@mastra/code-sdk 0.0.0-client-tool-results-20260912062135

package/dist/auth/providers/github-copilot.js

@@ -0,0 +1,340 @@
+//#region src/auth/providers/github-copilot.ts
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("SXYxLmI1MDdhMDhjODdlY2ZlOTg=");
+const COPILOT_USER_AGENT = "GitHubCopilotChat/0.35.0";
+/** Headers that Copilot endpoints expect from a VS Code-like client. */
+const COPILOT_HEADERS = {
+	"User-Agent": COPILOT_USER_AGENT,
+	"Editor-Version": "vscode/1.107.0",
+	"Editor-Plugin-Version": "copilot-chat/0.35.0",
+	"Copilot-Integration-Id": "vscode-chat"
+};
+const INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;
+const SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;
+/**
+* Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).
+* Returns null for an empty input or an unparseable URL.
+*/
+function normalizeDomain(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return null;
+	try {
+		return (trimmed.includes("://") ? new URL(trimmed) : new URL(`https://${trimmed}`)).hostname || null;
+	} catch {
+		return null;
+	}
+}
+function getUrls(domain) {
+	return {
+		deviceCodeUrl: `https://${domain}/login/device/code`,
+		accessTokenUrl: `https://${domain}/login/oauth/access_token`,
+		copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`
+	};
+}
+/**
+* Parse the `proxy-ep` segment from a Copilot bearer token and convert to its API base URL.
+* Token shape: `tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...`
+*/
+function getBaseUrlFromToken(token) {
+	const match = token.match(/proxy-ep=([^;]+)/);
+	if (!match) return null;
+	return `https://${match[1].replace(/^proxy\./, "api.")}`;
+}
+/**
+* Resolve the Copilot API base URL.
+* Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.
+*/
+function getGitHubCopilotBaseUrl(token, enterpriseDomain) {
+	if (token) {
+		const fromToken = getBaseUrlFromToken(token);
+		if (fromToken) return fromToken;
+	}
+	if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;
+	return "https://api.individual.githubcopilot.com";
+}
+async function fetchJson(url, init, signal) {
+	const response = await fetch(url, signal ? {
+		...init,
+		signal
+	} : init);
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`${response.status} ${response.statusText}: ${text}`);
+	}
+	return response.json();
+}
+async function startDeviceFlow(domain, signal) {
+	const data = await fetchJson(getUrls(domain).deviceCodeUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded",
+			"User-Agent": COPILOT_USER_AGENT
+		},
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			scope: "read:user"
+		})
+	}, signal);
+	if (!data || typeof data !== "object") throw new Error("Invalid device code response");
+	const obj = data;
+	const deviceCode = obj.device_code;
+	const userCode = obj.user_code;
+	const verificationUri = obj.verification_uri;
+	const interval = obj.interval;
+	const expiresIn = obj.expires_in;
+	if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string" || typeof interval !== "number" || typeof expiresIn !== "number") throw new Error("Invalid device code response fields");
+	return {
+		device_code: deviceCode,
+		user_code: userCode,
+		verification_uri: verificationUri,
+		interval,
+		expires_in: expiresIn
+	};
+}
+/** Sleep that can be interrupted by an AbortSignal. */
+function abortableSleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+			return;
+		}
+		let timeout;
+		const onAbort = () => {
+			clearTimeout(timeout);
+			reject(/* @__PURE__ */ new Error("Login cancelled"));
+		};
+		timeout = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** Delay to wait before the next upstream poll for a pending Copilot device login. */
+function copilotNextPollDelayMs(pending) {
+	return Math.ceil(pending.intervalMs * pending.intervalMultiplier);
+}
+/**
+* Start a Copilot device-code login: request a user code and return the
+* serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`
+* before the first poll.
