@happyvertical/auth 0.103.1 → 0.103.2

package/dist/local.d.ts

@@ -0,0 +1,58 @@
+export declare class ChatGPTSessionError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface ChatGPTSession {
+    subject: string;
+    email?: string;
+    clientId: string;
+    hostId: string;
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+    scopes: string[];
+    expiresAt: number;
+}
+export interface LocalChatGPTOptions {
+    appName: string;
+    path?: string;
+    openBrowser?: (url: string) => Promise<void> | void;
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+/**
+ * Stores credentials only in an owner-readable local file.  Callers should pass
+ * a per-application config path; no credential is ever written to a project.
+ */
+export declare class LocalChatGPTSessionManager {
+    private readonly options;
+    private pending;
+    private refreshing;
+    private readonly file;
+    private hostId?;
+    private readonly fetcher;
+    private readonly now;
+    private readonly remoteRevocationTimeoutMs;
+    constructor(options: LocalChatGPTOptions);
+    private disk;
+    private generation;
+    private processIsAlive;
+    private locked;
+    private save;
+    sessions(): Promise<Array<Omit<ChatGPTSession, 'accessToken' | 'refreshToken' | 'idToken'>>>;
+    begin(selectedClientId?: string): Promise<{
+        authorizationUrl: string;
+        callback: Promise<ChatGPTSession>;
+    }>;
+    private complete;
+    private verify;
+    /** Return a currently usable token, serializing rotating-token refreshes per registration. */
+    accessToken(clientId: string): Promise<string>;
+    refresh(clientId: string): Promise<ChatGPTSession>;
+    private doRefresh;
+    /** Clear local credentials after attempting remote refresh-token revocation. */
+    logout(clientId: string): Promise<{
+        remoteRevocationConfirmed: boolean;
+    }>;
+}
+//# sourceMappingURL=local.d.ts.map

package/dist/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../src/local.ts"],"names":[],"mappings":"AAuBA,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AACD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AA4CD;;;GAGG;AACH,qBAAa,0BAA0B;IAQzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAS;gBACtB,OAAO,EAAE,mBAAmB;YAK3C,IAAI;IAgBlB,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,cAAc;YAQR,MAAM;YAiCN,IAAI;IAQZ,QAAQ,IAAI,OAAO,CACvB,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC,CAAC,CACxE;IAKK,KAAK,CACT,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;KAAE,CAAC;YA0G7D,QAAQ;YAuGR,MAAM;IAyCpB,8FAA8F;IACxF,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAY9C,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YAS1C,SAAS;IA+JvB,gFAAgF;IAC1E,MAAM,CACV,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,yBAAyB,EAAE,OAAO,CAAA;KAAE,CAAC;CAoDnD"}

package/dist/local.js

@@ -0,0 +1,481 @@
+import { n as jwtVerify, t as createRemoteJWKSet } from "./chunks/remote-C3O0f74l.js";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+//#region src/local.ts
+/** Node-only local Sign in with ChatGPT session runtime. */
+var AUTHORIZE = "https://auth.openai.com/api/accounts/authorize";
+var TOKEN = "https://auth.openai.com/api/accounts/oauth/token";
+var DISCOVERY = "https://auth.openai.com/.well-known/openid-configuration";
+var RESOURCE = "https://api.openai.com/v1";
+var PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SCOPES = [
+	"openid",
+	"profile",
+	"email",
+	"offline_access",
+	"resource.invoke",
+	PLAN_SCOPE
+];
+var ChatGPTSessionError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "ChatGPTSessionError";
+	}
+};
+function b64(bytes) {
+	return Buffer.from(bytes).toString("base64url");
+}
+function random() {
+	return b64(randomBytes(32));
+}
+function pathFor(options) {
+	return options.path ?? join(process.env.XDG_CONFIG_HOME ?? join(process.env.HOME ?? tmpdir(), ".config"), options.appName, "chatgpt.json");
+}
+function required(value, label) {
+	if (!value) throw new ChatGPTSessionError("invalid_callback", `Missing ${label} in OAuth callback`);
+	return value;
+}
+/**
+* Stores credentials only in an owner-readable local file.  Callers should pass
+* a per-application config path; no credential is ever written to a project.
+*/
+var LocalChatGPTSessionManager = class {
+	options;
+	pending = /* @__PURE__ */ new Map();
+	refreshing = /* @__PURE__ */ new Map();
+	file;
+	hostId;
+	fetcher;
+	now;
+	remoteRevocationTimeoutMs = 5e3;
+	constructor(options) {
+		this.options = options;
+		this.file = pathFor(options);
+		this.fetcher = options.fetch ?? fetch;
+		this.now = options.now ?? Date.now;
+	}
+	async disk() {
+		try {
+			const disk = JSON.parse(await readFile(this.file, "utf8"));
+			this.hostId = disk.hostId;
+			return disk;
+		} catch (e) {
+			if (e?.code === "ENOENT") {
+				if (!this.hostId) this.hostId = `urn:uuid:${randomUUID()}`;
+				return {
+					hostId: this.hostId,
+					sessions: []
+				};
+			}
+			throw e;
+		}
+	}
+	generation(disk, clientId) {
+		return disk.generations?.[clientId] ?? 0;
+	}
+	processIsAlive(pid) {
+		try {
+			process.kill(pid, 0);
+			return true;
+		} catch (error) {
+			return error?.code !== "ESRCH";
+		}
+	}
+	async locked(operation) {
+		const mutex = `${this.file}.mutex.sqlite`;
+		await mkdir(dirname(this.file), {
+			recursive: true,
+			mode: 448
+		});
+		for (let attempt = 0; attempt < 200; attempt++) {
+			const database = new DatabaseSync(mutex, { timeout: 0 });
+			let busy = false;
+			try {
+				await chmod(mutex, 384);
+				try {
+					database.exec("BEGIN IMMEDIATE");
+				} catch (error) {
+					if (error?.code === "ERR_SQLITE_ERROR" && typeof error?.errcode === "number" && (error.errcode & 255) === 5) busy = true;
+					else throw error;
+				}
+				if (!busy) try {
+					return await operation();
+				} finally {
+					database.exec("ROLLBACK");
+				}
+			} finally {
+				database.close();
+			}
+			await new Promise((resolve) => setTimeout(resolve, 10));
+		}
+		throw new ChatGPTSessionError("storage_busy", "Credential storage is busy");
+	}
+	async save(disk) {
+		await mkdir(dirname(this.file), {
+			recursive: true,
+			mode: 448
+		});
+		const temp = `${this.file}.${randomUUID()}.tmp`;
+		await writeFile(temp, JSON.stringify(disk), { mode: 384 });
+		await chmod(temp, 384);
+		await rename(temp, this.file);
+		await chmod(this.file, 384);
+	}
+	async sessions() {
+		return (await this.disk()).sessions.map(({ accessToken, refreshToken, idToken, ...safe }) => safe);
+	}
+	async begin(selectedClientId) {
+		const disk = await this.locked(async () => {
+			const current = await this.disk();
+			await this.save(current);
+			return current;
+		});
+		const selected = selectedClientId ? disk.sessions.find((s) => s.clientId === selectedClientId) : void 0;
+		if (selectedClientId && !selected) throw new ChatGPTSessionError("unknown_account", "Selected ChatGPT account is not stored locally");
+		const state = random(), nonce = random(), verifier = random();
