codex-imagegen-mcp 0.1.2

package/README.md

@@ -0,0 +1,373 @@
+<p align="center">
+  <img src="docs/assets/hero.jpg" width="100%" alt="Codex ImageGen MCP — a 1930s travel-poster illustration: an enormous empty picture frame stands on a desert plain and frames a rising sun behind a peak, while a small train runs along a railway toward it">
+</p>
+
+<p align="center">
+  <b>Codex's image generation, in every coding agent.</b><br>
+  Generate and edit images from opencode, Claude Code, Cursor, VS Code and any other MCP client.<br>
+  It runs on the ChatGPT plan you already pay for, so there's no API key and no per-image bill.
+</p>
+
+<p align="center">
+  <a href="https://github.com/ShalomObongo/codex-imagegen-mcp/releases/latest"><img alt="Latest release" src="https://img.shields.io/github/v/release/ShalomObongo/codex-imagegen-mcp?style=flat-square&label=release&color=A6553B"></a>
+  <a href="https://github.com/ShalomObongo/codex-imagegen-mcp/actions/workflows/ci.yml"><img alt="CI status" src="https://img.shields.io/github/actions/workflow/status/ShalomObongo/codex-imagegen-mcp/ci.yml?branch=main&style=flat-square&label=CI"></a>
+  <img alt="MCP stdio server" src="https://img.shields.io/badge/MCP-stdio%20server-2A2523?style=flat-square">
+  <img alt="Node 22 or newer" src="https://img.shields.io/badge/node-%E2%89%A5%2022-4E6E63?style=flat-square">
+  <img alt="Runs on your ChatGPT plan" src="https://img.shields.io/badge/ChatGPT%20plan-no%20API%20key-A6553B?style=flat-square">
+  <a href="LICENSE"><img alt="Apache-2.0 license" src="https://img.shields.io/badge/license-Apache--2.0-D9A05B?style=flat-square"></a>
+</p>
+
+<p align="center">
+  <a href="#quick-start"><b>Quick start</b></a> &nbsp;·&nbsp;
+  <a href="#see-it-work"><b>See it work</b></a> &nbsp;·&nbsp;
+  <a href="docs/TOOLS.md"><b>Tools</b></a> &nbsp;·&nbsp;
+  <a href="docs/AUTH.md"><b>Sign-in</b></a> &nbsp;·&nbsp;
+  <a href="docs/CLIENTS.md"><b>Clients</b></a> &nbsp;·&nbsp;
+  <a href="docs/README.md"><b>All docs</b></a>
+</p>
+
+<br>
+
+## What it does
+
+<table>
+  <tr>
+    <td width="33%" valign="top">
+      <img src="docs/assets/badges/signin.png" width="76" alt=""><br>
+      <b>Your ChatGPT plan, not an API bill</b><br>
+      Sign in once with ChatGPT, or reuse the sign-in Codex or opencode already has. Every image counts against the plan you already pay for.
+    </td>
+    <td width="33%" valign="top">
+      <img src="docs/assets/badges/clients.png" width="76" alt=""><br>
+      <b>Works in any MCP client</b><br>
+      A standard local stdio server. opencode installs in one command; Claude Code, Cursor, VS Code, Windsurf and Gemini CLI take one pasted snippet.
+    </td>
+    <td width="33%" valign="top">
+      <img src="docs/assets/badges/transparency.png" width="76" alt=""><br>
+      <b>Real transparent PNGs</b><br>
+      Ask for <code>background: "transparent"</code> and get genuine alpha, checked on every file. A local chroma-key tool handles the rest.
+    </td>
+  </tr>
+  <tr>
+    <td width="33%" valign="top">
+      <img src="docs/assets/badges/aspect.png" width="76" alt=""><br>
+      <b>Any canvas shape</b><br>
+      Eleven aspect ratios from 21:9 to 9:21, and up to four variants of a prompt in parallel.
+    </td>
+    <td width="33%" valign="top">
+      <img src="docs/assets/badges/versions.png" width="76" alt=""><br>
+      <b>Saves into your project, safely</b><br>
+      Paths resolve to your workspace. An existing file is never overwritten; you get <code>hero-2.png</code> instead.
+    </td>
+    <td width="33%" valign="top">
+      <img src="docs/assets/badges/skill.png" width="76" alt=""><br>
+      <b>Codex's own playbook</b><br>
+      Ships the <code>imagegen</code> skill from the Codex app, adapted to these tools: prompt structure, edit invariants, save rules.