+*/
+async function startGitHubCopilotDeviceLogin(enterpriseDomain, options) {
+	const domain = enterpriseDomain || "github.com";
+	const device = await startDeviceFlow(domain, options?.signal);
+	return {
+		domain,
+		...enterpriseDomain ? { enterpriseDomain } : {},
+		deviceCode: device.device_code,
+		userCode: device.user_code,
+		url: device.verification_uri,
+		instructions: `Enter code: ${device.user_code}`,
+		intervalMs: Math.max(1e3, Math.floor(device.interval * 1e3)),
+		intervalMultiplier: INITIAL_POLL_INTERVAL_MULTIPLIER,
+		slowDownCount: 0,
+		deadlineAt: Date.now() + device.expires_in * 1e3
+	};
+}
+/**
+* Perform exactly one upstream poll for a pending Copilot device login.
+* On success, exchanges the GitHub OAuth token for a Copilot bearer token and
+* returns full credentials. Never throws for flow-level conditions; network
+* errors from fetch still propagate.
+*/
+async function pollGitHubCopilotDeviceLogin(pending, options) {
+	if (Date.now() >= pending.deadlineAt) {
+		if (pending.slowDownCount > 0) return {
+			status: "failed",
+			error: "Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again."
+		};
+		return {
+			status: "failed",
+			error: "Device flow timed out"
+		};
+	}
+	const raw = await fetchJson(getUrls(pending.domain).accessTokenUrl, {
+		method: "POST",
+		headers: {
+			Accept: "application/json",
+			"Content-Type": "application/x-www-form-urlencoded",
+			"User-Agent": COPILOT_USER_AGENT
+		},
+		body: new URLSearchParams({
+			client_id: CLIENT_ID,
+			device_code: pending.deviceCode,
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+		})
+	}, options?.signal);
+	if (raw && typeof raw === "object" && typeof raw.access_token === "string") {
+		const githubAccessToken = raw.access_token;
+		options?.onProgress?.("Fetching Copilot token...");
+		return {
+			status: "complete",
+			credentials: await refreshGitHubCopilotToken(githubAccessToken, pending.enterpriseDomain, options?.signal)
+		};
+	}
+	if (raw && typeof raw === "object" && typeof raw.error === "string") {
+		const { error, error_description: description, interval } = raw;
+		if (error === "slow_down") {
+			const next = {
+				...pending,
+				slowDownCount: pending.slowDownCount + 1,
+				intervalMs: typeof interval === "number" && interval > 0 ? interval * 1e3 : Math.max(1e3, pending.intervalMs + 5e3),
+				intervalMultiplier: SLOW_DOWN_POLL_INTERVAL_MULTIPLIER
+			};
+			return {
+				status: "pending",
+				pending: next,
+				nextPollMs: copilotNextPollDelayMs(next)
+			};
+		}
+		if (error !== "authorization_pending") return {
+			status: "failed",
+			error: `Device flow failed: ${error}${description ? `: ${description}` : ""}`
+		};
+	}
+	return {
+		status: "pending",
+		pending,
+		nextPollMs: copilotNextPollDelayMs(pending)
+	};
+}
+/**
+* Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.
+*
+* `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a
+* fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).
+*/
+async function refreshGitHubCopilotToken(refreshToken, enterpriseDomain, signal) {
+	const raw = await fetchJson(getUrls(enterpriseDomain || "github.com").copilotTokenUrl, { headers: {
+		Accept: "application/json",
+		Authorization: `Bearer ${refreshToken}`,
+		...COPILOT_HEADERS
+	} }, signal);
+	if (!raw || typeof raw !== "object") throw new Error("Invalid Copilot token response");
+	const obj = raw;
+	const token = obj.token;
+	const expiresAt = obj.expires_at;
+	if (typeof token !== "string" || typeof expiresAt !== "number") throw new Error("Invalid Copilot token response fields");
+	const credentials = {
+		refresh: refreshToken,
+		access: token,
+		expires: expiresAt * 1e3 - 300 * 1e3
+	};
+	if (enterpriseDomain) credentials.enterpriseUrl = enterpriseDomain;
+	return credentials;
+}
+/**
+* Login with GitHub Copilot OAuth (device-code flow).
+*
+* Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,
+* then exchanges the GitHub OAuth token for a Copilot bearer token.