+		const challenge = b64(createHash("sha256").update(verifier).digest());
+		let resolve, reject;
+		const callback = new Promise((a, b) => {
+			resolve = a;
+			reject = b;
+		});
+		let redirectUri = "";
+		const server = createServer((req, res) => {
+			let url;
+			try {
+				url = new URL(req.url ?? "/", redirectUri);
+			} catch {
+				res.writeHead(400, { "Content-Type": "text/plain" });
+				res.end("Invalid sign-in callback.");
+				return;
+			}
+			if (!this.pending.has(state)) {
+				res.writeHead(400, { "Content-Type": "text/plain" });
+				res.end("Sign-in callback was already consumed.");
+				return;
+			}
+			const finish = async () => {
+				try {
+					const result = await this.complete(url, state);
+					res.writeHead(200, { "Content-Type": "text/plain" });
+					res.end("Sign-in complete. You may close this window.");
+					resolve(result);
+				} catch (error) {
+					res.writeHead(400, { "Content-Type": "text/plain" });
+					res.end("Sign-in failed. Return to the application.");
+					reject(error);
+				} finally {
+					server.close();
+					this.pending.delete(state);
+				}
+			};
+			finish();
+		});
+		await new Promise((resolveListen, rejectListen) => {
+			server.once("error", rejectListen);
+			server.listen(0, "127.0.0.1", () => resolveListen());
+		});
+		const address = server.address();
+		if (!address || typeof address === "string") throw new ChatGPTSessionError("loopback_unavailable", "Could not bind 127.0.0.1 loopback callback");
+		redirectUri = `http://127.0.0.1:${address.port}/auth/callback`;
+		const clientId = selected?.clientId ?? "dynamic_agent_client";
+		this.pending.set(state, {
+			state,
+			nonce,
+			verifier,
+			redirectUri,
+			clientId,
+			selected,
+			generation: selected ? this.generation(disk, selected.clientId) : 0,
+			server
+		});
+		const params = new URLSearchParams({
+			client_id: clientId,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: SCOPES.join(" "),
+			resource: RESOURCE,
+			state,
+			nonce,
+			code_challenge_method: "S256",
+			code_challenge: challenge,
+			ext_agent_host_id: disk.hostId
+		});
+		if (selected) {
+			params.set("id_token_hint", selected.idToken);
+			if (selected.email) params.set("login_hint", selected.email);
+		} else params.set("agent_name_hint", this.options.appName);
+		const authorizationUrl = `${AUTHORIZE}?${params}`;
+		try {
+			await this.options.openBrowser?.(authorizationUrl);
+		} catch (error) {
+			this.pending.delete(state);
+			await new Promise((resolveClose) => server.close(() => resolveClose()));
+			throw error;
+		}
+		return {
+			authorizationUrl,
+			callback
+		};
+	}
+	async complete(url, expectedState) {
+		const pending = this.pending.get(expectedState);
+		if (!pending || url.searchParams.get("state") !== expectedState) throw new ChatGPTSessionError("state_mismatch", "Rejected OAuth callback with unbound state");
+		if (url.searchParams.get("error")) throw new ChatGPTSessionError("consent_declined", "ChatGPT authorization was declined");
+		this.pending.delete(expectedState);
+		const code = required(url.searchParams.get("code"), "code");
+		const callbackClientId = url.searchParams.get("client_id");
+		const clientId = pending.selected ? pending.clientId : required(callbackClientId, "issued client_id");
+		if (!pending.selected && clientId === "dynamic_agent_client") throw new ChatGPTSessionError("registration_incomplete", "OAuth registration did not return an issued client id");
+		if (pending.selected && callbackClientId && callbackClientId !== clientId) throw new ChatGPTSessionError("client_mismatch", "OAuth callback changed the registered client");
+		const body = new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: clientId,
+			code,
+			code_verifier: pending.verifier,
+			redirect_uri: pending.redirectUri,
+			resource: RESOURCE
+		});
+		const response = await this.fetcher(TOKEN, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body
+		});
+		if (!response.ok) throw new ChatGPTSessionError("token_exchange_failed", "OAuth token exchange failed");
+		const token = await response.json();
+		const identity = await this.verify(token.id_token, clientId, pending.nonce);
+		const scopes = String(token.scope ?? "").split(" ").filter(Boolean);
+		if (!scopes.includes(PLAN_SCOPE)) throw new ChatGPTSessionError("plan_permission_missing", "ChatGPT plan usage permission was not granted");
+		const session = {
+			subject: identity.sub,
+			email: identity.email,
+			clientId,
+			hostId: (await this.disk()).hostId,
+			idToken: token.id_token,
+			accessToken: token.access_token,
+			refreshToken: token.refresh_token,
+			scopes,
+			expiresAt: this.now() + Number(token.expires_in ?? 0) * 1e3
+		};
+		if (!session.accessToken || !session.refreshToken) throw new ChatGPTSessionError("invalid_token_response", "OAuth response omitted renewable credentials");
+		if (pending.selected && session.subject !== pending.selected.subject) throw new ChatGPTSessionError("account_mismatch", "OAuth identity did not match the selected account");
+		await this.locked(async () => {
+			const disk = await this.disk();
+			if (pending.selected && this.generation(disk, clientId) !== pending.generation) throw new ChatGPTSessionError("session_invalidated", "ChatGPT session changed while authorization was in progress");
+			disk.sessions = [...disk.sessions.filter((s) => s.clientId !== clientId), session];
+			disk.generations = {
+				...disk.generations,
+				[clientId]: this.generation(disk, clientId) + 1
+			};
+			if (disk.refreshes) delete disk.refreshes[clientId];
+			await this.save(disk);
+		});
+		return session;
+	}
+	async verify(token, clientId, nonce) {
+		if (!token) throw new ChatGPTSessionError("invalid_token_response", "OAuth response omitted id_token");
+		const config = await (await this.fetcher(DISCOVERY)).json();
+		if (!config.jwks_uri) throw new ChatGPTSessionError("discovery_failed", "OpenID discovery did not supply JWKS");
+		const result = await jwtVerify(token, createRemoteJWKSet(new URL(config.jwks_uri)), {
+			issuer: "https://auth.openai.com",
+			audience: clientId
+		});
+		if (result.payload.nonce !== nonce || typeof result.payload.sub !== "string" || typeof result.payload.exp !== "number" || typeof result.payload.iat !== "number") throw new ChatGPTSessionError("invalid_identity", "OIDC token nonce or subject is invalid");
+		return {
+			sub: result.payload.sub,
+			email: typeof result.payload.email === "string" ? result.payload.email : void 0
+		};
+	}
+	/** Return a currently usable token, serializing rotating-token refreshes per registration. */
+	async accessToken(clientId) {
+		const session = (await this.disk()).sessions.find((s) => s.clientId === clientId);
+		if (!session) throw new ChatGPTSessionError("unknown_account", "Selected ChatGPT account is not stored locally");
+		if (session.expiresAt > this.now() + 6e4) return session.accessToken;
+		return (await this.refresh(clientId)).accessToken;
