codex-imagegen-mcp 0.1.2

package/dist/src/auth/oauth.js

@@ -0,0 +1,246 @@
+import { DEVICE_CODE_TIMEOUT_MS, DEVICE_VERIFICATION_PATH, OAUTH_SCOPES } from "../constants.js";
+import { ImagegenError, toImagegenError } from "../errors.js";
+import { isRecord, num, readBody, sleep, snippet, str } from "../util/http.js";
+function doFetch(client) {
+    return client.fetchImpl ?? fetch;
+}
+function uaHeaders(client) {
+    return client.userAgent ? { "user-agent": client.userAgent } : {};
+}
+/** Build the /oauth/authorize URL with the same parameters (and order) Codex sends. */
+export function buildAuthorizeUrl(p) {
+    const q = new URLSearchParams();
+    q.set("response_type", "code");
+    q.set("client_id", p.clientId);
+    q.set("redirect_uri", p.redirectUri);
+    q.set("scope", p.scopes ?? OAUTH_SCOPES);
+    q.set("code_challenge", p.codeChallenge);
+    q.set("code_challenge_method", "S256");
+    q.set("id_token_add_organizations", "true");
+    q.set("codex_cli_simplified_flow", "true");
+    q.set("state", p.state);
+    q.set("originator", p.originator);
+    // URLSearchParams encodes spaces as '+'; Codex (and RFC 3986 style) uses %20.
+    return `${p.issuer}/oauth/authorize?${q.toString().replace(/\+/g, "%20")}`;
+}
+/** Extract a readable message from an OAuth error body. */
+export function describeOAuthError(json, text) {
+    if (isRecord(json)) {
+        const desc = str(json.error_description);
+        if (desc)
+            return desc;
+        if (isRecord(json.error)) {
+            const m = str(json.error.message) ?? str(json.error.code);
+            if (m)
+                return m;
+        }
+        const e = str(json.error) ?? str(json.message) ?? str(json.detail);
+        if (e)
+            return e;
+    }
+    return snippet(text) || "no details";
+}
+/** OAuth error code: `error.code` (object form), then `error` (string form), then top-level `code`. */
+export function oauthErrorCode(json) {
+    if (!isRecord(json))
+        return undefined;
+    if (isRecord(json.error))
+        return str(json.error.code);
+    return str(json.error) ?? str(json.code);
+}
+function parseTokenResponse(json) {
+    if (!isRecord(json))
+        return {};
+    const out = {};
+    const id = str(json.id_token);
+    if (id)
+        out.idToken = id;
+    const access = str(json.access_token);
+    if (access)
+        out.accessToken = access;
+    const refresh = str(json.refresh_token);
+    if (refresh)
+        out.refreshToken = refresh;
+    return out;
+}
+/** Exchange an authorization code for tokens (form-encoded, as Codex does). */
+export async function exchangeAuthorizationCode(client, p) {
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: p.code,
+        redirect_uri: p.redirectUri,
+        client_id: client.clientId,
+        code_verifier: p.codeVerifier,
+    });
+    let res;
+    try {
+        res = await doFetch(client)(`${client.issuer}/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", ...uaHeaders(client) },
+            body: body.toString(),
+            signal: p.signal ?? AbortSignal.timeout(60_000),
+        });
+    }
+    catch (err) {
+        throw toImagegenError(err, "network");
+    }
+    const { json, text } = await readBody(res);
+    if (!res.ok) {
+        throw new ImagegenError("login_failed", `Token exchange failed (HTTP ${res.status}): ${describeOAuthError(json, text)}`, {
+            details: { status: res.status, code: oauthErrorCode(json) },
+        });
+    }
+    const tokens = parseTokenResponse(json);
+    if (!tokens.accessToken || !tokens.refreshToken) {
+        throw new ImagegenError("login_failed", "Token exchange succeeded but the response is missing tokens.");
+    }
+    const out = { accessToken: tokens.accessToken, refreshToken: tokens.refreshToken };
+    if (tokens.idToken)
+        out.idToken = tokens.idToken;
+    return out;
+}
+const PERMANENT_REFRESH_MESSAGES = {
+    refresh_token_expired: "Your sign-in has expired.",
+    refresh_token_reused: "Your sign-in was invalidated because its refresh token was already used (another process or machine refreshed it first).",
+    refresh_token_invalidated: "Your sign-in was revoked.",
+};
+/**
+ * Refresh tokens. OpenAI rotates refresh tokens (they are single-use), so callers MUST persist the
+ * returned refresh token and serialize refreshes across processes.
