAsB,mBACpB,QACA,cACA,QAC+C;CAC/C,IAAI,CAAC,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,YAAY;CACrD,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,OAAO,QAAQ,MAAM,EAAA,EAAI,KAAK;CAC/C,QAAQ;EACN,QAAQ,eAAe;EACvB,MAAM,IAAI,MAAM,YAAY;CAC9B;CACA,QAAQ,eAAe;CACvB,MAAM,YAAY,QAAQ,YAAY,KAAK,IAAI,KAAA;CAC/C,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,MAAM,YAAY;CACtD,OAAO;EAAE;EAAO;CAAU;AAC5B;AAEA,eAAe,cACb,MACA,iBACA,QAC2B;CAC3B,MAAM,UAAU,YAAY,IAAI,CAAC,YAAY,QAAQ,gBAAgB,GAAG,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,CAAE,CAAC;CACpG,MAAM,WAAW,MAAM,MAAM,WAAW;EACtC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D;EACA,UAAU;EACV,QAAQ;CACV,CAAC;CACD,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;EACnD,MAAM,IAAI,MAAM,sCAAsC,SAAS,OAAO,kBAAkB;CAC1F;CACA,MAAM,OAAO,MAAM,gBAAgB,UAAU,0BAA0B,OAAO;CAC9E,MAAM,SAAS,OAAO,IAAI,IAAI,KAAK,eAAe,KAAA;CAClD,MAAM,UAAU,OAAO,IAAI,IAAK,KAAK,iBAAiB,kBAAmB,KAAA;CACzE,MAAM,YAAY,OAAO,IAAI,IAAI,KAAK,aAAa,KAAA;CACnD,IAAI,OAAO,WAAW,YAAY,OAAO,YAAY,YAAY,OAAO,cAAc,YAAY,aAAa,GAC7G,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,YAAY,YAAY,MAAM;CACpC,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,oDAAoD;CACpF,OAAO;EAAE;EAAQ;EAAS,SAAS,KAAK,IAAI,IAAI,YAAY;EAAM;CAAU;AAC9E;AAEA,SAAS,UAAU,UAAyB,UAA2B;CACrE,MAAM,OAAO,OAAO,KAAK,YAAY,EAAE;CACvC,MAAM,QAAQ,OAAO,KAAK,QAAQ;CAClC,OAAO,KAAK,WAAW,MAAM,UAAU,gBAAgB,MAAM,KAAK;AACpE;;AAGA,SAAS,iBAAiB,KAAU,OAAuB;CACzD,KAAK,MAAM,QAAQ;EAAC;EAAS;EAAQ;CAAO,GAC1C,IAAI,IAAI,aAAa,OAAO,IAAI,CAAC,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,iCAAiC;CACjG,IAAI,CAAC,UAAU,IAAI,aAAa,IAAI,OAAO,GAAG,KAAK,GACjD,MAAM,IAAI,MAAM,kDAAkD;CACpE,IAAI,IAAI,aAAa,IAAI,OAAO,GAAG,MAAM,IAAI,MAAM,+BAA+B;CAClF,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;CACxC,IAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,MAAM,MAAM,IAAI,MAAM,gDAAgD;CACnG,OAAO;AACT;;AAGA,eAAe,cAAc,OAAe,QAAiC;CAC3E,MAAM,SAAS,aAAa;CAC5B,IAAI;CACJ,IAAI;CACJ,MAAM,OAAO,IAAI,SAAiB,SAAS,WAAW;EACpD,cAAc;EACd,aAAa;CACf,CAAC;CACD,KAAK,YAAY,KAAA,CAAS;CAC1B,OAAO,GAAG,YAAY,SAAS,aAAa;EAC1C,MAAM,SAAS,QAAgB,SAAuB;GACpD,SAAS,UAAU,QAAQ;IAAE,gBAAgB;IAA6B,iBAAiB;GAAW,CAAC;GACvG,SAAS,IAAI,IAAI;EACnB;EACA,MAAM,MAAM,IAAI,IAAI,QAAQ,OAAO,KAAK,YAAY;EACpD,IAAI,QAAQ,WAAW,SAAS,IAAI,aAAa,eAAe,OAAO,MAAM,KAAK,YAAY;EAC9F,IAAI;GACF,YAAY,iBAAiB,KAAK,KAAK,CAAC;GACxC,MAAM,KAAK,qCAAqC;EAClD,SAAS,OAAO;GAEd,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,GAAG,KAAK,GAAG,WAAW,KAAc;GAC9E,MAAM,KAAK,iCAAiC;EAC9C;CACF,CAAC;CACD,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO;GAAE,MAAM;GAAe,MAAM;GAAe,WAAW;EAAK,SAAS;GACjF,OAAO,IAAI,SAAS,MAAM;GAC1B,QAAQ;EACV,CAAC;CACH,CAAC;CACD,MAAM,cAAoB;EACxB,OAAO,MAAM;EACb,OAAO,oBAAoB;CAC7B;CACA,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACvD,OAAO;EAAE;EAAM;CAAM;AACvB;AAEA,eAAe,MAAM,WAAsD;CACzE,MAAM,EAAE,WAAW;CACnB,MAAM,WAAW,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACrD,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CAClD,MAAM,YAAY,IAAI,IAAI,GAAG,YAAY,iBAAiB;CAC1D,UAAU,SAAS,IAAI,gBAAgB;EACrC,eAAe;EACf,WAAW;EACX,cAAc;EACd,OAAO;EACP,gBAAgB,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,WAAW;EACxE,uBAAuB;EACvB,4BAA4B;EAC5B;CACF,CAAC,CAAC,CAAC,SAAS;CAEZ,MAAM,WAAW,MAAM,cAAc,OAAO,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;CACzE,IAAI;EACF,UAAU,OAAO;GACf,KAAK,UAAU,SAAS;GACxB,cAAc;EAChB,CAAC;EACD,MAAM,UACJ,UAAU,oBAAoB,KAC9B,UAAU,SAAS;GAAE,SAAS;GAA2C,aAAa;EAAa,CAAC,EAAA,CACpG,MAAM,UAAU;GAChB,IAAI,CAAC,IAAI,SAAS,MAAM,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,2CAA2C;GAC5F,OAAO,iBAAiB,IAAI,IAAI,MAAM,KAAK,CAAC,GAAG,KAAK;EACtD,CAAC;EACD,MAAM,OAAO,OAAO,WAAW,QAAQ,KAAK,CAAC,SAAS,MAAM,MAAM,CAAC,IAAI;EACvE,QAAQ,eAAe;EACvB,OAAO,MAAM,cACX,IAAI,gBAAgB;GAClB,YAAY;GACZ,WAAW;GACX;GACA,eAAe;GACf,cAAc;EAChB,CAAC,GACD,KAAA,GACA,MACF;CACF,UAAU;EACR,UAAU,MAAM;CAClB;AACF;AAEA,MAAM,sBAAsC;CAC1C,MAAM;CACN,OAAO;EACL,MAAM;EACN,gBAAgB;EAChB;EACA,eAAe,aAAa,WAC1B,cACE,IAAI,gBAAgB;GAAE,YAAY;GAAiB,WAAW;GAAW,eAAe,YAAY;EAAQ,CAAC,GAC7G,YAAY,SACZ,MACF;EACF,YAAY,gBAAgB,YAAY;CAC1C;AACF;;AAGA,SAAgB,4BAA4B,SAAuD;CACjG,QAAQ,iBAAiB,0BAA0B,mBAAmB;AACxE;;;;;AAMA,SAAgB,wBAAwB,SAGrC;CACD,IAAI;CACJ,MAAM,gBAAuC;EAC3C,aAAa,YAAY;GACvB,MAAM,iBAAiB,iBAAiB,QAAQ,aAAa,QAAQ,aAAa;GAClF,MAAM,YAAY,qBAAqB,gBAAgB,QAAQ,aAAa;GAC5E,MAAM,UAAU,MAAM,aAAa,OAAO;IACxC,UAAU,KAAK,KAAK,WAAW,WAAW;IAC1C,YAAY,KAAK,KAAK,WAAW,aAAa;IAC9C,iBAAiB;GACnB,CAAC;GACD,4BAA4B,OAAO;GACnC,OAAO;EACT,EAAA,CAAG,CAAC,CAAC,OAAO,UAAmB;GAC7B,UAAU,KAAA;GACV,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,QAAQ,OAAO,WAAgD;EACnE,MAAM,UAAU,MAAM,QAAQ;EAC9B,MAAM,QAAQ,QAAQ;GACpB,cAAc;GACd,WAAW,CAAC,wBAAwB;GACpC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B,CAAC;EACD,OAAO;CACT;CACA,OAAO;;EAEL,MAAM,SAAS,QAAwC;GACrD,QAAQ,MAAM,MAAM,MAAM,EAAA,CAAG,oBAAoB,wBAAwB;EAC3E;EACA,MAAM,YAAY,cAAsB,QAAqE;GAC3G,MAAM,UAAU,MAAM,MAAM,MAAM;GAClC,OAAO,mBACL;IACE,iBAAiB,QAAQ,oBAAoB,wBAAwB;IACrE,UAAU,eAAe,QAAQ,QAAQ,0BAA0B,aAAa,EAAE,QAAQ,WAAW,IAAI,CAAC,CAAC;GAC7G,GACA,cACA,MACF;EACF;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/chatgptAuth/index.ts"],"sourcesContent":["/*\n * Portions of this file are adapted from OpenAI Codex at commit 5ecb3afd1b, by way of po-voice.\n * Copyright OpenAI. Licensed under the Apache License, Version 2.0.\n */\n\n/** The one ChatGPT sign-in every Po feature shares; separate from Pi's `openai-codex` model login. */\nexport const CHATGPT_AUTH_PROVIDER_ID = 'po-chatgpt';\nexport const CHATGPT_AUTH_PROVIDER_NAME = 'ChatGPT for Po features';\nexport const CHATGPT_SIGN_IN_HINT = `Sign in to ${CHATGPT_AUTH_PROVIDER_NAME} under Settings > Providers, or with /login.