(function attachBackgroundLocalCliProxyApi(root, factory) {
  root.MultiPageBackgroundLocalCliProxyApi = factory();
})(typeof self !== 'undefined' ? self : globalThis, function createBackgroundLocalCliProxyApiModule() {
  const AUTH_URL = 'https://auth.openai.com/oauth/authorize';
  const TOKEN_URL = 'https://auth.openai.com/oauth/token';
  const CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
  const REDIRECT_URI = 'http://localhost:1455/auth/callback';
  const DEFAULT_RELATIVE_AUTH_DIR = '.cli-proxy-api';

  function normalizeString(value = '') {
    return String(value || '').trim();
  }

  function ensureTextEncoder() {
    if (typeof TextEncoder === 'function') {
      return new TextEncoder();
    }
    throw new Error('当前环境缺少 TextEncoder，无法生成 PKCE。');
  }

  function getCryptoLike(explicitCrypto = null) {
    const candidate = explicitCrypto || globalThis.crypto || null;
    if (candidate && typeof candidate.getRandomValues === 'function' && candidate.subtle) {
      return candidate;
    }
    throw new Error('当前环境缺少 Web Crypto，无法执行本地 OAuth 模块。');
  }

  function getFetchLike(explicitFetch = null) {
    const candidate = explicitFetch || globalThis.fetch || null;
    if (typeof candidate === 'function') {
      return candidate.bind(globalThis);
    }
    throw new Error('当前环境缺少 fetch，无法交换 OAuth token。');
  }

  function getSessionConverter(explicitConverter = null) {
    const candidate = explicitConverter
      || globalThis.MultiPageSessionToJsonConverter
      || (typeof self !== 'undefined' ? self.MultiPageSessionToJsonConverter : null)
      || null;
    if (candidate && typeof candidate.convertSessionJson === 'function') {
      return candidate;
    }
    throw new Error('session-to-json 转换模块未加载，无法生成本地 auth json。');
  }

  function bytesToBase64Url(bytes) {
    if (!(bytes instanceof Uint8Array)) {
      throw new Error('bytesToBase64Url 需要 Uint8Array 输入。');
    }

    if (typeof Buffer !== 'undefined') {
      return Buffer.from(bytes).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
    }

    let binary = '';
    for (let index = 0; index < bytes.length; index += 0x8000) {
      binary += String.fromCharCode(...bytes.subarray(index, index + 0x8000));
    }
    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
  }

  async function sha256Bytes(value, cryptoLike) {
    const encoder = ensureTextEncoder();
    const digest = await cryptoLike.subtle.digest('SHA-256', encoder.encode(String(value || '')));
    return new Uint8Array(digest);
  }

  async function sha256Hex(value, cryptoLike) {
    const bytes = await sha256Bytes(value, cryptoLike);
    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
  }

  async function generateRandomState(options = {}) {
    const cryptoLike = getCryptoLike(options.crypto);
    const bytes = new Uint8Array(16);
    cryptoLike.getRandomValues(bytes);
    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
  }

  async function generatePkceCodes(options = {}) {
    const cryptoLike = getCryptoLike(options.crypto);
    const bytes = new Uint8Array(96);
    cryptoLike.getRandomValues(bytes);
    const codeVerifier = bytesToBase64Url(bytes);
    const codeChallenge = bytesToBase64Url(await sha256Bytes(codeVerifier, cryptoLike));
    return {
      codeVerifier,
      codeChallenge,
    };
  }

  function normalizePlanTypeForFilename(planType = '') {
    const parts = normalizeString(planType)
      .split(/[^A-Za-z0-9]+/g)
      .map((part) => part.trim().toLowerCase())
      .filter(Boolean);
    return parts.join('-');
  }

  function resolvePathSeparator(basePath = '') {
    return String(basePath || '').includes('\\') ? '\\' : '/';
  }

  function sanitizeRelativeDir(input = DEFAULT_RELATIVE_AUTH_DIR) {
    const normalized = normalizeString(input || DEFAULT_RELATIVE_AUTH_DIR);
    if (!normalized) {
      return DEFAULT_RELATIVE_AUTH_DIR;
    }