+    </td>
+  </tr>
+</table>
+
+## See it work
+
+Two real opencode sessions in a scratch project. The images are exactly what came back:
+
+<p align="center">
+  <img src="docs/assets/examples/real-session.jpg" width="100%" alt="Three real outputs: a transparent cartoon cactus sticker, the same sticker edited to wear a straw hat, and a 16:9 photographic hero of a cactus shop at sunset">
+</p>
+
+> **You:** I need a sticker-style illustration of a cute cartoon cactus with a transparent background for this project. Save it as `assets/cactus-sticker.png`.
+>
+> **opencode** · `openai/gpt-5.5` loads the `imagegen` skill → `imagegen_generate_image` with `background: "transparent"` → *"Saved `assets/cactus-sticker.png`, 1254×1254 PNG with a transparent background."*
+>
+> **You:** Make a 16:9 hero banner for the Cactus Shop landing page, and a variant of the sticker where the cactus wears a tiny straw hat. Keep everything else identical.
+>
+> **opencode** · `github-copilot/claude-sonnet-5` → `imagegen_auth_status` → `imagegen_generate_image` (`aspect_ratio: "16:9"`) and `imagegen_edit_image` (`images: ["assets/cactus-sticker.png"]`) in parallel → both saved, the edit with *"transparent background (alpha verified)"*.
+
+**One prompt, three canvases.** `aspect_ratio` doesn't crop. The service composes a new picture for each shape:
+
+<p align="center">
+  <img src="docs/assets/examples/aspect-ratios.jpg" width="100%" alt="The same travel-poster prompt of a train crossing a trestle bridge, generated at 1:1 (1254×1254), 16:9 (1672×941) and 9:16 (941×1672)">
+</p>
+
+**A green screen becomes alpha on your machine.** `remove_background` keys out a flat backdrop locally, with no network call and no quota:
+
+<p align="center">
+  <img src="docs/assets/examples/remove-background.jpg" width="82%" alt="A striped hot-air balloon generated on a flat green backdrop, and the same balloon cut out onto a transparent checkerboard">
+</p>
+
+> [!TIP]
+> Every image in this repository was made with codex-imagegen-mcp itself. That covers the posters, the badges, the logo and the examples. The prompts and the art-direction record are in [docs/assets](docs/assets/README.md).
+
+## Quick start
+
+> [!NOTE]
+> You need **Node.js 22+** and a **ChatGPT plan that includes Codex** (Plus, Pro, Business, Enterprise, Edu…). Codex image generation isn't available on the Free plan.
+
+**1 · Install.** This takes the packaged build from the latest GitHub release and puts `codex-imagegen-mcp` on your PATH.
+
+```bash
+npm install --global https://github.com/ShalomObongo/codex-imagegen-mcp/releases/latest/download/codex-imagegen-mcp.tgz
+```
+
+<details>
+<summary>Or build it from source</summary>
+<br>
+
+```bash
+git clone https://github.com/ShalomObongo/codex-imagegen-mcp.git && cd codex-imagegen-mcp
+npm ci && npm run build
+npm link                                  # puts `codex-imagegen-mcp` on your PATH
+```
+
+</details>
+
+**2 · Add it to opencode.** This registers the MCP server and the skill, keeping your config's comments and formatting.
+
+```bash
+codex-imagegen-mcp install opencode
+```
+
+**3 · Sign in with ChatGPT.** Skip this if Codex or opencode is already signed in with ChatGPT.