+	}
+	async refresh(clientId) {
+		const active = this.refreshing.get(clientId);
+		if (active) return active;
+		const refresh = this.doRefresh(clientId).finally(() => this.refreshing.delete(clientId));
+		this.refreshing.set(clientId, refresh);
+		return refresh;
+	}
+	async doRefresh(clientId) {
+		const leaseId = randomUUID();
+		let observedRefreshToken;
+		let current;
+		let generation = 0;
+		for (let attempt = 0; attempt < 200; attempt++) {
+			const claim = await this.locked(async () => {
+				const disk = await this.disk();
+				const session = disk.sessions.find((s) => s.clientId === clientId);
+				if (!session) throw new ChatGPTSessionError("unknown_account", "Selected ChatGPT account is not stored locally");
+				observedRefreshToken ??= session.refreshToken;
+				if (session.refreshToken !== observedRefreshToken) return {
+					kind: "updated",
+					session
+				};
+				const active = disk.refreshes?.[clientId];
+				if (active && this.processIsAlive(active.pid)) return { kind: "wait" };
+				disk.refreshes = {
+					...disk.refreshes,
+					[clientId]: {
+						id: leaseId,
+						pid: process.pid
+					}
+				};
+				await this.save(disk);
+				return {
+					kind: "owned",
+					session,
+					generation: this.generation(disk, clientId)
+				};
+			});
+			if (claim.kind === "updated") return claim.session;
+			if (claim.kind === "owned") {
+				current = claim.session;
+				generation = claim.generation;
+				break;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 10));
+		}
+		if (!current) throw new ChatGPTSessionError("storage_busy", "Credential refresh is already in progress");
+		const releaseLease = async () => {
+			await this.locked(async () => {
+				const disk = await this.disk();
+				if (disk.refreshes?.[clientId]?.id === leaseId) {
+					delete disk.refreshes[clientId];
+					await this.save(disk);
+				}
+			});
+		};
+		const invalidate = async (code, message) => {
+			await this.locked(async () => {
+				const disk = await this.disk();
+				if (disk.refreshes?.[clientId]?.id === leaseId && this.generation(disk, clientId) === generation && disk.sessions.find((session) => session.clientId === clientId)?.refreshToken === current.refreshToken) {
+					disk.sessions = disk.sessions.filter((s) => s.clientId !== clientId);
+					disk.generations = {
+						...disk.generations,
+						[clientId]: generation + 1
+					};
+					delete disk.refreshes[clientId];
+					await this.save(disk);
+				}
+			});
+			throw new ChatGPTSessionError(code, message);
+		};
+		let response;
+		try {
+			response = await this.fetcher(TOKEN, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					grant_type: "refresh_token",
+					client_id: current.clientId,
+					refresh_token: current.refreshToken,
+					resource: RESOURCE
+				})
+			});
+		} catch (error) {
+			await releaseLease();
+			throw error;
+		}
+		if (!response.ok) {
+			if (response.status === 400 || response.status === 401) return invalidate("refresh_invalid", "Saved ChatGPT session is no longer renewable; sign in again");
+			await releaseLease();
+			throw new ChatGPTSessionError("refresh_failed", "ChatGPT session refresh failed; credentials were retained");
+		}
+		let token;
+		try {
+			token = await response.json();
+		} catch (error) {
+			await releaseLease();
+			throw error;
+		}
+		if (!token.access_token || !token.refresh_token) {
+			await releaseLease();
+			throw new ChatGPTSessionError("invalid_refresh_response", "Refresh response omitted replacement credentials");
+		}
+		const scopes = String(token.scope ?? current.scopes.join(" ")).split(" ").filter(Boolean);
+		if (!scopes.includes(PLAN_SCOPE)) return invalidate("plan_permission_missing", "ChatGPT plan usage permission was not granted");
+		const updated = {
+			...current,
+			accessToken: token.access_token,
+			refreshToken: token.refresh_token,
+			idToken: token.id_token ?? current.idToken,
+			scopes,
+			expiresAt: this.now() + Number(token.expires_in ?? 0) * 1e3
+		};
+		return this.locked(async () => {
+			const disk = await this.disk();
+			const stored = disk.sessions.find((s) => s.clientId === clientId);
+			const ownsLease = disk.refreshes?.[clientId]?.id === leaseId;
+			if (!ownsLease || this.generation(disk, clientId) !== generation || stored?.refreshToken !== current.refreshToken) {
+				if (ownsLease) {
+					delete disk.refreshes[clientId];
+					await this.save(disk);
+				}
+				throw new ChatGPTSessionError("session_invalidated", "ChatGPT session changed while refresh was in progress");
+			}
+			disk.sessions = disk.sessions.map((s) => s.clientId === clientId ? updated : s);
+			delete disk.refreshes[clientId];
+			await this.save(disk);
+			return updated;
+		});
+	}
+	/** Clear local credentials after attempting remote refresh-token revocation. */
+	async logout(clientId) {
+		const current = await this.locked(async () => {
+			const disk = await this.disk();
+			const current = disk.sessions.find((s) => s.clientId === clientId);
+			if (!current) return void 0;
+			disk.sessions = disk.sessions.filter((s) => s.clientId !== clientId);
+			disk.generations = {
+				...disk.generations,
+				[clientId]: this.generation(disk, clientId) + 1
+			};
+			if (disk.refreshes) delete disk.refreshes[clientId];
+			await this.save(disk);
+			return current;
+		});
+		if (!current) return { remoteRevocationConfirmed: true };
+		const controller = new AbortController();
+		let timer;
+		try {
+			return { remoteRevocationConfirmed: await Promise.race([(async () => {
+				const discovery = await (await this.fetcher(DISCOVERY, { signal: controller.signal })).json();
+				if (!discovery.revocation_endpoint) return false;
+				const body = new URLSearchParams({
+					token: current.refreshToken,
+					token_type_hint: "refresh_token",
+					client_id: current.clientId
+				});
+				return (await this.fetcher(discovery.revocation_endpoint, {
+					method: "POST",
+					headers: { "content-type": "application/x-www-form-urlencoded" },
+					body,
+					signal: controller.signal
+				})).ok;
+			})(), new Promise((resolve) => {
+				timer = setTimeout(() => {
+					controller.abort();
+					resolve(false);
+				}, this.remoteRevocationTimeoutMs);
+			})]) };
+		} catch {
+			return { remoteRevocationConfirmed: false };
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+	}
+};
+//#endregion
+export { ChatGPTSessionError, LocalChatGPTSessionManager };
+
+//# sourceMappingURL=local.js.map