+*/
+async function loginGitHubCopilot(options) {
+	const input = await options.onPrompt({
+		message: "GitHub Enterprise URL/domain (blank for github.com)",
+		placeholder: "company.ghe.com",
+		allowEmpty: true
+	});
+	if (options.signal?.aborted) throw new Error("Login cancelled");
+	const trimmed = input.trim();
+	const enterpriseDomain = normalizeDomain(input);
+	if (trimmed && !enterpriseDomain) throw new Error("Invalid GitHub Enterprise URL/domain");
+	let pending = await startGitHubCopilotDeviceLogin(enterpriseDomain ?? void 0, { signal: options.signal });
+	options.onAuth(pending.url, pending.instructions);
+	while (true) {
+		if (options.signal?.aborted) throw new Error("Login cancelled");
+		const remainingMs = Math.max(pending.deadlineAt - Date.now(), 0);
+		await abortableSleep(Math.min(copilotNextPollDelayMs(pending), remainingMs), options.signal);
+		const result = await pollGitHubCopilotDeviceLogin(pending, {
+			signal: options.signal,
+			onProgress: options.onProgress
+		});
+		if (result.status === "complete") return result.credentials;
+		if (result.status === "failed") throw new Error(result.error);
+		pending = result.pending;
+	}
+}
+/**
+* Fetch the Copilot model list available to the current subscription.
+*
+* Hits `${baseURL}/models` with the Copilot bearer token, filters to
+* `model_picker_enabled === true && policy.state !== 'disabled'`, and returns
+* a normalized list. Mirrors opencode's filtering rules.
+*
+* Inspired by:
+*   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts
+*/
+async function fetchCopilotModels(opts) {
+	const url = `${opts.baseUrl.replace(/\/$/, "")}/models`;
+	const response = await fetch(url, {
+		headers: {
+			Accept: "application/json",
+			Authorization: `Bearer ${opts.bearerToken}`,
+			...COPILOT_HEADERS
+		},
+		signal: opts.signal
+	});
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);
+	}
+	const json = await response.json().catch(() => null);
+	if (!json || typeof json !== "object" || !Array.isArray(json.data)) throw new Error("Invalid Copilot models response: missing `data` array");
+	const data = json.data;
+	const result = [];
+	for (const item of data) {
+		if (!item || typeof item !== "object") continue;
+		const obj = item;
+		if (obj.model_picker_enabled !== true) continue;
+		const policy = obj.policy;
+		if (policy && policy.state === "disabled") continue;
+		const id = obj.id;
+		if (typeof id !== "string" || !id) continue;
+		const name = typeof obj.name === "string" ? obj.name : id;
+		const vendor = typeof obj.vendor === "string" ? obj.vendor : "";
+		const supports = obj.capabilities?.supports;
+		const supportsVision = supports?.vision === true;
+		const supportsToolCalls = supports?.tool_calls === true;
+		const rawEndpoints = obj.supported_endpoints;
+		const supportedEndpoints = Array.isArray(rawEndpoints) ? rawEndpoints.filter((e) => typeof e === "string") : [];
+		const isAnthropicShaped = supportedEndpoints.includes("/v1/messages");
+		result.push({
+			id,
+			name,
+			vendor,
+			supportedEndpoints,
+			isAnthropicShaped,
+			supportsVision,
+			supportsToolCalls
+		});
+	}
+	return result;
+}
+const githubCopilotOAuthProvider = {
+	id: "github-copilot",
+	name: "GitHub Copilot",
+	async login(callbacks) {
+		return loginGitHubCopilot({
+			onAuth: (url, instructions) => callbacks.onAuth({
+				url,
+				instructions
+			}),
+			onPrompt: callbacks.onPrompt,
+			onProgress: callbacks.onProgress,
+			signal: callbacks.signal
+		});
+	},
+	async refreshToken(credentials) {
+		const creds = credentials;
+		return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	}
+};
+//#endregion
+export { COPILOT_HEADERS, COPILOT_USER_AGENT, copilotNextPollDelayMs, fetchCopilotModels, getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, pollGitHubCopilotDeviceLogin, refreshGitHubCopilotToken, startGitHubCopilotDeviceLogin };
