@code-yeongyu/senpi 2026.9.21-2 → 2026.9.22

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.js

@@ -1,24 +1,20 @@
 /**
  * Kimi Code (subscription) OAuth flow
  *
- * RFC 8628 device authorization grant against https://auth.kimi.com with JSON
- * responses. The access token authenticates requests to
- * https://api.kimi.com/coding as an `Authorization: Bearer` header.
+ * RFC 8628 device authorization grant against the region's auth host
+ * (https://auth.kimi.com or https://auth.kimi.ai) with JSON responses. The
+ * access token authenticates requests to that region's coding API as an
+ * `Authorization: Bearer` header; see kimi-region.ts for the host table.
  */
-import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { sleep } from "../../utils/sleep.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 import { kimiCodeIdentityHeaders } from "./kimi-identity.js";
+import { chooseKimiCodeLoginEndpoints, kimiCodeCredentialEnv, kimiCodeEndpointsForCredential } from "./kimi-region.js";
 const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
-const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
 const DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
 const DEFAULT_POLL_INTERVAL_SECONDS = 5;
 const REQUEST_TIMEOUT_MS = 30 * 1000;
 const REFRESH_MAX_RETRIES = 3;
-function getOauthHost() {
-    const override = getProviderEnvValue("KIMI_CODE_OAUTH_HOST") || getProviderEnvValue("KIMI_OAUTH_HOST");
-    return (override || DEFAULT_OAUTH_HOST).replace(/\/+$/, "");
-}
 function requestSignal(signal) {
     return AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);
 }
@@ -224,7 +220,8 @@ async function refreshToken(oauthHost, refreshTokenValue, signal) {
     throw lastError ?? new Error("Kimi Code token refresh failed");
 }
 async function loginKimiCoding(interaction) {
-    const oauthHost = getOauthHost();
+    const endpoints = await chooseKimiCodeLoginEndpoints(interaction);
+    const oauthHost = endpoints.oauthHost;
     const device = await startDeviceAuthorization(oauthHost, interaction.signal);
     interaction.notify({
         type: "device_code",
@@ -234,7 +231,13 @@ async function loginKimiCoding(interaction) {
         expiresInSeconds: device.expiresInSeconds,
     });
     const token = await pollForToken(oauthHost, device, interaction.signal);
-    return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
+    return {
+        type: "oauth",
+        access: token.access,
+        refresh: token.refresh,
+        expires: token.expires,
+        ...(endpoints.env ? { env: endpoints.env } : {}),
+    };
 }
 export const kimiCodingOAuth = {
     name: "Kimi Code (subscription)",
@@ -242,11 +245,22 @@ export const kimiCodingOAuth = {
     loginLabel: "Sign in with Kimi Code",
     login: loginKimiCoding,
     refresh: async (credential, signal) => {
-        const token = await refreshToken(getOauthHost(), credential.refresh, signal);
-        return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
+        const env = kimiCodeCredentialEnv(credential);
+        const token = await refreshToken(kimiCodeEndpointsForCredential(credential).oauthHost, credential.refresh, signal);
+        return {
+            type: "oauth",
+            access: token.access,
+            refresh: token.refresh,
+            expires: token.expires,
+            ...(env ? { env } : {}),
+        };
     },
     async toAuth(credential) {
-        return { headers: { ...kimiCodeIdentityHeaders(), Authorization: `Bearer ${credential.access}` } };
+        const { apiBaseUrl } = kimiCodeEndpointsForCredential(credential);
+        return {
+            headers: { ...kimiCodeIdentityHeaders(), Authorization: `Bearer ${credential.access}` },
+            ...(apiBaseUrl ? { baseUrl: apiBaseUrl } : {}),
+        };
     },
 };
 //# sourceMappingURL=kimi-coding.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.js.map

@@ -1 +1 @@
-{"version":3,"file":"kimi-coding.js","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-coding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAiB9B,SAAS,YAAY;IACpB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACvG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB;IACzC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB,EAAE,MAAmB;IAC7E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,iCAAiC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,GAAG,uBAAuB,EAAE;YAC5B,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC7C,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,EAAE,WAAW,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,EAAE,gBAAgB,CAAC;IAC/C,MAAM,uBAAuB,GAAG,IAAI,EAAE,yBAAyB,CAAC;IAChE,IACC,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,OAAO,uBAAuB,KAAK,QAAQ;QAC3C,CAAC,cAAc,CAAC,uBAAuB,CAAC;QACxC,CAAC,cAAc,CAAC,eAAe,CAAC,EAC/B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,OAAO;QACN,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB;QACvB,eAAe,EACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACxE,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,6BAA6B;QACjC,gBAAgB,EACf,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC3E,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,2BAA2B;KAC/B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAoC,EAAE,SAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,EAAE,YAAY,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,IACC,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,WAAW;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,YAAY;QACb,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,IAAI,CAAC,EACb,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,6BAA6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACN,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,SAAiB,EACjB,MAA2B,EAC3B,MAAmB;IAEnB,OAAO,uBAAuB,CAAgB;QAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,GAAG,uBAAuB,EAAE;oBAC5B,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,aAAa,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,UAAU,EAAE,8CAA8C;iBAC1D,CAAC;gBACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO;oBACN,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,qDAAqD,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACzG,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACJ,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9F,CAAC;YACF,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;YAC1B,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;gBAChC,OAAO;oBACN,MAAM,EAAE,WAAW;oBACnB,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACpF,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;YACvG,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;YACrE,CAAC;YACD,OAAO;gBACN,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,iDAAiD,QAAQ,CAAC,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aAC1I,CAAC;QACH,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAkB;IACpD,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,iBAAyB,EAAE,MAAmB;IAC5F,IAAI,SAA4B,CAAC;IACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,GAAG,uBAAuB,EAAE;oBAC5B,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,aAAa,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,iBAAiB;iBAChC,CAAC;gBACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,sFAAsF;QACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;YAC3F,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAC1E,SAAS,GAAG,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,WAAoC;IAClE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7E,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,uBAAuB;QAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAc;IACzC,IAAI,EAAE,0BAA0B;IAChC,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,wBAAwB;IAEpC,KAAK,EAAE,eAAe;IAEtB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,uBAAuB,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IACpG,CAAC;CACD,CAAC","sourcesContent":["/**\n * Kimi Code (subscription) OAuth flow\n *\n * RFC 8628 device authorization grant against https://auth.kimi.com with JSON\n * responses. The access token authenticates requests to\n * https://api.kimi.com/coding as an `Authorization: Bearer` header.