`;\n\n/** Where a feature reads the shared sign-in: a session's or the hub's Pi model runtime. */\nexport interface ChatgptAuthSource {\n  available(): boolean;\n  getAuth(signal?: AbortSignal): Promise<{ auth: { apiKey?: string } } | undefined>;\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** Reads a JSON body without buffering more than `limit` bytes. Errors are generic; callers map them. */\nexport async function readBoundedJson(response: Response, limit: number, signal?: AbortSignal): Promise<unknown> {\n  if (!response.body) throw new Error('Response has no body.');\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let length = 0;\n  try {\n    while (true) {\n      signal?.throwIfAborted();\n      const { value, done } = await reader.read();\n      if (done) break;\n      length += value.length;\n      if (length > limit) throw new Error('Response body is too large.');\n      chunks.push(value);\n    }\n    signal?.throwIfAborted();\n    return JSON.parse(Buffer.concat(chunks).toString('utf8')) as unknown;\n  } finally {\n    await reader.cancel().catch(() => undefined); // Response cleanup never replaces the operation error.\n    reader.releaseLock();\n  }\n}\n\n/** The ChatGPT account claim of an access token, or undefined when it is missing or malformed. */\nexport function accountIdOf(token: string): string | undefined {\n  try {\n    const payload: unknown = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'));\n    const auth = record(payload) ? payload['https://api.openai.com/auth'] : undefined;\n    const id = record(auth) ? auth.chatgpt_account_id : undefined;\n    return typeof id === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(id) ? id : undefined;\n  } catch {\n    return undefined; // Documented fallback: a malformed token has no account, which callers treat as signed out.\n  }\n}\n\n/** Resolves the subscription token and account claim; every failure becomes `loginMessage` unless aborted. */\nexport async function chatgptCredentials(\n  source: ChatgptAuthSource,\n  loginMessage: string,\n  signal?: AbortSignal,\n): Promise<{ token: string; accountId: string }> {\n  if (!source.available()) throw new Error(loginMessage);\n  let token: string | undefined;\n  try {\n    token = (await source.getAuth(signal))?.auth.apiKey;\n  } catch {\n    signal?.throwIfAborted();\n    throw new Error(loginMessage);\n  }\n  signal?.throwIfAborted();\n  const accountId = token ? accountIdOf(token) : undefined;\n  if (!token || !accountId) throw new Error(loginMessage);\n  return { token, accountId };\n}\n"],"mappings":";;AAMA,MAAa,2BAA2B;AACxC,MAAa,6BAA6B;AAC1C,MAAa,uBAAuB,cAAc,2BAA2B;AAQ7E,SAAS,OAAO,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,eAAsB,gBAAgB,UAAoB,OAAe,QAAwC;CAC/G,IAAI,CAAC,SAAS,MAAM,MAAM,IAAI,MAAM,uBAAuB;CAC3D,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,SAAuB,CAAC;CAC9B,IAAI,SAAS;CACb,IAAI;EACF,OAAO,MAAM;GACX,QAAQ,eAAe;GACvB,MAAM,EAAE,OAAO,SAAS,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,UAAU,MAAM;GAChB,IAAI,SAAS,OAAO,MAAM,IAAI,MAAM,6BAA6B;GACjE,OAAO,KAAK,KAAK;EACnB;EACA,QAAQ,eAAe;EACvB,OAAO,KAAK,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC;CAC1D,UAAU;EACR,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;EAC3C,OAAO,YAAY;CACrB;AACF;;AAGA,SAAgB,YAAY,OAAmC;CAC7D,IAAI;EACF,MAAM,UAAmB,KAAK,MAAM,OAAO,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACxG,MAAM,OAAO,OAAO,OAAO,IAAI,QAAQ,iCAAiC,KAAA;EACxE,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,qBAAqB,KAAA;EACpD,OAAO,OAAO,OAAO,YAAY,yBAAyB,KAAK,EAAE,IAAI,KAAK,KAAA;CAC5E,QAAQ;EACN;CACF;AACF;;AAGA,eAAsB,mBACpB,QACA,cACA,QAC+C;CAC/C,IAAI,CAAC,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,YAAY;CACrD,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,OAAO,QAAQ,MAAM,EAAA,EAAI,KAAK;CAC/C,QAAQ;EACN,QAAQ,eAAe;EACvB,MAAM,IAAI,MAAM,YAAY;CAC9B;CACA,QAAQ,eAAe;CACvB,MAAM,YAAY,QAAQ,YAAY,KAAK,IAAI,KAAA;CAC/C,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,MAAM,YAAY;CACtD,OAAO;EAAE;EAAO;CAAU;AAC5B"}

package/dist/src/services/chatgptImages/index.cjs

@@ -31,7 +31,7 @@ function matchesMime(bytes, mimeType) {
 	if (mimeType === "image/jpeg") return bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
 	return mimeType === "image/webp" && bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP";
 }
-/** Host-only transport: authentication never crosses the facet boundary. */
+/** Host-only transport: authentication never crosses the package boundary. */
 function createChatgptImageClient(dependencies) {
 	return {
 		available: () => dependencies.available(),

package/dist/src/services/chatgptImages/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["CHATGPT_SIGN_IN_HINT","chatgptCredentials","readBoundedJson"],"sources":["../../../../src/services/chatgptImages/index.ts"],"sourcesContent":["import { CHATGPT_SIGN_IN_HINT, chatgptCredentials, readBoundedJson } from '../chatgptAuth';\nimport type { ChatgptBackendDependencies, ImageGenerationRequest } from './type';\n\nconst BASE_URL = 'https://chatgpt.com/backend-api/codex/images/';\nconst MAX_IMAGE_BYTES = 32 * 1024 * 1024;\nconst MAX_REFERENCE_BYTES = 20 * 1024 * 1024;\nconst MAX_REFERENCES_BYTES = 50 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES = Math.ceil((MAX_IMAGE_BYTES * 4) / 3) + 1024 * 1024;\nconst LOGIN_MESSAGE = `Image generation needs a ChatGPT sign-in. ${CHATGPT_SIGN_IN_HINT}`;\nconst INVALID_RESPONSE = 'Image generation returned an invalid image.';\nconst PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\nfunction decodeImage(data: string, limit: number): Buffer {\n  if (!data || data.length > Math.ceil((limit * 4) / 3) + 4 || !/^[A-Za-z0-9+/]*={0,2}$/.test(data))\n    throw new Error(INVALID_RESPONSE);\n  const bytes = Buffer.from(data, 'base64');\n  if (bytes.length > limit || bytes.toString('base64') !== data) throw new Error(INVALID_RESPONSE);\n  return bytes;\n}\n\nfunction matchesMime(bytes: Buffer, mimeType: string): boolean {\n  if (mimeType === 'image/png') return bytes.subarray(0, 8).equals(PNG_SIGNATURE);\n  if (mimeType === 'image/jpeg') return bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;\n  return (\n    mimeType === 'image/webp' && bytes.toString('ascii', 0, 4) === 'RIFF' && bytes.toString('ascii', 8, 12) === 'WEBP'\n  );\n}\n\n/** Host-only transport: authentication never crosses the facet boundary. */\nexport function createChatgptImageClient(dependencies: ChatgptBackendDependencies) {\n  return {\n    available: () => dependencies.available(),\n    async generate(request: ImageGenerationRequest) {\n      request.signal?.throwIfAborted();\n      if (typeof request.prompt !