+
+```bash
+codex-imagegen-mcp login                  # opens the browser; use --device on a headless machine
+```
+
+**4 · Check, then ask for pictures**
+
+```bash
+codex-imagegen-mcp doctor                 # Node, credentials, quota, opencode entry, skill
+opencode mcp list                         # → ✓ imagegen connected
+```
+
+```text
+you › Make a 16:9 hero image of a lighthouse at dusk and save it to assets/hero.png
+```
+
+## How it works
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant A as Your agent<br/>(opencode, Claude Code…)
+    participant M as imagegen MCP server<br/>(local · stdio)
+    participant O as auth.openai.com
+    participant C as chatgpt.com<br/>/backend-api/codex
+    A->>M: generate_image {prompt, aspect_ratio, background}
+    M->>M: pick credentials: own sign-in → Codex → opencode
+    opt token expires within 5 minutes
+        M->>O: refresh (under a cross-process lock)
+        O-->>M: new access token + rotated refresh token
+    end
+    M->>C: POST /images/generations · Bearer token · ChatGPT-Account-ID
+    loop every 5 s while the image renders
+        M-->>A: progress notification (keeps the client's timeout alive)
+    end
+    C-->>M: PNG + usage headers
+    M->>M: save without overwriting · verify alpha · build preview
+    M-->>A: path, size, background + a 1024 px preview
+```
+
+It sends the same request as the image tool built into the Codex app, byte for byte. As OpenAI improves Codex's image model on the server, this server gets the same upgrade. [How that was reverse-engineered →](docs/BACKEND.md)
+
+## Signing in
+
+| You already have… | What happens |
+|---|---|
+| **Codex** (CLI or desktop app) signed in with ChatGPT | Works immediately. The server borrows `~/.codex/auth.json` **read-only**. |
+| **opencode** signed in with *OpenAI → ChatGPT Plus/Pro* | Works immediately. It borrows `~/.local/share/opencode/auth.json` read-only. |
+| Neither, or you want an independent sign-in | Run `codex-imagegen-mcp login`, or ask your agent to call the `sign_in` tool. |
+
+```bash
+codex-imagegen-mcp login            # browser → sign in → "You're signed in to Codex ImageGen MCP"
+codex-imagegen-mcp login --device   # SSH/headless: enter a code at auth.openai.com/codex/device
+codex-imagegen-mcp status           # account, plan, credential source and usage windows
+codex-imagegen-mcp logout           # remove and revoke this tool's own sign-in
+```
+
+> [!IMPORTANT]
+> OpenAI refresh tokens are **single-use**. Borrowed sign-ins are therefore never refreshed or modified, so this server can't sign you out of Codex or opencode. Its own tokens are stored `0600` and refreshed under a lock shared by every server process. [Authentication in depth →](docs/AUTH.md)
+
+## Tools
+
+| Tool | What it does | Key parameters |
+|---|---|---|
+| `generate_image` | A new image from a prompt | `prompt` · `aspect_ratio` · `background` · `n` · `output_path` |
+| `edit_image` | Edit images, or generate from 1–5 references | `images` · `prompt` · same options |
+| `remove_background` | Cut a flat backdrop out locally (no quota) | `input_path` · `key_color` (auto) · `output_path` |
+| `auth_status` | Sign-in, plan, credential source, usage windows | `check_usage` |
+| `sign_in` | Start a ChatGPT sign-in and return a link or code for you | `method` (`browser` · `device`) |
+
+The server also exposes the resources `imagegen://history`, `imagegen://images/{id}` and `imagegen://skill/*`, and the prompts `generate` and `edit`. In opencode the prompts appear as `/imagegen:generate` and `/imagegen:edit`. [Full reference →](docs/TOOLS.md)
+
+## From the terminal
+
+The CLI uses the same engine as the MCP tools:
+
+```bash
+codex-imagegen-mcp generate "a watercolor fox in a snowy forest" -a 16:9 -o art/fox.png
+codex-imagegen-mcp generate "Image 1: add a tiny straw hat; keep everything else" \
+  -i assets/cactus.png -b transparent -o assets/cactus-hat.png
+codex-imagegen-mcp remove-bg sprite-on-green.png -o sprite.png
+codex-imagegen-mcp config claude-code     # print the setup for another client
+```
+
+## Other clients
+
+| Client | Setup |
+|---|---|
+| **opencode** | `codex-imagegen-mcp install opencode` (automated, reversible with `uninstall`) |
+| **Claude Code** | `claude mcp add --scope user imagegen -- node /path/to/dist/src/cli.js serve` |
+| **Claude Desktop · Cursor · VS Code · Windsurf · Gemini CLI · Codex** | `codex-imagegen-mcp config <client>` prints a ready-to-paste config |
+
+Per-client guidance, including where each one loads skills from: [docs/CLIENTS.md](docs/CLIENTS.md).
+
+## Documentation
+
+<table>
+  <tr>
+    <td width="33%" valign="top">
+      <a href="docs/TOOLS.md"><img src="docs/assets/thumbs/banner-tools.jpg" alt="Tools"></a><br>
+      <b><a href="docs/TOOLS.md">Tools</a></b><br>
+      Every tool, parameter, result field, resource and error.