package/dist/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","names":[],"sources":["../src/local.ts"],"sourcesContent":["/** Node-only local Sign in with ChatGPT session runtime. */\nimport { createHash, randomBytes, randomUUID } from 'node:crypto';\nimport { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';\nimport { createServer } from 'node:http';\nimport { tmpdir } from 'node:os';\nimport { dirname, join } from 'node:path';\nimport { DatabaseSync } from 'node:sqlite';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\n\nconst AUTHORIZE = 'https://auth.openai.com/api/accounts/authorize';\nconst TOKEN = 'https://auth.openai.com/api/accounts/oauth/token';\nconst DISCOVERY = 'https://auth.openai.com/.well-known/openid-configuration';\nconst RESOURCE = 'https://api.openai.com/v1';\nconst PLAN_SCOPE = 'chatgpt.tokens.use.direct';\nconst SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'offline_access',\n  'resource.invoke',\n  PLAN_SCOPE,\n];\n\nexport class ChatGPTSessionError extends Error {\n  constructor(\n    public readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = 'ChatGPTSessionError';\n  }\n}\nexport interface ChatGPTSession {\n  subject: string;\n  email?: string;\n  clientId: string;\n  hostId: string;\n  idToken: string;\n  accessToken: string;\n  refreshToken: string;\n  scopes: string[];\n  expiresAt: number;\n}\nexport interface LocalChatGPTOptions {\n  appName: string;\n  path?: string;\n  openBrowser?: (url: string) => Promise<void> | void;\n  fetch?: typeof fetch;\n  now?: () => number;\n}\ninterface Disk {\n  hostId: string;\n  sessions: ChatGPTSession[];\n  generations?: Record<string, number>;\n  refreshes?: Record<string, { id: string; pid: number }>;\n}\ninterface Pending {\n  state: string;\n  nonce: string;\n  verifier: string;\n  redirectUri: string;\n  clientId: string;\n  selected?: ChatGPTSession;\n  generation: number;\n  server: ReturnType<typeof createServer>;\n}\n\nfunction b64(bytes: Uint8Array) {\n  return Buffer.from(bytes).toString('base64url');\n}\nfunction random() {\n  return b64(randomBytes(32));\n}\nfunction pathFor(options: LocalChatGPTOptions) {\n  return (\n    options.path ??\n    join(\n      process.env.XDG_CONFIG_HOME ??\n        join(process.env.HOME ?? tmpdir(), '.config'),\n      options.appName,\n      'chatgpt.json',\n    )\n  );\n}\nfunction required(value: string | null, label: string) {\n  if (!value)\n    throw new ChatGPTSessionError(\n      'invalid_callback',\n      `Missing ${label} in OAuth callback`,\n    );\n  return value;\n}\n\n/**\n * Stores credentials only in an owner-readable local file.  Callers should pass\n * a per-application config path; no credential is ever written to a project.\n */\nexport class LocalChatGPTSessionManager {\n  private pending = new Map<string, Pending>();\n  private refreshing = new Map<string, Promise<ChatGPTSession>>();\n  private readonly file: string;\n  private hostId?: string;\n  private readonly fetcher: typeof fetch;\n  private readonly now: () => number;\n  private readonly remoteRevocationTimeoutMs = 5_000;\n  constructor(private readonly options: LocalChatGPTOptions) {\n    this.file = pathFor(options);\n    this.fetcher = options.fetch ?? fetch;\n    this.now = options.now ?? Date.now;\n  }\n  private async disk(): Promise<Disk> {\n    try {\n      const disk = JSON.parse(await readFile(this.file, 'utf8')) as Disk;\n      this.hostId = disk.hostId;\n      return disk;\n    } catch (e: any) {\n      if (e?.code === 'ENOENT') {\n        if (!this.hostId) this.hostId = `urn:uuid:${randomUUID()}`;\n        return {\n          hostId: this.hostId,\n          sessions: [],\n        };\n      }\n      throw e;\n    }\n  }\n  private generation(disk: Disk, clientId: string) {\n    return disk.generations?.[clientId] ?? 0;\n  }\n  private processIsAlive(pid: number) {\n    try {\n      process.kill(pid, 0);\n      return true;\n    } catch (error: any) {\n      return error?.code !== 'ESRCH';\n    }\n  }\n  private async locked<T>(operation: () => Promise<T>): Promise<T> {\n    const mutex = `${this.file}.mutex.sqlite`;\n    await mkdir(dirname(this.file), { recursive: true, mode: 0o700 });\n    for (let attempt = 0; attempt < 200; attempt++) {\n      const database = new DatabaseSync(mutex, { timeout: 0 });\n      let busy = false;\n      try {\n        await chmod(mutex, 0o600);\n        try {\n          database.exec('BEGIN IMMEDIATE');\n        } catch (error: any) {\n          if (\n            error?.code === 'ERR_SQLITE_ERROR' &&\n            typeof error?.errcode === 'number' &&\n            (error.errcode & 0xff) === 5\n          )\n            busy = true;\n          else throw error;\n        }\n        if (!busy) {\n          try {\n            return await operation();\n          } finally {\n            database.exec('ROLLBACK');\n          }\n        }\n      } finally {\n        database.close();\n      }\n      await new Promise((resolve) => setTimeout(resolve, 10));\n    }\n    throw new ChatGPTSessionError('storage_busy', 'Credential storage is busy');\n  }\n  private async save(disk: Disk) {\n    await mkdir(dirname(this.file), { recursive: true, mode: 0o700 });\n    const temp = `${this.file}.${randomUUID()}.tmp`;\n    await writeFile(temp, JSON.stringify(disk), { mode: 0o600 });\n    await chmod(temp, 0o600);\n    await rename(temp, this.file);\n    await chmod(this.file, 0o600);\n  }\n  async sessions(): Promise<\n    Array<Omit<ChatGPTSession, 'accessToken' | 'refreshToken' | 'idToken'>>\n  > {\n    return (await this.disk()).sessions.map(\n      ({ accessToken, refreshToken, idToken, ...safe }) => safe,\n    );\n  }\n  async begin(\n    selectedClientId?: string,\n  ): Promise<{ authorizationUrl: string; callback: Promise<ChatGPTSession> }> {\n    const disk = await this.locked(async () => {\n      const current = await this.disk();\n      await this.save(current);\n      return current;\n    });\n    const selected = selectedClientId\n      ? disk.sessions.find((s) => s.clientId === selectedClientId)\n      : undefined;\n    if (selectedClientId && !selected)\n      throw new ChatGPTSessionError(\n        'unknown_account',\n        'Selected ChatGPT account is not stored locally',\n      );\n    const state = random(),\n      nonce = random(),\n      verifier = random();\n    const challenge = b64(createHash('sha256').update(verifier).digest());\n    let resolve!: (value: ChatGPTSession) => void,\n      reject!: (reason: Error) => void;\n    const callback = new Promise<ChatGPTSession>((a, b) => {\n      resolve = a;\n      reject = b;\n    });\n    let redirectUri = '';\n    const server = createServer((req, res) => {\n      let url: URL;\n      try {\n        url = new URL(req.url ?? '/', redirectUri);\n      } catch {\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('Invalid sign-in callback.');\n        return;\n      }\n      if (!this.pending.has(state)) {\n        res.writeHead(400, { 'Content-Type': 'text/plain' });\n        res.end('Sign-in callback was already consumed.');\n        return;\n      }\n      const finish = async () => {\n        try {\n          const result = await this.complete(url, state);\n          res.writeHead(200, { 'Content-Type': 'text/plain' });\n          res.end('Sign-in complete. You may close this window.');\n          resolve(result);\n        } catch (error) {\n          res.writeHead(400, { 'Content-Type': 'text/plain' });\n          res.end('Sign-in failed. Return to the application.');\n          reject(error as Error);\n        } finally {\n          server.close();\n          this.pending.delete(state);\n        }\n      };\n      void finish();\n    });\n    await new Promise<void>((resolveListen, rejectListen) => {\n      server.once('error', rejectListen);\n      server.listen(0, '127.0.0.1', () => resolveListen());\n    });\n    const address = server.address();\n    if (!address || typeof address === 'string')\n      throw new ChatGPTSessionError(\n        'loopback_unavailable',\n        'Could not bind 127.0.0.1 loopback callback',\n      );\n    redirectUri = `http://127.0.0.1:${address.port}/auth/callback`;\n    const clientId = selected?.clientId ?? 