\n */\n\nimport { getProviderEnvValue } from \"../../utils/provider-env.ts\";\nimport { sleep } from \"../../utils/sleep.ts\";\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\nimport { kimiCodeIdentityHeaders } from \"./kimi-identity.ts\";\n\nconst CLIENT_ID = \"17e5f671-d194-4dfb-9706-5516cb48c098\";\nconst DEFAULT_OAUTH_HOST = \"https://auth.kimi.com\";\nconst DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;\nconst DEFAULT_POLL_INTERVAL_SECONDS = 5;\nconst REQUEST_TIMEOUT_MS = 30 * 1000;\nconst REFRESH_MAX_RETRIES = 3;\n\ntype DeviceAuthorization = {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tverificationUriComplete: string;\n\tintervalSeconds: number;\n\texpiresInSeconds: number;\n};\n\ntype TokenResponse = {\n\taccess: string;\n\trefresh: string;\n\texpires: number;\n};\n\nfunction getOauthHost(): string {\n\tconst override = getProviderEnvValue(\"KIMI_CODE_OAUTH_HOST\") || getProviderEnvValue(\"KIMI_OAUTH_HOST\");\n\treturn (override || DEFAULT_OAUTH_HOST).replace(/\\/+$/, \"\");\n}\n\nfunction requestSignal(signal: AbortSignal): AbortSignal {\n\treturn AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);\n}\n\nfunction formUrlEncode(fields: Record<string, string>): string {\n\treturn new URLSearchParams(fields).toString();\n}\n\nasync function readJson(response: Response): Promise<Record<string, unknown> | null> {\n\ttry {\n\t\tconst json = await response.json();\n\t\treturn json && typeof json === \"object\" ? (json as Record<string, unknown>) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */\nfunction trustedHttpUrl(value: unknown): string | null {\n\tif (typeof value !== \"string\" || !value) return null;\n\ttry {\n\t\tconst url = new URL(value);\n\t\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") return null;\n\t\treturn url.href;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nasync function startDeviceAuthorization(oauthHost: string, signal: AbortSignal): Promise<DeviceAuthorization> {\n\tconst response = await fetch(`${oauthHost}/api/oauth/device_authorization`, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t...kimiCodeIdentityHeaders(),\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\tAccept: \"application/json\",\n\t\t},\n\t\tbody: formUrlEncode({ client_id: CLIENT_ID }),\n\t\tsignal: requestSignal(signal),\n\t});\n\n\tif (!response.ok) {\n\t\tconst text = await response.text().catch(() => \"\");\n\t\tthrow new Error(`Kimi Code device authorization failed with status ${response.status}${text ? `: ${text}` : \"\"}`);\n\t}\n\n\tconst json = await readJson(response);\n\tconst deviceCode = json?.device_code;\n\tconst userCode = json?.user_code;\n\tconst verificationUri = json?.verification_uri;\n\tconst verificationUriComplete = json?.verification_uri_complete;\n\tif (\n\t\ttypeof deviceCode !== \"string\" ||\n\t\ttypeof userCode !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\ttypeof verificationUriComplete !== \"string\" ||\n\t\t!trustedHttpUrl(verificationUriComplete) ||\n\t\t!trustedHttpUrl(verificationUri)\n\t) {\n\t\tthrow new Error(`Invalid Kimi Code device authorization response: ${JSON.stringify(json)}`);\n\t}\n\n\tconst interval = json?.interval;\n\tconst expiresIn = json?.expires_in;\n\treturn {\n\t\tdeviceCode,\n\t\tuserCode,\n\t\tverificationUri,\n\t\tverificationUriComplete,\n\t\tintervalSeconds:\n\t\t\ttypeof interval === \"number\" && Number.isFinite(interval) && interval > 0\n\t\t\t\t? interval\n\t\t\t\t: DEFAULT_POLL_INTERVAL_SECONDS,\n\t\texpiresInSeconds:\n\t\t\ttypeof expiresIn === \"number\" && Number.isFinite(expiresIn) && expiresIn > 0\n\t\t\t\t? expiresIn\n\t\t\t\t: DEVICE_CODE_TIMEOUT_SECONDS,\n\t};\n}\n\nfunction parseTokenResponse(json: Record<string, unknown> | null, operation: string): TokenResponse {\n\tconst accessToken = json?.access_token;\n\tconst refreshToken = json?.refresh_token;\n\tconst expiresIn = json?.expires_in;\n\tif (\n\t\ttypeof accessToken !== \"string\" ||\n\t\t!accessToken ||\n\t\ttypeof refreshToken !== \"string\" ||\n\t\t!refreshToken ||\n\t\ttypeof expiresIn !== \"number\" ||\n\t\t!Number.isFinite(expiresIn) ||\n\t\texpiresIn <= 0\n\t) {\n\t\tthrow new Error(`Kimi Code token ${operation} response missing fields: ${JSON.stringify(json)}`);\n\t}\n\treturn {\n\t\taccess: accessToken,\n\t\trefresh: refreshToken,\n\t\texpires: Date.now() + expiresIn * 1000,\n\t};\n}\n\nasync function pollForToken(\n\toauthHost: string,\n\tdevice: DeviceAuthorization,\n\tsignal: AbortSignal,\n): Promise<TokenResponse> {\n\treturn pollOAuthDeviceCodeFlow<TokenResponse>({\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst response = await fetch(`${oauthHost}/api/oauth/token`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t...kimiCodeIdentityHeaders(),\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formUrlEncode({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tdevice_code: device.deviceCode,\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t}),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\n\t\t\tif (response.status >= 500) {\n\t\t\t\tconst text = await response.text().catch(() => \"\");\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"failed\",\n\t\t\t\t\tmessage: `Kimi Code device token request failed with status ${response.status}${text ? `: ${text}` : \"\"}`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst json = await readJson(response);\n\t\t\tif (response.ok && typeof json?.access_token === \"string\") {\n\t\t\t\ttry {\n\t\t\t\t\treturn { status: \"complete\", value: parseTokenResponse(json, \"poll\") };\n\t\t\t\t} catch (error) {\n\t\t\t\t\treturn { status: \"failed\", message: error instanceof Error ? error.message : String(error) };\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst error = json?.error;\n\t\t\tconst description = typeof json?.error_description === \"string\" ? `: ${json.error_description}` : \"\";\n\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\treturn { status: \"pending\" };\n\t\t\t}\n\t\t\tif (error === \"slow_down\") {\n\t\t\t\tconst interval = json?.interval;\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"slow_down\",\n\t\t\t\t\tintervalSeconds: typeof interval === \"number\" && interval > 0 ? interval : undefined,\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (error === \"expired_token\") {\n\t\t\t\treturn { status: \"failed\", message: \"Kimi Code device authorization expired. Please restart login.\" };\n\t\t\t}\n\t\t\tif (error === \"access_denied\") {\n\t\t\t\treturn { status: \"failed\", message: \"Kimi Code login was denied.\" };\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tmessage: `Kimi Code device token request failed (status ${response.status})${typeof error === \"string\" ? `: ${error}${description}` : \"\"}`,\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction isRetryableRefreshFailure(response: Response): boolean {\n\treturn response.status === 429 || response.status >= 500;\n}\n\nasync function refreshToken(oauthHost: string, refreshTokenValue: string, signal: AbortSignal): Promise<TokenResponse> {\n\tlet lastError: Error | undefined;\n\tfor (let attempt = 0; attempt <= REFRESH_MAX_RETRIES; attempt++) {\n\t\tif (attempt > 0) {\n\t\t\tawait sleep(1000 * 2 ** (attempt - 1), signal);\n\t\t}\n\t\tif (signal.aborted) {\n\t\t\tthrow new Error(\"Kimi Code token refresh aborted\");\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(`${oauthHost}/api/oauth/token`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t...kimiCodeIdentityHeaders(),\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formUrlEncode({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\t\trefresh_token: refreshTokenValue,\n\t\t\t\t}),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlastError = error instanceof Error ? error : new Error(String(error));\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst json = await readJson(response);\n\t\tif (response.ok) {\n\t\t\treturn parseTokenResponse(json, \"refresh\");\n\t\t}\n\n\t\t// Unauthorized: the stored credential is dead; Models clears it and prompts re-login.\n\t\tif (response.status === 401 || response.status === 403 || json?.error === \"invalid_grant\") {\n\t\t\tconst description = typeof json?.error_description === \"string\" ? `: ${json.error_description}` : \"\";\n\t\t\tthrow new Error(`Kimi Code token refresh unauthorized (status ${response.status})${description}`);\n\t\t}\n\n\t\tif (isRetryableRefreshFailure(response) && attempt < REFRESH_MAX_RETRIES) {\n\t\t\tlastError = new Error(`Kimi Code token refresh failed with status ${response.status}`);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst text = JSON.stringify(json);\n\t\tthrow new Error(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : \"\"}`);\n\t}\n\n\tthrow lastError ?? new Error(\"Kimi Code token refresh failed\");\n}\n\nasync function loginKimiCoding(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst oauthHost = getOauthHost();\n\tconst device = await startDeviceAuthorization(oauthHost, interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.userCode,\n\t\tverificationUri: device.verificationUriComplete,\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t});\n\tconst token = await pollForToken(oauthHost, device, interaction.signal);\n\treturn { type: \"oauth\", access: token.access, refresh: token.refresh, expires: token.expires };\n}\n\nexport const kimiCodingOAuth: OAuthAuth = {\n\tname: \"Kimi Code (subscription)\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with Kimi Code\",\n\n\tlogin: loginKimiCoding,\n\n\trefresh: async (credential, signal) => {\n\t\tconst token = await refreshToken(getOauthHost(), credential.refresh, signal);\n\t\treturn { type: \"oauth\", access: token.access, refresh: token.refresh, expires: token.expires };\n\t},\n\n\tasync toAuth(credential) {\n\t\treturn { headers: { ...kimiCodeIdentityHeaders(), Authorization: `Bearer ${credential.access}` } };\n\t},\n};\n"]}