+
+//# sourceMappingURL=github-copilot.js.map

package/dist/auth/providers/github-copilot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-copilot.js","names":[],"sources":["../../../src/auth/providers/github-copilot.ts"],"sourcesContent":["/**\n * GitHub Copilot OAuth flow\n *\n * Inspired by:\n *   - pi-mono: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/github-copilot.ts\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/copilot.ts\n *\n * Storage layout in AuthStorage:\n *   - `refresh` holds the long-lived GitHub OAuth access token (used to mint Copilot tokens).\n *   - `access`  holds the short-lived Copilot bearer token (~30 minutes).\n *   - `expires` is the Copilot bearer expiry (ms epoch, with a 5-minute safety buffer).\n *   - `enterpriseUrl` is the GitHub Enterprise hostname, or undefined for github.com.\n */\n\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nexport type GitHubCopilotCredentials = OAuthCredentials & {\n  enterpriseUrl?: string;\n};\n\nconst decode = (s: string): string => atob(s);\n// Copilot's public client ID, encoded to mirror the upstream references.\nconst CLIENT_ID = decode('SXYxLmI1MDdhMDhjODdlY2ZlOTg=');\n\nexport const COPILOT_USER_AGENT = 'GitHubCopilotChat/0.35.0';\n\n/** Headers that Copilot endpoints expect from a VS Code-like client. */\nexport const COPILOT_HEADERS = {\n  'User-Agent': COPILOT_USER_AGENT,\n  'Editor-Version': 'vscode/1.107.0',\n  'Editor-Plugin-Version': 'copilot-chat/0.35.0',\n  'Copilot-Integration-Id': 'vscode-chat',\n} as const;\n\nconst INITIAL_POLL_INTERVAL_MULTIPLIER = 1.2;\nconst SLOW_DOWN_POLL_INTERVAL_MULTIPLIER = 1.4;\n\ntype DeviceCodeResponse = {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  interval: number;\n  expires_in: number;\n};\n\ntype DeviceTokenSuccessResponse = {\n  access_token: string;\n  token_type?: string;\n  scope?: string;\n};\n\ntype DeviceTokenErrorResponse = {\n  error: string;\n  error_description?: string;\n  interval?: number;\n};\n\n/**\n * Normalize a user-entered Enterprise URL/domain into a hostname (e.g. `company.ghe.com`).\n * Returns null for an empty input or an unparseable URL.\n */\nexport function normalizeDomain(input: string): string | null {\n  const trimmed = input.trim();\n  if (!trimmed) return null;\n  try {\n    const url = trimmed.includes('://') ? new URL(trimmed) : new URL(`https://${trimmed}`);\n    return url.hostname || null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getUrls(domain: string): {\n  deviceCodeUrl: string;\n  accessTokenUrl: string;\n  copilotTokenUrl: string;\n} {\n  return {\n    deviceCodeUrl: `https://${domain}/login/device/code`,\n    accessTokenUrl: `https://${domain}/login/oauth/access_token`,\n    copilotTokenUrl: `https://api.${domain}/copilot_internal/v2/token`,\n  };\n}\n\n/**\n * Parse the `proxy-ep` segment from a Copilot bearer token and convert to its API base URL.\n * Token shape: `tid=...;exp=...;proxy-ep=proxy.individual.githubcopilot.com;...`\n */\nfunction getBaseUrlFromToken(token: string): string | null {\n  const match = token.match(/proxy-ep=([^;]+)/);\n  if (!match) return null;\n  const proxyHost = match[1]!;\n  const apiHost = proxyHost.replace(/^proxy\\./, 'api.');\n  return `https://${apiHost}`;\n}\n\n/**\n * Resolve the Copilot API base URL.\n * Prefers the `proxy-ep` parsed from the bearer token, then falls back to enterprise/individual defaults.\n */\nexport function getGitHubCopilotBaseUrl(token?: string, enterpriseDomain?: string): string {\n  if (token) {\n    const fromToken = getBaseUrlFromToken(token);\n    if (fromToken) return fromToken;\n  }\n  if (enterpriseDomain) return `https://copilot-api.