== 'string' || !request.prompt.trim()) throw new Error('An image prompt is required.');\n      if (request.transparentBackground !== undefined && typeof request.transparentBackground !== 'boolean')\n        throw new Error('Invalid transparency option.');\n      if (typeof request.correlationId !== 'string' || !/^[\\x21-\\x7e]{1,1024}$/.test(request.correlationId))\n        throw new Error('Invalid image operation identifier.');\n      if (request.images !== undefined && (!Array.isArray(request.images) || request.images.length > 5))\n        throw new Error('At most five reference images are supported.');\n      let total = 0;\n      for (const image of request.images ?? []) {\n        if (!record(image) || typeof image.data !== 'string' || typeof image.mimeType !== 'string')\n          throw new Error('Invalid reference image.');\n        const bytes = decodeImage(image.data, MAX_REFERENCE_BYTES);\n        total += bytes.length;\n        if (total > MAX_REFERENCES_BYTES || !matchesMime(bytes, image.mimeType))\n          throw new Error('Invalid or oversized reference image.');\n      }\n      const { token, accountId: id } = await chatgptCredentials(dependencies, LOGIN_MESSAGE, request.signal);\n      let response: Response;\n      try {\n        response = await (dependencies.fetch ?? globalThis.fetch)(\n          BASE_URL + (request.images?.length ? 'edits' : 'generations'),\n          {\n            method: 'POST',\n            redirect: 'error',\n            signal: request.signal,\n            headers: {\n              Authorization: `Bearer ${token}`,\n              'chatgpt-account-id': id,\n              originator: 'po_image_gen',\n              'User-Agent': '@agimon-ai/po-image-gen',\n              'Content-Type': 'application/json',\n              'x-codex-image-turn-id': request.correlationId,\n            },\n            body: JSON.stringify({\n              prompt: request.prompt,\n              background: request.transparentBackground ? 'transparent' : 'opaque',\n              model: 'gpt-image-2',\n              quality: 'auto',\n              size: 'auto',\n              ...(request.images?.length\n                ? {\n                    images: request.images.map((image) => ({\n                      image_url: `data:${image.mimeType};base64,${image.data}`,\n                    })),\n                  }\n                : {}),\n            }),\n          },\n        );\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error('Image generation request failed.');\n      }\n      if (!response.ok) {\n        await response.body?.cancel().catch(() => undefined);\n        if (response.status === 401) throw new Error(LOGIN_MESSAGE);\n        if (response.status === 403) throw new Error('Image generation was denied for this account.');\n        if (response.status === 429) {\n          const reset = response.headers.get('x-image-gen-primary-reset-at');\n          throw new Error(\n            `Image generation quota reached.${reset && /^\\d{1,12}$/.test(reset) ? ` Reset time: ${reset}.` : ''}`,\n          );\n        }\n        throw new Error('Image generation request failed.');\n      }\n      let body: unknown;\n      try {\n        body = await readBoundedJson(response, MAX_RESPONSE_BYTES, request.signal);\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error(INVALID_RESPONSE);\n      }\n      const first = record(body) && Array.isArray(body.data) ? (body.data[0] as unknown) : undefined;\n      if (!record(first) || typeof first.b64_json !== 'string') throw new Error(INVALID_RESPONSE);\n      const bytes = decodeImage(first.b64_json, MAX_IMAGE_BYTES);\n      if (!matchesMime(bytes, 'image/png')) throw new Error(INVALID_RESPONSE);\n      const requestId = response.headers.get('x-codex-imagegen-request-id');\n      const generationId = first.generation_id;\n      return {\n        data: first.b64_json,\n        mimeType: 'image/png' as const,\n        ...(requestId && /^[A-Za-z0-9_-]{1,256}$/.test(requestId) ? { requestId } : {}),\n        ...(typeof generationId === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(generationId) ? { generationId } : {}),\n      };\n    },\n  };\n}\n"],"mappings":";;AAGA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB,KAAK,KAAM,kBAAkB,IAAK,CAAC,IAAI;AAClE,MAAM,gBAAgB,6CAA6CA,cAAAA;AACnE,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,OAAO,KAAK;CAAC;CAAK;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;AAAE,CAAC;AAEnE,SAAS,OAAO,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AACA,SAAS,YAAY,MAAc,OAAuB;CACxD,IAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,KAAM,QAAQ,IAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI,GAC9F,MAAM,IAAI,MAAM,gBAAgB;CAClC,MAAM,QAAQ,OAAO,KAAK,MAAM,QAAQ;CACxC,IAAI,MAAM,SAAS,SAAS,MAAM,SAAS,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,gBAAgB;CAC/F,OAAO;AACT;AAEA,SAAS,YAAY,OAAe,UAA2B;CAC7D,IAAI,aAAa,aAAa,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,aAAa;CAC9E,IAAI,aAAa,cAAc,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO;CAC3F,OACE,aAAa,gBAAgB,MAAM,SAAS,SAAS,GAAG,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,GAAG,EAAE,MAAM;AAEhH;;AAGA,SAAgB,yBAAyB,cAA0C;CACjF,OAAO;EACL,iBAAiB,aAAa,UAAU;EACxC,MAAM,SAAS,SAAiC;GAC9C,QAAQ,QAAQ,eAAe;GAC/B,IAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,8BAA8B;GAChH,IAAI,QAAQ,0BAA0B,KAAA,KAAa,OAAO,QAAQ,0BAA0B,WAC1F,MAAM,IAAI,MAAM,8BAA8B;GAChD,IAAI,OAAO,QAAQ,kBAAkB,YAAY,CAAC,wBAAwB,KAAK,QAAQ,aAAa,GAClG,MAAM,IAAI,MAAM,qCAAqC;GACvD,IAAI,QAAQ,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,QAAQ,MAAM,KAAK,QAAQ,OAAO,SAAS,IAC7F,MAAM,IAAI,MAAM,8CAA8C;GAChE,IAAI,QAAQ;GACZ,KAAK,MAAM,SAAS,QAAQ,UAAU,CAAC,GAAG;IACxC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,aAAa,UAChF,MAAM,IAAI,MAAM,0BAA0B;IAC5C,MAAM,QAAQ,YAAY,MAAM,MAAM,mBAAmB;IACzD,SAAS,MAAM;IACf,IAAI,QAAQ,wBAAwB,CAAC,YAAY,OAAO,MAAM,QAAQ,GACpE,MAAM,IAAI,MAAM,uCAAuC;GAC3D;GACA,MAAM,EAAE,OAAO,WAAW,OAAO,MAAMC,cAAAA,mBAAmB,cAAc,eAAe,QAAQ,MAAM;GACrG,IAAI;GACJ,IAAI