+{"version":3,"file":"kimi-coding.js","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-coding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAEvH,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAiB9B,SAAS,aAAa,CAAC,MAAmB;IACzC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB,EAAE,MAAmB;IAC7E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,iCAAiC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,GAAG,uBAAuB,EAAE;YAC5B,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC7C,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,EAAE,WAAW,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,EAAE,gBAAgB,CAAC;IAC/C,MAAM,uBAAuB,GAAG,IAAI,EAAE,yBAAyB,CAAC;IAChE,IACC,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,OAAO,uBAAuB,KAAK,QAAQ;QAC3C,CAAC,cAAc,CAAC,uBAAuB,CAAC;QACxC,CAAC,cAAc,CAAC,eAAe,CAAC,EAC/B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,OAAO;QACN,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB;QACvB,eAAe,EACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACxE,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,6BAA6B;QACjC,gBAAgB,EACf,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC3E,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,2BAA2B;KAC/B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAoC,EAAE,SAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,EAAE,YAAY,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,IACC,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,WAAW;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,YAAY;QACb,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,IAAI,CAAC,EACb,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,6BAA6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACN,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,SAAiB,EACjB,MAA2B,EAC3B,MAAmB;IAEnB,OAAO,uBAAuB,CAAgB;QAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,GAAG,uBAAuB,EAAE;oBAC5B,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,aAAa,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,UAAU,EAAE,8CAA8C;iBAC1D,CAAC;gBACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO;oBACN,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,qDAAqD,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACzG,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACJ,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9F,CAAC;YACF,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;YAC1B,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;gBAChC,OAAO;oBACN,MAAM,EAAE,WAAW;oBACnB,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACpF,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;YACvG,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;YACrE,CAAC;YACD,OAAO;gBACN,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,iDAAiD,QAAQ,CAAC,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aAC1I,CAAC;QACH,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAkB;IACpD,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,iBAAyB,EAAE,MAAmB;IAC5F,IAAI,SAA4B,CAAC;IACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,GAAG,uBAAuB,EAAE;oBAC5B,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,aAAa,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,iBAAiB;iBAChC,CAAC;gBACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,sFAAsF;QACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;YAC3F,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAC1E,SAAS,GAAG,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,WAAoC;IAClE,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7E,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,uBAAuB;QAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAc;IACzC,IAAI,EAAE,0BAA0B;IAChC,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,wBAAwB;IAEpC,KAAK,EAAE,eAAe;IAEtB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAC/B,8BAA8B,CAAC,UAAU,CAAC,CAAC,SAAS,EACpD,UAAU,CAAC,OAAO,EAClB,MAAM,CACN,CAAC;QACF,OAAO;YACN,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,MAAM,EAAE,UAAU,EAAE,GAAG,8BAA8B,CAAC,UAAU,CAAC,CAAC;QAClE,OAAO;YACN,OAAO,EAAE,EAAE,GAAG,uBAAuB,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,EAAE;YACvF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACH,CAAC;CACD,CAAC","sourcesContent":["/**\n * Kimi Code (subscription) OAuth flow\n *\n * RFC 8628 device authorization grant against the region's auth host\n * (https://auth.kimi.com or https://auth.kimi.ai) with JSON responses. The\n * access token authenticates requests to that region's coding API as an\n * `Authorization: Bearer` header; see kimi-region.ts for the host table.\n */\n\nimport { sleep } from \"../../utils/sleep.ts\";\nimport type { OAuthAuth, OAuthCredential, ProviderAuthInteraction } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\nimport { kimiCodeIdentityHeaders } from \"./kimi-identity.ts\";\nimport { chooseKimiCodeLoginEndpoints, kimiCodeCredentialEnv, kimiCodeEndpointsForCredential } from \"./kimi-region.ts\";\n\nconst CLIENT_ID = \"17e5f671-d194-4dfb-9706-5516cb48c098\";\nconst DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;\nconst DEFAULT_POLL_INTERVAL_SECONDS = 5;\nconst REQUEST_TIMEOUT_MS = 30 * 1000;\nconst REFRESH_MAX_RETRIES = 3;\n\ntype DeviceAuthorization = {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tverificationUriComplete: string;\n\tintervalSeconds: number;\n\texpiresInSeconds: number;\n};\n\ntype TokenResponse = {\n\taccess: string;\n\trefresh: string;\n\texpires: number;\n};\n\nfunction requestSignal(signal: AbortSignal): AbortSignal {\n\treturn AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);\n}\n\nfunction formUrlEncode(fields: Record<string, string>): string {\n\treturn new URLSearchParams(fields).toString();\n}\n\nasync function readJson(response: Response): Promise<Record<string, unknown> | null> {\n\ttry {\n\t\tconst json = await response.json();\n\t\treturn json && typeof json === \"object\" ? (json as Record<string, unknown>) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */\nfunction trustedHttpUrl(value: unknown): string | null {\n\tif (typeof value !== \"string\" || !value) return null;\n\ttry {\n\t\tconst url = new URL(value);\n\t\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") return null;\n\t\treturn url.href;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nasync function startDeviceAuthorization(oauthHost: string, signal: AbortSignal): Promise<DeviceAuthorization> {\n\tconst response = await fetch(`${oauthHost}/api/oauth/device_authorization`, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t...kimiCodeIdentityHeaders(),\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\tAccept: \"application/json\",\n\t\t},\n\t\tbody: formUrlEncode({ client_id: CLIENT_ID }),\n\t\tsignal: requestSignal(signal),\n\t});\n\n\tif (!response.ok) {\n\t\tconst text = await response.text().catch(() => \"\");\n\t\tthrow new Error(`Kimi Code device authorization failed with status ${response.status}${text ? `: ${text}` : \"\"}`);\n\t}\n\n\tconst json = await readJson(response);\n\tconst deviceCode = json?.device_code;\n\tconst userCode = json?.user_code;\n\tconst verificationUri = json?.verification_uri;\n\tconst verificationUriComplete = json?.verification_uri_complete;\n\tif (\n\t\ttypeof deviceCode !== \"string\" ||\n\t\ttypeof userCode !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\ttypeof verificationUriComplete !== \"string\" ||\n\t\t!trustedHttpUrl(verificationUriComplete) ||\n\t\t!trustedHttpUrl(verificationUri)\n\t) {\n\t\tthrow new Error(`Invalid Kimi Code device authorization response: ${JSON.stringify(json)}`);\n\t}\n\n\tconst interval = json?.interval;\n\tconst expiresIn = json?.expires_in;\n\treturn {\n\t\tdeviceCode,\n\t\tuserCode,\n\t\tverificationUri,\n\t\tverificationUriComplete,\n\t\tintervalSeconds:\n\t\t\ttypeof interval === \"number\" && Number.isFinite(interval) && interval > 0\n\t\t\t\t? interval\n\t\t\t\t: DEFAULT_POLL_INTERVAL_SECONDS,\n\t\texpiresInSeconds:\n\t\t\ttypeof expiresIn === \"number\" && Number.isFinite(expiresIn) && expiresIn > 0\n\t\t\t\t? expiresIn\n\t\t\t\t: DEVICE_CODE_TIMEOUT_SECONDS,\n\t};\n}\n\nfunction parseTokenResponse(json: Record<string, unknown> | null, operation: string): TokenResponse {\n\tconst accessToken = json?.access_token;\n\tconst refreshToken = json?.refresh_token;\n\tconst expiresIn = json?.expires_in;\n\tif (\n\t\ttypeof accessToken !