codex-imagegen-mcp 0.1.2

package/dist/src/auth/device-login.js

@@ -0,0 +1,39 @@
+import { ImagegenError } from "../errors.js";
+import { deviceRedirectUri, exchangeAuthorizationCode, pollDeviceAuthorization, requestDeviceCode, } from "./oauth.js";
+/** Start OpenAI's device-code flow (for headless/remote machines where a browser redirect can't reach us). */
+export async function startDeviceLogin(client, signal) {
+    const device = await requestDeviceCode(client, signal);
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(new ImagegenError("login_cancelled", "Device-code sign-in was cancelled."));
+    if (signal?.aborted)
+        onAbort();
+    else
+        signal?.addEventListener("abort", onAbort, { once: true });
+    const result = (async () => {
+        try {
+            const auth = await pollDeviceAuthorization(client, device, controller.signal);
+            return await exchangeAuthorizationCode(client, {
+                code: auth.authorizationCode,
+                redirectUri: deviceRedirectUri(client.issuer),
+                codeVerifier: auth.codeVerifier,
+            });
+        }
+        catch (err) {
+            if (controller.signal.aborted)
+                throw new ImagegenError("login_cancelled", "Device-code sign-in was cancelled.");
+            throw err;
+        }
+        finally {
+            signal?.removeEventListener("abort", onAbort);
+        }
+    })();
+    result.catch(() => undefined);
+    return {
+        verificationUrl: device.verificationUrl,
+        userCode: device.userCode,
+        expiresAt: device.expiresAt,
+        result,
+        cancel: onAbort,
+    };
+}
+//# sourceMappingURL=device-login.js.map

package/dist/src/auth/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../../../src/auth/device-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,YAAY,CAAC;AAWpB,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAmB,EAAE,MAAoB;IAC9E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACnH,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,CAAC;;QAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,CAAC,KAAK,IAAuB,EAAE;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC9E,OAAO,MAAM,yBAAyB,CAAC,MAAM,EAAE;gBAC7C,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;YAChH,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9B,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM;QACN,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC"}

package/dist/src/auth/jwt.js

@@ -0,0 +1,69 @@
+import { isRecord, str } from "../util/http.js";
+const AUTH_CLAIM = "https://api.openai.com/auth";
+const PROFILE_CLAIM = "https://api.openai.com/profile";
+/**
+ * Decode a JWT payload WITHOUT verifying the signature. That is fine here: tokens come straight
+ * from OpenAI's token endpoint (or the user's own credential files) and are only read for
+ * display/expiry; the backend is what validates them. Mirrors codex-rs/login/src/token_data.rs.
+ */
+export function decodeJwtPayload(token) {
+    if (!token)
+        return undefined;
+    const parts = token.split(".");
+    if (parts.length < 2 || !parts[1])
+        return undefined;
+    try {
+        const value = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return isRecord(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `exp` claim in epoch milliseconds, if present. */
+export function jwtExpiryMs(token) {
+    const exp = decodeJwtPayload(token)?.exp;
+    return typeof exp === "number" && Number.isFinite(exp) ? exp * 1000 : undefined;
+}
+function readIdentity(payload) {
+    if (!payload)
+        return {};
+    const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
+    const profile = isRecord(payload[PROFILE_CLAIM]) ? payload[PROFILE_CLAIM] : {};
+    const out = {};
+    const email = str(payload.email) ?? str(profile.email);
+    if (email)
+        out.email = email;
+    const plan = str(auth.chatgpt_plan_type);
+    if (plan)
+        out.planType = plan;
+    const account = str(auth.chatgpt_account_id);
+    if (account)
+        out.accountId = account;
+    const user = str(auth.chatgpt_user_id) ?? str(auth.user_id);
+    if (user)
+        out.userId = user;
+    if (auth.chatgpt_account_is_fedramp === true)
+        out.isFedramp = true;
+    return out;
+}
+/** Identity from the id_token, with access-token claims as fallback for missing fields. */
+export function identityFromTokens(idToken, accessToken) {
+    const fromId = readIdentity(decodeJwtPayload(idToken));
+    const fromAccess = readIdentity(decodeJwtPayload(accessToken));
+    const merged = { isFedramp: Boolean(fromId.isFedramp ?? fromAccess.isFedramp) };
+    const email = fromId.email ?? fromAccess.email;
+    if (email)
+        merged.email = email;
+    const planType = fromId.planType ?? fromAccess.planType;
+    if (planType)
+        merged.planType = planType;
+    const accountId = fromId.accountId ?? fromAccess.accountId;
+    if (accountId)
+        merged.accountId = accountId;
+    const userId = fromId.userId ?? fromAccess.userId;