    const segments = normalized
      .replace(/\\/g, '/')
      .split('/')
      .map((segment) => segment.trim())
      .filter(Boolean);

    if (segments.some((segment) => segment === '.' || segment === '..')) {
      throw new Error('relativeAuthDir 不能包含 . 或 .. 路径段。');
    }

    return segments.join('/');
  }

  function joinPath(basePath, ...parts) {
    const separator = resolvePathSeparator(basePath);
    const normalizedBase = normalizeString(basePath).replace(/[\\/]+$/g, '');
    const resultParts = [normalizedBase];

    for (const rawPart of parts) {
      const normalized = String(rawPart || '')
        .replace(/\\/g, '/')
        .split('/')
        .map((segment) => segment.trim())
        .filter(Boolean);
      if (normalized.length) {
        resultParts.push(normalized.join(separator));
      }
    }

    return resultParts.join(separator);
  }

  function buildAuthUrl({
    state,
    codeChallenge,
    clientId = CLIENT_ID,
    redirectUri = REDIRECT_URI,
  } = {}) {
    const normalizedState = normalizeString(state);
    const normalizedChallenge = normalizeString(codeChallenge);
    if (!normalizedState) {
      throw new Error('生成 OAuth 地址失败：缺少 state。');
    }
    if (!normalizedChallenge) {
      throw new Error('生成 OAuth 地址失败：缺少 PKCE code_challenge。');
    }

    const params = new URLSearchParams();
    params.set('client_id', normalizeString(clientId) || CLIENT_ID);
    params.set('response_type', 'code');
    params.set('redirect_uri', normalizeString(redirectUri) || REDIRECT_URI);
    params.set('scope', 'openid email profile offline_access');
    params.set('state', normalizedState);
    params.set('code_challenge', normalizedChallenge);
    params.set('code_challenge_method', 'S256');
    params.set('prompt', 'login');
    params.set('id_token_add_organizations', 'true');
    params.set('codex_cli_simplified_flow', 'true');
    return `${AUTH_URL}?${params.toString()}`;
  }

  function parseOAuthCallback(callbackUrl, expectedState = '') {
    const rawInput = normalizeString(callbackUrl);
    if (!rawInput) {
      throw new Error('缺少 OAuth callback 地址。');
    }

    let candidate = rawInput;
    if (!candidate.includes('://')) {
      if (candidate.startsWith('?')) {
        candidate = `http://localhost${candidate}`;
      } else if (candidate.includes('=') && !candidate.includes('/')) {
        candidate = `http://localhost/?${candidate}`;
      } else {
        candidate = `http://${candidate}`;
      }
    }

    let parsed;
    try {
      parsed = new URL(candidate);
    } catch {
      throw new Error('OAuth callback 地址格式无效。');
    }

    const query = parsed.searchParams;
    let code = normalizeString(query.get('code'));
    let state = normalizeString(query.get('state'));
    let error = normalizeString(query.get('error'));
    let errorDescription = normalizeString(query.get('error_description'));

    if (parsed.hash) {
      const fragment = new URLSearchParams(parsed.hash.replace(/^#/, ''));
      code = code || normalizeString(fragment.get('code'));
      state = state || normalizeString(fragment.get('state'));
      error = error || normalizeString(fragment.get('error'));
      errorDescription = errorDescription || normalizeString(fragment.get('error_description'));
    }

    if (error) {
      throw new Error(errorDescription ? `OAuth 回调失败：${errorDescription}` : `OAuth 回调失败：${error}`);
    }
    if (!code) {
      throw new Error('OAuth callback 缺少 code。');
    }

    const normalizedExpectedState = normalizeString(expectedState);
    if (normalizedExpectedState && state !== normalizedExpectedState) {
      throw new Error(`OAuth state 不匹配：expected ${normalizedExpectedState}, got ${state || '(empty)'}`);
    }

    return {
      code,
      state,
      callbackUrl: parsed.toString(),
    };
  }

  async function buildCredentialFileName(authJson, options = {}) {
    const cryptoLike = getCryptoLike(options.crypto);
    const email = normalizeString(authJson?.email);
    if (!email) {
      throw new Error('生成本地 auth 文件名失败：json 中缺少 email。');
    }