== \"string\" ||\n\t\t!accessToken ||\n\t\ttypeof refreshToken !== \"string\" ||\n\t\t!refreshToken ||\n\t\ttypeof expiresIn !== \"number\" ||\n\t\t!Number.isFinite(expiresIn) ||\n\t\texpiresIn <= 0\n\t) {\n\t\tthrow new Error(`Kimi Code token ${operation} response missing fields: ${JSON.stringify(json)}`);\n\t}\n\treturn {\n\t\taccess: accessToken,\n\t\trefresh: refreshToken,\n\t\texpires: Date.now() + expiresIn * 1000,\n\t};\n}\n\nasync function pollForToken(\n\toauthHost: string,\n\tdevice: DeviceAuthorization,\n\tsignal: AbortSignal,\n): Promise<TokenResponse> {\n\treturn pollOAuthDeviceCodeFlow<TokenResponse>({\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst response = await fetch(`${oauthHost}/api/oauth/token`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t...kimiCodeIdentityHeaders(),\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formUrlEncode({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tdevice_code: device.deviceCode,\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t}),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\n\t\t\tif (response.status >= 500) {\n\t\t\t\tconst text = await response.text().catch(() => \"\");\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"failed\",\n\t\t\t\t\tmessage: `Kimi Code device token request failed with status ${response.status}${text ? `: ${text}` : \"\"}`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst json = await readJson(response);\n\t\t\tif (response.ok && typeof json?.access_token === \"string\") {\n\t\t\t\ttry {\n\t\t\t\t\treturn { status: \"complete\", value: parseTokenResponse(json, \"poll\") };\n\t\t\t\t} catch (error) {\n\t\t\t\t\treturn { status: \"failed\", message: error instanceof Error ? error.message : String(error) };\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst error = json?.error;\n\t\t\tconst description = typeof json?.error_description === \"string\" ? `: ${json.error_description}` : \"\";\n\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\treturn { status: \"pending\" };\n\t\t\t}\n\t\t\tif (error === \"slow_down\") {\n\t\t\t\tconst interval = json?.interval;\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"slow_down\",\n\t\t\t\t\tintervalSeconds: typeof interval === \"number\" && interval > 0 ? interval : undefined,\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (error === \"expired_token\") {\n\t\t\t\treturn { status: \"failed\", message: \"Kimi Code device authorization expired. Please restart login.\" };\n\t\t\t}\n\t\t\tif (error === \"access_denied\") {\n\t\t\t\treturn { status: \"failed\", message: \"Kimi Code login was denied.\" };\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tmessage: `Kimi Code device token request failed (status ${response.status})${typeof error === \"string\" ? `: ${error}${description}` : \"\"}`,\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction isRetryableRefreshFailure(response: Response): boolean {\n\treturn response.status === 429 || response.status >= 500;\n}\n\nasync function refreshToken(oauthHost: string, refreshTokenValue: string, signal: AbortSignal): Promise<TokenResponse> {\n\tlet lastError: Error | undefined;\n\tfor (let attempt = 0; attempt <= REFRESH_MAX_RETRIES; attempt++) {\n\t\tif (attempt > 0) {\n\t\t\tawait sleep(1000 * 2 ** (attempt - 1), signal);\n\t\t}\n\t\tif (signal.aborted) {\n\t\t\tthrow new Error(\"Kimi Code token refresh aborted\");\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(`${oauthHost}/api/oauth/token`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t...kimiCodeIdentityHeaders(),\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formUrlEncode({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\t\trefresh_token: refreshTokenValue,\n\t\t\t\t}),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlastError = error instanceof Error ? error : new Error(String(error));\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst json = await readJson(response);\n\t\tif (response.ok) {\n\t\t\treturn parseTokenResponse(json, \"refresh\");\n\t\t}\n\n\t\t// Unauthorized: the stored credential is dead; Models clears it and prompts re-login.\n\t\tif (response.status === 401 || response.status === 403 || json?.error === \"invalid_grant\") {\n\t\t\tconst description = typeof json?.error_description === \"string\" ? `: ${json.error_description}` : \"\";\n\t\t\tthrow new Error(`Kimi Code token refresh unauthorized (status ${response.status})${description}`);\n\t\t}\n\n\t\tif (isRetryableRefreshFailure(response) && attempt < REFRESH_MAX_RETRIES) {\n\t\t\tlastError = new Error(`Kimi Code token refresh failed with status ${response.status}`);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst text = JSON.stringify(json);\n\t\tthrow new Error(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : \"\"}`);\n\t}\n\n\tthrow lastError ?? new Error(\"Kimi Code token refresh failed\");\n}\n\nasync function loginKimiCoding(interaction: ProviderAuthInteraction): Promise<OAuthCredential> {\n\tconst endpoints = await chooseKimiCodeLoginEndpoints(interaction);\n\tconst oauthHost = endpoints.oauthHost;\n\tconst device = await startDeviceAuthorization(oauthHost, interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.userCode,\n\t\tverificationUri: device.verificationUriComplete,\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t});\n\tconst token = await pollForToken(oauthHost, device, interaction.signal);\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess: token.access,\n\t\trefresh: token.refresh,\n\t\texpires: token.expires,\n\t\t...(endpoints.env ? { env: endpoints.env } : {}),\n\t};\n}\n\nexport const kimiCodingOAuth: OAuthAuth = {\n\tname: \"Kimi Code (subscription)\",\n\tisSubscription: true,\n\tloginLabel: \"Sign in with Kimi Code\",\n\n\tlogin: loginKimiCoding,\n\n\trefresh: async (credential, signal) => {\n\t\tconst env = kimiCodeCredentialEnv(credential);\n\t\tconst token = await refreshToken(\n\t\t\tkimiCodeEndpointsForCredential(credential).oauthHost,\n\t\t\tcredential.refresh,\n\t\t\tsignal,\n\t\t);\n\t\treturn {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: token.access,\n\t\t\trefresh: token.refresh,\n\t\t\texpires: token.expires,\n\t\t\t...(env ? { env } : {}),\n\t\t};\n\t},\n\n\tasync toAuth(credential) {\n\t\tconst { apiBaseUrl } = kimiCodeEndpointsForCredential(credential);\n\t\treturn {\n\t\t\theaders: { ...kimiCodeIdentityHeaders(), Authorization: `Bearer ${credential.access}` },\n\t\t\t...(apiBaseUrl ? { baseUrl: apiBaseUrl } : {}),\n\t\t};\n\t},\n};\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-region.d.ts

@@ -0,0 +1,44 @@
+import type { ProviderEnv } from "../../types.ts";
+import type { AuthPrompt, ProviderAuthInteraction } from "../types.ts";
+/** Region ids match the official Kimi Code CLI's `kimi login --region` values. */
+export type KimiCodeRegion = "mainland-cn" | "global";
+export declare const KIMI_CODE_REGION_ENV = "KIMI_CODE_REGION";
+export declare const KIMI_CODE_OAUTH_HOST_ENV = "KIMI_CODE_OAUTH_HOST";
+export declare const KIMI_OAUTH_HOST_ENV = "KIMI_OAUTH_HOST";
+export declare const DEFAULT_KIMI_CODE_REGION: KimiCodeRegion;
+export interface KimiCodeRegionProfile {
+    readonly id: KimiCodeRegion;
+    readonly label: string;
+    readonly description: string;
+    readonly oauthHost: string;
+    readonly apiBaseUrl: string;
+}
+export declare const KIMI_CODE_REGION_PROFILES: Readonly<Record<KimiCodeRegion, KimiCodeRegionProfile>>;
+export interface KimiCodeEndpoints {
+    readonly region: KimiCodeRegion | undefined;
+    readonly oauthHost: string;
+    /** Set only when the region moves inference off the provider's catalog base. */
+    readonly apiBaseUrl: string | undefined;
+    /** Credential metadata that makes refresh and inference follow this choice. */
+    readonly env: ProviderEnv | undefined;
+}
+export interface KimiCodeEndpointInput {
+    readonly storedRegion?: unknown;
+    readonly storedOauthHost?: unknown;
+    readonly envOauthHost?: string | undefined;
+    readonly envRegion?: string | undefined;
+}
+export declare function isKimiCodeRegion(value: unknown): value is KimiCodeRegion;
+export declare function kimiCodeRegionForOauthHost(host: string): KimiCodeRegion | undefined;
+/**
+ * A credential's stored host or region owns its refresh and inference routing;
+ * the process env only decides for credentials that predate regions and for
+ * new logins.