${enterpriseDomain}`;\n  return 'https://api.individual.githubcopilot.com';\n}\n\nasync function fetchJson(url: string, init: RequestInit, signal?: AbortSignal): Promise<unknown> {\n  const response = await fetch(url, signal ? { ...init, signal } : init);\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`${response.status} ${response.statusText}: ${text}`);\n  }\n  return response.json();\n}\n\nasync function startDeviceFlow(domain: string, signal?: AbortSignal): Promise<DeviceCodeResponse> {\n  const urls = getUrls(domain);\n  const data = await fetchJson(\n    urls.deviceCodeUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        scope: 'read:user',\n      }),\n    },\n    signal,\n  );\n\n  if (!data || typeof data !== 'object') {\n    throw new Error('Invalid device code response');\n  }\n\n  const obj = data as Record<string, unknown>;\n  const deviceCode = obj.device_code;\n  const userCode = obj.user_code;\n  const verificationUri = obj.verification_uri;\n  const interval = obj.interval;\n  const expiresIn = obj.expires_in;\n\n  if (\n    typeof deviceCode !== 'string' ||\n    typeof userCode !== 'string' ||\n    typeof verificationUri !== 'string' ||\n    typeof interval !== 'number' ||\n    typeof expiresIn !== 'number'\n  ) {\n    throw new Error('Invalid device code response fields');\n  }\n\n  return {\n    device_code: deviceCode,\n    user_code: userCode,\n    verification_uri: verificationUri,\n    interval,\n    expires_in: expiresIn,\n  };\n}\n\n/** Sleep that can be interrupted by an AbortSignal. */\nfunction abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new Error('Login cancelled'));\n      return;\n    }\n\n    let timeout: ReturnType<typeof setTimeout>;\n    const onAbort = () => {\n      clearTimeout(timeout);\n      reject(new Error('Login cancelled'));\n    };\n\n    timeout = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * Serializable pending state for a Copilot device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests/replicas.\n */\nexport interface CopilotDeviceLoginPending {\n  /** GitHub host performing the flow (`github.com` or an Enterprise hostname). */\n  domain: string;\n  /** Enterprise hostname, or undefined for github.com. Recorded on the final credentials. */\n  enterpriseDomain?: string;\n  deviceCode: string;\n  userCode: string;\n  /** Verification URL for the user to open. */\n  url: string;\n  instructions: string;\n  /** Current base poll interval in ms (grows on slow_down). */\n  intervalMs: number;\n  /** Safety margin applied to intervalMs when computing the next wait. */\n  intervalMultiplier: number;\n  /** Number of slow_down responses seen (used for the clock-drift hint). */\n  slowDownCount: number;\n  /** ms epoch after which the device authorization expires. */\n  deadlineAt: number;\n}\n\nexport type CopilotDevicePollResult =\n  | { status: 'complete'; credentials: GitHubCopilotCredentials }\n  | { status: 'pending'; pending: CopilotDeviceLoginPending; nextPollMs: number }\n  | { status: 'failed'; error: string };\n\n/** Delay to wait before the next upstream poll for a pending Copilot device login. */\nexport function copilotNextPollDelayMs(pending: CopilotDeviceLoginPending): number {\n  return Math.ceil(pending.intervalMs * pending.intervalMultiplier);\n}\n\n/**\n * Start a Copilot device-code login: request a user code and return the\n * serializable pending state for subsequent polls. Wait `copilotNextPollDelayMs`\n * before the first poll.\n */\nexport async function startGitHubCopilotDeviceLogin(\n  enterpriseDomain?: string,\n  options?: { signal?: AbortSignal },\n): Promise<CopilotDeviceLoginPending> {\n  const domain = enterpriseDomain || 'github.com';\n  const device = await startDeviceFlow(domain, options?.signal);\n\n  return {\n    domain,\n    ...