@longrun-ai/codex-auth 0.1.0

package/dist/oauth/deviceCode.js

@@ -0,0 +1,103 @@
+import { CLIENT_ID, DEFAULT_ISSUER } from '../auth/schema.js';
+import { persistTokens, resolveCodexHome } from '../auth/storage.js';
+import { sleep } from '../utils/time.js';
+import { ensureWorkspaceAllowed } from './browserLogin.js';
+import { exchangeCodeForTokens, obtainApiKey } from './tokenExchange.js';
+export async function requestDeviceCode(options = {}) {
+    const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/$/, '');
+    const clientId = options.clientId ?? CLIENT_ID;
+    const apiBase = `${issuer}/api/accounts`;
+    const response = await fetch(`${apiBase}/deviceauth/usercode`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ client_id: clientId }),
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new Error('device code login is not enabled for this Codex server. Use the browser login or verify the server URL.');
+        }
+        throw new Error(`device code request failed with status ${response.status}`);
+    }
+    const json = (await response.json());
+    const intervalValue = parseInterval(json.interval);
+    const userCode = json.user_code ?? json.usercode;
+    if (!userCode || !json.device_auth_id) {
+        throw new Error('device code response missing required fields');
+    }
+    return {
+        verificationUrl: `${issuer}/codex/device`,
+        userCode,
+        deviceAuthId: json.device_auth_id,
+        interval: intervalValue,
+    };
+}
+export async function completeDeviceCodeLogin(options, deviceCode) {
+    const codexHome = resolveCodexHome(options.codexHome);
+    const issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/$/, '');
+    const clientId = options.clientId ?? CLIENT_ID;
+    const storeMode = options.storeMode ?? 'file';
+    const apiBase = `${issuer}/api/accounts`;
+    const codeResp = await pollForToken(apiBase, deviceCode.deviceAuthId, deviceCode.userCode, deviceCode.interval);
+    const redirectUri = `${issuer}/deviceauth/callback`;
+    const tokens = await exchangeCodeForTokens(issuer, clientId, redirectUri, codeResp.codeVerifier, codeResp.authorizationCode);
+    ensureWorkspaceAllowed(options.forcedChatgptWorkspaceId, tokens.idToken);
+    let apiKey;
+    try {
+        apiKey = await obtainApiKey(issuer, clientId, tokens.idToken);
+    }
+    catch {
+        apiKey = undefined;
+    }
+    persistTokens(codexHome, apiKey, tokens.idToken, tokens.accessToken, tokens.refreshToken, storeMode);
+}
+export async function runDeviceCodeLogin(options = {}) {
+    const deviceCode = await requestDeviceCode(options);
+    options.onDeviceCode?.(deviceCode);
+    await completeDeviceCodeLogin(options, deviceCode);
+    return deviceCode;
+}
+async function pollForToken(apiBase, deviceAuthId, userCode, interval) {
+    const maxWaitMs = 15 * 60 * 1000;
+    const start = Date.now();
+    while (true) {
+        const response = await fetch(`${apiBase}/deviceauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                device_auth_id: deviceAuthId,
+                user_code: userCode,
+            }),
+        });
+        if (response.ok) {
+            const json = (await response.json());
+            return {
+                authorizationCode: json.authorization_code,
+                codeVerifier: json.code_verifier,
+                codeChallenge: json.code_challenge,
+            };
+        }
+        if (response.status === 403 || response.status === 404) {
+            if (Date.now() - start >= maxWaitMs) {
+                throw new Error('device auth timed out after 15 minutes');
+            }
+            const remaining = maxWaitMs - (Date.now() - start);
+            const sleepFor = Math.min(interval * 1000, remaining);
+            await sleep(sleepFor);
+            continue;
+        }
+        throw new Error(`device auth failed with status ${response.status}`);
+    }
+}
+function parseInterval(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        const parsed = Number.parseInt(value.trim(), 10);
+        if (!Number.isNaN(parsed)) {
+            return parsed;
+        }
+    }
+    return 5;
+}
+//# sourceMappingURL=deviceCode.js.map