+ */
+export declare function resolveKimiCodeEndpoints(input: KimiCodeEndpointInput): KimiCodeEndpoints;
+export declare function kimiCodeCredentialEnv(credential: Readonly<Record<string, unknown>>): ProviderEnv | undefined;
+export declare function kimiCodeEndpointsForCredential(credential: Readonly<Record<string, unknown>>): KimiCodeEndpoints;
+export declare function kimiCodeRegionPrompt(): AuthPrompt;
+/** An explicit host or region in the env skips the prompt so headless logins keep working. */
+export declare function chooseKimiCodeLoginEndpoints(interaction: ProviderAuthInteraction): Promise<KimiCodeEndpoints>;
+//# sourceMappingURL=kimi-region.d.ts.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-region.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-region.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-region.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEvE,kFAAkF;AAClF,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEtD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,wBAAwB,EAAE,cAA8B,CAAC;AAEtE,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAe7F,CAAC;AAEF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAExE;AAMD,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAMnF;AAuBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,GAAG,iBAAiB,CAQxF;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAQ5G;AAED,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAQ/G;AAED,wBAAgB,oBAAoB,IAAI,UAAU,CAUjD;AAED,8FAA8F;AAC9F,wBAAsB,4BAA4B,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAanH"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-region.js

@@ -0,0 +1,120 @@
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+export const KIMI_CODE_REGION_ENV = "KIMI_CODE_REGION";
+export const KIMI_CODE_OAUTH_HOST_ENV = "KIMI_CODE_OAUTH_HOST";
+export const KIMI_OAUTH_HOST_ENV = "KIMI_OAUTH_HOST";
+export const DEFAULT_KIMI_CODE_REGION = "mainland-cn";
+export const KIMI_CODE_REGION_PROFILES = {
+    "mainland-cn": {
+        id: "mainland-cn",
+        label: "Mainland China (kimi.com)",
+        description: "Accounts created on kimi.com",
+        oauthHost: "https://auth.kimi.com",
+        apiBaseUrl: "https://api.kimi.com/coding",
+    },
+    global: {
+        id: "global",
+        label: "Outside mainland China (kimi.ai)",
+        description: "Accounts created on kimi.ai",
+        oauthHost: "https://auth.kimi.ai",
+        apiBaseUrl: "https://api.kimi.ai/coding",
+    },
+};
+export function isKimiCodeRegion(value) {
+    return value === "mainland-cn" || value === "global";
+}
+function normalizeHost(host) {
+    return host.trim().replace(/\/+$/, "");
+}
+export function kimiCodeRegionForOauthHost(host) {
+    const normalized = normalizeHost(host);
+    for (const profile of Object.values(KIMI_CODE_REGION_PROFILES)) {
+        if (profile.oauthHost === normalized)
+            return profile.id;
+    }
+    return undefined;
+}
+function endpointsForRegion(region) {
+    const profile = KIMI_CODE_REGION_PROFILES[region];
+    return {
+        region,
+        oauthHost: profile.oauthHost,
+        apiBaseUrl: region === DEFAULT_KIMI_CODE_REGION ? undefined : profile.apiBaseUrl,
+        env: { [KIMI_CODE_REGION_ENV]: region },
+    };
+}
+function endpointsForHost(host) {
+    const region = kimiCodeRegionForOauthHost(host);
+    if (region !== undefined)
+        return endpointsForRegion(region);
+    return {
+        region: undefined,
+        oauthHost: normalizeHost(host),
+        apiBaseUrl: undefined,
+        env: { [KIMI_CODE_OAUTH_HOST_ENV]: normalizeHost(host) },
+    };
+}
+/**
+ * A credential's stored host or region owns its refresh and inference routing;
+ * the process env only decides for credentials that predate regions and for
+ * new logins.
+ */
+export function resolveKimiCodeEndpoints(input) {
+    if (typeof input.storedOauthHost === "string" && input.storedOauthHost.trim()) {
+        return endpointsForHost(input.storedOauthHost);
+    }
+    if (isKimiCodeRegion(input.storedRegion))
+        return endpointsForRegion(input.storedRegion);
+    if (input.envOauthHost?.trim())
+        return endpointsForHost(input.envOauthHost);
+    if (isKimiCodeRegion(input.envRegion))
+        return endpointsForRegion(input.envRegion);
+    return { ...endpointsForRegion(DEFAULT_KIMI_CODE_REGION), env: undefined };
+}
+export function kimiCodeCredentialEnv(credential) {
+    const value = credential.env;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const env = {};
+    for (const [name, entry] of Object.entries(value)) {
+        if (typeof entry === "string")
+            env[name] = entry;
+    }
+    return env;
+}
+export function kimiCodeEndpointsForCredential(credential) {
+    const env = kimiCodeCredentialEnv(credential);
+    return resolveKimiCodeEndpoints({
+        storedRegion: env?.[KIMI_CODE_REGION_ENV],
+        storedOauthHost: env?.[KIMI_CODE_OAUTH_HOST_ENV],
+        envOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),
+        envRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),
+    });
+}
+export function kimiCodeRegionPrompt() {
+    return {
+        type: "select",
+        message: "Which Kimi service hosts your account?",
+        options: Object.values(KIMI_CODE_REGION_PROFILES).map((profile) => ({
+            id: profile.id,
+            label: profile.label,
+            description: profile.description,
+        })),
+    };
+}
+/** An explicit host or region in the env skips the prompt so headless logins keep working. */
+export async function chooseKimiCodeLoginEndpoints(interaction) {
+    const fromEnv = resolveKimiCodeEndpoints({
+        envOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),
+        envRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),
+    });
+    if (fromEnv.env !== undefined)
+        return fromEnv;
+    interaction.signal.throwIfAborted();
+    const answer = await interaction.prompt(kimiCodeRegionPrompt());
+    interaction.signal.throwIfAborted();
+    if (!isKimiCodeRegion(answer)) {
+        throw new Error(`Unknown Kimi Code region: ${answer}`);
+    }
+    return endpointsForRegion(answer);
+}
+//# sourceMappingURL=kimi-region.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-region.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-region.js","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-region.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAmB,aAAa,CAAC;AAUtE,MAAM,CAAC,MAAM,yBAAyB,GAA4D;IACjG,aAAa,EAAE;QACd,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,uBAAuB;QAClC,UAAU,EAAE,6BAA6B;KACzC;IACD,MAAM,EAAE;QACP,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,6BAA6B;QAC1C,SAAS,EAAE,sBAAsB;QACjC,UAAU,EAAE,4BAA4B;KACxC;CACD,CAAC;AAkBF,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,QAAQ,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAsB;IACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO;QACN,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;QAChF,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE;KACvC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC;QAC9B,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE;KACxD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA4B;IACpE,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/E,OAAO,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClF,OAAO,EAAE,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAA6C;IAClF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAA6C;IAC3F,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,wBAAwB,CAAC;QAC/B,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC;QACzC,eAAe,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC;QAChD,YAAY,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,CAAC;QACvG,SAAS,EAAE,mBAAmB,CAAC,oBAAoB,CAAC;KACpD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC,CAAC;KACH,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAoC;IACtF,MAAM,OAAO,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,CAAC;QACvG,SAAS,EAAE,mBAAmB,CAAC,oBAAoB,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC9C,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAChE,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { ProviderEnv } from \"../../types.ts\";\nimport { getProviderEnvValue } from \"../../utils/provider-env.ts\";\nimport type { AuthPrompt, ProviderAuthInteraction } from \"../types.ts\";\n\n/** Region ids match the official Kimi Code CLI's `kimi login --region` values. */\nexport type KimiCodeRegion = \"mainland-cn\" | \"global\";\n\nexport const KIMI_CODE_REGION_ENV = \"KIMI_CODE_REGION\";\nexport const KIMI_CODE_OAUTH_HOST_ENV = \"KIMI_CODE_OAUTH_HOST\";\nexport const KIMI_OAUTH_HOST_ENV = \"KIMI_OAUTH_HOST\";\nexport const DEFAULT_KIMI_CODE_REGION: KimiCodeRegion = \"mainland-cn\";\n\nexport interface KimiCodeRegionProfile {\n\treadonly id: KimiCodeRegion;\n\treadonly label: string;\n\treadonly description: string;\n\treadonly oauthHost: string;\n\treadonly apiBaseUrl: string;\n}\n\nexport const KIMI_CODE_REGION_PROFILES: Readonly<Record<KimiCodeRegion, KimiCodeRegionProfile>> = {\n\t\"mainland-cn\": {\n\t\tid: \"mainland-cn\",\n\t\tlabel: \"Mainland China (kimi.com)\",\n\t\tdescription: \"Accounts created on kimi.com\",\n\t\toauthHost: \"https://auth.kimi.com\",\n\t\tapiBaseUrl: \"https://api.kimi.com/coding\",\n\t},\n\tglobal: {\n\t\tid: \"global\",\n\t\tlabel: \"Outside mainland China (kimi.ai)\",\n\t\tdescription: \"Accounts created on kimi.ai\",\n\t\toauthHost: \"https://auth.kimi.ai\",\n\t\tapiBaseUrl: \"https://api.kimi.ai/coding\",\n\t},\n};\n\nexport interface KimiCodeEndpoints {\n\treadonly region: KimiCodeRegion | undefined;\n\treadonly oauthHost: string;\n\t/** Set only when the region moves inference off the provider's catalog base. */\n\treadonly apiBaseUrl: string | undefined;\n\t/** Credential metadata that makes refresh and inference follow this choice. */\n\treadonly env: ProviderEnv | undefined;\n}\n\nexport interface KimiCodeEndpointInput {\n\treadonly storedRegion?: unknown;\n\treadonly storedOauthHost?: unknown;\n\treadonly envOauthHost?: string | undefined;\n\treadonly envRegion?: string | undefined;\n}\n\nexport function isKimiCodeRegion(value: unknown): value is KimiCodeRegion {\n\treturn value === \"mainland-cn\" || value === \"global\";\n}\n\nfunction normalizeHost(host: string): string {\n\treturn host.trim().replace(/\\/+$/, \"\");\n}\n\nexport function kimiCodeRegionForOauthHost(host: string): KimiCodeRegion | undefined {\n\tconst normalized = normalizeHost(host);\n\tfor (const profile of Object.values(KIMI_CODE_REGION_PROFILES)) {\n\t\tif (profile.oauthHost === normalized) return profile.id;\n\t}\n\treturn undefined;\n}\n\nfunction endpointsForRegion(region: KimiCodeRegion): KimiCodeEndpoints {\n\tconst profile = KIMI_CODE_REGION_PROFILES[region];\n\treturn {\n\t\tregion,\n\t\toauthHost: profile.oauthHost,\n\t\tapiBaseUrl: region === DEFAULT_KIMI_CODE_REGION ? undefined : profile.apiBaseUrl,\n\t\tenv: { [KIMI_CODE_REGION_ENV]: region },\n\t};\n}\n\nfunction endpointsForHost(host: string): KimiCodeEndpoints {\n\tconst region = kimiCodeRegionForOauthHost(host);\n\tif (region !== undefined) return endpointsForRegion(region);\n\treturn {\n\t\tregion: undefined,\n\t\toauthHost: normalizeHost(host),\n\t\tapiBaseUrl: undefined,\n\t\tenv: { [KIMI_CODE_OAUTH_HOST_ENV]: normalizeHost(host) },\n\t};\n}\n\n/**\n * A credential's stored host or region owns its refresh and inference routing;\n * the process env only decides for credentials that predate regions and for\n * new logins.\n */\nexport function resolveKimiCodeEndpoints(input: KimiCodeEndpointInput): KimiCodeEndpoints {\n\tif (typeof input.storedOauthHost === \"string\" && input.storedOauthHost.trim()) {\n\t\treturn endpointsForHost(input.storedOauthHost);\n\t}\n\tif (isKimiCodeRegion(input.storedRegion)) return endpointsForRegion(input.storedRegion);\n\tif (input.envOauthHost?.trim()) return endpointsForHost(input.envOauthHost);\n\tif (isKimiCodeRegion(input.envRegion)) return endpointsForRegion(input.envRegion);\n\treturn { ...endpointsForRegion(DEFAULT_KIMI_CODE_REGION), env: undefined };\n}\n\nexport function kimiCodeCredentialEnv(credential: Readonly<Record<string, unknown>>): ProviderEnv | undefined {\n\tconst value = credential.env;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n\tconst env: ProviderEnv = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (typeof entry === \"string\") env[name] = entry;\n\t}\n\treturn env;\n}\n\nexport function kimiCodeEndpointsForCredential(credential: Readonly<Record<string, unknown>>): KimiCodeEndpoints {\n\tconst env = kimiCodeCredentialEnv(credential);\n\treturn resolveKimiCodeEndpoints({\n\t\tstoredRegion: env?.[KIMI_CODE_REGION_ENV],\n\t\tstoredOauthHost: env?.[KIMI_CODE_OAUTH_HOST_ENV],\n\t\tenvOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),\n\t\tenvRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),\n\t});\n}\n\nexport function kimiCodeRegionPrompt(): AuthPrompt {\n\treturn {\n\t\ttype: \"select\",\n\t\tmessage: \"Which Kimi service hosts your account?\",\n\t\toptions: Object.values(KIMI_CODE_REGION_PROFILES).map((profile) => ({\n\t\t\tid: profile.id,\n\t\t\tlabel: profile.label,\n\t\t\tdescription: profile.description,\n\t\t})),\n\t};\n}\n\n/** An explicit host or region in the env skips the prompt so headless logins keep working. */\nexport async function chooseKimiCodeLoginEndpoints(interaction: ProviderAuthInteraction): Promise<KimiCodeEndpoints> {\n\tconst fromEnv = resolveKimiCodeEndpoints({\n\t\tenvOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),\n\t\tenvRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),\n\t});\n\tif (fromEnv.env !== undefined) return fromEnv;\n\tinteraction.signal.throwIfAborted();\n\tconst answer = await interaction.prompt(kimiCodeRegionPrompt());\n\tinteraction.signal.throwIfAborted();\n\tif (!isKimiCodeRegion(answer)) {\n\t\tthrow new Error(`Unknown Kimi Code region: ${answer}`);\n\t}\n\treturn endpointsForRegion(answer);\n}\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/failover.d.ts

@@ -1,7 +1,7 @@
+import { TURN_RETRY_SUPPRESSION_PREFIX } from "../../utils/provider-failure-description.ts";
 import { type PoolFailureClassification } from "./classify.ts";
 import type { SelectableSlot } from "./select.ts";
-/** Must stay byte-identical to the claude-sdk-oauth marker AgentSession already honors. */
-export declare const TURN_RETRY_SUPPRESSION_PREFIX = "senpi:no-turn-retry:";
+export { TURN_RETRY_SUPPRESSION_PREFIX };
 export declare const DEFAULT_SLOT_BLOCK_MS = 60000;
 export declare const MAX_SLOT_BLOCK_MS: number;
 export type PoolFailoverEvent<TSlot extends SelectableSlot> = {

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/failover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"failover.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,2FAA2F;AAC3F,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AACpE,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAEtD,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,cAAc,IAAI;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,cAAc,EAAE,yBAAyB,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,IAAI;IACvE,KAAK,EAAE,SAAS,KAAK,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,KAAK,KAAK,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,yBAAyB,CAAC;IACzD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,YAAY,cAAc,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAOnG;CACD;AAoBD;;;;;;GAMG;AACH,wBAAuB,eAAe,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,EAC1E,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,GACzC,cAAc,CAAC,MAAM,CAAC,CA4CxB"}
+{"version":3,"file":"failover.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACzC,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAEtD,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,cAAc,IAAI;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,cAAc,EAAE,yBAAyB,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,IAAI;IACvE,KAAK,EAAE,SAAS,KAAK,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,KAAK,KAAK,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,yBAAyB,CAAC;IACzD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,YAAY,cAAc,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAOnG;CACD;AAoBD;;;;;;GAMG;AACH,wBAAuB,eAAe,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,EAC1E,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,GACzC,cAAc,CAAC,MAAM,CAAC,CA4CxB"}

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/failover.js

@@ -1,6 +1,6 @@
+import { TURN_RETRY_SUPPRESSION_PREFIX } from "../../utils/provider-failure-description.js";
 import { classifyPoolFailure } from "./classify.js";
-/** Must stay byte-identical to the claude-sdk-oauth marker AgentSession already honors. */
-export const TURN_RETRY_SUPPRESSION_PREFIX = "senpi:no-turn-retry:";
+export { TURN_RETRY_SUPPRESSION_PREFIX };
 export const DEFAULT_SLOT_BLOCK_MS = 60_000;
 export const MAX_SLOT_BLOCK_MS = 48 * 60 * 60 * 1_000;
 export class PoolFailoverError extends Error {

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/failover.js.map

@@ -1 +1 @@