;IACF,WAAW,OAAO,aAAa,SAAS,WAAW,MAAA,CACjD,YAAY,QAAQ,QAAQ,SAAS,UAAU,gBAC/C;KACE,QAAQ;KACR,UAAU;KACV,QAAQ,QAAQ;KAChB,SAAS;MACP,eAAe,UAAU;MACzB,sBAAsB;MACtB,YAAY;MACZ,cAAc;MACd,gBAAgB;MAChB,yBAAyB,QAAQ;KACnC;KACA,MAAM,KAAK,UAAU;MACnB,QAAQ,QAAQ;MAChB,YAAY,QAAQ,wBAAwB,gBAAgB;MAC5D,OAAO;MACP,SAAS;MACT,MAAM;MACN,GAAI,QAAQ,QAAQ,SAChB,EACE,QAAQ,QAAQ,OAAO,KAAK,WAAW,EACrC,WAAW,QAAQ,MAAM,SAAS,UAAU,MAAM,OACpD,EAAE,EACJ,IACA,CAAC;KACP,CAAC;IACH,CACF;GACF,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACnD,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,aAAa;IAC1D,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,+CAA+C;IAC5F,IAAI,SAAS,WAAW,KAAK;KAC3B,MAAM,QAAQ,SAAS,QAAQ,IAAI,8BAA8B;KACjE,MAAM,IAAI,MACR,kCAAkC,SAAS,aAAa,KAAK,KAAK,IAAI,gBAAgB,MAAM,KAAK,IACnG;IACF;IACA,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI;GACJ,IAAI;IACF,OAAO,MAAMC,cAAAA,gBAAgB,UAAU,oBAAoB,QAAQ,MAAM;GAC3E,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,gBAAgB;GAClC;GACA,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAK,KAAK,KAAK,KAAiB,KAAA;GACrF,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,aAAa,UAAU,MAAM,IAAI,MAAM,gBAAgB;GAE1F,IAAI,CAAC,YADS,YAAY,MAAM,UAAU,eACrB,GAAG,WAAW,GAAG,MAAM,IAAI,MAAM,gBAAgB;GACtE,MAAM,YAAY,SAAS,QAAQ,IAAI,6BAA6B;GACpE,MAAM,eAAe,MAAM;GAC3B,OAAO;IACL,MAAM,MAAM;IACZ,UAAU;IACV,GAAI,aAAa,yBAAyB,KAAK,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;IAC7E,GAAI,OAAO,iBAAiB,YAAY,yBAAyB,KAAK,YAAY,IAAI,EAAE,aAAa,IAAI,CAAC;GAC5G;EACF;CACF;AACF"}
+{"version":3,"file":"index.cjs","names":["CHATGPT_SIGN_IN_HINT","chatgptCredentials","readBoundedJson"],"sources":["../../../../src/services/chatgptImages/index.ts"],"sourcesContent":["import { CHATGPT_SIGN_IN_HINT, chatgptCredentials, readBoundedJson } from '../chatgptAuth';\nimport type { ChatgptBackendDependencies, ImageGenerationRequest } from './type';\n\nconst BASE_URL = 'https://chatgpt.com/backend-api/codex/images/';\nconst MAX_IMAGE_BYTES = 32 * 1024 * 1024;\nconst MAX_REFERENCE_BYTES = 20 * 1024 * 1024;\nconst MAX_REFERENCES_BYTES = 50 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES = Math.ceil((MAX_IMAGE_BYTES * 4) / 3) + 1024 * 1024;\nconst LOGIN_MESSAGE = `Image generation needs a ChatGPT sign-in. ${CHATGPT_SIGN_IN_HINT}`;\nconst INVALID_RESPONSE = 'Image generation returned an invalid image.';\nconst PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\nfunction decodeImage(data: string, limit: number): Buffer {\n  if (!data || data.length > Math.ceil((limit * 4) / 3) + 4 || !/^[A-Za-z0-9+/]*={0,2}$/.test(data))\n    throw new Error(INVALID_RESPONSE);\n  const bytes = Buffer.from(data, 'base64');\n  if (bytes.length > limit || bytes.toString('base64') !== data) throw new Error(INVALID_RESPONSE);\n  return bytes;\n}\n\nfunction matchesMime(bytes: Buffer, mimeType: string): boolean {\n  if (mimeType === 'image/png') return bytes.subarray(0, 8).equals(PNG_SIGNATURE);\n  if (mimeType === 'image/jpeg') return bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;\n  return (\n    mimeType === 'image/webp' && bytes.toString('ascii', 0, 4) === 'RIFF' && bytes.toString('ascii', 8, 12) === 'WEBP'\n  );\n}\n\n/** Host-only transport: authentication never crosses the package boundary. */\nexport function createChatgptImageClient(dependencies: ChatgptBackendDependencies) {\n  return {\n    available: () => dependencies.available(),\n    async generate(request: ImageGenerationRequest) {\n      request.signal?.throwIfAborted();\n      if (typeof request.prompt !== 'string' || !request.prompt.trim()) throw new Error('An image prompt is required.');\n      if (request.transparentBackground !== undefined && typeof request.transparentBackground !== 'boolean')\n        throw new Error('Invalid transparency option.');\n      if (typeof request.correlationId !== 'string' || !/^[\\x21-\\x7e]{1,1024}$/.test(request.correlationId))\n        throw new Error('Invalid image operation identifier.');\n      if (request.images !== undefined && (!Array.isArray(request.images) || request.images.length > 5))\n        throw new Error('At most five reference images are supported.');\n      let total = 0;\n      for (const image of request.images ?? []) {\n        if (!record(image) || typeof image.data !== 'string' || typeof image.mimeType !== 'string')\n          throw new Error('Invalid reference image.');\n        const bytes = decodeImage(image.data, MAX_REFERENCE_BYTES);\n        total += bytes.length;\n        if (total > MAX_REFERENCES_BYTES || !matchesMime(bytes, image.mimeType))\n          throw new Error('Invalid or oversized reference image.');\n      }\n      const { token, accountId: id } = await chatgptCredentials(dependencies, LOGIN_MESSAGE, request.signal);\n      let response: Response;\n      try {\n        response = await (dependencies.fetch ?? globalThis.fetch)(\n          BASE_URL + (request.images?.length ? 'edits' : 'generations'),\n          {\n            method: 'POST',\n            redirect: 'error',\n            signal: request.signal,\n            headers: {\n              Authorization: `Bearer ${token}`,\n              'chatgpt-account-id': id,\n              originator: 'po_image_gen',\n              'User-Agent': '@agimon-ai/po-image-gen',\n              'Content-Type': 'application/json',\n              'x-codex-image-turn-id': request.correlationId,\n            },\n            body: JSON.stringify({\n              prompt: request.prompt,\n              background: request.transparentBackground ? 'transparent' : 'opaque',\n              model: 'gpt-image-2',\n              quality: 'auto',\n              size: 'auto',\n              ...(request.images?.length\n                ? {\n                    images: request.images.map((image) => ({\n                      image_url: `data:${image.mimeType};base64,${image.data}`,\n                    })),\n                  }\n                : {}),\n            }),\n          },\n        );\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error('Image generation request failed.');\n      }\n      if (!response.ok) {\n        await response.body?.cancel().catch(() => undefined);\n        if (response.status === 401) throw new Error(LOGIN_MESSAGE);\n        if (response.status === 403) throw new Error('Image generation was denied for this account.');\n        if (response.status === 429) {\n          const reset = response.headers.get('x-image-gen-primary-reset-at');\n          throw new Error(\n            `Image generation quota reached.