+ * Throws `session_expired` for permanent failures and a retryable error otherwise.
+ */
+export async function refreshAccessToken(client, p) {
+    let res;
+    try {
+        res = await doFetch(client)(`${client.issuer}/oauth/token`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json",
+                ...uaHeaders(client),
+                ...(p.originator ? { originator: p.originator } : {}),
+            },
+            body: JSON.stringify({ client_id: client.clientId, grant_type: "refresh_token", refresh_token: p.refreshToken }),
+            signal: p.signal ?? AbortSignal.timeout(60_000),
+        });
+    }
+    catch (err) {
+        throw toImagegenError(err, "network");
+    }
+    const { json, text } = await readBody(res);
+    if (!res.ok) {
+        const code = oauthErrorCode(json);
+        const known = code ? PERMANENT_REFRESH_MESSAGES[code] : undefined;
+        const permanent = known !== undefined || res.status === 401 || (res.status === 400 && code === "invalid_grant");
+        if (permanent) {
+            throw new ImagegenError("session_expired", `${known ?? `Refreshing your sign-in failed (HTTP ${res.status}: ${describeOAuthError(json, text)}).`} Please sign in again.`, {
+                details: { status: res.status, code, permanent: true },
+            });
+        }
+        throw new ImagegenError("server_error", `Token refresh failed (HTTP ${res.status}): ${describeOAuthError(json, text)}`, {
+            details: { status: res.status, code },
+            retryable: true,
+        });
+    }
+    const tokens = parseTokenResponse(json);
+    if (!tokens.accessToken)
+        throw new ImagegenError("server_error", "Token refresh response did not include an access token.", { retryable: true });
+    return tokens;
+}
+/** Revoke a token (best effort). Returns whether the server acknowledged it. */
+export async function revokeToken(client, token, hint) {
+    try {
+        const body = { token, token_type_hint: hint };
+        if (hint === "refresh_token")
+            body.client_id = client.clientId;
+        const res = await doFetch(client)(`${client.issuer}/oauth/revoke`, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json", ...uaHeaders(client) },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(10_000),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+export async function requestDeviceCode(client, signal) {
+    let res;
+    try {
+        res = await doFetch(client)(`${client.issuer}/api/accounts/deviceauth/usercode`, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json", ...uaHeaders(client) },
+            body: JSON.stringify({ client_id: client.clientId }),
+            signal: signal ?? AbortSignal.timeout(30_000),
+        });
+    }
+    catch (err) {
+        throw toImagegenError(err, "network");
+    }
+    const { json, text } = await readBody(res);
+    if (res.status === 404) {
+        throw new ImagegenError("login_failed", "Device-code sign-in is not enabled for this account. Enable it in ChatGPT → Settings → Security (device code authorization for Codex), or use the browser sign-in instead.", { details: { status: 404 } });
+    }
+    if (!res.ok || !isRecord(json)) {
+        throw new ImagegenError("login_failed", `Could not start device-code sign-in (HTTP ${res.status}): ${describeOAuthError(json, text)}`, {
+            details: { status: res.status },
+        });
+    }
+    const deviceAuthId = str(json.device_auth_id);
+    const userCode = str(json.user_code) ?? str(json.usercode);
+    if (!deviceAuthId || !userCode)
+        throw new ImagegenError("login_failed", "Device-code response is missing the device id or user code.");
+    const intervalSeconds = num(json.interval) ?? 5;
+    return {
+        deviceAuthId,
+        userCode,
+        intervalMs: Math.max(1, intervalSeconds) * 1000,
+        verificationUrl: `${client.issuer}${DEVICE_VERIFICATION_PATH}`,
+        expiresAt: Date.now() + DEVICE_CODE_TIMEOUT_MS,
+    };
+}
+/** Poll until the user approves (403/404 = still pending). */
+export async function pollDeviceAuthorization(client, device, signal) {
+    for (;;) {
+        if (Date.now() > device.expiresAt) {
+            throw new ImagegenError("login_failed", "Device-code sign-in timed out after 15 minutes. Start again.");
+        }
+        let res;
+        try {
+            res = await doFetch(client)(`${client.issuer}/api/accounts/deviceauth/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json", accept: "application/json", ...uaHeaders(client) },
+                body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
+                signal: signal ?? AbortSignal.timeout(30_000),
+            });
+        }
+        catch (err) {
+            const e = toImagegenError(err, "network");
+            if (e.kind === "cancelled")
+                throw new ImagegenError("login_cancelled", "Device-code sign-in was cancelled.");
+            // Transient network trouble while polling: keep going until the code expires.