-{"version":3,"file":"failover.js","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAkC,MAAM,eAAe,CAAC;AAGpF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AA4BtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAK3C,YAAY,cAAyC,EAAE,QAAiB,EAAE,iBAA0B;QACnG,MAAM,MAAM,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,KAAK,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,WAAW,CACnB,IAAW,EACX,cAAyC,EACzC,GAAW,EACX,OAAe,EACf,WAAmB;IAEnB,IAAI,cAAc,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACjD,kEAAkE;QAClE,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACrC,OAA2C;IAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,SAAwC,CAAC;IAE7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACzC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,cAAc,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9E,SAAS,GAAG,OAAO,CAAC;YACpB,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YAEtD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/E,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1F,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,QAAQ,GAA6B;gBAC1C,IAAI,EAAE,OAAO;gBACb,cAAc;gBACd,OAAO,EAAE,OAAO,GAAG,CAAC;gBACpB,eAAe;aACf,CAAC;YACF,IAAI,CAAC;gBACJ,IAAI,CAAC,eAAe,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACpD,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACF,CAAC;oBAAS,CAAC;gBACV,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,eAAe;gBAAE,MAAM,OAAO,CAAC;QACpC,CAAC;IACF,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { classifyPoolFailure, type PoolFailureClassification } from \"./classify.ts\";\nimport type { SelectableSlot } from \"./select.ts\";\n\n/** Must stay byte-identical to the claude-sdk-oauth marker AgentSession already honors. */\nexport const TURN_RETRY_SUPPRESSION_PREFIX = \"senpi:no-turn-retry:\";\nexport const DEFAULT_SLOT_BLOCK_MS = 60_000;\nexport const MAX_SLOT_BLOCK_MS = 48 * 60 * 60 * 1_000;\n\nexport type PoolFailoverEvent<TSlot extends SelectableSlot> = {\n\tslot: TSlot;\n\tnextSlot?: TSlot;\n\tclassification: PoolFailureClassification;\n\tattempt: number;\n\tcommittedOutput: boolean;\n};\n\nexport type PoolFailoverOptions<TEvent, TSlot extends SelectableSlot> = {\n\tslots: readonly TSlot[];\n\tselect: (slots: readonly TSlot[]) => TSlot;\n\trunAttempt: (slot: TSlot) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;\n\tclassify?: (error: unknown) => PoolFailureClassification;\n\t/**\n\t * Rotation is transparent only before committed output. Absent, every yielded\n\t * event counts as committed (default-DENY), so silent mid-stream rotation\n\t * requires an explicit opt-in from a caller that knows which events are\n\t * bookkeeping rather than user-visible output.\n\t */\n\tisCommittedOutput?: (event: TEvent) => boolean;\n\tpersistBlock?: (slot: TSlot) => void | Promise<void>;\n\tonRotate?: (event: PoolFailoverEvent<TSlot>) => void | Promise<void>;\n\tnow?: () => number;\n\tbaseBlockMs?: number;\n};\n\nexport class PoolFailoverError extends Error {\n\treadonly classification: PoolFailureClassification;\n\treadonly original: unknown;\n\treadonly suppressTurnRetry: boolean;\n\n\tconstructor(classification: PoolFailureClassification, original: unknown, suppressTurnRetry: boolean) {\n\t\tconst detail = original instanceof Error ? original.message : String(original);\n\t\tsuper(`${suppressTurnRetry ? TURN_RETRY_SUPPRESSION_PREFIX : \"\"}${detail}`);\n\t\tthis.name = \"PoolFailoverError\";\n\t\tthis.classification = classification;\n\t\tthis.original = original;\n\t\tthis.suppressTurnRetry = suppressTurnRetry;\n\t}\n}\n\nfunction blockedSlot<TSlot extends SelectableSlot>(\n\tslot: TSlot,\n\tclassification: PoolFailureClassification,\n\tnow: number,\n\tattempt: number,\n\tbaseBlockMs: number,\n): TSlot {\n\tif (classification.blockReason === \"auth_error\") {\n\t\t// An auth block has no expiry: only a re-login rewrites the slot.\n\t\tconst next = { ...slot, blockReason: \"auth_error\" };\n\t\tdelete next.blockedUntil;\n\t\treturn next;\n\t}\n\tconst fallback = Math.min(MAX_SLOT_BLOCK_MS, baseBlockMs * 2 ** attempt);\n\tconst duration = Math.min(MAX_SLOT_BLOCK_MS, classification.retryAfterMs ?? fallback);\n\treturn { ...slot, blockedUntil: now + duration, blockReason: \"rate_limit\" };\n}\n\n/**\n * Runs at most one attempt per slot. A rotation is transparent only while no\n * committed output has reached the caller; afterwards the classified error is\n * thrown with the turn-retry suppression marker so the session layer never\n * replays a partially delivered turn. Non-rotate classes throw immediately and\n * compose with the retry/model-fallback machinery above this engine.\n */\nexport async function* runSlotFailover<TEvent, TSlot extends SelectableSlot>(\n\toptions: PoolFailoverOptions<TEvent, TSlot>,\n): AsyncGenerator<TEvent> {\n\tconst now = options.now ?? Date.now;\n\tconst classify = options.classify ?? classifyPoolFailure;\n\tconst committed = options.isCommittedOutput ?? (() => true);\n\tconst baseBlockMs = options.baseBlockMs ?? DEFAULT_SLOT_BLOCK_MS;\n\tlet slots = [...options.slots];\n\tlet lastError: PoolFailoverError | undefined;\n\n\tfor (let attempt = 0; attempt < options.slots.length; attempt++) {\n\t\tconst slot = options.select(slots);\n\t\tlet committedOutput = false;\n\t\ttry {\n\t\t\tconst attemptStream = await options.runAttempt(slot);\n\t\t\tfor await (const event of attemptStream) {\n\t\t\t\tcommittedOutput ||= committed(event);\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tconst classification = classify(error);\n\t\t\tconst failure = new PoolFailoverError(classification, error, committedOutput);\n\t\t\tlastError = failure;\n\t\t\tif (classification.action !== \"rotate\") throw failure;\n\n\t\t\tconst blocked = blockedSlot(slot, classification, now(), attempt, baseBlockMs);\n\t\t\tslots = slots.map((candidate) => (candidate.name === blocked.name ? blocked : candidate));\n\t\t\tawait options.persistBlock?.(blocked);\n\t\t\tconst rotation: PoolFailoverEvent<TSlot> = {\n\t\t\t\tslot: blocked,\n\t\t\t\tclassification,\n\t\t\t\tattempt: attempt + 1,\n\t\t\t\tcommittedOutput,\n\t\t\t};\n\t\t\ttry {\n\t\t\t\tif (!committedOutput && attempt + 1 < slots.length) {\n\t\t\t\t\trotation.nextSlot = options.select(slots);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tawait options.onRotate?.(rotation);\n\t\t\t}\n\t\t\tif (committedOutput) throw failure;\n\t\t}\n\t}\n\tthrow lastError ?? new Error(\"Credential pool failover exhausted without an attempt\");\n}\n"]}
+{"version":3,"file":"failover.js","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAkC,MAAM,eAAe,CAAC;AAGpF,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AA4BtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAK3C,YAAY,cAAyC,EAAE,QAAiB,EAAE,iBAA0B;QACnG,MAAM,MAAM,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,KAAK,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,WAAW,CACnB,IAAW,EACX,cAAyC,EACzC,GAAW,EACX,OAAe,EACf,WAAmB;IAEnB,IAAI,cAAc,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACjD,kEAAkE;QAClE,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACrC,OAA2C;IAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,SAAwC,CAAC;IAE7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACzC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,cAAc,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9E,SAAS,GAAG,OAAO,CAAC;YACpB,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YAEtD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/E,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1F,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,QAAQ,GAA6B;gBAC1C,IAAI,EAAE,OAAO;gBACb,cAAc;gBACd,OAAO,EAAE,OAAO,GAAG,CAAC;gBACpB,eAAe;aACf,CAAC;YACF,IAAI,CAAC;gBACJ,IAAI,CAAC,eAAe,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACpD,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACF,CAAC;oBAAS,CAAC;gBACV,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,eAAe;gBAAE,MAAM,OAAO,CAAC;QACpC,CAAC;IACF,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { TURN_RETRY_SUPPRESSION_PREFIX } from \"../../utils/provider-failure-description.ts\";\nimport { classifyPoolFailure, type PoolFailureClassification } from \"./classify.ts\";\nimport type { SelectableSlot } from \"./select.ts\";\n\nexport { TURN_RETRY_SUPPRESSION_PREFIX };\nexport const DEFAULT_SLOT_BLOCK_MS = 60_000;\nexport const MAX_SLOT_BLOCK_MS = 48 * 60 * 60 * 1_000;\n\nexport type PoolFailoverEvent<TSlot extends SelectableSlot> = {\n\tslot: TSlot;\n\tnextSlot?: TSlot;\n\tclassification: PoolFailureClassification;\n\tattempt: number;\n\tcommittedOutput: boolean;\n};\n\nexport type PoolFailoverOptions<TEvent, TSlot extends SelectableSlot> = {\n\tslots: readonly TSlot[];\n\tselect: (slots: readonly TSlot[]) => TSlot;\n\trunAttempt: (slot: TSlot) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;\n\tclassify?: (error: unknown) => PoolFailureClassification;\n\t/**\n\t * Rotation is transparent only before committed output. Absent, every yielded\n\t * event counts as committed (default-DENY), so silent mid-stream rotation\n\t * requires an explicit opt-in from a caller that knows which events are\n\t * bookkeeping rather than user-visible output.