package/dist/oauth/deviceCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceCode.js","sourceRoot":"","sources":["../../src/oauth/deviceCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAqBzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAA6B,EAAE;IACrE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,MAAM,eAAe,CAAC;IAEzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,sBAAsB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC;IAEjD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,eAAe,EAAE,GAAG,MAAM,eAAe;QACzC,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,cAAc;QACjC,QAAQ,EAAE,aAAa;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA0B,EAC1B,UAAsB;IAEtB,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,MAAM,eAAe,CAAC;IAEzC,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,OAAO,EACP,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,QAAQ,CACpB,CAAC;IAEF,MAAM,WAAW,GAAG,GAAG,MAAM,sBAAsB,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,MAAM,EACN,QAAQ,EACR,WAAW,EACX,QAAQ,CAAC,YAAY,EACrB,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;IAEF,sBAAsB,CAAC,OAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEzE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IAED,aAAa,CACX,SAAS,EACT,MAAM,EACN,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,YAAY,EACnB,SAAS,CACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,YAAoB,EACpB,QAAgB,EAChB,QAAgB;IAMhB,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,mBAAmB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc,EAAE,YAAY;gBAC5B,SAAS,EAAE,QAAQ;aACpB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;YAEF,OAAO;gBACL,iBAAiB,EAAE,IAAI,CAAC,kBAAkB;gBAC1C,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,aAAa,EAAE,IAAI,CAAC,cAAc;aACnC,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAkC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,7 @@
+export interface PkceCodes {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare function generatePkce(): PkceCodes;
+export declare function generateState(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,YAAY,IAAI,SAAS,CAOxC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/oauth/pkce.js

@@ -0,0 +1,14 @@
+import crypto from 'node:crypto';
+import { base64UrlEncode } from '../utils/base64.js';
+export function generatePkce() {
+    const verifier = base64UrlEncode(crypto.randomBytes(32));
+    const challenge = base64UrlEncode(crypto.createHash('sha256').update(verifier).digest());
+    return {
+        codeVerifier: verifier,
+        codeChallenge: challenge,
+    };
+}
+export function generateState() {
+    return base64UrlEncode(crypto.randomBytes(32));
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOrD,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,OAAO;QACL,YAAY,EAAE,QAAQ;QACtB,aAAa,EAAE,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/oauth/refresh.d.ts

@@ -0,0 +1,14 @@
+export type RefreshTokenFailedReason = 'expired' | 'exhausted' | 'revoked' | 'other';
+export interface RefreshResponse {
+    id_token?: string;
+    access_token?: string;
+    refresh_token?: string;
+}
+export declare class RefreshTokenError extends Error {
+    readonly kind: 'permanent' | 'transient';
+    readonly reason?: RefreshTokenFailedReason;
+    constructor(kind: 'permanent' | 'transient', message: string, reason?: RefreshTokenFailedReason);
+}
+export declare function tryRefreshToken(refreshToken: string): Promise<RefreshResponse>;
+export declare function refreshTokenEndpoint(): string;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/oauth/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/oauth/refresh.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAYrF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC;gBAE/B,IAAI,EAAE,WAAW,GAAG,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,wBAAwB;CAKhG;AAED,wBAAsB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgCpF;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/oauth/refresh.js