+    </td>
+    <td width="33%" valign="top">
+      <a href="docs/AUTH.md"><img src="docs/assets/thumbs/banner-auth.jpg" alt="Authentication"></a><br>
+      <b><a href="docs/AUTH.md">Authentication</a></b><br>
+      PKCE and device-code sign-in, token rotation, borrowing, security.
+    </td>
+    <td width="33%" valign="top">
+      <a href="docs/CLIENTS.md"><img src="docs/assets/thumbs/banner-clients.jpg" alt="Clients"></a><br>
+      <b><a href="docs/CLIENTS.md">Clients</a></b><br>
+      opencode, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI and more.
+    </td>
+  </tr>
+  <tr>
+    <td width="33%" valign="top">
+      <a href="docs/BACKEND.md"><img src="docs/assets/thumbs/banner-backend.jpg" alt="Backend"></a><br>
+      <b><a href="docs/BACKEND.md">Backend</a></b><br>
+      How Codex's image generation really works: extracted and measured.
+    </td>
+    <td width="33%" valign="top">
+      <a href="docs/ARCHITECTURE.md"><img src="docs/assets/thumbs/banner-architecture.jpg" alt="Architecture"></a><br>
+      <b><a href="docs/ARCHITECTURE.md">Architecture</a></b><br>
+      Modules, the request flow and the design decisions behind them.
+    </td>
+    <td width="33%" valign="top">
+      <a href="docs/DEVELOPMENT.md"><img src="docs/assets/thumbs/banner-development.jpg" alt="Development"></a><br>
+      <b><a href="docs/DEVELOPMENT.md">Development</a></b><br>
+      Build, the mock-backed test suite, live testing, releases.
+    </td>
+  </tr>
+</table>
+
+## FAQ
+
+<details>
+<summary><b>Does it cost anything?</b></summary>
+<br>
+
+No extra money. Images come out of your ChatGPT plan's Codex usage limits, the same as images you make in the Codex app. `codex-imagegen-mcp status` (or the `auth_status` tool) shows the 5-hour and weekly windows, and checking them uses no quota.
+
+</details>
+
+<details>
+<summary><b>Is the output the same as Codex's built-in image tool?</b></summary>
+<br>
+
+Yes. The endpoint, request body and auth headers are identical to the ones the Codex desktop app sends. The service picks the model, resolution and quality itself, for Codex and for this server alike.
+
+</details>
+
+<details>
+<summary><b>Can I choose <code>gpt-image-2.5</code>, an exact size or a quality level?</b></summary>
+<br>
+
+Not with a ChatGPT sign-in. The service ignores `model`, `size`, `quality` and `n`. That was measured, including requests for the newer `gpt-image-2.5-sunburst` and `-flare` models, and the tools deliberately don't pretend otherwise. Choose the shape with `aspect_ratio`; for exact pixels, resize or crop afterwards. Selecting a model explicitly requires the billed OpenAI Platform API, which is out of scope by design. [The measurements →](docs/BACKEND.md#newer-image-models)
+
+</details>
+
+<details>
+<summary><b>Where do images go?</b></summary>
+<br>
+
+They go to `output_path`, relative to your workspace, when you give one. Otherwise they land in the image library at `~/.local/share/codex-imagegen-mcp/images/<date>/`. Every file is also recorded in `imagegen://history`. Existing files are never replaced unless you pass `overwrite: true`.
+
+</details>
+
+<details>
+<summary><b>Will it sign me out of Codex or opencode?</b></summary>
+<br>
+
+No. Borrowed sign-ins are read-only: they're used while their access token is valid and are never refreshed or written. Its own sign-in (`login`) is independent. [Why that matters →](docs/AUTH.md#why-borrowed-sign-ins-are-read-only)
+
+</details>
+
+<details>
+<summary><b>Is this official?</b></summary>
+<br>
+
+No. It's an unofficial integration that uses the same public OAuth client and internal ChatGPT endpoints as the Codex CLI, as opencode's ChatGPT sign-in also does. Those interfaces are undocumented and may change. Use it within OpenAI's Terms of Use.