\n\t */\n\tisCommittedOutput?: (event: TEvent) => boolean;\n\tpersistBlock?: (slot: TSlot) => void | Promise<void>;\n\tonRotate?: (event: PoolFailoverEvent<TSlot>) => void | Promise<void>;\n\tnow?: () => number;\n\tbaseBlockMs?: number;\n};\n\nexport class PoolFailoverError extends Error {\n\treadonly classification: PoolFailureClassification;\n\treadonly original: unknown;\n\treadonly suppressTurnRetry: boolean;\n\n\tconstructor(classification: PoolFailureClassification, original: unknown, suppressTurnRetry: boolean) {\n\t\tconst detail = original instanceof Error ? original.message : String(original);\n\t\tsuper(`${suppressTurnRetry ? TURN_RETRY_SUPPRESSION_PREFIX : \"\"}${detail}`);\n\t\tthis.name = \"PoolFailoverError\";\n\t\tthis.classification = classification;\n\t\tthis.original = original;\n\t\tthis.suppressTurnRetry = suppressTurnRetry;\n\t}\n}\n\nfunction blockedSlot<TSlot extends SelectableSlot>(\n\tslot: TSlot,\n\tclassification: PoolFailureClassification,\n\tnow: number,\n\tattempt: number,\n\tbaseBlockMs: number,\n): TSlot {\n\tif (classification.blockReason === \"auth_error\") {\n\t\t// An auth block has no expiry: only a re-login rewrites the slot.\n\t\tconst next = { ...slot, blockReason: \"auth_error\" };\n\t\tdelete next.blockedUntil;\n\t\treturn next;\n\t}\n\tconst fallback = Math.min(MAX_SLOT_BLOCK_MS, baseBlockMs * 2 ** attempt);\n\tconst duration = Math.min(MAX_SLOT_BLOCK_MS, classification.retryAfterMs ?? fallback);\n\treturn { ...slot, blockedUntil: now + duration, blockReason: \"rate_limit\" };\n}\n\n/**\n * Runs at most one attempt per slot. A rotation is transparent only while no\n * committed output has reached the caller; afterwards the classified error is\n * thrown with the turn-retry suppression marker so the session layer never\n * replays a partially delivered turn. Non-rotate classes throw immediately and\n * compose with the retry/model-fallback machinery above this engine.\n */\nexport async function* runSlotFailover<TEvent, TSlot extends SelectableSlot>(\n\toptions: PoolFailoverOptions<TEvent, TSlot>,\n): AsyncGenerator<TEvent> {\n\tconst now = options.now ?? Date.now;\n\tconst classify = options.classify ?? classifyPoolFailure;\n\tconst committed = options.isCommittedOutput ?? (() => true);\n\tconst baseBlockMs = options.baseBlockMs ?? DEFAULT_SLOT_BLOCK_MS;\n\tlet slots = [...options.slots];\n\tlet lastError: PoolFailoverError | undefined;\n\n\tfor (let attempt = 0; attempt < options.slots.length; attempt++) {\n\t\tconst slot = options.select(slots);\n\t\tlet committedOutput = false;\n\t\ttry {\n\t\t\tconst attemptStream = await options.runAttempt(slot);\n\t\t\tfor await (const event of attemptStream) {\n\t\t\t\tcommittedOutput ||= committed(event);\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tconst classification = classify(error);\n\t\t\tconst failure = new PoolFailoverError(classification, error, committedOutput);\n\t\t\tlastError = failure;\n\t\t\tif (classification.action !== \"rotate\") throw failure;\n\n\t\t\tconst blocked = blockedSlot(slot, classification, now(), attempt, baseBlockMs);\n\t\t\tslots = slots.map((candidate) => (candidate.name === blocked.name ? blocked : candidate));\n\t\t\tawait options.persistBlock?.(blocked);\n\t\t\tconst rotation: PoolFailoverEvent<TSlot> = {\n\t\t\t\tslot: blocked,\n\t\t\t\tclassification,\n\t\t\t\tattempt: attempt + 1,\n\t\t\t\tcommittedOutput,\n\t\t\t};\n\t\t\ttry {\n\t\t\t\tif (!committedOutput && attempt + 1 < slots.length) {\n\t\t\t\t\trotation.nextSlot = options.select(slots);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tawait options.onRotate?.(rotation);\n\t\t\t}\n\t\t\tif (committedOutput) throw failure;\n\t\t}\n\t}\n\tthrow lastError ?? new Error(\"Credential pool failover exhausted without an attempt\");\n}\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/slots.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderEnv } from "../../types.ts";
 import type { Credential } from "../types.ts";
 export type { Credential };
 export declare const DEFAULT_SLOT_NAME = "default";
@@ -12,6 +13,8 @@ export type CredentialSlot = {
     access?: string;
     refresh?: string;
     expires?: number;
+    /** Provider-scoped values this account carries (a Kimi region, a Cloudflare account id). */
+    env?: ProviderEnv;
 };
 export type PooledCredential = Credential & {
     accounts?: CredentialSlot[];

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtD;AAID;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAiC3C,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAoBD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GAClB,gBAAgB,CA8BlB;AAmBD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,EAAE,CAIpF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAc3G;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW/G;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAGpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAU1G;AA+CD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,UAAU,EAChB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,KAAK,IAAI,GACpE,UAAU,CA2BZ;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAQnH;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAS7G;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAe3F"}
+{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtD;AAID;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAiC3C,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAoBD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GAClB,gBAAgB,CA8BlB;AAqBD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,EAAE,CAIpF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAc3G;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW/G;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAGpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAW1G;AAgDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,UAAU,EAChB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,KAAK,IAAI,GACpE,UAAU,CA2BZ;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAQnH;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAS7G;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAe3F"}

package/node_modules/@earendil-works/pi-ai/dist/auth/pool/slots.js

@@ -119,17 +119,20 @@ export function renameSlotDisplayName(credential, name, value) {
 function storedSlots(credential) {
     return Array.isArray(credential.accounts) ? credential.accounts : [];
 }
-function slotFromFlatCredential(credential) {
-    if (credential.type === "oauth") {
-        return {
-            name: DEFAULT_SLOT_NAME,
-            source: "login",
-            access: credential.access,
-            refresh: credential.refresh,
-            expires: credential.expires,
-        };
+function credentialSlotEnv(credential) {
+    const value = credential.env;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return {};
+    const env = {};
+    for (const [name, entry] of Object.entries(value)) {
+        if (typeof entry !== "string")
+            return {};
+        env[name] = entry;
     }
-    return { name: DEFAULT_SLOT_NAME, source: "login", key: credential.key };
+    return { env };
+}
+function slotFromFlatCredential(credential) {
+    return slotFromFlatCredentialNamed(credential, DEFAULT_SLOT_NAME);
 }
 /**
  * A flat credential written by a build predating pools is read as a one-slot pool
@@ -170,12 +173,13 @@ function slotMirrorsFlat(credential, slot) {
 }
 /** Rewrites the flat top-level projection to carry the given slot's material. */
 function projectFlatFields(credential, slot) {
+    const env = slot.env === undefined ? {} : { env: slot.env };
     if (credential.type === "oauth") {
         if (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined)
             return credential;
-        return { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires };
+        return { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };
     }
-    return { ...credential, key: slot.key };
+    return { ...credential, key: slot.key, ...env };
 }
 /**
  * Removes one slot. The credential is dropped entirely once its last slot is gone,
@@ -219,12 +223,13 @@ export function projectSlot(credential, name) {
     if (!slot)
         return undefined;
     const { accounts: _accounts, pinned: _pinned, ...flat } = credential;
+    const env = slot.env === undefined ? {} : { env: slot.env };
     if (flat.type === "oauth") {
         if (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined)
             return undefined;
-        return { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires };
+        return { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };
     }
-    return { ...flat, key: slot.key };
+    return { ...flat, key: slot.key, ...env };
 }
 function slotFromFlatCredentialNamed(credential, name) {
     if (credential.type === "oauth") {
@@ -234,9 +239,10 @@ function slotFromFlatCredentialNamed(credential, name) {
             access: credential.access,
             refresh: credential.refresh,
             expires: credential.expires,
+            ...credentialSlotEnv(credential),
         };
     }
-    return { name, source: "login", key: credential.key };
+    return { name, source: "login", key: credential.key, ...credentialSlotEnv(credential) };
 }
 function nextLoginSlotName(credential) {
     const taken = new Set(listSlots(credential).map((slot) => slot.name));