+    if (userId)
+        merged.userId = userId;
+    return merged;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/src/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAIhD,MAAM,UAAU,GAAG,6BAA6B,CAAC;AACjD,MAAM,aAAa,GAAG,gCAAgC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAYD,SAAS,YAAY,CAAC,OAA+B;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACzC,IAAI,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,GAAG,CAAC,SAAS,GAAG,OAAO,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI;QAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,IAAI,CAAC,0BAA0B,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,OAAgB,EAAE,WAAoB;IACvE,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAoB,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC/C,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;IACxD,IAAI,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC;IAC3D,IAAI,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;IAClD,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACnC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/auth/manager.js

@@ -0,0 +1,289 @@
+import { ACCESS_TOKEN_REFRESH_WINDOW_MS, BORROWED_TOKEN_MIN_VALIDITY_MS, FALLBACK_REFRESH_INTERVAL_MS, } from "../constants.js";
+import { ImagegenError, loginHint, toImagegenError } from "../errors.js";
+import { formatWhen } from "../util/format.js";
+import { withFileLock } from "../util/fs.js";
+import { readCodexCredential, readOpencodeCredential } from "./borrowed.js";
+import { identityFromTokens, jwtExpiryMs } from "./jwt.js";
+import { refreshAccessToken, revokeToken } from "./oauth.js";
+import { buildStoredAuth, deleteStoredAuth, readStoredAuth, writeStoredAuth, } from "./store.js";
+export const SOURCE_LABELS = {
+    own: "codex-imagegen-mcp sign-in",
+    codex: "Codex sign-in (borrowed, read-only)",
+    opencode: "opencode ChatGPT sign-in (borrowed, read-only)",
+};
+const OWNER_APP = { codex: "Codex", opencode: "opencode" };
+export function authOptionsFromConfig(config, logger, fetchImpl) {
+    const oauth = { issuer: config.issuer, clientId: config.clientId, userAgent: config.userAgent };
+    if (fetchImpl)
+        oauth.fetchImpl = fetchImpl;
+    return {
+        mode: config.credentialMode,
+        authFile: config.authFile,
+        lockFile: config.lockFile,
+        codexAuthFile: config.codexAuthFile,
+        opencodeAuthFile: config.opencodeAuthFile,
+        oauth,
+        originator: config.originator,
+        logger,
+    };
+}
+/**
+ * Resolves credentials for the ChatGPT backend from, in order:
+ *   1. our own sign-in (`login`), refreshed automatically under a cross-process lock;
+ *   2. the Codex CLI/app sign-in (read-only, never refreshed by us);
+ *   3. the opencode ChatGPT sign-in (read-only, never refreshed by us).
+ * `CODEX_IMAGEGEN_CREDENTIALS=own|codex|opencode` pins a single source.
+ */
+export class AuthManager {
+    o;
+    /** Access tokens the backend rejected with 401 during this process's lifetime. */
+    rejected = new Set();
+    constructor(o) {
+        this.o = o;
+    }
+    get mode() {
+        return this.o.mode;
+    }
+    get oauthClient() {
+        return this.o.oauth;
+    }
+    enabledSources() {
+        return this.o.mode === "auto" ? ["own", "codex", "opencode"] : [this.o.mode];
+    }
+    now() {
+        return this.o.now?.() ?? Date.now();
+    }
+    /** Return credentials that are valid right now (refreshing our own tokens if needed). */
+    async getCredentials() {
+        const reasons = [];
+        const errors = [];
+        for (const source of this.enabledSources()) {
+            try {
+                const r = await this.resolve(source);
+                if ("credentials" in r)
+                    return r.credentials;
+                reasons.push(`${SOURCE_LABELS[source]}: ${r.reason}`);
+            }
+            catch (err) {
+                const e = toImagegenError(err);
+                if (e.kind === "cancelled")
+                    throw e;
+                errors.push(e);
+                reasons.push(`${SOURCE_LABELS[source]}: ${e.message}`);
+                this.o.logger.warn("credential source failed", { source, kind: e.kind, message: e.message });
+            }
+        }
+        const expired = errors.find((e) => e.kind === "session_expired");
+        if (expired) {
+            throw new ImagegenError("session_expired", `${expired.message} ${loginHint()}`, { details: { sources: reasons }, cause: expired });
+        }
+        const transient = errors.find((e) => e.retryable);
+        if (transient)
+            throw transient;
+        throw new ImagegenError("not_signed_in", `Not signed in to ChatGPT. ${loginHint()} (Checked — ${reasons.join("; ")}.)`, {
+            details: { sources: reasons },
+        });
+    }
+    /**
+     * Called after the backend answered 401 for `failed`. Marks that token as rejected and returns a
+     * different usable credential (refreshed own token, a re-read borrowed token, or the next source).