+
+</details>
+
+## Configuration
+
+<details>
+<summary>Environment variables</summary>
+<br>
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `CODEX_IMAGEGEN_HOME` | `~/.local/share/codex-imagegen-mcp` | Credentials, history, logs and the default image library |
+| `CODEX_IMAGEGEN_OUTPUT_DIR` | `$CODEX_IMAGEGEN_HOME/images` | Where images go when no `output_path` is given |
+| `CODEX_IMAGEGEN_CREDENTIALS` | `auto` | `auto` (own → Codex → opencode), or pin `own`, `codex` or `opencode` |
+| `CODEX_IMAGEGEN_TIMEOUT_MS` | `300000` | Per-request timeout for the image service |
+| `CODEX_IMAGEGEN_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, `error` or `silent`; the log is `$CODEX_IMAGEGEN_HOME/server.log` |
+| `CODEX_IMAGEGEN_NO_BROWSER` | unset | Never open a browser automatically |
+| `CODEX_HOME` | `~/.codex` | Where to look for a Codex sign-in |
+| `CODEX_IMAGEGEN_ORIGINATOR` | `codex-imagegen-mcp` | The `originator` identifying this client to OpenAI |
+
+Test-only overrides: `CODEX_IMAGEGEN_BASE_URL`, `CODEX_IMAGEGEN_USAGE_URL`, `CODEX_IMAGEGEN_AUTH_ISSUER`, `CODEX_IMAGEGEN_CLIENT_ID`, `CODEX_IMAGEGEN_OPENCODE_AUTH_FILE`.
+
+</details>
+
+## Troubleshooting
+
+Start with `codex-imagegen-mcp doctor`. It checks Node, the data directory, credentials, backend reachability and quota, the sign-in ports, the opencode entry and duplicate skills.
+
+<details>
+<summary>Common problems</summary>
+<br>
+
+| Symptom | Fix |
+|---|---|
+| `Not signed in` | `codex-imagegen-mcp login` (or `--device`), or open Codex/opencode once so their sign-in refreshes |
+| `usage limit … resets in …` | Wait for the reset; `status` shows the windows |
+| `ports 1455 and 1457 are busy` | Another Codex or opencode login is waiting. Finish it, or use `login --device` |
+| `Device-code sign-in is not enabled` | ChatGPT → Settings → Security → allow device code authorization for Codex |
+| Tools missing in opencode | Check `opencode mcp list`, re-run `install opencode`, then restart opencode |
+| An opaque result despite `transparent` | Retry, or generate on a flat `#00FF00` backdrop and run `remove_background` |
+
+Still stuck? See [getting help](.github/SUPPORT.md).
+
+</details>
+
+## Contributing
+
+Bug reports, docs fixes, support for more clients and backend measurements are welcome. Start with [CONTRIBUTING.md](.github/CONTRIBUTING.md); security issues go through [SECURITY.md](.github/SECURITY.md), never public issues. Every release is listed in the [changelog](CHANGELOG.md).
+
+---
+
+<p align="center">
+  <img src="docs/assets/logo.png" width="64" alt="The Codex ImageGen MCP emblem: a sun rising behind a peak"><br>
+  <a href="CHANGELOG.md">Changelog</a> &nbsp;·&nbsp;
+  <a href=".github/CONTRIBUTING.md">Contributing</a> &nbsp;·&nbsp;
+  <a href=".github/SECURITY.md">Security</a> &nbsp;·&nbsp;
+  <a href=".github/CODE_OF_CONDUCT.md">Code of Conduct</a> &nbsp;·&nbsp;
+  <a href=".github/SUPPORT.md">Support</a><br>
+  <sub>
+    Unofficial; not affiliated with or endorsed by OpenAI. Usage counts against your ChatGPT plan and is subject to OpenAI's Terms of Use.<br>
+    Generated images carry OpenAI's C2PA provenance metadata. Apache-2.0; the bundled skill is adapted from OpenAI Codex (Apache-2.0), see <a href="NOTICE">NOTICE</a>.