+            await sleep(device.intervalMs, signal);
+            continue;
+        }
+        const { json, text } = await readBody(res);
+        if (res.ok && isRecord(json)) {
+            const authorizationCode = str(json.authorization_code);
+            const codeVerifier = str(json.code_verifier);
+            if (!authorizationCode || !codeVerifier)
+                throw new ImagegenError("login_failed", "Device authorization response is missing the authorization code.");
+            return { authorizationCode, codeVerifier };
+        }
+        if (res.status === 403 || res.status === 404) {
+            await sleep(Math.min(device.intervalMs, Math.max(0, device.expiresAt - Date.now())), signal);
+            continue;
+        }
+        throw new ImagegenError("login_failed", `Device-code sign-in failed (HTTP ${res.status}): ${describeOAuthError(json, text)}`, {
+            details: { status: res.status },
+        });
+    }
+}
+export function deviceRedirectUri(issuer) {
+    return `${issuer}/deviceauth/callback`;
+}
+//# sourceMappingURL=oauth.js.map

package/dist/src/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAiB/E,SAAS,OAAO,CAAC,MAAmB;IAClC,OAAO,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,MAAmB;IACpC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAYD,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,CAAqB;IACrD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAClC,8EAA8E;IAC9E,OAAO,GAAG,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAAC,IAAa,EAAE,IAAY;IAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACzC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;AACvC,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAsE,EAAE,CAAC;IAClF,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,EAAE;QAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,OAAO;QAAE,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AASD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAmB,EAAE,CAAe;IAClF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,CAAC,CAAC,YAAY;KAC9B,CAAC,CAAC;IACH,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,cAAc,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE;YAClH,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,+BAA+B,GAAG,CAAC,MAAM,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;YACvH,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8DAA8D,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC7F,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,0BAA0B,GAA2B;IACzD,qBAAqB,EAAE,2BAA2B;IAClD,oBAAoB,EAClB,0HAA0H;IAC5H,yBAAyB,EAAE,2BAA2B;CACvD,CAAC;AAQF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,CAAiB;IAC7E,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,cAAc,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,SAAS,CAAC,MAAM,CAAC;gBACpB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;YAChH,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,CAAC,CAAC;QAChH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,GAAG,KAAK,IAAI,wCAAwC,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,wBAAwB,EAAE;gBACxK,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8BAA8B,GAAG,CAAC,MAAM,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;YACtH,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE;YACrC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,yDAAyD,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjJ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAmB,EACnB,KAAa,EACb,IAAsC;IAEtC,IAAI,CAAC;QACH,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACtE,IAAI,IAAI,KAAK,eAAe;YAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,eAAe,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE;YACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAmB,EAAE,MAAoB;IAC/E,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE;YACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpD,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,4KAA4K,EAC5K,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,6CAA6C,GAAG,CAAC,MAAM,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;YACrI,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,6DAA6D,CAAC,CAAC;IACvI,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,IAAI;QAC/C,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,wBAAwB,EAAE;QAC9D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB;KAC/C,CAAC;AACJ,CAAC;AAOD,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAmB,EACnB,MAAkB,EAClB,MAAoB;IAEpB,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,8DAA8D,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,gCAAgC,EAAE;gBAC5E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE;gBACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACzF,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;gBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;YAC7G,8EAA8E;YAC9E,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,iBAAiB,GAAG,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACvD,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7C,IAAI,CAAC,iBAAiB,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,kEAAkE,CAAC,CAAC;YACrJ,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,oCAAoC,GAAG,CAAC,MAAM,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;YAC5H,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,GAAG,MAAM,sBAAsB,CAAC;AACzC,CAAC"}