+     */
+    async recoverFromUnauthorized(failed) {
+        this.rejected.add(failed.accessToken);
+        try {
+            const next = await this.getCredentials();
+            return next.accessToken === failed.accessToken ? undefined : next;
+        }
+        catch (err) {
+            this.o.logger.warn("could not recover from 401", { message: toImagegenError(err).message });
+            return undefined;
+        }
+    }
+    async resolve(source) {
+        if (source === "own")
+            return this.resolveOwn();
+        const read = source === "codex" ? await readCodexCredential(this.o.codexAuthFile) : await readOpencodeCredential(this.o.opencodeAuthFile);
+        return this.resolveBorrowed(source, read);
+    }
+    resolveBorrowed(source, read) {
+        if (!read.ok)
+            return { reason: read.reason };
+        const c = read.credential;
+        if (this.rejected.has(c.accessToken)) {
+            return { reason: `ChatGPT rejected its access token; open ${OWNER_APP[source]} once so it refreshes the sign-in` };
+        }
+        if (c.expiresAt !== undefined && c.expiresAt - this.now() < BORROWED_TOKEN_MIN_VALIDITY_MS) {
+            return { reason: `its access token expired ${formatWhen(c.expiresAt, this.now())}; open ${OWNER_APP[source]} once to refresh it` };
+        }
+        const credentials = { source, file: c.file, accessToken: c.accessToken, identity: c.identity };
+        if (c.accountId)
+            credentials.accountId = c.accountId;
+        if (c.expiresAt !== undefined)
+            credentials.expiresAt = c.expiresAt;
+        return { credentials };
+    }
+    ownToCredentials(stored) {
+        const identity = identityFromTokens(stored.tokens.id_token, stored.tokens.access_token);
+        const credentials = {
+            source: "own",
+            file: this.o.authFile,
+            accessToken: stored.tokens.access_token,
+            identity,
+        };
+        const accountId = stored.tokens.account_id ?? identity.accountId;
+        if (accountId)
+            credentials.accountId = accountId;
+        const exp = jwtExpiryMs(stored.tokens.access_token);
+        if (exp !== undefined)
+            credentials.expiresAt = exp;
+        return credentials;
+    }
+    needsRefresh(stored) {
+        if (this.rejected.has(stored.tokens.access_token))
+            return true;
+        const exp = jwtExpiryMs(stored.tokens.access_token);
+        if (exp !== undefined)
+            return exp - this.now() <= ACCESS_TOKEN_REFRESH_WINDOW_MS;
+        const last = Date.parse(stored.last_refresh);
+        return !Number.isFinite(last) || this.now() - last >= FALLBACK_REFRESH_INTERVAL_MS;
+    }
+    async resolveOwn() {
+        const stored = await readStoredAuth(this.o.authFile);
+        if (!stored)
+            return { reason: "not signed in" };
+        if (!this.needsRefresh(stored))
+            return { credentials: this.ownToCredentials(stored) };
+        return { credentials: await this.refreshOwn(stored.tokens.access_token) };
+    }
+    /**
+     * Refresh under a cross-process lock. After acquiring it we re-read the file: if another process
+     * already rotated the tokens we adopt its result instead of spending the (single-use) refresh
+     * token again — which would invalidate the whole sign-in with `refresh_token_reused`.