@@ -0,0 +1,122 @@
+import { CLIENT_ID, CODEX_REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR } from '../auth/schema.js';
+const REFRESH_TOKEN_EXPIRED_MESSAGE = 'Your access token could not be refreshed because your refresh token has expired. Please log out and sign in again.';
+const REFRESH_TOKEN_REUSED_MESSAGE = 'Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again.';
+const REFRESH_TOKEN_INVALIDATED_MESSAGE = 'Your access token could not be refreshed because your refresh token was revoked. Please log out and sign in again.';
+const REFRESH_TOKEN_UNKNOWN_MESSAGE = 'Your access token could not be refreshed. Please log out and sign in again.';
+const DEFAULT_REFRESH_TOKEN_URL = 'https://auth.openai.com/oauth/token';
+export class RefreshTokenError extends Error {
+    kind;
+    reason;
+    constructor(kind, message, reason) {
+        super(message);
+        this.kind = kind;
+        this.reason = reason;
+    }
+}
+export async function tryRefreshToken(refreshToken) {
+    const endpoint = refreshTokenEndpoint();
+    const body = JSON.stringify({
+        client_id: CLIENT_ID,
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        scope: 'openid profile email',
+    });
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+        },
+        body,
+    });
+    if (response.ok) {
+        return (await response.json());
+    }
+    const text = await response.text();
+    if (response.status === 401) {
+        const failed = classifyRefreshTokenFailure(text);
+        throw new RefreshTokenError('permanent', failed.message, failed.reason);
+    }
+    const message = tryParseErrorMessage(text);
+    throw new RefreshTokenError('transient', `Failed to refresh token: ${response.status}: ${message}`);
+}
+export function refreshTokenEndpoint() {
+    return process.env[CODEX_REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR] || DEFAULT_REFRESH_TOKEN_URL;
+}
+function classifyRefreshTokenFailure(body) {
+    const code = extractRefreshTokenErrorCode(body)?.toLowerCase();
+    let reason = 'other';
+    if (code === 'refresh_token_expired') {
+        reason = 'expired';
+    }
+    else if (code === 'refresh_token_reused') {
+        reason = 'exhausted';
+    }
+    else if (code === 'refresh_token_invalidated') {
+        reason = 'revoked';
+    }
+    let message = REFRESH_TOKEN_UNKNOWN_MESSAGE;
+    if (reason === 'expired') {
+        message = REFRESH_TOKEN_EXPIRED_MESSAGE;
+    }
+    else if (reason === 'exhausted') {
+        message = REFRESH_TOKEN_REUSED_MESSAGE;
+    }
+    else if (reason === 'revoked') {
+        message = REFRESH_TOKEN_INVALIDATED_MESSAGE;
+    }
+    return { reason, message };
+}
+function extractRefreshTokenErrorCode(body) {
+    if (!body.trim()) {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return undefined;
+    }
+    const record = parsed;
+    const errorValue = record.error;
+    if (errorValue && typeof errorValue === 'object' && !Array.isArray(errorValue)) {
+        const code = errorValue.code;
+        if (typeof code === 'string') {
+            return code;
+        }
+    }
+    if (typeof errorValue === 'string') {
+        return errorValue;
+    }
+    const code = record.code;
+    if (typeof code === 'string') {
+        return code;
+    }
+    return undefined;
+}
+function tryParseErrorMessage(body) {
+    if (!body.trim()) {
+        return '';
+    }
+    try {
+        const parsed = JSON.parse(body);
+        const error = parsed.error;
+        if (typeof error === 'string') {
+            return error;
+        }
+        if (error && typeof error === 'object') {
+            const message = error.message;
+            if (typeof message === 'string') {
+                return message;
+            }
+        }
+    }
+    catch {
+        return body;
+    }
+    return body;
+}
+//# sourceMappingURL=refresh.js.map

package/dist/oauth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,wCAAwC,EAAE,MAAM,mBAAmB,CAAC;AAIxF,MAAM,6BAA6B,GACjC,oHAAoH,CAAC;AACvH,MAAM,4BAA4B,GAChC,yHAAyH,CAAC;AAC5H,MAAM,iCAAiC,GACrC,oHAAoH,CAAC;AACvH,MAAM,6BAA6B,GACjC,6EAA6E,CAAC;AAChF,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AAQxE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAA4B;IAChC,MAAM,CAA4B;IAE3C,YAAY,IAA+B,EAAE,OAAe,EAAE,MAAiC;QAC7F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,YAAoB;IACxD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,iBAAiB,CACzB,WAAW,EACX,4BAA4B,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,IAAI,yBAAyB,CAAC;AAC5F,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAI/C,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC;IAE/D,IAAI,MAAM,GAA6B,OAAO,CAAC;IAC/C,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACrC,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC3C,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;SAAM,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;QAChD,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,OAAO,GAAG,6BAA6B,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,6BAA6B,CAAC;IAC1C,CAAC;SAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,GAAG,4BAA4B,CAAC;IACzC,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,GAAG,iCAAiC,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAI,UAAsC,CAAC,IAAI,CAAC;QAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,OAAO,GAAI,KAAiC,CAAC,OAAO,CAAC;YAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/oauth/tokenExchange.d.ts