${reset && /^\\d{1,12}$/.test(reset) ? ` Reset time: ${reset}.` : ''}`,\n          );\n        }\n        throw new Error('Image generation request failed.');\n      }\n      let body: unknown;\n      try {\n        body = await readBoundedJson(response, MAX_RESPONSE_BYTES, request.signal);\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error(INVALID_RESPONSE);\n      }\n      const first = record(body) && Array.isArray(body.data) ? (body.data[0] as unknown) : undefined;\n      if (!record(first) || typeof first.b64_json !== 'string') throw new Error(INVALID_RESPONSE);\n      const bytes = decodeImage(first.b64_json, MAX_IMAGE_BYTES);\n      if (!matchesMime(bytes, 'image/png')) throw new Error(INVALID_RESPONSE);\n      const requestId = response.headers.get('x-codex-imagegen-request-id');\n      const generationId = first.generation_id;\n      return {\n        data: first.b64_json,\n        mimeType: 'image/png' as const,\n        ...(requestId && /^[A-Za-z0-9_-]{1,256}$/.test(requestId) ? { requestId } : {}),\n        ...(typeof generationId === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(generationId) ? { generationId } : {}),\n      };\n    },\n  };\n}\n"],"mappings":";;AAGA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB,KAAK,KAAM,kBAAkB,IAAK,CAAC,IAAI;AAClE,MAAM,gBAAgB,6CAA6CA,cAAAA;AACnE,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,OAAO,KAAK;CAAC;CAAK;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;AAAE,CAAC;AAEnE,SAAS,OAAO,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AACA,SAAS,YAAY,MAAc,OAAuB;CACxD,IAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,KAAM,QAAQ,IAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI,GAC9F,MAAM,IAAI,MAAM,gBAAgB;CAClC,MAAM,QAAQ,OAAO,KAAK,MAAM,QAAQ;CACxC,IAAI,MAAM,SAAS,SAAS,MAAM,SAAS,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,gBAAgB;CAC/F,OAAO;AACT;AAEA,SAAS,YAAY,OAAe,UAA2B;CAC7D,IAAI,aAAa,aAAa,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,aAAa;CAC9E,IAAI,aAAa,cAAc,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO;CAC3F,OACE,aAAa,gBAAgB,MAAM,SAAS,SAAS,GAAG,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,GAAG,EAAE,MAAM;AAEhH;;AAGA,SAAgB,yBAAyB,cAA0C;CACjF,OAAO;EACL,iBAAiB,aAAa,UAAU;EACxC,MAAM,SAAS,SAAiC;GAC9C,QAAQ,QAAQ,eAAe;GAC/B,IAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,8BAA8B;GAChH,IAAI,QAAQ,0BAA0B,KAAA,KAAa,OAAO,QAAQ,0BAA0B,WAC1F,MAAM,IAAI,MAAM,8BAA8B;GAChD,IAAI,OAAO,QAAQ,kBAAkB,YAAY,CAAC,wBAAwB,KAAK,QAAQ,aAAa,GAClG,MAAM,IAAI,MAAM,qCAAqC;GACvD,IAAI,QAAQ,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,QAAQ,MAAM,KAAK,QAAQ,OAAO,SAAS,IAC7F,MAAM,IAAI,MAAM,8CAA8C;GAChE,IAAI,QAAQ;GACZ,KAAK,MAAM,SAAS,QAAQ,UAAU,CAAC,GAAG;IACxC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,aAAa,UAChF,MAAM,IAAI,MAAM,0BAA0B;IAC5C,MAAM,QAAQ,YAAY,MAAM,MAAM,mBAAmB;IACzD,SAAS,MAAM;IACf,IAAI,QAAQ,wBAAwB,CAAC,YAAY,OAAO,MAAM,QAAQ,GACpE,MAAM,IAAI,MAAM,uCAAuC;GAC3D;GACA,MAAM,EAAE,OAAO,WAAW,OAAO,MAAMC,cAAAA,mBAAmB,cAAc,eAAe,QAAQ,MAAM;GACrG,IAAI;GACJ,IAAI;IACF,WAAW,OAAO,aAAa,SAAS,WAAW,MAAA,CACjD,YAAY,QAAQ,QAAQ,SAAS,UAAU,gBAC/C;KACE,QAAQ;KACR,UAAU;KACV,QAAQ,QAAQ;KAChB,SAAS;MACP,eAAe,UAAU;MACzB,sBAAsB;MACtB,YAAY;MACZ,cAAc;MACd,gBAAgB;MAChB,yBAAyB,QAAQ;KACnC;KACA,MAAM,KAAK,UAAU;MACnB,QAAQ,QAAQ;MAChB,YAAY,QAAQ,wBAAwB,gBAAgB;MAC5D,OAAO;MACP,SAAS;MACT,MAAM;MACN,GAAI,QAAQ,QAAQ,SAChB,EACE,QAAQ,QAAQ,OAAO,KAAK,WAAW,EACrC,WAAW,QAAQ,MAAM,SAAS,UAAU,MAAM,OACpD,EAAE,EACJ,IACA,CAAC;KACP,CAAC;IACH,CACF;GACF,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACnD,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,aAAa;IAC1D,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,+CAA+C;IAC5F,IAAI,SAAS,WAAW,KAAK;KAC3B,MAAM,QAAQ,SAAS,QAAQ,IAAI,8BAA8B;KACjE,MAAM,IAAI,MACR,kCAAkC,SAAS,aAAa,KAAK,KAAK,IAAI,gBAAgB,MAAM,KAAK,IACnG;IACF;IACA,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI;GACJ,IAAI;IACF,OAAO,MAAMC,cAAAA,gBAAgB,UAAU,oBAAoB,QAAQ,MAAM;GAC3E,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,gBAAgB;GAClC;GACA,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAK,KAAK,KAAK,KAAiB,KAAA;GACrF,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,aAAa,UAAU,MAAM,IAAI,MAAM,gBAAgB;GAE1F,IAAI,CAAC,YADS,YAAY,MAAM,UAAU,eACrB,GAAG,WAAW,GAAG,MAAM,IAAI,MAAM,gBAAgB;GACtE,MAAM,YAAY,SAAS,QAAQ,IAAI,6BAA6B;GACpE,MAAM,eAAe,MAAM;GAC3B,OAAO;IACL,MAAM,MAAM;IACZ,UAAU;IACV,GAAI,aAAa,yBAAyB,KAAK,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;IAC7E,GAAI,OAAO,iBAAiB,YAAY,yBAAyB,KAAK,YAAY,IAAI,EAAE,aAAa,IAAI,CAAC;GAC5G;EACF;CACF;AACF"}

package/dist/src/services/chatgptImages/index.mjs

@@ -31,7 +31,7 @@ function matchesMime(bytes, mimeType) {
 	if (mimeType === "image/jpeg") return bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
 	return mimeType === "image/webp" && bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP";
 }
-/** Host-only transport: authentication never crosses the facet boundary. */
+/** Host-only transport: authentication never crosses the package boundary. */
 function createChatgptImageClient(dependencies) {
 	return {
 		available: () => dependencies.available(),