(enterpriseDomain ? { enterpriseDomain } : {}),\n    deviceCode: device.device_code,\n    userCode: device.user_code,\n    url: device.verification_uri,\n    instructions: `Enter code: ${device.user_code}`,\n    intervalMs: Math.max(1000, Math.floor(device.interval * 1000)),\n    intervalMultiplier: INITIAL_POLL_INTERVAL_MULTIPLIER,\n    slowDownCount: 0,\n    deadlineAt: Date.now() + device.expires_in * 1000,\n  };\n}\n\n/**\n * Perform exactly one upstream poll for a pending Copilot device login.\n * On success, exchanges the GitHub OAuth token for a Copilot bearer token and\n * returns full credentials. Never throws for flow-level conditions; network\n * errors from fetch still propagate.\n */\nexport async function pollGitHubCopilotDeviceLogin(\n  pending: CopilotDeviceLoginPending,\n  options?: { signal?: AbortSignal; onProgress?: (message: string) => void },\n): Promise<CopilotDevicePollResult> {\n  if (Date.now() >= pending.deadlineAt) {\n    if (pending.slowDownCount > 0) {\n      return {\n        status: 'failed',\n        error:\n          'Device flow timed out after one or more slow_down responses. This is often caused by clock drift in WSL or VM environments. Please sync or restart the VM clock and try again.',\n      };\n    }\n    return { status: 'failed', error: 'Device flow timed out' };\n  }\n\n  const urls = getUrls(pending.domain);\n  const raw = await fetchJson(\n    urls.accessTokenUrl,\n    {\n      method: 'POST',\n      headers: {\n        Accept: 'application/json',\n        'Content-Type': 'application/x-www-form-urlencoded',\n        'User-Agent': COPILOT_USER_AGENT,\n      },\n      body: new URLSearchParams({\n        client_id: CLIENT_ID,\n        device_code: pending.deviceCode,\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n      }),\n    },\n    options?.signal,\n  );\n\n  if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenSuccessResponse).access_token === 'string') {\n    const githubAccessToken = (raw as DeviceTokenSuccessResponse).access_token;\n    options?.onProgress?.('Fetching Copilot token...');\n    const credentials = await refreshGitHubCopilotToken(githubAccessToken, pending.enterpriseDomain, options?.signal);\n    return { status: 'complete', credentials };\n  }\n\n  if (raw && typeof raw === 'object' && typeof (raw as DeviceTokenErrorResponse).error === 'string') {\n    const { error, error_description: description, interval } = raw as DeviceTokenErrorResponse;\n\n    if (error === 'slow_down') {\n      const next: CopilotDeviceLoginPending = {\n        ...pending,\n        slowDownCount: pending.slowDownCount + 1,\n        intervalMs:\n          typeof interval === 'number' && interval > 0 ? interval * 1000 : Math.max(1000, pending.intervalMs + 5000),\n        intervalMultiplier: SLOW_DOWN_POLL_INTERVAL_MULTIPLIER,\n      };\n      return { status: 'pending', pending: next, nextPollMs: copilotNextPollDelayMs(next) };\n    }\n\n    if (error !== 'authorization_pending') {\n      const descriptionSuffix = description ? `: ${description}` : '';\n      return { status: 'failed', error: `Device flow failed: ${error}${descriptionSuffix}` };\n    }\n  }\n\n  // authorization_pending or an unrecognized-but-OK response: keep polling.\n  return { status: 'pending', pending, nextPollMs: copilotNextPollDelayMs(pending) };\n}\n\n/**\n * Refresh the short-lived Copilot bearer token using the long-lived GitHub OAuth token.\n *\n * `refreshToken` here is the GitHub OAuth access token; the Copilot endpoint returns a\n * fresh bearer token (`token`) and absolute expiry (`expires_at`, seconds since epoch).\n */\nexport async function refreshGitHubCopilotToken(\n  refreshToken: string,\n  enterpriseDomain?: string,\n  signal?: AbortSignal,\n): Promise<GitHubCopilotCredentials> {\n  const domain = enterpriseDomain || 'github.com';\n  const urls = getUrls(domain);\n\n  const raw = await fetchJson(\n    urls.copilotTokenUrl,\n    {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `Bearer ${refreshToken}`,\n        ...COPILOT_HEADERS,\n      },\n    },\n    signal,\n  );\n\n  if (!raw || typeof raw !