+  </sub>
+</p>

package/dist/src/auth/borrowed.js

@@ -0,0 +1,77 @@
+import { readJsonFile } from "../util/fs.js";
+import { isRecord, num, str } from "../util/http.js";
+import { identityFromTokens, jwtExpiryMs } from "./jwt.js";
+async function load(file) {
+    try {
+        const value = await readJsonFile(file);
+        if (value === undefined)
+            return { ok: false, reason: "not signed in (file not found)", missing: true };
+        return { ok: true, value };
+    }
+    catch (err) {
+        return { ok: false, reason: `unreadable (${err instanceof Error ? err.message : String(err)})`, missing: false };
+    }
+}
+/** Codex CLI / Codex desktop app: $CODEX_HOME/auth.json (file credential store only). */
+export async function readCodexCredential(file) {
+    const loaded = await load(file);
+    if (!loaded.ok)
+        return loaded;
+    const raw = loaded.value;
+    if (!isRecord(raw))
+        return { ok: false, reason: "unrecognized format", missing: false };
+    const mode = str(raw.auth_mode);
+    const tokens = isRecord(raw.tokens) ? raw.tokens : undefined;
+    if (mode && mode !== "chatgpt") {
+        return { ok: false, reason: `Codex is signed in with "${mode}", not a ChatGPT account`, missing: false };
+    }
+    if (!tokens) {
+        const why = str(raw.OPENAI_API_KEY) ? "Codex is signed in with an API key, not a ChatGPT account" : "no ChatGPT tokens";
+        return { ok: false, reason: why, missing: false };
+    }
+    const accessToken = str(tokens.access_token);
+    if (!accessToken)
+        return { ok: false, reason: "no access token", missing: false };
+    // Codex only sends auth headers when last_refresh is present; mirror that sanity check.
+    if (!str(raw.last_refresh))
+        return { ok: false, reason: "incomplete sign-in (no last_refresh)", missing: false };
+    const idToken = str(tokens.id_token);
+    const identity = identityFromTokens(idToken, accessToken);
+    const credential = { source: "codex", file, accessToken, identity };
+    const accountId = str(tokens.account_id) ?? identity.accountId;
+    if (accountId)
+        credential.accountId = accountId;
+    const expiresAt = jwtExpiryMs(accessToken);
+    if (expiresAt !== undefined)
+        credential.expiresAt = expiresAt;
+    return { ok: true, credential };
+}
+/** opencode "ChatGPT Plus/Pro" OAuth: ~/.local/share/opencode/auth.json -> { openai: { type: "oauth", ... } } */
+export async function readOpencodeCredential(file) {
+    const loaded = await load(file);
+    if (!loaded.ok)
+        return loaded;
+    const raw = loaded.value;
+    if (!isRecord(raw))
+        return { ok: false, reason: "unrecognized format", missing: false };
+    const entry = raw.openai;
+    if (!isRecord(entry))
+        return { ok: false, reason: "no OpenAI sign-in (run `opencode auth login` → OpenAI → ChatGPT)", missing: true };
+    if (entry.type !== "oauth")
+        return { ok: false, reason: "opencode's OpenAI provider uses an API key, not a ChatGPT sign-in", missing: false };
+    const accessToken = str(entry.access);
+    if (!accessToken)
+        return { ok: false, reason: "no access token", missing: false };
+    const identity = identityFromTokens(undefined, accessToken);
+    const credential = { source: "opencode", file, accessToken, identity };
+    const accountId = str(entry.accountId) ?? identity.accountId;
+    if (accountId)
+        credential.accountId = accountId;
+    const expires = num(entry.expires);
+    const jwtExp = jwtExpiryMs(accessToken);
+    const expiresAt = expires !== undefined && jwtExp !== undefined ? Math.min(expires, jwtExp) : (expires ?? jwtExp);
+    if (expiresAt !== undefined)
+        credential.expiresAt = expiresAt;
+    return { ok: true, credential };
+}
+//# sourceMappingURL=borrowed.js.map

package/dist/src/auth/borrowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"borrowed.js","sourceRoot":"","sources":["../../../src/auth/borrowed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAwB,MAAM,UAAU,CAAC;AAoBjF,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnH,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,IAAI,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,IAAI,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACxH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClF,wFAAwF;IACxF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAuB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC;IAC/D,IAAI,SAAS;QAAE,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS;QAAE,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtI,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9I,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAuB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC3F,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC;IAC7D,IAAI,SAAS;QAAE,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAClH,IAAI,SAAS,KAAK,SAAS;QAAE,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}

package/dist/src/auth/browser-login.js

@@ -0,0 +1,179 @@
+import http from "node:http";
+import { BROWSER_LOGIN_TIMEOUT_MS, OAUTH_CALLBACK_PATH, OAUTH_CALLBACK_PORTS } from "../constants.js";
+import { ImagegenError, toImagegenError } from "../errors.js";
+import { sleep } from "../util/http.js";
+import { identityFromTokens } from "./jwt.js";
+import { buildAuthorizeUrl, exchangeAuthorizationCode } from "./oauth.js";
+import { errorPage, successPage } from "./pages.js";
+import { createPkce, createState } from "./pkce.js";
+function listenOnce(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            server.off("listening", onListening);
+            reject(err);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, "127.0.0.1");