package/dist/src/services/chatgptImages/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/chatgptImages/index.ts"],"sourcesContent":["import { CHATGPT_SIGN_IN_HINT, chatgptCredentials, readBoundedJson } from '../chatgptAuth';\nimport type { ChatgptBackendDependencies, ImageGenerationRequest } from './type';\n\nconst BASE_URL = 'https://chatgpt.com/backend-api/codex/images/';\nconst MAX_IMAGE_BYTES = 32 * 1024 * 1024;\nconst MAX_REFERENCE_BYTES = 20 * 1024 * 1024;\nconst MAX_REFERENCES_BYTES = 50 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES = Math.ceil((MAX_IMAGE_BYTES * 4) / 3) + 1024 * 1024;\nconst LOGIN_MESSAGE = `Image generation needs a ChatGPT sign-in. ${CHATGPT_SIGN_IN_HINT}`;\nconst INVALID_RESPONSE = 'Image generation returned an invalid image.';\nconst PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\nfunction decodeImage(data: string, limit: number): Buffer {\n  if (!data || data.length > Math.ceil((limit * 4) / 3) + 4 || !/^[A-Za-z0-9+/]*={0,2}$/.test(data))\n    throw new Error(INVALID_RESPONSE);\n  const bytes = Buffer.from(data, 'base64');\n  if (bytes.length > limit || bytes.toString('base64') !== data) throw new Error(INVALID_RESPONSE);\n  return bytes;\n}\n\nfunction matchesMime(bytes: Buffer, mimeType: string): boolean {\n  if (mimeType === 'image/png') return bytes.subarray(0, 8).equals(PNG_SIGNATURE);\n  if (mimeType === 'image/jpeg') return bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;\n  return (\n    mimeType === 'image/webp' && bytes.toString('ascii', 0, 4) === 'RIFF' && bytes.toString('ascii', 8, 12) === 'WEBP'\n  );\n}\n\n/** Host-only transport: authentication never crosses the facet boundary. */\nexport function createChatgptImageClient(dependencies: ChatgptBackendDependencies) {\n  return {\n    available: () => dependencies.available(),\n    async generate(request: ImageGenerationRequest) {\n      request.signal?.throwIfAborted();\n      if (typeof request.prompt !== 'string' || !request.prompt.trim()) throw new Error('An image prompt is required.');\n      if (request.transparentBackground !== undefined && typeof request.transparentBackground !== 'boolean')\n        throw new Error('Invalid transparency option.');\n      if (typeof request.correlationId !== 'string' || !/^[\\x21-\\x7e]{1,1024}$/.test(request.correlationId))\n        throw new Error('Invalid image operation identifier.');\n      if (request.images !== undefined && (!Array.isArray(request.images) || request.images.length > 5))\n        throw new Error('At most five reference images are supported.');\n      let total = 0;\n      for (const image of request.images ?? []) {\n        if (!record(image) || typeof image.data !== 'string' || typeof image.mimeType !== 'string')\n          throw new Error('Invalid reference image.');\n        const bytes = decodeImage(image.data, MAX_REFERENCE_BYTES);\n        total += bytes.length;\n        if (total > MAX_REFERENCES_BYTES || !matchesMime(bytes, image.mimeType))\n          throw new Error('Invalid or oversized reference image.');\n      }\n      const { token, accountId: id } = await chatgptCredentials(dependencies, LOGIN_MESSAGE, request.signal);\n      let response: Response;\n      try {\n        response = await (dependencies.fetch ?? globalThis.fetch)(\n          BASE_URL + (request.images?.length ? 'edits' : 'generations'),\n          {\n            method: 'POST',\n            redirect: 'error',\n            signal: request.signal,\n            headers: {\n              Authorization: `Bearer ${token}`,\n              'chatgpt-account-id': id,\n              originator: 'po_image_gen',\n              'User-Agent': '@agimon-ai/po-image-gen',\n              'Content-Type': 'application/json',\n              'x-codex-image-turn-id': request.correlationId,\n            },\n            body: JSON.stringify({\n              prompt: request.prompt,\n              background: request.transparentBackground ? 'transparent' : 'opaque',\n              model: 'gpt-image-2',\n              quality: 'auto',\n              size: 'auto',\n              ...(request.images?.length\n                ? {\n                    images: request.images.map((image) => ({\n                      image_url: `data:${image.mimeType};base64,${image.data}`,\n                    })),\n                  }\n                : {}),\n            }),\n          },\n        );\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error('Image generation request failed.');\n      }\n      if (!response.ok) {\n        await response.body?.cancel().catch(() => undefined);\n        if (response.status === 401) throw new Error(LOGIN_MESSAGE);\n        if (response.status === 403) throw new Error('Image generation was denied for this account.');\n        if (response.status === 429) {\n          const reset = response.headers.get('x-image-gen-primary-reset-at');\n          throw new Error(\n            `Image generation quota reached.${reset && /^\\d{1,12}$/.test(reset) ? ` Reset time: ${reset}.` : ''}`,\n          );\n        }\n        throw new Error('Image generation request failed.');\n      }\n      let body: unknown;\n      try {\n        body = await readBoundedJson(response, MAX_RESPONSE_BYTES, request.signal);\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error(INVALID_RESPONSE);\n      }\n      const first = record(body) && Array.isArray(body.data) ? (body.data[0] as unknown) : undefined;\n      if (!record(first) || typeof first.b64_json !== 'string') throw new Error(INVALID_RESPONSE);\n      const bytes = decodeImage(first.b64_json, MAX_IMAGE_BYTES);\n      if (!matchesMime(bytes, 'image/png')) throw new Error(INVALID_RESPONSE);\n      const requestId = response.headers.get('x-codex-imagegen-request-id');\n      const generationId = first.generation_id;\n      return {\n        data: first.b64_json,\n        mimeType: 'image/png' as const,\n        ...(requestId && /^[A-Za-z0-9_-]{1,256}$/.test(requestId) ? { requestId } : {}),\n        ...