    const planType = normalizePlanTypeForFilename(authJson?.plan_type || authJson?.chatgpt_plan_type);
    const accountId = normalizeString(authJson?.account_id || authJson?.chatgpt_account_id);
    const hashAccountId = accountId ? (await sha256Hex(accountId, cryptoLike)).slice(0, 8) : '';

    if (!planType) {
      return `codex-${email}.json`;
    }
    if (planType === 'team') {
      return `codex-${hashAccountId}-${email}-${planType}.json`;
    }
    return `codex-${email}-${planType}.json`;
  }

  function createLocalCliProxyApi(deps = {}) {
    const fetchLike = getFetchLike(deps.fetch);
    const cryptoLike = getCryptoLike(deps.crypto);
    const sessionConverter = getSessionConverter(deps.sessionToJsonConverter);
    const ensureDirectory = typeof deps.ensureDirectory === 'function' ? deps.ensureDirectory : null;
    const writeTextFile = typeof deps.writeTextFile === 'function' ? deps.writeTextFile : null;

    async function createAuthorizationRequest(options = {}) {
      const oauthState = normalizeString(options.state) || await generateRandomState({ crypto: cryptoLike });
      const pkceCodes = options.pkceCodes?.codeVerifier && options.pkceCodes?.codeChallenge
        ? {
            codeVerifier: normalizeString(options.pkceCodes.codeVerifier),
            codeChallenge: normalizeString(options.pkceCodes.codeChallenge),
          }
        : await generatePkceCodes({ crypto: cryptoLike });

      return {
        oauthState,
        redirectUri: normalizeString(options.redirectUri) || REDIRECT_URI,
        pkceCodes,
        oauthUrl: buildAuthUrl({
          state: oauthState,
          codeChallenge: pkceCodes.codeChallenge,
          clientId: options.clientId || CLIENT_ID,
          redirectUri: options.redirectUri || REDIRECT_URI,
        }),
      };
    }

    async function exchangeCodeForTokens(options = {}) {
      const code = normalizeString(options.code);
      const redirectUri = normalizeString(options.redirectUri) || REDIRECT_URI;
      const codeVerifier = normalizeString(options.pkceCodes?.codeVerifier);
      if (!code) {
        throw new Error('token 交换失败：缺少 OAuth code。');
      }
      if (!codeVerifier) {
        throw new Error('token 交换失败：缺少 PKCE code_verifier。');
      }

      const form = new URLSearchParams();
      form.set('grant_type', 'authorization_code');
      form.set('client_id', normalizeString(options.clientId) || CLIENT_ID);
      form.set('code', code);
      form.set('redirect_uri', redirectUri);
      form.set('code_verifier', codeVerifier);

      const response = await fetchLike(TOKEN_URL, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/x-www-form-urlencoded',
          Accept: 'application/json',
        },
        body: form.toString(),
      });

      const rawText = await response.text();
      if (!response.ok) {
        throw new Error(`token exchange failed with status ${response.status}: ${rawText}`);
      }

      let payload = {};
      try {
        payload = JSON.parse(rawText || '{}');
      } catch {
        throw new Error('token 交换失败：返回内容不是合法 JSON。');
      }

      const accessToken = normalizeString(payload.access_token);
      const refreshToken = normalizeString(payload.refresh_token);
      const idToken = normalizeString(payload.id_token);
      const expiresIn = Number(payload.expires_in);
      if (!accessToken) {
        throw new Error('token 交换失败：缺少 access_token。');
      }

      const expiresAt = Number.isFinite(expiresIn) && expiresIn > 0
        ? new Date(Date.now() + expiresIn * 1000).toISOString()
        : undefined;

      return {
        accessToken,
        refreshToken,
        idToken,
        tokenType: normalizeString(payload.token_type),
        expiresIn: Number.isFinite(expiresIn) ? expiresIn : undefined,
        expiresAt,
        rawPayload: payload,
      };
    }

    async function buildAuthJsonArtifact(options = {}) {
      const accessToken = normalizeString(options.accessToken || options.access_token);
      if (!accessToken) {
        throw new Error('生成本地 auth json 失败：缺少 accessToken。');
      }