package/dist/src/auth/pages.js

@@ -0,0 +1,39 @@
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c] ?? c);
+}
+function page(title, heading, body, ok) {
+    const accent = ok ? "#10a37f" : "#d9534f";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center;
+         font: 16px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+         background: Canvas; color: CanvasText; }
+  main { max-width: 34rem; padding: 2.5rem; border-radius: 16px; border: 1px solid color-mix(in srgb, CanvasText 15%, transparent); }
+  .badge { width: 44px; height: 44px; border-radius: 50%; display: grid; place-items: center;
+           background: ${accent}; color: white; font-size: 24px; margin-bottom: 1rem; }
+  h1 { font-size: 1.35rem; margin: 0 0 .5rem; }
+  p { margin: .5rem 0; opacity: .85; }
+  code { font-size: .9em; }
+</style>
+</head>
+<body><main>
+  <div class="badge">${ok ? "&#10003;" : "!"}</div>
+  <h1>${escapeHtml(heading)}</h1>
+  ${body}
+</main></body>
+</html>`;
+}
+export function successPage(email) {
+    const who = email ? `<p>Signed in as <strong>${escapeHtml(email)}</strong>.</p>` : "";
+    return page("Signed in — Codex ImageGen MCP", "You're signed in to Codex ImageGen MCP", `${who}<p>Image generation will use your ChatGPT plan. You can close this tab and return to your coding tool.</p>`, true);
+}
+export function errorPage(message) {
+    return page("Sign-in failed — Codex ImageGen MCP", "Sign-in failed", `<p>${escapeHtml(message)}</p><p>Return to your terminal or coding tool and try again.</p>`, false);
+}
+//# sourceMappingURL=pages.js.map

package/dist/src/auth/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../../src/auth/pages.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY,EAAE,EAAW;IACrE,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,OAAO;;;;;SAKA,UAAU,CAAC,KAAK,CAAC;;;;;;;;yBAQD,MAAM;;;;;;;uBAOR,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG;QACpC,UAAU,CAAC,OAAO,CAAC;IACvB,IAAI;;QAEA,CAAC;AACT,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,2BAA2B,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,IAAI,CACT,gCAAgC,EAChC,wCAAwC,EACxC,GAAG,GAAG,4GAA4G,EAClH,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CACT,qCAAqC,EACrC,gBAAgB,EAChB,MAAM,UAAU,CAAC,OAAO,CAAC,kEAAkE,EAC3F,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/src/auth/pkce.js

@@ -0,0 +1,14 @@
+import { createHash, randomBytes } from "node:crypto";
+/** RFC 7636 S256 pair: 64 random bytes -> base64url verifier (86 chars), SHA-256 -> challenge. */
+export function createPkce() {
+    const verifier = randomBytes(64).toString("base64url");
+    return { verifier, challenge: pkceChallenge(verifier) };
+}
+export function pkceChallenge(verifier) {
+    return createHash("sha256").update(verifier, "ascii").digest("base64url");
+}
+/** Opaque CSRF state for the authorize round-trip. */
+export function createState() {
+    return randomBytes(32).toString("base64url");
+}
+//# sourceMappingURL=pkce.js.map

package/dist/src/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAOtD,kGAAkG;AAClG,MAAM,UAAU,UAAU;IACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC"}

package/dist/src/auth/store.js

@@ -0,0 +1,75 @@
+import fs from "node:fs/promises";
+import { ImagegenError } from "../errors.js";
+import { readJsonFile, writeFileAtomic } from "../util/fs.js";
+import { isRecord, str } from "../util/http.js";
+import { identityFromTokens } from "./jwt.js";
+export function buildStoredAuth(tokens, method, now = new Date()) {
+    const identity = identityFromTokens(tokens.idToken, tokens.accessToken);
+    const stored = {
+        version: 1,
+        auth_mode: "chatgpt",
+        tokens: {
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+        },
+        last_refresh: now.toISOString(),
+        login_method: method,
+        created_at: now.toISOString(),
+    };
+    if (tokens.idToken)
+        stored.tokens.id_token = tokens.idToken;
+    if (identity.accountId)
+        stored.tokens.account_id = identity.accountId;
+    return stored;
+}
+function corrupt(file, why) {
+    return new ImagegenError("auth_failed", `The saved credentials at ${file} are unreadable (${why}). Sign in again to replace them.`);