+    });
+}
+/** Ask a stale login server (ours or Codex's) on this port to shut down, like Codex does. */
+async function requestCancel(port) {
+    try {
+        await fetch(`http://127.0.0.1:${port}/cancel`, { signal: AbortSignal.timeout(2_000) });
+    }
+    catch {
+        /* nothing listening that understands /cancel */
+    }
+}
+async function bindCallbackServer(server, ports) {
+    for (const [index, port] of ports.entries()) {
+        for (let attempt = 0; attempt < 10; attempt++) {
+            try {
+                await listenOnce(server, port);
+                return server.address().port;
+            }
+            catch (err) {
+                if (err.code !== "EADDRINUSE")
+                    throw err;
+                if (index === 0 && attempt === 0)
+                    await requestCancel(port);
+                await sleep(200);
+            }
+        }
+    }
+    throw new ImagegenError("login_failed", `Could not start the local sign-in callback server: port${ports.length > 1 ? "s" : ""} ${ports.join(" and ")} ${ports.length > 1 ? "are" : "is"} busy. ` +
+        "Another Codex/opencode sign-in may be in progress — finish or close it, or use device-code sign-in instead.");
+}
+function friendlyAuthorizeError(error, description) {
+    if (error === "access_denied" && description.includes("missing_codex_entitlement")) {
+        return "Codex is not enabled for your ChatGPT workspace. Ask your workspace admin to enable Codex, then try again.";
+    }
+    if (error === "access_denied")
+        return `Sign-in was denied${description ? `: ${description}` : "."}`;
+    return `Sign-in failed: ${error}${description ? ` — ${description}` : ""}`;
+}
+/**
+ * Start the browser (authorization code + PKCE) flow. Binds the loopback callback server first so
+ * the returned URL is immediately usable; the caller decides how to show/open it.
+ */
+export async function startBrowserLogin(options) {
+    const pkce = createPkce();
+    const state = createState();
+    const sockets = new Set();
+    let resolveResult;
+    let rejectResult;
+    const result = new Promise((resolve, reject) => {
+        resolveResult = resolve;
+        rejectResult = reject;
+    });
+    // Avoid unhandled-rejection noise if the caller never awaits (e.g. cancelled in the background).
+    result.catch(() => undefined);
+    let settled = false;
+    let timer;
+    let redirectUri = "";
+    let port = 0;
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+        const html = (status, body) => {
+            res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" });
+            res.end(body);
+        };
+        if (url.pathname === OAUTH_CALLBACK_PATH) {
+            if (settled) {
+                html(200, errorPage("This sign-in attempt already finished. You can close this tab."));
+                return;
+            }
+            const q = url.searchParams;
+            if (q.get("state") !== state) {
+                // Possibly a stale tab from an earlier attempt: reject it but keep waiting.
+                res.writeHead(400, { "content-type": "text/plain; charset=utf-8", connection: "close" });
+                res.end("State mismatch");
+                return;
+            }
+            const error = q.get("error");
+            if (error) {
+                const message = friendlyAuthorizeError(error, q.get("error_description") ?? "");
+                html(200, errorPage(message));
+                finish(new ImagegenError("login_failed", message, { details: { error } }));
+                return;
+            }
+            const code = q.get("code");
+            if (!code) {
+                html(200, errorPage("The authorization code is missing from the callback."));
+                finish(new ImagegenError("login_failed", "The authorization code is missing from the callback."));
+                return;
+            }
+            exchangeAuthorizationCode(options, { code, redirectUri, codeVerifier: pkce.verifier }).then((tokens) => {
+                const email = identityFromTokens(tokens.idToken, tokens.accessToken).email ?? "";
+                res.writeHead(302, { location: `/success?email=${encodeURIComponent(email)}`, connection: "close" });
+                res.end();
+                finish(undefined, tokens);
+            }, (err) => {
+                const e = toImagegenError(err, "login_failed");
+                html(200, errorPage(e.message));
+                finish(e);
+            });
+            return;
+        }
+        if (url.pathname === "/success") {
+            html(200, successPage(url.searchParams.get("email") || undefined));
+            return;
+        }
+        if (url.pathname === "/cancel") {
+            res.writeHead(200, { "content-type": "text/plain; charset=utf-8", connection: "close" });
+            res.end("Login cancelled");
+            finish(new ImagegenError("login_cancelled", "Sign-in was cancelled (a newer sign-in attempt took over the callback port)."));
+            return;
+        }
+        res.writeHead(404, { "content-type": "text/plain; charset=utf-8", connection: "close" });
+        res.end("Not found");
+    });
+    server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+    });
+    const shutdown = () => {
+        server.close();
+        for (const s of sockets)
+            s.destroy();
+    };
+    function finish(err, tokens) {
+        if (settled)
+            return;
+        settled = true;
+        if (timer)
+            clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onAbort);
+        // Keep serving briefly so the browser can load /success after the redirect.