@@ -0,0 +1,7 @@
+export declare function exchangeCodeForTokens(issuer: string, clientId: string, redirectUri: string, codeVerifier: string, code: string): Promise<{
+    idToken: string;
+    accessToken: string;
+    refreshToken: string;
+}>;
+export declare function obtainApiKey(issuer: string, clientId: string, idToken: string): Promise<string>;
+//# sourceMappingURL=tokenExchange.d.ts.map

package/dist/oauth/tokenExchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/oauth/tokenExchange.ts"],"names":[],"mappings":"AAAA,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCzE;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CA0BjB"}

package/dist/oauth/tokenExchange.js

@@ -0,0 +1,50 @@
+export async function exchangeCodeForTokens(issuer, clientId, redirectUri, codeVerifier, code) {
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: codeVerifier,
+    });
+    const response = await fetch(`${issuer}/oauth/token`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`token endpoint returned status ${response.status}`);
+    }
+    const json = (await response.json());
+    return {
+        idToken: json.id_token,
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+    };
+}
+export async function obtainApiKey(issuer, clientId, idToken) {
+    const body = new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+        client_id: clientId,
+        requested_token: 'openai-api-key',
+        subject_token: idToken,
+        subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
+    });
+    const response = await fetch(`${issuer}/oauth/token`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`api key exchange failed with status ${response.status}`);
+    }
+    const json = (await response.json());
+    if (!json.access_token) {
+        throw new Error('api key exchange response missing access_token');
+    }
+    return json.access_token;
+}
+//# sourceMappingURL=tokenExchange.js.map

package/dist/oauth/tokenExchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenExchange.js","sourceRoot":"","sources":["../../src/oauth/tokenExchange.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,QAAgB,EAChB,WAAmB,EACnB,YAAoB,EACpB,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,QAAgB,EAChB,OAAe;IAEf,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,iDAAiD;QAC7D,SAAS,EAAE,QAAQ;QACnB,eAAe,EAAE,gBAAgB;QACjC,aAAa,EAAE,OAAO;QACtB,kBAAkB,EAAE,2CAA2C;KAChE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC"}

package/dist/oauth/tokenParsing.d.ts

@@ -0,0 +1,4 @@
+import { IdTokenInfo } from '../auth/schema.js';
+export declare function parseIdToken(idToken: string): IdTokenInfo;
+export declare function extractAccountId(idToken: string): string | undefined;
+//# sourceMappingURL=tokenParsing.d.ts.map

package/dist/oauth/tokenParsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenParsing.d.ts","sourceRoot":"","sources":["../../src/oauth/tokenParsing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAmBzD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE"}

package/dist/oauth/tokenParsing.js

@@ -0,0 +1,22 @@
+import { getStringClaim, parseJwtPayload } from '../utils/jwt.js';
+export function parseIdToken(idToken) {
+    const payload = parseJwtPayload(idToken);
+    const auth = payload['https://api.openai.com/auth'] &&
+        typeof payload['https://api.openai.com/auth'] === 'object' &&
+        !Array.isArray(payload['https://api.openai.com/auth'])
+        ? payload['https://api.openai.com/auth']
+        : {};
+    const email = getStringClaim(payload.email);
+    const chatgptPlan = getStringClaim(auth.chatgpt_plan_type);
+    const chatgptAccountId = getStringClaim(auth.chatgpt_account_id);
+    return {
+        email,
+        chatgpt_plan_type: chatgptPlan,
+        chatgpt_account_id: chatgptAccountId,
+        raw_jwt: idToken,
+    };
+}
+export function extractAccountId(idToken) {
+    return parseIdToken(idToken).chatgpt_account_id;
+}
+//# sourceMappingURL=tokenParsing.js.map