== 'object') {\n    throw new Error('Invalid Copilot token response');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const token = obj.token;\n  const expiresAt = obj.expires_at;\n\n  if (typeof token !== 'string' || typeof expiresAt !== 'number') {\n    throw new Error('Invalid Copilot token response fields');\n  }\n\n  const credentials: GitHubCopilotCredentials = {\n    refresh: refreshToken,\n    access: token,\n    // expires_at is seconds; subtract 5 minutes so we refresh before actual expiry.\n    expires: expiresAt * 1000 - 5 * 60 * 1000,\n  };\n  if (enterpriseDomain) {\n    credentials.enterpriseUrl = enterpriseDomain;\n  }\n  return credentials;\n}\n\n/**\n * Login with GitHub Copilot OAuth (device-code flow).\n *\n * Prompts for an optional GitHub Enterprise URL/domain, performs the device-code flow,\n * then exchanges the GitHub OAuth token for a Copilot bearer token.\n */\nexport async function loginGitHubCopilot(options: {\n  onAuth: (url: string, instructions?: string) => void;\n  onPrompt: (prompt: { message: string; placeholder?: string; allowEmpty?: boolean }) => Promise<string>;\n  onProgress?: (message: string) => void;\n  signal?: AbortSignal;\n}): Promise<GitHubCopilotCredentials> {\n  const input = await options.onPrompt({\n    message: 'GitHub Enterprise URL/domain (blank for github.com)',\n    placeholder: 'company.ghe.com',\n    allowEmpty: true,\n  });\n\n  if (options.signal?.aborted) {\n    throw new Error('Login cancelled');\n  }\n\n  const trimmed = input.trim();\n  const enterpriseDomain = normalizeDomain(input);\n  if (trimmed && !enterpriseDomain) {\n    throw new Error('Invalid GitHub Enterprise URL/domain');\n  }\n  let pending = await startGitHubCopilotDeviceLogin(enterpriseDomain ?? undefined, { signal: options.signal });\n  options.onAuth(pending.url, pending.instructions);\n\n  while (true) {\n    if (options.signal?.aborted) {\n      throw new Error('Login cancelled');\n    }\n\n    // Wait before polling (safety margin over the server interval), clamped to the deadline.\n    const remainingMs = Math.max(pending.deadlineAt - Date.now(), 0);\n    await abortableSleep(Math.min(copilotNextPollDelayMs(pending), remainingMs), options.signal);\n\n    const result = await pollGitHubCopilotDeviceLogin(pending, {\n      signal: options.signal,\n      onProgress: options.onProgress,\n    });\n    if (result.status === 'complete') {\n      return result.credentials;\n    }\n    if (result.status === 'failed') {\n      throw new Error(result.error);\n    }\n    pending = result.pending;\n  }\n}\n\n/**\n * Filtered, normalized entry from the Copilot `/models` API.\n *\n * The full API payload includes a lot of capability metadata; we only keep the bits\n * we need to expose models in `listAvailableModels()` and route requests sensibly.\n */\nexport type CopilotModelEntry = {\n  /** Stable model id (e.g. `claude-sonnet-4.5`, `gpt-4.1`). */\n  id: string;\n  /** Human-readable display name (e.g. `Claude Sonnet 4.5`). */\n  name: string;\n  /** Vendor field from the API (e.g. `Anthropic`, `OpenAI`). */\n  vendor: string;\n  /**\n   * Endpoints the model exposes (e.g. `/chat/completions`, `/responses`, `/v1/messages`).\n   * Empty when the API didn't return `supported_endpoints` for this entry.\n   */\n  supportedEndpoints: string[];\n  /** True when `supported_endpoints` includes `/v1/messages` (Anthropic-shaped Copilot model). */\n  isAnthropicShaped: boolean;\n  /** True when `capabilities.supports.vision` is true. */\n  supportsVision: boolean;\n  /** True when the model supports tool calling. */\n  supportsToolCalls: boolean;\n};\n\n/**\n * Fetch the Copilot model list available to the current subscription.