+}
+export async function readStoredAuth(file) {
+    let raw;
+    try {
+        raw = await readJsonFile(file);
+    }
+    catch (err) {
+        throw corrupt(file, err instanceof Error ? err.message : String(err));
+    }
+    if (raw === undefined)
+        return undefined;
+    if (!isRecord(raw) || !isRecord(raw.tokens))
+        throw corrupt(file, "missing tokens");
+    const accessToken = str(raw.tokens.access_token);
+    const refreshToken = str(raw.tokens.refresh_token);
+    if (!accessToken || !refreshToken)
+        throw corrupt(file, "missing access or refresh token");
+    const stored = {
+        version: 1,
+        auth_mode: "chatgpt",
+        tokens: { access_token: accessToken, refresh_token: refreshToken },
+        last_refresh: str(raw.last_refresh) ?? new Date(0).toISOString(),
+        login_method: raw.login_method === "device" ? "device" : "browser",
+        created_at: str(raw.created_at) ?? str(raw.last_refresh) ?? new Date(0).toISOString(),
+    };
+    const idToken = str(raw.tokens.id_token);
+    if (idToken)
+        stored.tokens.id_token = idToken;
+    const accountId = str(raw.tokens.account_id) ?? identityFromTokens(idToken, accessToken).accountId;
+    if (accountId)
+        stored.tokens.account_id = accountId;
+    return stored;
+}
+export async function writeStoredAuth(file, auth) {
+    await writeFileAtomic(file, `${JSON.stringify(auth, null, 2)}\n`, 0o600);
+}
+/** Delete the credential file. Returns whether a file was removed. */
+export async function deleteStoredAuth(file) {
+    try {
+        await fs.rm(file);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/src/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AA+B9C,MAAM,UAAU,eAAe,CAAC,MAAgB,EAAE,MAAmB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE;YACN,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC;QACD,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;QAC/B,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;KAC9B,CAAC;IACF,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;IAC5D,IAAI,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,OAAO,IAAI,aAAa,CACtB,aAAa,EACb,4BAA4B,IAAI,oBAAoB,GAAG,mCAAmC,CAC3F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,MAAM,OAAO,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE;QAClE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAChE,YAAY,EAAE,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAClE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACtF,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC;IACnG,IAAI,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAgB;IAClE,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/src/backend/images-client.js

@@ -0,0 +1,223 @@
+import { SOURCE_LABELS } from "../auth/manager.js";
+import { IMAGE_MODEL, MAX_INPUT_IMAGES, MAX_OUTPUT_IMAGE_BYTES } from "../constants.js";
+import { ImagegenError, loginHint, toImagegenError } from "../errors.js";
+import { sniffImageMime } from "../images/codec.js";
+import { formatWhen } from "../util/format.js";
+import { anySignal, isRecord, num, readBody, sleep, snippet, str } from "../util/http.js";
+import { exhaustedResetAt, parseRateLimitHeaders, parseUsageResponse } from "./ratelimits.js";
+const DEFAULT_RETRY_DELAYS = [1_000, 3_000];
+/**
+ * Client for the ChatGPT backend image endpoints used by the Codex built-in `image_gen` tool:
+ *   POST {base}/images/generations   {prompt, background, model, quality, size}
+ *   POST {base}/images/edits         {…, images: [{image_url: data-url}]}   (max 5 images)
+ * Auth: `Authorization: Bearer <ChatGPT access token>` + `ChatGPT-Account-ID`.
+ */
+export class ImagesClient {
+    auth;
+    o;
+    constructor(auth, o) {
+        this.auth = auth;
+        this.o = o;
+    }
+    headers(creds) {
+        const h = {
+            authorization: `Bearer ${creds.accessToken}`,
+            originator: this.o.originator,
+            "user-agent": this.o.userAgent,
+            accept: "application/json",
+        };
+        if (creds.accountId)
+            h["chatgpt-account-id"] = creds.accountId;
+        if (creds.identity.isFedramp)
+            h["x-openai-fedramp"] = "true";
+        return h;
+    }
+    async createImage(req, options = {}) {
+        const images = req.images ?? [];
+        if (images.length > MAX_INPUT_IMAGES) {
+            throw new ImagegenError("invalid_input", `At most ${MAX_INPUT_IMAGES} input images are supported (got ${images.length}).`);
+        }
+        const endpoint = images.length > 0 ? "images/edits" : "images/generations";
+        // Same body the Codex built-in tool sends. The service picks model/quality/size itself;
+        // only `prompt`, `background` and `images` influence the result.