package/dist/oauth/tokenParsing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenParsing.js","sourceRoot":"","sources":["../../src/oauth/tokenParsing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElE,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GACR,OAAO,CAAC,6BAA6B,CAAC;QACtC,OAAO,OAAO,CAAC,6BAA6B,CAAC,KAAK,QAAQ;QAC1D,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpD,CAAC,CAAE,OAAO,CAAC,6BAA6B,CAA6B;QACrE,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEjE,OAAO;QACL,KAAK;QACL,iBAAiB,EAAE,WAAW;QAC9B,kBAAkB,EAAE,gBAAgB;QACpC,OAAO,EAAE,OAAO;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC;AAClD,CAAC"}

package/dist/prompts.d.ts

@@ -0,0 +1,4 @@
+export declare function resolveCodexPromptFilename(model: string): string;
+export declare function loadCodexPrompt(model: string): Promise<string | null>;
+export declare function loadCodexPromptSync(model: string): string | null;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAKA,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBhE;AAqBD,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsB3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBhE"}

package/dist/prompts.js

@@ -0,0 +1,85 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+const promptCache = new Map();
+export function resolveCodexPromptFilename(model) {
+    if (model.startsWith('gpt-5.2-codex') || model.startsWith('bengalfox')) {
+        return 'gpt-5.2-codex_prompt.md';
+    }
+    if (model.startsWith('gpt-5.1-codex-max')) {
+        return 'gpt-5.1-codex-max_prompt.md';
+    }
+    if ((model.startsWith('gpt-5-codex') ||
+        model.startsWith('gpt-5.1-codex') ||
+        model.startsWith('codex-')) &&
+        !model.includes('-mini')) {
+        return 'gpt_5_codex_prompt.md';
+    }
+    if (model.startsWith('codex-mini-latest')) {
+        return 'prompt_with_apply_patch_instructions.md';
+    }
+    if (model.startsWith('gpt-5.2')) {
+        return 'gpt_5_2_prompt.md';
+    }
+    if (model.startsWith('gpt-5.1')) {
+        return 'gpt_5_1_prompt.md';
+    }
+    return 'prompt.md';
+}
+function resolvePromptUrl(filename) {
+    return new URL(`../prompts/${filename}`, import.meta.url);
+}
+async function readPromptFile(url) {
+    try {
+        return await readFile(url, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function readPromptFileSync(url) {
+    if (!existsSync(url)) {
+        return null;
+    }
+    return readFileSync(url, 'utf8');
+}
+export async function loadCodexPrompt(model) {
+    const cached = promptCache.get(model);
+    if (cached) {
+        return cached;
+    }
+    const filename = resolveCodexPromptFilename(model);
+    const candidate = resolvePromptUrl(filename);
+    const prompt = await readPromptFile(candidate);
+    if (prompt) {
+        promptCache.set(model, prompt);
+        return prompt;
+    }
+    const fallback = resolvePromptUrl('prompt.md');
+    const fallbackPrompt = await readPromptFile(fallback);
+    if (fallbackPrompt) {
+        promptCache.set(model, fallbackPrompt);
+        return fallbackPrompt;
+    }
+    return null;
+}
+export function loadCodexPromptSync(model) {
+    const cached = promptCache.get(model);
+    if (cached) {
+        return cached;
+    }
+    const filename = resolveCodexPromptFilename(model);
+    const candidate = resolvePromptUrl(filename);
+    const prompt = readPromptFileSync(candidate);
+    if (prompt) {
+        promptCache.set(model, prompt);
+        return prompt;
+    }
+    const fallback = resolvePromptUrl('prompt.md');
+    const fallbackPrompt = readPromptFileSync(fallback);
+    if (fallbackPrompt) {
+        promptCache.set(model, fallbackPrompt);
+        return fallbackPrompt;
+    }
+    return null;
+}
+//# sourceMappingURL=prompts.js.map

package/dist/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACvE,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EACxB,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,IAAI,GAAG,CAAC,cAAc,QAAQ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAQ;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAQ;IAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,cAAc,EAAE,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACvC,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,cAAc,EAAE,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACvC,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/base64.d.ts