'dynamic_agent_client';\n    this.pending.set(state, {\n      state,\n      nonce,\n      verifier,\n      redirectUri,\n      clientId,\n      selected,\n      generation: selected ? this.generation(disk, selected.clientId) : 0,\n      server,\n    });\n    const params = new URLSearchParams({\n      client_id: clientId,\n      response_type: 'code',\n      redirect_uri: redirectUri,\n      scope: SCOPES.join(' '),\n      resource: RESOURCE,\n      state,\n      nonce,\n      code_challenge_method: 'S256',\n      code_challenge: challenge,\n      ext_agent_host_id: disk.hostId,\n    });\n    if (selected) {\n      params.set('id_token_hint', selected.idToken);\n      if (selected.email) params.set('login_hint', selected.email);\n    } else params.set('agent_name_hint', this.options.appName);\n    const authorizationUrl = `${AUTHORIZE}?${params}`;\n    try {\n      await this.options.openBrowser?.(authorizationUrl);\n    } catch (error) {\n      this.pending.delete(state);\n      await new Promise<void>((resolveClose) =>\n        server.close(() => resolveClose()),\n      );\n      throw error;\n    }\n    return { authorizationUrl, callback };\n  }\n  private async complete(\n    url: URL,\n    expectedState: string,\n  ): Promise<ChatGPTSession> {\n    const pending = this.pending.get(expectedState);\n    if (!pending || url.searchParams.get('state') !== expectedState)\n      throw new ChatGPTSessionError(\n        'state_mismatch',\n        'Rejected OAuth callback with unbound state',\n      );\n    if (url.searchParams.get('error'))\n      throw new ChatGPTSessionError(\n        'consent_declined',\n        'ChatGPT authorization was declined',\n      );\n    this.pending.delete(expectedState);\n    const code = required(url.searchParams.get('code'), 'code');\n    const callbackClientId = url.searchParams.get('client_id');\n    const clientId = pending.selected\n      ? pending.clientId\n      : required(callbackClientId, 'issued client_id');\n    if (!pending.selected && clientId === 'dynamic_agent_client')\n      throw new ChatGPTSessionError(\n        'registration_incomplete',\n        'OAuth registration did not return an issued client id',\n      );\n    if (pending.selected && callbackClientId && callbackClientId !== clientId)\n      throw new ChatGPTSessionError(\n        'client_mismatch',\n        'OAuth callback changed the registered client',\n      );\n    const body = new URLSearchParams({\n      grant_type: 'authorization_code',\n      client_id: clientId,\n      code,\n      code_verifier: pending.verifier,\n      redirect_uri: pending.redirectUri,\n      resource: RESOURCE,\n    });\n    const response = await this.fetcher(TOKEN, {\n      method: 'POST',\n      headers: { 'content-type': 'application/x-www-form-urlencoded' },\n      body,\n    });\n    if (!response.ok)\n      throw new ChatGPTSessionError(\n        'token_exchange_failed',\n        'OAuth token exchange failed',\n      );\n    const token: any = await response.json();\n    const identity = await this.verify(token.id_token, clientId, pending.nonce);\n    const scopes = String(token.scope ?? '')\n      .split(' ')\n      .filter(Boolean);\n    if (!scopes.includes(PLAN_SCOPE))\n      throw new ChatGPTSessionError(\n        'plan_permission_missing',\n        'ChatGPT plan usage permission was not granted',\n      );\n    const session: ChatGPTSession = {\n      subject: identity.sub,\n      email: identity.email,\n      clientId,\n      hostId: (await this.disk()).hostId,\n      idToken: token.id_token,\n      accessToken: token.access_token,\n      refreshToken: token.refresh_token,\n      scopes,\n      expiresAt: this.now() + Number(token.expires_in ?? 0) * 1000,\n    };\n    if (!session.accessToken || !session.refreshToken)\n      throw new ChatGPTSessionError(\n        'invalid_token_response',\n        'OAuth response omitted renewable credentials',\n      );\n    if (pending.selected && session.subject !== pending.selected.subject)\n      throw new ChatGPTSessionError(\n        'account_mismatch',\n        'OAuth identity did not match the selected account',\n      );\n    await this.locked(async () => {\n      const disk = await this.disk();\n      if (\n        pending.selected &&\n        this.generation(disk, clientId) !== pending.generation\n      )\n        throw new ChatGPTSessionError(\n          'session_invalidated',\n          'ChatGPT session changed while authorization was in progress',\n        );\n      disk.sessions = [\n        ...disk.sessions.filter((s) => s.clientId !== clientId),\n        session,\n      ];\n      disk.generations = {\n        ...disk.generations,\n        [clientId]: this.generation(disk, clientId) + 1,\n      };\n      if (disk.refreshes) delete disk.refreshes[clientId];\n      await this.save(disk);\n    });\n    return session;\n  }\n  private async verify(\n    token: string,\n    clientId: string,\n    nonce: string,\n  ): Promise<{ sub: string; email?: string }> {\n    if (!token)\n      throw new ChatGPTSessionError(\n        'invalid_token_response',\n        'OAuth response omitted id_token',\n      );\n    const config = (await (await this.fetcher(DISCOVERY)).json()) as {\n      jwks_uri?: string;\n    };\n    if (!config.jwks_uri)\n      throw new ChatGPTSessionError(\n        'discovery_failed',\n        'OpenID discovery did not supply JWKS',\n      );\n    const result = await jwtVerify(\n      token,\n      createRemoteJWKSet(new URL(config.jwks_uri)),\n      { issuer: 'https://auth.openai.com', audience: clientId },\n    );\n    if (\n      result.payload.nonce !== nonce ||\n      typeof result.payload.sub !== 'string' ||\n      typeof result.payload.exp !== 'number' ||\n      typeof result.payload.iat !