+        const body = {
+            prompt: req.prompt,
+            background: req.background,
+            model: IMAGE_MODEL,
+            quality: "auto",
+            size: "auto",
+        };
+        if (images.length > 0)
+            body.images = images.map((i) => ({ image_url: i.dataUrl }));
+        const payload = JSON.stringify(body);
+        const { res, creds, started } = await this.send(`${this.o.baseUrl}/${endpoint}`, "POST", payload, options.signal);
+        const requestId = requestIdOf(res.headers);
+        const rateLimits = parseRateLimitHeaders(res.headers);
+        const { json, text } = await readBody(res);
+        const first = isRecord(json) && Array.isArray(json.data) ? json.data[0] : undefined;
+        const b64 = isRecord(first) ? str(first.b64_json) : undefined;
+        if (!b64) {
+            throw new ImagegenError("server_error", `The image service returned no image data${text ? `: ${snippet(text, 200)}` : "."}`, {
+                details: { requestId },
+                retryable: true,
+            });
+        }
+        const bytes = Buffer.from(b64, "base64");
+        if (bytes.length === 0 || bytes.length > MAX_OUTPUT_IMAGE_BYTES) {
+            throw new ImagegenError("server_error", `The image service returned an invalid image (${bytes.length} bytes).`, { details: { requestId } });
+        }
+        const result = {
+            bytes,
+            mimeType: sniffImageMime(bytes) ?? "image/png",
+            elapsedMs: Date.now() - started,
+            credentialSource: creds.source,
+        };
+        const meta = isRecord(json) ? json : {};
+        const background = str(meta.background);
+        if (background)
+            result.background = background;
+        const size = str(meta.size);
+        if (size)
+            result.size = size;
+        const quality = str(meta.quality);
+        if (quality)
+            result.quality = quality;
+        const format = str(meta.output_format);
+        if (format)
+            result.outputFormat = format;
+        if (isRecord(first)) {
+            const gen = str(first.generation_id);
+            if (gen)
+                result.generationId = gen;
+        }
+        if (requestId)
+            result.requestId = requestId;
+        if (isRecord(meta.usage))
+            result.usage = meta.usage;
+        if (rateLimits)
+            result.rateLimits = rateLimits;
+        return result;
+    }
+    /** Current plan + quota windows (does not consume any quota). */
+    async getUsage(options = {}) {
+        const { res, creds } = await this.send(this.o.usageUrl, "GET", undefined, options.signal);
+        const { json } = await readBody(res);
+        return { ...parseUsageResponse(json), credentialSource: creds.source };
+    }
+    /**
+     * Send with auth, a per-attempt timeout, one 401 recovery (refresh / re-read / next source) and
+     * bounded retries for transient failures. Returns only successful responses.
+     */
+    async send(url, method, payload, signal) {
+        const fetchImpl = this.o.fetchImpl ?? fetch;
+        const maxRetries = this.o.maxRetries ?? 2;
+        const delays = this.o.retryDelaysMs ?? DEFAULT_RETRY_DELAYS;
+        let creds = await this.auth.getCredentials();
+        let authRecovered = false;
+        let attempt = 0;
+        for (;;) {
+            const started = Date.now();
+            let res;
+            try {
+                const headers = this.headers(creds);
+                if (payload !== undefined)
+                    headers["content-type"] = "application/json";
+                const init = { method, headers, signal: anySignal(signal, AbortSignal.timeout(this.o.timeoutMs)) ?? null };
+                if (payload !== undefined)
+                    init.body = payload;
+                res = await fetchImpl(url, init);
+            }
+            catch (err) {
+                const e = signal?.aborted ? new ImagegenError("cancelled", "The request was cancelled.") : toImagegenError(err, "network");
+                if (e.retryable && attempt < maxRetries) {
+                    this.o.logger.warn("request failed; retrying", { url, attempt, message: e.message });
+                    await sleep(delays[Math.min(attempt, delays.length - 1)] ?? 1_000, signal);
+                    attempt++;
+                    continue;
+                }
+                throw e;
+            }
+            if (res.ok)
+                return { res, creds, started };
+            const error = await errorFromResponse(res, creds);
+            if (res.status === 401 && !authRecovered) {
+                authRecovered = true;
+                const next = await this.auth.recoverFromUnauthorized(creds);
+                if (next) {