@@ -0,0 +1,3 @@
+export declare function base64UrlEncode(input: Uint8Array): string;
+export declare function base64UrlDecode(input: string): Buffer;
+//# sourceMappingURL=base64.d.ts.map

package/dist/utils/base64.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.d.ts","sourceRoot":"","sources":["../../src/utils/base64.ts"],"names":[],"mappings":"AAAA,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrD"}

package/dist/utils/base64.js

@@ -0,0 +1,16 @@
+export function base64UrlEncode(input) {
+    return Buffer.from(input)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/g, '');
+}
+export function base64UrlDecode(input) {
+    let normalized = input.replace(/-/g, '+').replace(/_/g, '/');
+    const padLength = normalized.length % 4;
+    if (padLength !== 0) {
+        normalized += '='.repeat(4 - padLength);
+    }
+    return Buffer.from(normalized, 'base64');
+}
+//# sourceMappingURL=base64.js.map

package/dist/utils/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","sourceRoot":"","sources":["../../src/utils/base64.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/utils/jwt.d.ts

@@ -0,0 +1,6 @@
+export type JwtClaims = Record<string, unknown>;
+export declare function parseJwtPayload(token: string): JwtClaims;
+export declare function jwtAuthClaims(token: string): Record<string, unknown>;
+export declare function getStringClaim(value: unknown): string | undefined;
+export declare function getBooleanClaim(value: unknown): boolean | undefined;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/utils/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAaxD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWpE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAKnE"}

package/dist/utils/jwt.js

@@ -0,0 +1,40 @@
+import { base64UrlDecode } from './base64.js';
+export function parseJwtPayload(token) {
+    const parts = token.split('.');
+    if (parts.length < 3 || parts.some((part) => part.length === 0)) {
+        throw new Error('invalid JWT format');
+    }
+    const payload = base64UrlDecode(parts[1]);
+    const text = payload.toString('utf8');
+    const json = JSON.parse(text);
+    if (json && typeof json === 'object') {
+        return json;
+    }
+    throw new Error('invalid JWT payload');
+}
+export function jwtAuthClaims(token) {
+    try {
+        const payload = parseJwtPayload(token);
+        const auth = payload['https://api.openai.com/auth'];
+        if (auth && typeof auth === 'object' && !Array.isArray(auth)) {
+            return auth;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+export function getStringClaim(value) {
+    if (typeof value === 'string' && value.length > 0) {
+        return value;
+    }
+    return undefined;
+}
+export function getBooleanClaim(value) {
+    if (typeof value === 'boolean') {
+        return value;
+    }
+    return undefined;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/utils/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9C,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,OAAO,IAA+B,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/openBrowser.d.ts

@@ -0,0 +1,2 @@
+export declare function openBrowser(url: string): boolean;
+//# sourceMappingURL=openBrowser.d.ts.map

package/dist/utils/openBrowser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openBrowser.d.ts","sourceRoot":"","sources":["../../src/utils/openBrowser.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA0BhD"}

package/dist/utils/openBrowser.js

@@ -0,0 +1,30 @@
+import { spawn } from 'node:child_process';
+export function openBrowser(url) {
+    const platform = process.platform;
+    let command;
+    let args = [];
+    if (platform === 'darwin') {
+        command = 'open';
+        args = [url];
+    }
+    else if (platform === 'win32') {
+        command = 'cmd';
+        args = ['/c', 'start', '', url];
+    }
+    else {
+        command = 'xdg-open';
+        args = [url];
+    }
+    try {
+        const child = spawn(command, args, {
+            stdio: 'ignore',
+            detached: true,
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=openBrowser.js.map

package/dist/utils/openBrowser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openBrowser.js","sourceRoot":"","sources":["../../src/utils/openBrowser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAI,GAAa,EAAE,CAAC;IAExB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,UAAU,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/utils/time.d.ts

@@ -0,0 +1,2 @@
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=time.d.ts.map