== 'number'\n    )\n      throw new ChatGPTSessionError(\n        'invalid_identity',\n        'OIDC token nonce or subject is invalid',\n      );\n    return {\n      sub: result.payload.sub,\n      email:\n        typeof result.payload.email === 'string'\n          ? result.payload.email\n          : undefined,\n    };\n  }\n  /** Return a currently usable token, serializing rotating-token refreshes per registration. */\n  async accessToken(clientId: string): Promise<string> {\n    const session = (await this.disk()).sessions.find(\n      (s) => s.clientId === clientId,\n    );\n    if (!session)\n      throw new ChatGPTSessionError(\n        'unknown_account',\n        'Selected ChatGPT account is not stored locally',\n      );\n    if (session.expiresAt > this.now() + 60_000) return session.accessToken;\n    return (await this.refresh(clientId)).accessToken;\n  }\n  async refresh(clientId: string): Promise<ChatGPTSession> {\n    const active = this.refreshing.get(clientId);\n    if (active) return active;\n    const refresh = this.doRefresh(clientId).finally(() =>\n      this.refreshing.delete(clientId),\n    );\n    this.refreshing.set(clientId, refresh);\n    return refresh;\n  }\n  private async doRefresh(clientId: string): Promise<ChatGPTSession> {\n    const leaseId = randomUUID();\n    let observedRefreshToken: string | undefined;\n    let current: ChatGPTSession | undefined;\n    let generation = 0;\n    for (let attempt = 0; attempt < 200; attempt++) {\n      const claim = await this.locked(async () => {\n        const disk = await this.disk();\n        const session = disk.sessions.find((s) => s.clientId === clientId);\n        if (!session)\n          throw new ChatGPTSessionError(\n            'unknown_account',\n            'Selected ChatGPT account is not stored locally',\n          );\n        observedRefreshToken ??= session.refreshToken;\n        if (session.refreshToken !== observedRefreshToken)\n          return { kind: 'updated' as const, session };\n        const active = disk.refreshes?.[clientId];\n        if (active && this.processIsAlive(active.pid))\n          return { kind: 'wait' as const };\n        disk.refreshes = {\n          ...disk.refreshes,\n          [clientId]: { id: leaseId, pid: process.pid },\n        };\n        await this.save(disk);\n        return {\n          kind: 'owned' as const,\n          session,\n          generation: this.generation(disk, clientId),\n        };\n      });\n      if (claim.kind === 'updated') return claim.session;\n      if (claim.kind === 'owned') {\n        current = claim.session;\n        generation = claim.generation;\n        break;\n      }\n      await new Promise((resolve) => setTimeout(resolve, 10));\n    }\n    if (!current)\n      throw new ChatGPTSessionError(\n        'storage_busy',\n        'Credential refresh is already in progress',\n      );\n\n    const releaseLease = async () => {\n      await this.locked(async () => {\n        const disk = await this.disk();\n        if (disk.refreshes?.[clientId]?.id === leaseId) {\n          delete disk.refreshes[clientId];\n          await this.save(disk);\n        }\n      });\n    };\n    const invalidate = async (code: string, message: string) => {\n      await this.locked(async () => {\n        const disk = await this.disk();\n        if (\n          disk.refreshes?.[clientId]?.id === leaseId &&\n          this.generation(disk, clientId) === generation &&\n          disk.sessions.find((session) => session.clientId === clientId)\n            ?.refreshToken === current.refreshToken\n        ) {\n          disk.sessions = disk.sessions.filter((s) => s.clientId !== clientId);\n          disk.generations = {\n            ...disk.generations,\n            [clientId]: generation + 1,\n          };\n          delete disk.refreshes[clientId];\n          await this.save(disk);\n        }\n      });\n      throw new ChatGPTSessionError(code, message);\n    };\n\n    let response: Response;\n    try {\n      response = await this.fetcher(TOKEN, {\n        method: 'POST',\n        headers: { 'content-type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          client_id: current.clientId,\n          refresh_token: current.refreshToken,\n          resource: RESOURCE,\n        }),\n      });\n    } catch (error) {\n      await releaseLease();\n      throw error;\n    }\n    if (!response.ok) {\n      if (response.status === 400 || response.status === 401)\n        return invalidate(\n          'refresh_invalid',\n          'Saved ChatGPT session is no longer renewable; sign in again',\n        );\n      await releaseLease();\n      throw new ChatGPTSessionError(\n        'refresh_failed',\n        'ChatGPT session refresh failed; credentials were retained',\n      );\n    }\n    let token: any;\n    try {\n      token = await response.json();\n    } catch (error) {\n      await releaseLease();\n      throw error;\n    }\n    if (!token.access_token || !token.refresh_token) {\n      await releaseLease();\n      throw new ChatGPTSessionError(\n        'invalid_refresh_response',\n        'Refresh response omitted replacement credentials',\n      );\n    }\n    const scopes = String(token.scope ?? current.scopes.join(' '))\n      .split(' ')\n      .filter(Boolean);\n    if (!scopes.includes(PLAN_SCOPE))\n      return invalidate(\n        'plan_permission_missing',\n        'ChatGPT plan usage permission was not granted',\n      );\n    const updated: ChatGPTSession = {\n      ...current,\n      accessToken: token.access_token,\n      refreshToken: token.refresh_token,\n      idToken: token.id_token ?? current.idToken,\n      scopes,\n      expiresAt: this.now() + Number(token.expires_in ?? 0) * 1000,\n    };\n    return this.locked(async () => {\n      const disk = await this.disk();\n      const stored = disk.sessions.find((s) => s.clientId === clientId);\n      const ownsLease = disk.refreshes?.[clientId]?.id === leaseId;\n      if (\n        !ownsLease ||\n        this.generation(disk, clientId) !== generation ||\n        stored?.refreshToken !== current.refreshToken\n      ) {\n        if (ownsLease) {\n          delete disk.refreshes![clientId];\n          await this.save(disk);\n        }\n        throw new ChatGPTSessionError(\n          'session_invalidated',\n          'ChatGPT session changed while refresh was in progress',\n        );\n      }\n      disk.sessions = disk.sessions.map((s) =>\n        s.clientId === clientId ? updated : s,\n      );\n      delete disk.refreshes![clientId];\n      await this.save(disk);\n      return updated;\n    });\n  }\n  /** Clear local credentials after attempting remote refresh-token revocation. */\n  async logout(\n    clientId: string,\n  ): Promise<{ remoteRevocationConfirmed: boolean }> {\n    const current = await this.locked(async () => {\n      const disk = await this.disk();\n      const current = disk.sessions.find((s) => s.clientId === clientId);\n      if (!current) return undefined;\n      disk.sessions = disk.sessions.filter((s) => s.clientId !