+     */
+    async refreshOwn(staleAccessToken) {
+        return withFileLock(this.o.lockFile, async () => {
+            const latest = await readStoredAuth(this.o.authFile);
+            if (!latest)
+                throw new ImagegenError("not_signed_in", "You were signed out while the sign-in was being refreshed.");
+            if (latest.tokens.access_token !== staleAccessToken && !this.needsRefresh(latest)) {
+                this.o.logger.debug("adopting tokens refreshed by another process");
+                return this.ownToCredentials(latest);
+            }
+            let fresh;
+            try {
+                fresh = await refreshAccessToken(this.o.oauth, { refreshToken: latest.tokens.refresh_token, originator: this.o.originator });
+            }
+            catch (err) {
+                const e = toImagegenError(err);
+                const exp = jwtExpiryMs(latest.tokens.access_token);
+                const stillUsable = exp !== undefined && exp - this.now() > 30_000 && !this.rejected.has(latest.tokens.access_token);
+                if (e.kind !== "session_expired" && stillUsable) {
+                    this.o.logger.warn("token refresh failed; using the current access token until it expires", { message: e.message });
+                    return this.ownToCredentials(latest);
+                }
+                throw e;
+            }
+            const next = { ...latest, tokens: { ...latest.tokens }, last_refresh: new Date(this.now()).toISOString() };
+            if (fresh.accessToken)
+                next.tokens.access_token = fresh.accessToken;
+            if (fresh.refreshToken)
+                next.tokens.refresh_token = fresh.refreshToken;
+            if (fresh.idToken)
+                next.tokens.id_token = fresh.idToken;
+            if (!next.tokens.account_id) {
+                const accountId = identityFromTokens(next.tokens.id_token, next.tokens.access_token).accountId;
+                if (accountId)
+                    next.tokens.account_id = accountId;
+            }
+            await writeStoredAuth(this.o.authFile, next);
+            this.o.logger.info("refreshed ChatGPT access token");
+            return this.ownToCredentials(next);
+        });
+    }
+    /** Persist a fresh login (replacing and revoking any previous one of ours). */
+    async saveLogin(tokens, method) {
+        return withFileLock(this.o.lockFile, async () => {
+            const previous = await readStoredAuth(this.o.authFile).catch(() => undefined);
+            const stored = buildStoredAuth(tokens, method, new Date(this.now()));
+            await writeStoredAuth(this.o.authFile, stored);
+            this.rejected.clear();
+            let revokedPrevious = false;
+            if (previous && previous.tokens.refresh_token !== stored.tokens.refresh_token) {
+                revokedPrevious = await revokeToken(this.o.oauth, previous.tokens.refresh_token, "refresh_token");
+            }
+            return { stored, identity: identityFromTokens(stored.tokens.id_token, stored.tokens.access_token), revokedPrevious };
+        });
+    }
+    /** Remove our own credentials (never touches Codex/opencode files). */
+    async logout(options) {
+        return withFileLock(this.o.lockFile, async () => {
+            const stored = await readStoredAuth(this.o.authFile).catch(() => undefined);
+            let revoked = false;
+            if (stored && options.revoke)
+                revoked = await revokeToken(this.o.oauth, stored.tokens.refresh_token, "refresh_token");
+            const removed = await deleteStoredAuth(this.o.authFile);
+            return { hadCredentials: Boolean(stored), removed, revoked };
+        });
+    }
+    /** Describe every credential source without refreshing anything. */
+    async inspect() {
+        const enabled = new Set(this.enabledSources());
+        const disabledDetail = `disabled (CODEX_IMAGEGEN_CREDENTIALS=${this.o.mode})`;
+        const own = await this.inspectOwn();
+        const codex = this.inspectBorrowed("codex", this.o.codexAuthFile, await readCodexCredential(this.o.codexAuthFile));
+        const opencode = this.inspectBorrowed("opencode", this.o.opencodeAuthFile, await readOpencodeCredential(this.o.opencodeAuthFile));
+        return [own, codex, opencode].map((r) => (enabled.has(r.source) ? r : { ...r, state: "disabled", detail: disabledDetail }));
+    }
+    /** The source `getCredentials()` would pick, based on an `inspect()` report. */
+    static activeSource(reports) {
+        return reports.find((r) => r.state === "ready" || r.state === "refreshable");
+    }
+    async inspectOwn() {
+        const base = { source: "own", label: SOURCE_LABELS.own, file: this.o.authFile };
+        let stored;
+        try {
+            stored = await readStoredAuth(this.o.authFile);
+        }
+        catch (err) {
+            return { ...base, state: "unusable", detail: toImagegenError(err).message };
+        }
+        if (!stored)
+            return { ...base, state: "missing", detail: "not signed in" };
+        const identity = identityFromTokens(stored.tokens.id_token, stored.tokens.access_token);
+        const report = {
+            ...base,
+            state: "ready",
+            detail: "signed in",
+            identity,
+            lastRefresh: stored.last_refresh,
+            loginMethod: stored.login_method,
+        };
+        const exp = jwtExpiryMs(stored.tokens.access_token);
+        if (exp !== undefined)
+            report.expiresAt = exp;
+        if (this.needsRefresh(stored)) {
+            report.state = "refreshable";
+            report.detail = "access token expired or expiring; it is refreshed automatically on next use";
+        }
+        return report;
+    }
+    inspectBorrowed(source, file, read) {
+        const base = { source, label: SOURCE_LABELS[source], file };
+        if (!read.ok)
+            return { ...base, state: read.missing ? "missing" : "unusable", detail: read.reason };
+        const c = read.credential;
+        const report = { ...base, state: "ready", detail: "signed in", identity: c.identity };