(typeof generationId === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(generationId) ? { generationId } : {}),\n      };\n    },\n  };\n}\n"],"mappings":";;AAGA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB,KAAK,KAAM,kBAAkB,IAAK,CAAC,IAAI;AAClE,MAAM,gBAAgB,6CAA6C;AACnE,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,OAAO,KAAK;CAAC;CAAK;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;AAAE,CAAC;AAEnE,SAAS,OAAO,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AACA,SAAS,YAAY,MAAc,OAAuB;CACxD,IAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,KAAM,QAAQ,IAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI,GAC9F,MAAM,IAAI,MAAM,gBAAgB;CAClC,MAAM,QAAQ,OAAO,KAAK,MAAM,QAAQ;CACxC,IAAI,MAAM,SAAS,SAAS,MAAM,SAAS,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,gBAAgB;CAC/F,OAAO;AACT;AAEA,SAAS,YAAY,OAAe,UAA2B;CAC7D,IAAI,aAAa,aAAa,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,aAAa;CAC9E,IAAI,aAAa,cAAc,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO;CAC3F,OACE,aAAa,gBAAgB,MAAM,SAAS,SAAS,GAAG,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,GAAG,EAAE,MAAM;AAEhH;;AAGA,SAAgB,yBAAyB,cAA0C;CACjF,OAAO;EACL,iBAAiB,aAAa,UAAU;EACxC,MAAM,SAAS,SAAiC;GAC9C,QAAQ,QAAQ,eAAe;GAC/B,IAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,8BAA8B;GAChH,IAAI,QAAQ,0BAA0B,KAAA,KAAa,OAAO,QAAQ,0BAA0B,WAC1F,MAAM,IAAI,MAAM,8BAA8B;GAChD,IAAI,OAAO,QAAQ,kBAAkB,YAAY,CAAC,wBAAwB,KAAK,QAAQ,aAAa,GAClG,MAAM,IAAI,MAAM,qCAAqC;GACvD,IAAI,QAAQ,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,QAAQ,MAAM,KAAK,QAAQ,OAAO,SAAS,IAC7F,MAAM,IAAI,MAAM,8CAA8C;GAChE,IAAI,QAAQ;GACZ,KAAK,MAAM,SAAS,QAAQ,UAAU,CAAC,GAAG;IACxC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,aAAa,UAChF,MAAM,IAAI,MAAM,0BAA0B;IAC5C,MAAM,QAAQ,YAAY,MAAM,MAAM,mBAAmB;IACzD,SAAS,MAAM;IACf,IAAI,QAAQ,wBAAwB,CAAC,YAAY,OAAO,MAAM,QAAQ,GACpE,MAAM,IAAI,MAAM,uCAAuC;GAC3D;GACA,MAAM,EAAE,OAAO,WAAW,OAAO,MAAM,mBAAmB,cAAc,eAAe,QAAQ,MAAM;GACrG,IAAI;GACJ,IAAI;IACF,WAAW,OAAO,aAAa,SAAS,WAAW,MAAA,CACjD,YAAY,QAAQ,QAAQ,SAAS,UAAU,gBAC/C;KACE,QAAQ;KACR,UAAU;KACV,QAAQ,QAAQ;KAChB,SAAS;MACP,eAAe,UAAU;MACzB,sBAAsB;MACtB,YAAY;MACZ,cAAc;MACd,gBAAgB;MAChB,yBAAyB,QAAQ;KACnC;KACA,MAAM,KAAK,UAAU;MACnB,QAAQ,QAAQ;MAChB,YAAY,QAAQ,wBAAwB,gBAAgB;MAC5D,OAAO;MACP,SAAS;MACT,MAAM;MACN,GAAI,QAAQ,QAAQ,SAChB,EACE,QAAQ,QAAQ,OAAO,KAAK,WAAW,EACrC,WAAW,QAAQ,MAAM,SAAS,UAAU,MAAM,OACpD,EAAE,EACJ,IACA,CAAC;KACP,CAAC;IACH,CACF;GACF,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACnD,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,aAAa;IAC1D,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,+CAA+C;IAC5F,IAAI,SAAS,WAAW,KAAK;KAC3B,MAAM,QAAQ,SAAS,QAAQ,IAAI,8BAA8B;KACjE,MAAM,IAAI,MACR,kCAAkC,SAAS,aAAa,KAAK,KAAK,IAAI,gBAAgB,MAAM,KAAK,IACnG;IACF;IACA,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,gBAAgB,UAAU,oBAAoB,QAAQ,MAAM;GAC3E,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,gBAAgB;GAClC;GACA,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAK,KAAK,KAAK,KAAiB,KAAA;GACrF,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,aAAa,UAAU,MAAM,IAAI,MAAM,gBAAgB;GAE1F,IAAI,CAAC,YADS,YAAY,MAAM,UAAU,eACrB,GAAG,WAAW,GAAG,MAAM,IAAI,MAAM,gBAAgB;GACtE,MAAM,YAAY,SAAS,QAAQ,IAAI,6BAA6B;GACpE,MAAM,eAAe,MAAM;GAC3B,OAAO;IACL,MAAM,MAAM;IACZ,UAAU;IACV,GAAI,aAAa,yBAAyB,KAAK,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;IAC7E,GAAI,OAAO,iBAAiB,YAAY,yBAAyB,KAAK,YAAY,IAAI,EAAE,aAAa,IAAI,CAAC;GAC5G;EACF;CACF;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../src/services/chatgptImages/index.ts"],"sourcesContent":["import { CHATGPT_SIGN_IN_HINT, chatgptCredentials, readBoundedJson } from '../chatgptAuth';\nimport type { ChatgptBackendDependencies, ImageGenerationRequest } from './type';\n\nconst BASE_URL = 'https://chatgpt.com/backend-api/codex/images/';\nconst MAX_IMAGE_BYTES = 32 * 1024 * 1024;\nconst MAX_REFERENCE_BYTES = 20 * 1024 * 1024;\nconst MAX_REFERENCES_BYTES = 50 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES = Math.ceil((MAX_IMAGE_BYTES * 4) / 3) + 1024 * 1024;\nconst LOGIN_MESSAGE = `Image generation needs a ChatGPT sign-in. ${CHATGPT_SIGN_IN_HINT}`;\nconst INVALID_RESPONSE = 'Image generation returned an invalid image.';\nconst PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\nfunction decodeImage(data: string, limit: number): Buffer {\n  if (!data || data.length > Math.ceil((limit * 4) / 3) + 4 || !/^[A-Za-z0-9+/]*={0,2}$/.test(data))\n    throw new Error(INVALID_RESPONSE);\n  const bytes = Buffer.from(data, 'base64');\n  if (bytes.length > limit || bytes.toString('base64') !== data) throw new Error(INVALID_RESPONSE);\n  return bytes;\n}\n\nfunction matchesMime(bytes: Buffer, mimeType: string): boolean {\n  if (mimeType === 'image/png') return bytes.subarray(0, 8).equals(PNG_SIGNATURE);\n  if (mimeType === 'image/jpeg') return bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;\n  return (\n    mimeType === 'image/webp' && bytes.toString('ascii', 0, 4) === 'RIFF' && bytes.toString('ascii', 8, 12) === 'WEBP'\n  );\n}\n\n/** Host-only transport: authentication never crosses the package boundary. */\nexport function createChatgptImageClient(dependencies: ChatgptBackendDependencies) {\n  return {\n    available: () => dependencies.available(),\n    async generate(request: ImageGenerationRequest) {\n      request.signal?.throwIfAborted();\n      if (typeof request.prompt !== 'string' || !request.prompt.trim()) throw new Error('An image prompt is required.');\n      if (request.transparentBackground !== undefined && typeof request.transparentBackground !== 'boolean')\n        throw new Error('Invalid transparency option.');\n      if (typeof request.correlationId !== 'string' || !/^[\\x21-\\x7e]{1,1024}$/.test(request.correlationId))\n        throw new Error('Invalid image operation identifier.');\n      if (request.images !== undefined && (!Array.isArray(request.images) || request.images.length > 5))\n        throw new Error('At most five reference images are supported.');\n      let total = 0;\n      for (const image of request.images ?? []) {\n        if (!record(image) || typeof image.data !== 'string' || typeof image.mimeType !== 'string')\n          throw new Error('Invalid reference image.');\n        const bytes = decodeImage(image.data, MAX_REFERENCE_BYTES);\n        total += bytes.length;\n        if (total > MAX_REFERENCES_BYTES || !matchesMime(bytes, image.mimeType))\n          throw new Error('Invalid or oversized reference image.');\n      }\n      const { token, accountId: id } = await chatgptCredentials(dependencies, LOGIN_MESSAGE, request.signal);\n      let response: Response;\n      try {\n        response = await (dependencies.fetch ?? globalThis.fetch)(\n          BASE_URL + (request.images?.length ? 