+        setTimeout(shutdown, 1_500).unref();
+        if (err)
+            rejectResult(err);
+        else
+            resolveResult(tokens);
+    }
+    const onAbort = () => finish(new ImagegenError("login_cancelled", "Sign-in was cancelled."));
+    port = await bindCallbackServer(server, options.ports ?? OAUTH_CALLBACK_PORTS);
+    redirectUri = `http://localhost:${port}${OAUTH_CALLBACK_PATH}`;
+    const timeoutMs = options.timeoutMs ?? BROWSER_LOGIN_TIMEOUT_MS;
+    timer = setTimeout(() => finish(new ImagegenError("login_failed", `Timed out after ${Math.round(timeoutMs / 60_000)} minutes waiting for the browser sign-in.`)), timeoutMs);
+    timer.unref();
+    if (options.signal?.aborted)
+        onAbort();
+    else
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+    const url = buildAuthorizeUrl({
+        issuer: options.issuer,
+        clientId: options.clientId,
+        redirectUri,
+        codeChallenge: pkce.challenge,
+        state,
+        originator: options.originator,
+    });
+    return { url, redirectUri, port, result, cancel: onAbort };
+}
+//# sourceMappingURL=browser-login.js.map

package/dist/src/auth/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"","sources":["../../../src/auth/browser-login.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAoB,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAqBpD,SAAS,UAAU,CAAC,MAAmB,EAAE,IAAY;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,oBAAoB,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,KAAwB;IAC7E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/B,OAAQ,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,YAAY;oBAAE,MAAM,GAAG,CAAC;gBACpE,IAAI,KAAK,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC;oBAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC5D,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,0DAA0D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS;QACtJ,6GAA6G,CAChH,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,WAAmB;IAChE,IAAI,KAAK,KAAK,eAAe,IAAI,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnF,OAAO,4GAA4G,CAAC;IACtH,CAAC;IACD,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,qBAAqB,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpG,OAAO,mBAAmB,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA4B;IAClE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,IAAI,aAAqC,CAAC;IAC1C,IAAI,YAAmC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,aAAa,GAAG,OAAO,CAAC;QACxB,YAAY,GAAG,MAAM,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,iGAAiG;IACjG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAiC,CAAC;IACtC,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE;YAC5C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACxH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,gEAAgE,CAAC,CAAC,CAAC;gBACvF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7B,4EAA4E;gBAC5E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzF,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChF,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,sDAAsD,CAAC,CAAC,CAAC;gBAC7E,MAAM,CAAC,IAAI,aAAa,CAAC,cAAc,EAAE,sDAAsD,CAAC,CAAC,CAAC;gBAClG,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CACzF,CAAC,MAAM,EAAE,EAAE;gBACT,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACrG,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC5B,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChC,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACzF,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,aAAa,CAAC,iBAAiB,EAAE,8EAA8E,CAAC,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC,CAAC;IAEF,SAAS,MAAM,CAAC,GAAa,EAAE,MAAiB;QAC9C,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,4EAA4E;QAC5E,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC;;YACtB,aAAa,CAAC,MAAkB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE7F,IAAI,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC;IAC/E,WAAW,GAAG,oBAAoB,IAAI,GAAG,mBAAmB,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAChE,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,cAAc,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,2CAA2C,CAAC,CAAC,EAC7I,SAAS,CACV,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,CAAC;;QAClC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW;QACX,aAAa,EAAE,IAAI,CAAC,SAAS;QAC7B,KAAK;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}