== clientId);\n      disk.generations = {\n        ...disk.generations,\n        [clientId]: this.generation(disk, clientId) + 1,\n      };\n      if (disk.refreshes) delete disk.refreshes[clientId];\n      await this.save(disk);\n      return current;\n    });\n    if (!current) return { remoteRevocationConfirmed: true };\n\n    const controller = new AbortController();\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    try {\n      const confirmed = await Promise.race([\n        (async () => {\n          const discovery = (await (\n            await this.fetcher(DISCOVERY, { signal: controller.signal })\n          ).json()) as { revocation_endpoint?: string };\n          if (!discovery.revocation_endpoint) return false;\n          const body = new URLSearchParams({\n            token: current.refreshToken,\n            token_type_hint: 'refresh_token',\n            client_id: current.clientId,\n          });\n          const response = await this.fetcher(discovery.revocation_endpoint, {\n            method: 'POST',\n            headers: { 'content-type': 'application/x-www-form-urlencoded' },\n            body,\n            signal: controller.signal,\n          });\n          return response.ok;\n        })(),\n        new Promise<boolean>((resolve) => {\n          timer = setTimeout(() => {\n            controller.abort();\n            resolve(false);\n          }, this.remoteRevocationTimeoutMs);\n        }),\n      ]);\n      return { remoteRevocationConfirmed: confirmed };\n    } catch {\n      return { remoteRevocationConfirmed: false };\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AASA,IAAM,YAAY;AAClB,IAAM,QAAQ;AACd,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,aAAa;AACnB,IAAM,SAAS;CACb;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,IAAa,sBAAb,cAAyC,MAAM;CAE3B;CADlB,YACE,MACA,SACA;EACA,MAAM,OAAO;EAHG,KAAA,OAAA;EAIhB,KAAK,OAAO;CACd;AACF;AAoCA,SAAS,IAAI,OAAmB;CAC9B,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,WAAW;AAChD;AACA,SAAS,SAAS;CAChB,OAAO,IAAI,YAAY,EAAE,CAAC;AAC5B;AACA,SAAS,QAAQ,SAA8B;CAC7C,OACE,QAAQ,QACR,KACE,QAAQ,IAAI,mBACV,KAAK,QAAQ,IAAI,QAAQ,OAAO,GAAG,SAAS,GAC9C,QAAQ,SACR,cACF;AAEJ;AACA,SAAS,SAAS,OAAsB,OAAe;CACrD,IAAI,CAAC,OACH,MAAM,IAAI,oBACR,oBACA,WAAW,MAAM,mBACnB;CACF,OAAO;AACT;;;;;AAMA,IAAa,6BAAb,MAAwC;CAQT;CAP7B,0BAAkB,IAAI,IAAqB;CAC3C,6BAAqB,IAAI,IAAqC;CAC9D;CACA;CACA;CACA;CACA,4BAA6C;CAC7C,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,OAAO,QAAQ,OAAO;EAC3B,KAAK,UAAU,QAAQ,SAAS;EAChC,KAAK,MAAM,QAAQ,OAAO,KAAK;CACjC;CACA,MAAc,OAAsB;EAClC,IAAI;GACF,MAAM,OAAO,KAAK,MAAM,MAAM,SAAS,KAAK,MAAM,MAAM,CAAC;GACzD,KAAK,SAAS,KAAK;GACnB,OAAO;EACT,SAAS,GAAQ;GACf,IAAI,GAAG,SAAS,UAAU;IACxB,IAAI,CAAC,KAAK,QAAQ,KAAK,SAAS,YAAY,WAAW;IACvD,OAAO;KACL,QAAQ,KAAK;KACb,UAAU,CAAC;IACb;GACF;GACA,MAAM;EACR;CACF;CACA,WAAmB,MAAY,UAAkB;EAC/C,OAAO,KAAK,cAAc,aAAa;CACzC;CACA,eAAuB,KAAa;EAClC,IAAI;GACF,QAAQ,KAAK,KAAK,CAAC;GACnB,OAAO;EACT,SAAS,OAAY;GACnB,OAAO,OAAO,SAAS;EACzB;CACF;CACA,MAAc,OAAU,WAAyC;EAC/D,MAAM,QAAQ,GAAG,KAAK,KAAK;EAC3B,MAAM,MAAM,QAAQ,KAAK,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAChE,KAAK,IAAI,UAAU,GAAG,UAAU,KAAK,WAAW;GAC9C,MAAM,WAAW,IAAI,aAAa,OAAO,EAAE,SAAS,EAAE,CAAC;GACvD,IAAI,OAAO;GACX,IAAI;IACF,MAAM,MAAM,OAAO,GAAK;IACxB,IAAI;KACF,SAAS,KAAK,iBAAiB;IACjC,SAAS,OAAY;KACnB,IACE,OAAO,SAAS,sBAChB,OAAO,OAAO,YAAY,aACzB,MAAM,UAAU,SAAU,GAE3B,OAAO;UACJ,MAAM;IACb;IACA,IAAI,CAAC,MACH,IAAI;KACF,OAAO,MAAM,UAAU;IACzB,UAAU;KACR,SAAS,KAAK,UAAU;IAC1B;GAEJ,UAAU;IACR,SAAS,MAAM;GACjB;GACA,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EACxD;EACA,MAAM,IAAI,oBAAoB,gBAAgB,4BAA4B;CAC5E;CACA,MAAc,KAAK,MAAY;EAC7B,MAAM,MAAM,QAAQ,KAAK,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAChE,MAAM,OAAO,GAAG,KAAK,KAAK,GAAG,WAAW,EAAE;EAC1C,MAAM,UAAU,MAAM,KAAK,UAAU,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;EAC3D,MAAM,MAAM,MAAM,GAAK;EACvB,MAAM,OAAO,MAAM,KAAK,IAAI;EAC5B,MAAM,MAAM,KAAK,MAAM,GAAK;CAC9B;CACA,MAAM,WAEJ;EACA,QAAQ,MAAM,KAAK,KAAK,EAAA,CAAG,SAAS,KACjC,EAAE,aAAa,cAAc,SAAS,GAAG,WAAW,IACvD;CACF;CACA,MAAM,MACJ,kBAC0E;EAC1E,MAAM,OAAO,MAAM,KAAK,OAAO,YAAY;GACzC,MAAM,UAAU,MAAM,KAAK,KAAK;GAChC,MAAM,KAAK,KAAK,OAAO;GACvB,OAAO;EACT,CAAC;EACD,MAAM,WAAW,mBACb,KAAK,SAAS,MAAM,MAAM,EAAE,aAAa,gBAAgB,IACzD,KAAA;EACJ,IAAI,oBAAoB,CAAC,UACvB,MAAM,IAAI,oBACR,mBACA,gDACF;EACF,MAAM,QAAQ,OAAO,GACnB,QAAQ,OAAO,GACf,WAAW,OAAO;EACpB,MAAM,YAAY,IAAI,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,CAAC;EACpE,IAAI,SACF;EACF,MAAM,WAAW,IAAI,SAAyB,GAAG,MAAM;GACrD,UAAU;GACV,SAAS;EACX,CAAC;EACD,IAAI,cAAc;EAClB,MAAM,SAAS,cAAc,KAAK,QAAQ;GACxC,IAAI;GACJ,IAAI;IACF,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,WAAW;GAC3C,QAAQ;IACN,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;IACnD,IAAI,IAAI,2BAA2B;IACnC;GACF;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,KAAK,GAAG;IAC5B,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;IACnD,IAAI,IAAI,wCAAwC;IAChD;GACF;GACA,MAAM,SAAS,YAAY;IACzB,IAAI;KACF,MAAM,SAAS,MAAM,KAAK,SAAS,KAAK,KAAK;KAC7C,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;KACnD,IAAI,IAAI,8CAA8C;KACtD,QAAQ,MAAM;IAChB,SAAS,OAAO;KACd,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;KACnD,IAAI,IAAI,4CAA4C;KACpD,OAAO,KAAc;IACvB,UAAU;KACR,OAAO,MAAM;KACb,KAAK,QAAQ,OAAO,KAAK;IAC3B;GACF;GACA,OAAY;EACd,CAAC;EACD,MAAM,IAAI,SAAe,eAAe,iBAAiB;GACvD,OAAO,KAAK,SAAS,YAAY;GACjC,OAAO,OAAO,GAAG,mBAAmB,cAAc,CAAC;EACrD,CAAC;EACD,MAAM,UAAU,OAAO,QAAQ;EAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UACjC,MAAM,IAAI,oBACR,wBACA,4CACF;EACF,cAAc,oBAAoB,QAAQ,KAAK;EAC/C,MAAM,WAAW,UAAU,YAAY;EACvC,KAAK,QAAQ,IAAI,OAAO;GACtB;GACA;GACA;GACA;GACA;GACA;GACA,YAAY,WAAW,KAAK,WAAW,MAAM,SAAS,QAAQ,IAAI;GAClE;EACF,CAAC;EACD,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW;GACX,eAAe;GACf,cAAc;GACd,OAAO,OAAO,KAAK,GAAG;GACtB,UAAU;GACV;GACA;GACA,uBAAuB;GACvB,gBAAgB;GAChB,mBAAmB,KAAK;EAC1B,CAAC;EACD,IAAI,UAAU;GACZ,OAAO,IAAI,iBAAiB,SAAS,OAAO;GAC5C,IAAI,SAAS,OAAO,OAAO,IAAI,cAAc,SAAS,KAAK;EAC7D,OAAO,OAAO,IAAI,mBAAmB,KAAK,QAAQ,OAAO;EACzD,MAAM,mBAAmB,GAAG,UAAU,GAAG;EACzC,IAAI;GACF,MAAM,KAAK,QAAQ,cAAc,gBAAgB;EACnD,SAAS,OAAO;GACd,KAAK,QAAQ,OAAO,KAAK;GACzB,MAAM,IAAI,SAAe,iBACvB,OAAO,YAAY,aAAa,CAAC,CACnC;GACA,MAAM;EACR;EACA,OAAO;GAAE;GAAkB;EAAS;CACtC;CACA,MAAc,SACZ,KACA,eACyB;EACzB,MAAM,UAAU,KAAK,QAAQ,IAAI,aAAa;EAC9C,IAAI,CAAC,WAAW,IAAI,aAAa,IAAI,OAAO,MAAM,eAChD,MAAM,IAAI,oBACR,kBACA,4CACF;EACF,IAAI,IAAI,aAAa,IAAI,OAAO,GAC9B,MAAM,IAAI,oBACR,oBACA,oCACF;EACF,KAAK,QAAQ,OAAO,aAAa;EACjC,MAAM,OAAO,SAAS,IAAI,aAAa,IAAI,MAAM,GAAG,MAAM;EAC1D,MAAM,mBAAmB,IAAI,aAAa,IAAI,WAAW;EACzD,MAAM,WAAW,QAAQ,WACrB,QAAQ,WACR,SAAS,kBAAkB,kBAAkB;EACjD,IAAI,CAAC,QAAQ,YAAY,aAAa,wBACpC,MAAM,IAAI,oBACR,2BACA,uDACF;EACF,IAAI,QAAQ,YAAY,oBAAoB,qBAAqB,UAC/D,MAAM,IAAI,oBACR,mBACA,8CACF;EACF,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW;GACX;GACA,eAAe,QAAQ;GACvB,cAAc,QAAQ;GACtB,UAAU;EACZ,CAAC;EACD,MAAM,WAAW,MAAM,KAAK,QAAQ,OAAO;GACzC,QAAQ;GACR,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;EACF,CAAC;EACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,oBACR,yBACA,6BACF;EACF,MAAM,QAAa,MAAM,SAAS,KAAK;EACvC,MAAM,WAAW,MAAM,KAAK,OAAO,MAAM,UAAU,UAAU,QAAQ,KAAK;EAC1E,MAAM,SAAS,OAAO,MAAM,SAAS,EAAE,CAAC,CACrC,MAAM,GAAG,CAAC,CACV,OAAO,OAAO;EACjB,IAAI,CAAC,OAAO,SAAS,UAAU,GAC7B,MAAM,IAAI,oBACR,2BACA,+CACF;EACF,MAAM,UAA0B;GAC9B,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB;GACA,SAAS,MAAM,KAAK,KAAK,EAAA,CAAG;GAC5B,SAAS,MAAM;GACf,aAAa,MAAM;GACnB,cAAc,MAAM;GACpB;GACA,WAAW,KAAK,IAAI,IAAI,OAAO,MAAM,cAAc,CAAC,IAAI;EAC1D;EACA,IAAI,CAAC,QAAQ,eAAe,CAAC,QAAQ,cACnC,MAAM,IAAI,oBACR,0BACA,8CACF;EACF,IAAI,QAAQ,YAAY,QAAQ,YAAY,QAAQ,SAAS,SAC3D,MAAM,IAAI,oBACR,oBACA,mDACF;EACF,MAAM,KAAK,OAAO,YAAY;GAC5B,MAAM,OAAO,MAAM,KAAK,KAAK;GAC7B,IACE,QAAQ,YACR,KAAK,WAAW,MAAM,QAAQ,MAAM,QAAQ,YAE5C,MAAM,IAAI,oBACR,uBACA,6DACF;GACF,KAAK,WAAW,CACd,GAAG,KAAK,SAAS,QAAQ,MAAM,EAAE,aAAa,QAAQ,GACtD,OACF;GACA,KAAK,cAAc;IACjB,GAAG,KAAK;KACP,WAAW,KAAK,WAAW,MAAM,QAAQ,IAAI;GAChD;GACA,IAAI,KAAK,WAAW,OAAO,KAAK,UAAU;GAC1C,MAAM,KAAK,KAAK,IAAI;EACtB,CAAC;EACD,OAAO;CACT;CACA,MAAc,OACZ,OACA,UACA,OAC0C;EAC1C,IAAI,CAAC,OACH,MAAM,IAAI,oBACR,0BACA,iCACF;EACF,MAAM,SAAU,OAAO,MAAM,KAAK,QAAQ,SAAS,EAAA,CAAG,KAAK;EAG3D,IAAI,CAAC,OAAO,UACV,MAAM,IAAI,oBACR,oBACA,sCACF;EACF,MAAM,SAAS,MAAM,UACnB,OACA,mBAAmB,IAAI,IAAI,OAAO,QAAQ,CAAC,GAC3C;GAAE,QAAQ;GAA2B,UAAU;EAAS,CAC1D;EACA,IACE,OAAO,QAAQ,UAAU,SACzB,OAAO,OAAO,QAAQ,QAAQ,YAC9B,OAAO,OAAO,QAAQ,QAAQ,YAC9B,OAAO,OAAO,QAAQ,QAAQ,UAE9B,MAAM,IAAI,oBACR,oBACA,wCACF;EACF,OAAO;GACL,KAAK,OAAO,QAAQ;GACpB,OACE,OAAO,OAAO,QAAQ,UAAU,WAC5B,OAAO,QAAQ,QACf,KAAA;EACR;CACF;;CAEA,MAAM,YAAY,UAAmC;EACnD,MAAM,WAAW,MAAM,KAAK,KAAK,EAAA,CAAG,SAAS,MAC1C,MAAM,EAAE,aAAa,QACxB;EACA,IAAI,CAAC,SACH,MAAM,IAAI,oBACR,mBACA,gDACF;EACF,IAAI,QAAQ,YAAY,KAAK,IAAI,IAAI,KAAQ,OAAO,QAAQ;EAC5D,QAAQ,MAAM,KAAK,QAAQ,QAAQ,EAAA,CAAG;CACxC;CACA,MAAM,QAAQ,UAA2C;EACvD,MAAM,SAAS,KAAK,WAAW,IAAI,QAAQ;EAC3C,IAAI,QAAQ,OAAO;EACnB,MAAM,UAAU,KAAK,UAAU,QAAQ,CAAC,CAAC,cACvC,KAAK,WAAW,OAAO,QAAQ,CACjC;EACA,KAAK,WAAW,IAAI,UAAU,OAAO;EACrC,OAAO;CACT;CACA,MAAc,UAAU,UAA2C;EACjE,MAAM,UAAU,WAAW;EAC3B,IAAI;EACJ,IAAI;EACJ,IAAI,aAAa;EACjB,KAAK,IAAI,UAAU,GAAG,UAAU,KAAK,WAAW;GAC9C,MAAM,QAAQ,MAAM,KAAK,OAAO,YAAY;IAC1C,MAAM,OAAO,MAAM,KAAK,KAAK;IAC7B,MAAM,UAAU,KAAK,SAAS,MAAM,MAAM,EAAE,aAAa,QAAQ;IACjE,IAAI,CAAC,SACH,MAAM,IAAI,oBACR,mBACA,gDACF;IACF,yBAAyB,QAAQ;IACjC,IAAI,QAAQ,iBAAiB,sBAC3B,OAAO;KAAE,MAAM;KAAoB;IAAQ;IAC7C,MAAM,SAAS,KAAK,YAAY;IAChC,IAAI,UAAU,KAAK,eAAe,OAAO,GAAG,GAC1C,OAAO,EAAE,MAAM,OAAgB;IACjC,KAAK,YAAY;KACf,GAAG,KAAK;MACP,WAAW;MAAE,IAAI;MAAS,KAAK,QAAQ;KAAI;IAC9C;IACA,MAAM,KAAK,KAAK,IAAI;IACpB,OAAO;KACL,MAAM;KACN;KACA,YAAY,KAAK,WAAW,MAAM,QAAQ;IAC5C;GACF,CAAC;GACD,IAAI,MAAM,SAAS,WAAW,OAAO,MAAM;GAC3C,IAAI,MAAM,SAAS,SAAS;IAC1B,UAAU,MAAM;IAChB,aAAa,MAAM;IACnB;GACF;GACA,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EACxD;EACA,IAAI,CAAC,SACH,MAAM,IAAI,oBACR,gBACA,2CACF;EAEF,MAAM,eAAe,YAAY;GAC/B,MAAM,KAAK,OAAO,YAAY;IAC5B,MAAM,OAAO,MAAM,KAAK,KAAK;IAC7B,IAAI,KAAK,YAAY,SAAS,EAAE,OAAO,SAAS;KAC9C,OAAO,KAAK,UAAU;KACtB,MAAM,KAAK,KAAK,IAAI;IACtB;GACF,CAAC;EACH;EACA,MAAM,aAAa,OAAO,MAAc,YAAoB;GAC1D,MAAM,KAAK,OAAO,YAAY;IAC5B,MAAM,OAAO,MAAM,KAAK,KAAK;IAC7B,IACE,KAAK,YAAY,SAAS,EAAE,OAAO,WACnC,KAAK,WAAW,MAAM,QAAQ,MAAM,cACpC,KAAK,SAAS,MAAM,YAAY,QAAQ,aAAa,QAAQ,CAAC,EAC1D,iBAAiB,QAAQ,cAC7B;KACA,KAAK,WAAW,KAAK,SAAS,QAAQ,MAAM,EAAE,aAAa,QAAQ;KACnE,KAAK,cAAc;MACjB,GAAG,KAAK;OACP,WAAW,aAAa;KAC3B;KACA,OAAO,KAAK,UAAU;KACtB,MAAM,KAAK,KAAK,IAAI;IACtB;GACF,CAAC;GACD,MAAM,IAAI,oBAAoB,MAAM,OAAO;EAC7C;EAEA,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,QAAQ,OAAO;IACnC,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB,YAAY;KACZ,WAAW,QAAQ;KACnB,eAAe,QAAQ;KACvB,UAAU;IACZ,CAAC;GACH,CAAC;EACH,SAAS,OAAO;GACd,MAAM,aAAa;GACnB,MAAM;EACR;EACA,IAAI,CAAC,SAAS,IAAI;GAChB,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,WACL,mBACA,6DACF;GACF,MAAM,aAAa;GACnB,MAAM,IAAI,oBACR,kBACA,2DACF;EACF;EACA,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,aAAa;GACnB,MAAM;EACR;EACA,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,eAAe;GAC/C,MAAM,aAAa;GACnB,MAAM,IAAI,oBACR,4BACA,kDACF;EACF;EACA,MAAM,SAAS,OAAO,MAAM,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC,CAC3D,MAAM,GAAG,CAAC,CACV,OAAO,OAAO;EACjB,IAAI,CAAC,OAAO,SAAS,UAAU,GAC7B,OAAO,WACL,2BACA,+CACF;EACF,MAAM,UAA0B;GAC9B,GAAG;GACH,aAAa,MAAM;GACnB,cAAc,MAAM;GACpB,SAAS,MAAM,YAAY,QAAQ;GACnC;GACA,WAAW,KAAK,IAAI,IAAI,OAAO,MAAM,cAAc,CAAC,IAAI;EAC1D;EACA,OAAO,KAAK,OAAO,YAAY;GAC7B,MAAM,OAAO,MAAM,KAAK,KAAK;GAC7B,MAAM,SAAS,KAAK,SAAS,MAAM,MAAM,EAAE,aAAa,QAAQ;GAChE,MAAM,YAAY,KAAK,YAAY,SAAS,EAAE,OAAO;GACrD,IACE,CAAC,aACD,KAAK,WAAW,MAAM,QAAQ,MAAM,cACpC,QAAQ,iBAAiB,QAAQ,cACjC;IACA,IAAI,WAAW;KACb,OAAO,KAAK,UAAW;KACvB,MAAM,KAAK,KAAK,IAAI;IACtB;IACA,MAAM,IAAI,oBACR,uBACA,uDACF;GACF;GACA,KAAK,WAAW,KAAK,SAAS,KAAK,MACjC,EAAE,aAAa,WAAW,UAAU,CACtC;GACA,OAAO,KAAK,UAAW;GACvB,MAAM,KAAK,KAAK,IAAI;GACpB,OAAO;EACT,CAAC;CACH;;CAEA,MAAM,OACJ,UACiD;EACjD,MAAM,UAAU,MAAM,KAAK,OAAO,YAAY;GAC5C,MAAM,OAAO,MAAM,KAAK,KAAK;GAC7B,MAAM,UAAU,KAAK,SAAS,MAAM,MAAM,EAAE,aAAa,QAAQ;GACjE,IAAI,CAAC,SAAS,OAAO,KAAA;GACrB,KAAK,WAAW,KAAK,SAAS,QAAQ,MAAM,EAAE,aAAa,QAAQ;GACnE,KAAK,cAAc;IACjB,GAAG,KAAK;KACP,WAAW,KAAK,WAAW,MAAM,QAAQ,IAAI;GAChD;GACA,IAAI,KAAK,WAAW,OAAO,KAAK,UAAU;GAC1C,MAAM,KAAK,KAAK,IAAI;GACpB,OAAO;EACT,CAAC;EACD,IAAI,CAAC,SAAS,OAAO,EAAE,2BAA2B,KAAK;EAEvD,MAAM,aAAa,IAAI,gBAAgB;EACvC,IAAI;EACJ,IAAI;GA2BF,OAAO,EAAE,2BAA2B,MA1BZ,QAAQ,KAAK,EAClC,YAAY;IACX,MAAM,YAAa,OACjB,MAAM,KAAK,QAAQ,WAAW,EAAE,QAAQ,WAAW,OAAO,CAAC,EAAA,CAC3D,KAAK;IACP,IAAI,CAAC,UAAU,qBAAqB,OAAO;IAC3C,MAAM,OAAO,IAAI,gBAAgB;KAC/B,OAAO,QAAQ;KACf,iBAAiB;KACjB,WAAW,QAAQ;IACrB,CAAC;IAOD,QAAO,MANgB,KAAK,QAAQ,UAAU,qBAAqB;KACjE,QAAQ;KACR,SAAS,EAAE,gBAAgB,oCAAoC;KAC/D;KACA,QAAQ,WAAW;IACrB,CAAC,EAAA,CACe;GAClB,EAAA,CAAG,GACH,IAAI,SAAkB,YAAY;IAChC,QAAQ,iBAAiB;KACvB,WAAW,MAAM;KACjB,QAAQ,KAAK;IACf,GAAG,KAAK,yBAAyB;GACnC,CAAC,CACH,CAAC,EAC6C;EAChD,QAAQ;GACN,OAAO,EAAE,2BAA2B,MAAM;EAC5C,UAAU;GACR,IAAI,OAAO,aAAa,KAAK;EAC/B;CACF;AACF"}

package/metadata.json

@@ -5,9 +5,9 @@
     "index": 4,
     "count": 33
   },
-  "description": "Unified authentication interface supporting Keycloak, AWS Cognito, and Nostr with OAuth2/OIDC and public key identity",
+  "description": "Unified authentication for Keycloak, Cognito, Nostr, and local ChatGPT sessions with OAuth2/OIDC and public key identity",
   "provides": [
-    "Unified authentication interface supporting Keycloak, AWS Cognito, and Nostr with OAuth2/OIDC and public key identity"
+    "Unified authentication for Keycloak, Cognito, Nostr, and local ChatGPT sessions with OAuth2/OIDC and public key identity"
   ],
   "implements": [],
   "requires": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@happyvertical/auth",
-  "version": "0.103.1",
-  "description": "Unified authentication interface supporting Keycloak, AWS Cognito, and Nostr with OAuth2/OIDC and public key identity",
+  "version": "0.103.2",
+  "description": "Unified authentication for Keycloak, Cognito, Nostr, and local ChatGPT sessions with OAuth2/OIDC and public key identity",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -9,6 +9,10 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./local": {
+      "import": "./dist/local.js",
+      "types": "./dist/local.d.ts"
     }
   },
   "bin": {
@@ -36,7 +40,7 @@
   "homepage": "https://github.com/happyvertical/sdk/tree/main/packages/auth#readme",
   "license": "MIT",
   "dependencies": {
-    "@happyvertical/utils": "0.103.1",
+    "@happyvertical/utils": "0.103.2",
     "jose": "^6.2.2"
   },
   "optionalDependencies": {