'edits' : 'generations'),\n          {\n            method: 'POST',\n            redirect: 'error',\n            signal: request.signal,\n            headers: {\n              Authorization: `Bearer ${token}`,\n              'chatgpt-account-id': id,\n              originator: 'po_image_gen',\n              'User-Agent': '@agimon-ai/po-image-gen',\n              'Content-Type': 'application/json',\n              'x-codex-image-turn-id': request.correlationId,\n            },\n            body: JSON.stringify({\n              prompt: request.prompt,\n              background: request.transparentBackground ? 'transparent' : 'opaque',\n              model: 'gpt-image-2',\n              quality: 'auto',\n              size: 'auto',\n              ...(request.images?.length\n                ? {\n                    images: request.images.map((image) => ({\n                      image_url: `data:${image.mimeType};base64,${image.data}`,\n                    })),\n                  }\n                : {}),\n            }),\n          },\n        );\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error('Image generation request failed.');\n      }\n      if (!response.ok) {\n        await response.body?.cancel().catch(() => undefined);\n        if (response.status === 401) throw new Error(LOGIN_MESSAGE);\n        if (response.status === 403) throw new Error('Image generation was denied for this account.');\n        if (response.status === 429) {\n          const reset = response.headers.get('x-image-gen-primary-reset-at');\n          throw new Error(\n            `Image generation quota reached.${reset && /^\\d{1,12}$/.test(reset) ? ` Reset time: ${reset}.` : ''}`,\n          );\n        }\n        throw new Error('Image generation request failed.');\n      }\n      let body: unknown;\n      try {\n        body = await readBoundedJson(response, MAX_RESPONSE_BYTES, request.signal);\n      } catch {\n        request.signal?.throwIfAborted();\n        throw new Error(INVALID_RESPONSE);\n      }\n      const first = record(body) && Array.isArray(body.data) ? (body.data[0] as unknown) : undefined;\n      if (!record(first) || typeof first.b64_json !== 'string') throw new Error(INVALID_RESPONSE);\n      const bytes = decodeImage(first.b64_json, MAX_IMAGE_BYTES);\n      if (!matchesMime(bytes, 'image/png')) throw new Error(INVALID_RESPONSE);\n      const requestId = response.headers.get('x-codex-imagegen-request-id');\n      const generationId = first.generation_id;\n      return {\n        data: first.b64_json,\n        mimeType: 'image/png' as const,\n        ...(requestId && /^[A-Za-z0-9_-]{1,256}$/.test(requestId) ? { requestId } : {}),\n        ...(typeof generationId === 'string' && /^[A-Za-z0-9_-]{1,256}$/.test(generationId) ? { generationId } : {}),\n      };\n    },\n  };\n}\n"],"mappings":";;AAGA,MAAM,WAAW;AACjB,MAAM,kBAAkB;AACxB,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,qBAAqB,KAAK,KAAM,kBAAkB,IAAK,CAAC,IAAI;AAClE,MAAM,gBAAgB,6CAA6C;AACnE,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,OAAO,KAAK;CAAC;CAAK;CAAI;CAAI;CAAI;CAAI;CAAI;CAAI;AAAE,CAAC;AAEnE,SAAS,OAAO,OAAkD;CAChE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AACA,SAAS,YAAY,MAAc,OAAuB;CACxD,IAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,KAAM,QAAQ,IAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,IAAI,GAC9F,MAAM,IAAI,MAAM,gBAAgB;CAClC,MAAM,QAAQ,OAAO,KAAK,MAAM,QAAQ;CACxC,IAAI,MAAM,SAAS,SAAS,MAAM,SAAS,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,gBAAgB;CAC/F,OAAO;AACT;AAEA,SAAS,YAAY,OAAe,UAA2B;CAC7D,IAAI,aAAa,aAAa,OAAO,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,aAAa;CAC9E,IAAI,aAAa,cAAc,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO,OAAO,MAAM,OAAO;CAC3F,OACE,aAAa,gBAAgB,MAAM,SAAS,SAAS,GAAG,CAAC,MAAM,UAAU,MAAM,SAAS,SAAS,GAAG,EAAE,MAAM;AAEhH;;AAGA,SAAgB,yBAAyB,cAA0C;CACjF,OAAO;EACL,iBAAiB,aAAa,UAAU;EACxC,MAAM,SAAS,SAAiC;GAC9C,QAAQ,QAAQ,eAAe;GAC/B,IAAI,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAI,MAAM,8BAA8B;GAChH,IAAI,QAAQ,0BAA0B,KAAA,KAAa,OAAO,QAAQ,0BAA0B,WAC1F,MAAM,IAAI,MAAM,8BAA8B;GAChD,IAAI,OAAO,QAAQ,kBAAkB,YAAY,CAAC,wBAAwB,KAAK,QAAQ,aAAa,GAClG,MAAM,IAAI,MAAM,qCAAqC;GACvD,IAAI,QAAQ,WAAW,KAAA,MAAc,CAAC,MAAM,QAAQ,QAAQ,MAAM,KAAK,QAAQ,OAAO,SAAS,IAC7F,MAAM,IAAI,MAAM,8CAA8C;GAChE,IAAI,QAAQ;GACZ,KAAK,MAAM,SAAS,QAAQ,UAAU,CAAC,GAAG;IACxC,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,aAAa,UAChF,MAAM,IAAI,MAAM,0BAA0B;IAC5C,MAAM,QAAQ,YAAY,MAAM,MAAM,mBAAmB;IACzD,SAAS,MAAM;IACf,IAAI,QAAQ,wBAAwB,CAAC,YAAY,OAAO,MAAM,QAAQ,GACpE,MAAM,IAAI,MAAM,uCAAuC;GAC3D;GACA,MAAM,EAAE,OAAO,WAAW,OAAO,MAAM,mBAAmB,cAAc,eAAe,QAAQ,MAAM;GACrG,IAAI;GACJ,IAAI;IACF,WAAW,OAAO,aAAa,SAAS,WAAW,MAAA,CACjD,YAAY,QAAQ,QAAQ,SAAS,UAAU,gBAC/C;KACE,QAAQ;KACR,UAAU;KACV,QAAQ,QAAQ;KAChB,SAAS;MACP,eAAe,UAAU;MACzB,sBAAsB;MACtB,YAAY;MACZ,cAAc;MACd,gBAAgB;MAChB,yBAAyB,QAAQ;KACnC;KACA,MAAM,KAAK,UAAU;MACnB,QAAQ,QAAQ;MAChB,YAAY,QAAQ,wBAAwB,gBAAgB;MAC5D,OAAO;MACP,SAAS;MACT,MAAM;MACN,GAAI,QAAQ,QAAQ,SAChB,EACE,QAAQ,QAAQ,OAAO,KAAK,WAAW,EACrC,WAAW,QAAQ,MAAM,SAAS,UAAU,MAAM,OACpD,EAAE,EACJ,IACA,CAAC;KACP,CAAC;IACH,CACF;GACF,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACnD,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,aAAa;IAC1D,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,MAAM,+CAA+C;IAC5F,IAAI,SAAS,WAAW,KAAK;KAC3B,MAAM,QAAQ,SAAS,QAAQ,IAAI,8BAA8B;KACjE,MAAM,IAAI,MACR,kCAAkC,SAAS,aAAa,KAAK,KAAK,IAAI,gBAAgB,MAAM,KAAK,IACnG;IACF;IACA,MAAM,IAAI,MAAM,kCAAkC;GACpD;GACA,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,gBAAgB,UAAU,oBAAoB,QAAQ,MAAM;GAC3E,QAAQ;IACN,QAAQ,QAAQ,eAAe;IAC/B,MAAM,IAAI,MAAM,gBAAgB;GAClC;GACA,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,IAAK,KAAK,KAAK,KAAiB,KAAA;GACrF,IAAI,CAAC,OAAO,KAAK,KAAK,OAAO,MAAM,aAAa,UAAU,MAAM,IAAI,MAAM,gBAAgB;GAE1F,IAAI,CAAC,YADS,YAAY,MAAM,UAAU,eACrB,GAAG,WAAW,GAAG,MAAM,IAAI,MAAM,gBAAgB;GACtE,MAAM,YAAY,SAAS,QAAQ,IAAI,6BAA6B;GACpE,MAAM,eAAe,MAAM;GAC3B,OAAO;IACL,MAAM,MAAM;IACZ,UAAU;IACV,GAAI,aAAa,yBAAyB,KAAK,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;IAC7E,GAAI,OAAO,iBAAiB,YAAY,yBAAyB,KAAK,YAAY,IAAI,EAAE,aAAa,IAAI,CAAC;GAC5G;EACF;CACF;AACF"}