+        if (c.expiresAt !== undefined)
+            report.expiresAt = c.expiresAt;
+        if (this.rejected.has(c.accessToken)) {
+            report.state = "unusable";
+            report.detail = `ChatGPT rejected this token; open ${OWNER_APP[source]} once to refresh it`;
+        }
+        else if (c.expiresAt !== undefined && c.expiresAt - this.now() < BORROWED_TOKEN_MIN_VALIDITY_MS) {
+            report.state = "expired";
+            report.detail = `access token expired ${formatWhen(c.expiresAt, this.now())}; open ${OWNER_APP[source]} once to refresh it`;
+        }
+        return report;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/src/auth/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/auth/manager.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAqB,MAAM,eAAe,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAwB,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,eAAe,GAIhB,MAAM,YAAY,CAAC;AA0BpB,MAAM,CAAC,MAAM,aAAa,GAAqC;IAC7D,GAAG,EAAE,4BAA4B;IACjC,KAAK,EAAE,qCAAqC;IAC5C,QAAQ,EAAE,gDAAgD;CAC3D,CAAC;AAEF,MAAM,SAAS,GAAqD,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAc7G,MAAM,UAAU,qBAAqB,CAAC,MAAqB,EAAE,MAAc,EAAE,SAAwB;IACnG,MAAM,KAAK,GAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7G,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,cAAc;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,KAAK;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC;AAID;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IAIO,CAAC;IAH9B,kFAAkF;IACjE,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,YAA6B,CAAqB;iBAArB,CAAC;IAAuB,CAAC;IAEtD,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,cAAc;QAClB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrC,IAAI,aAAa,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,CAAC,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;QACjE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,6BAA6B,SAAS,EAAE,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACtH,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAAmB;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5F,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAwB;QAC5C,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAEO,eAAe,CAAC,MAAwC,EAAE,IAAkB;QAClF,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,2CAA2C,SAAS,CAAC,MAAM,CAAC,mCAAmC,EAAE,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,8BAA8B,EAAE,CAAC;YAC3F,OAAO,EAAE,MAAM,EAAE,4BAA4B,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,SAAS,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACrI,CAAC;QACD,MAAM,WAAW,GAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5G,IAAI,CAAC,CAAC,SAAS;YAAE,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACrD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACnE,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IAEO,gBAAgB,CAAC,MAAkB;QACzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,MAAM,WAAW,GAAgB;YAC/B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;YACrB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;YACvC,QAAQ;SACT,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,SAAS,CAAC;QACjE,IAAI,SAAS;YAAE,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC;QACjD,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,WAAW,CAAC,SAAS,GAAG,GAAG,CAAC;QACnD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,YAAY,CAAC,MAAkB;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,8BAA8B,CAAC;QACjF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,4BAA4B,CAAC;IACrF,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CAAC,gBAAwB;QAC/C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;YACpH,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,KAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/H,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrH,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,WAAW,EAAE,CAAC;oBAChD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uEAAuE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpH,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;YACD,MAAM,IAAI,GAAe,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACvH,IAAI,KAAK,CAAC,WAAW;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;YACpE,IAAI,KAAK,CAAC,YAAY;gBAAE,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;YACvE,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC;gBAC/F,IAAI,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;YACpD,CAAC;YACD,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,SAAS,CAAC,MAAgB,EAAE,MAAmB;QACnD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC9E,eAAe,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;QACvH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YACtH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,wCAAwC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,UAAmB,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACvI,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAc,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzF,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,MAAM,MAAM,GAAiB;YAC3B,GAAG,IAAI;YACP,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,WAAW;YACnB,QAAQ;YACR,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,WAAW,EAAE,MAAM,CAAC,YAAY;SACjC,CAAC;QACF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;QAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;YAC7B,MAAM,CAAC,MAAM,GAAG,6EAA6E,CAAC;QAChG,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,eAAe,CAAC,MAAwC,EAAE,IAAY,EAAE,IAAkB;QAChG,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACpG,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1B,MAAM,MAAM,GAAiB,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC;YAC1B,MAAM,CAAC,MAAM,GAAG,qCAAqC,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC9F,CAAC;aAAM,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,8BAA8B,EAAE,CAAC;YAClG,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;YACzB,MAAM,CAAC,MAAM,GAAG,wBAAwB,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,SAAS,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAC9H,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}