+                    this.o.logger.info("retrying with recovered credentials", { from: creds.source, to: next.source });
+                    creds = next;
+                    continue;
+                }
+            }
+            if (error.retryable && attempt < maxRetries) {
+                this.o.logger.warn("transient backend error; retrying", { url, status: res.status, attempt });
+                await sleep(delays[Math.min(attempt, delays.length - 1)] ?? 1_000, signal);
+                attempt++;
+                continue;
+            }
+            this.o.logger.warn("backend request failed", { url, status: res.status, kind: error.kind, requestId: error.details.requestId });
+            throw error;
+        }
+    }
+}
+function requestIdOf(headers) {
+    return headers.get("x-codex-imagegen-request-id") ?? headers.get("x-oai-request-id") ?? headers.get("x-request-id") ?? undefined;
+}
+const POLICY_CODES = new Set(["moderation_blocked", "content_policy_violation", "safety_violation", "image_generation_user_error_moderation"]);
+/** Map a non-2xx backend response onto an actionable ImagegenError. */
+export async function errorFromResponse(res, creds) {
+    const { json, text } = await readBody(res);
+    const status = res.status;
+    const err = isRecord(json) && isRecord(json.error) ? json.error : undefined;
+    const type = str(err?.type);
+    const code = str(err?.code);
+    const detail = isRecord(json) ? (str(json.detail) ?? (isRecord(json.detail) ? str(json.detail.message) : undefined)) : undefined;
+    const message = str(err?.message) ?? detail ?? (isRecord(json) ? str(json.message) : undefined);
+    const requestId = requestIdOf(res.headers);
+    const rateLimits = parseRateLimitHeaders(res.headers);
+    const details = { status, type, code, requestId, cfRay: res.headers.get("cf-ray") ?? undefined };
+    const isCloudflare = /cloudflare|cf-chl|just a moment/i.test(text) && !json;
+    if (status === 401) {
+        return new ImagegenError("auth_failed", `ChatGPT rejected the ${SOURCE_LABELS[creds.source]} (HTTP 401${message ? `: ${message}` : ""}). ${loginHint()}`, { details });
+    }
+    if (status === 403) {
+        if (isCloudflare) {
+            return new ImagegenError("blocked", "The request was blocked by Cloudflare before reaching ChatGPT (HTTP 403).", { details });
+        }
+        return new ImagegenError("auth_failed", `Access denied (HTTP 403${message ? `: ${message}` : ""}). Your ChatGPT plan or workspace may not include Codex image generation (it is not available on the Free plan).`, { details });
+    }
+    if (status === 429) {
+        const resetsAt = num(err?.resets_at) ?? exhaustedResetAt(rateLimits);
+        const plan = str(err?.plan_type) ?? rateLimits?.planType ?? creds.identity.planType;
+        if (resetsAt !== undefined)
+            details.resetsAt = resetsAt;
+        if (type === "usage_not_included") {
+            return new ImagegenError("usage_limit", `Your ChatGPT${plan ? ` ${plan}` : ""} plan does not include Codex image generation.`, { details });
+        }
+        const when = resetsAt !== undefined ? ` It resets ${formatWhen(resetsAt * 1000)}.` : "";
+        const what = type === "usage_limit_reached" ? "You've hit your ChatGPT image-generation usage limit" : "Rate limited by ChatGPT (HTTP 429)";
+        return new ImagegenError("usage_limit", `${what}${plan ? ` (${plan} plan)` : ""}.${when}${message && type !== "usage_limit_reached" ? ` ${message}` : ""}`, {
+            details,
+        });
+    }
+    if (status === 400 || status === 422) {
+        const policy = (code !== undefined && POLICY_CODES.has(code)) || /safety|moderation|content policy|policy violation|not allowed/i.test(message ?? "");
+        if (policy) {
+            return new ImagegenError("content_policy", `The request was rejected by OpenAI's safety system${message ? `: ${message}` : "."}`, { details });
+        }
+        return new ImagegenError("invalid_request", `The image service rejected the request (HTTP ${status})${message ? `: ${message}` : "."}`, { details });
+    }
+    if (status === 413) {
+        return new ImagegenError("invalid_input", "The request is too large — use fewer or smaller input images.", { details });
+    }
+    if (status >= 500) {
+        return new ImagegenError("server_error", `OpenAI's image service had a problem (HTTP ${status})${message ? `: ${message}` : "."}`, {
+            details,
+            retryable: true,
+        });
+    }
+    return new ImagegenError("internal", `Unexpected response from the image service (HTTP ${status})${message ? `: ${message}` : text ? `: ${snippet(text, 200)}` : "."}`, {
+        details,
+    });
+}
+//# sourceMappingURL=images-client.js.map