      const sourceSession = options.session && typeof options.session === 'object' && !Array.isArray(options.session)
        ? options.session
        : {};
      const sessionRecord = {
        ...sourceSession,
        type: 'codex',
        accessToken,
        refreshToken: normalizeString(options.refreshToken || options.refresh_token || sourceSession.refreshToken || sourceSession.refresh_token),
        idToken: normalizeString(options.idToken || options.id_token || sourceSession.idToken || sourceSession.id_token),
        sessionToken: normalizeString(options.sessionToken || options.session_token || sourceSession.sessionToken || sourceSession.session_token),
        expiresAt: options.expiresAt || options.expires_at || sourceSession.expiresAt || sourceSession.expires,
        email: options.email || sourceSession.email || sourceSession.user?.email,
        account_id: options.accountId || options.account_id || sourceSession.account?.id,
        user_id: options.userId || options.user_id || sourceSession.user?.id,
        plan_type: options.planType || options.plan_type || sourceSession.account?.planType || sourceSession.account?.plan_type,
      };

      const converted = sessionConverter.convertSessionJson(sessionRecord, {
        lastRefresh: options.lastRefresh,
        now: options.now || new Date(),
        sourceName: normalizeString(options.sourceName) || 'CLIProxyAPI Local OAuth',
      });

      const authJson = converted.output;
      const fileName = await buildCredentialFileName(authJson, { crypto: cryptoLike });
      const pluginDir = normalizeString(options.pluginDir);
      if (!pluginDir) {
        throw new Error('生成本地 auth json 失败：缺少 pluginDir。');
      }

      const relativeAuthDir = sanitizeRelativeDir(options.relativeAuthDir || DEFAULT_RELATIVE_AUTH_DIR);
      const directoryPath = joinPath(pluginDir, relativeAuthDir);
      const filePath = joinPath(directoryPath, fileName);
      const jsonText = `${JSON.stringify(authJson, null, 2)}\n`;

      return {
        provider: 'codex',
        fileName,
        directoryPath,
        filePath,
        relativeAuthDir,
        authJson,
        jsonText,
        warnings: Array.isArray(converted.warnings) ? converted.warnings.slice() : [],
      };
    }

    async function saveAuthJsonArtifact(artifact) {
      if (!artifact || typeof artifact !== 'object') {
        throw new Error('保存本地 auth json 失败：artifact 无效。');
      }
      if (!writeTextFile) {
        throw new Error('保存本地 auth json 失败：未提供 writeTextFile。');
      }
      if (!normalizeString(artifact.filePath)) {
        throw new Error('保存本地 auth json 失败：缺少 filePath。');
      }

      if (ensureDirectory) {
        await ensureDirectory(artifact.directoryPath);
      }
      await writeTextFile(artifact.filePath, artifact.jsonText);

      return {
        ...artifact,
        saved: true,
      };
    }

    async function exchangeCallbackToAuthArtifact(options = {}) {
      const callback = parseOAuthCallback(options.callbackUrl, options.expectedState);
      const tokenBundle = await exchangeCodeForTokens({
        code: callback.code,
        pkceCodes: options.pkceCodes,
        redirectUri: options.redirectUri,
        clientId: options.clientId,
      });

      return buildAuthJsonArtifact({
        ...tokenBundle,
        pluginDir: options.pluginDir,
        relativeAuthDir: options.relativeAuthDir,
        sourceName: options.sourceName,
        now: options.now,
      });
    }

    return {
      AUTH_URL,
      TOKEN_URL,
      CLIENT_ID,
      REDIRECT_URI,
      DEFAULT_RELATIVE_AUTH_DIR,
      buildAuthJsonArtifact,
      createAuthorizationRequest,
      exchangeCallbackToAuthArtifact,
      exchangeCodeForTokens,
      parseOAuthCallback,
      saveAuthJsonArtifact,
    };
  }

  return {
    AUTH_URL,
    TOKEN_URL,
    CLIENT_ID,
    REDIRECT_URI,
    DEFAULT_RELATIVE_AUTH_DIR,
    buildAuthUrl,
    buildCredentialFileName,
    createLocalCliProxyApi,
    generatePkceCodes,
    generateRandomState,
    normalizePlanTypeForFilename,
    parseOAuthCallback,
  };
});