\n *\n * Hits `${baseURL}/models` with the Copilot bearer token, filters to\n * `model_picker_enabled === true && policy.state !== 'disabled'`, and returns\n * a normalized list. Mirrors opencode's filtering rules.\n *\n * Inspired by:\n *   - opencode: https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/plugin/github-copilot/models.ts\n */\nexport async function fetchCopilotModels(opts: {\n  baseUrl: string;\n  bearerToken: string;\n  signal?: AbortSignal;\n}): Promise<CopilotModelEntry[]> {\n  const url = `${opts.baseUrl.replace(/\\/$/, '')}/models`;\n  const response = await fetch(url, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `Bearer ${opts.bearerToken}`,\n      ...COPILOT_HEADERS,\n    },\n    signal: opts.signal,\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`Failed to fetch Copilot models: ${response.status} ${response.statusText}: ${text}`);\n  }\n\n  const json = await response.json().catch(() => null);\n  if (!json || typeof json !== 'object' || !Array.isArray((json as { data?: unknown }).data)) {\n    throw new Error('Invalid Copilot models response: missing `data` array');\n  }\n\n  const data = (json as { data: unknown[] }).data;\n  const result: CopilotModelEntry[] = [];\n\n  for (const item of data) {\n    if (!item || typeof item !== 'object') continue;\n    const obj = item as Record<string, unknown>;\n\n    if (obj.model_picker_enabled !== true) continue;\n\n    const policy = obj.policy as Record<string, unknown> | undefined;\n    if (policy && policy.state === 'disabled') continue;\n\n    const id = obj.id;\n    if (typeof id !== 'string' || !id) continue;\n\n    const name = typeof obj.name === 'string' ? obj.name : id;\n    const vendor = typeof obj.vendor === 'string' ? obj.vendor : '';\n\n    const capabilities = obj.capabilities as Record<string, unknown> | undefined;\n    const supports = capabilities?.supports as Record<string, unknown> | undefined;\n    const supportsVision = supports?.vision === true;\n    const supportsToolCalls = supports?.tool_calls === true;\n\n    const rawEndpoints = obj.supported_endpoints;\n    const supportedEndpoints = Array.isArray(rawEndpoints)\n      ? rawEndpoints.filter((e): e is string => typeof e === 'string')\n      : [];\n    const isAnthropicShaped = supportedEndpoints.includes('/v1/messages');\n\n    result.push({\n      id,\n      name,\n      vendor,\n      supportedEndpoints,\n      isAnthropicShaped,\n      supportsVision,\n      supportsToolCalls,\n    });\n  }\n\n  return result;\n}\n\nexport const githubCopilotOAuthProvider: OAuthProviderInterface = {\n  id: 'github-copilot',\n  name: 'GitHub Copilot',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginGitHubCopilot({\n      onAuth: (url, instructions) => callbacks.onAuth({ url, instructions }),\n      onPrompt: callbacks.onPrompt,\n      onProgress: callbacks.onProgress,\n      signal: callbacks.signal,\n    });\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    const creds = credentials as GitHubCopilotCredentials;\n    return refreshGitHubCopilotToken(creds.refresh, creds.enterpriseUrl);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";AAoBA,MAAM,UAAU,MAAsB,KAAK,CAAC;AAE5C,MAAM,YAAY,OAAO,8BAA8B;AAEvD,MAAa,qBAAqB;;AAGlC,MAAa,kBAAkB;CAC7B,cAAc;CACd,kBAAkB;CAClB,yBAAyB;CACzB,0BAA0B;AAC5B;AAEA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;;;;;AA0B3C,SAAgB,gBAAgB,OAA8B;CAC5D,MAAM,UAAU,MAAM,KAAK;CAC3B,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI;EAEF,QADY,QAAQ,SAAS,KAAK,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,SAAS,EAAA,CAC1E,YAAY;CACzB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,QAAQ,QAIf;CACA,OAAO;EACL,eAAe,WAAW,OAAO;EACjC,gBAAgB,WAAW,OAAO;EAClC,iBAAiB,eAAe,OAAO;CACzC;AACF;;;;;AAMA,SAAS,oBAAoB,OAA8B;CACzD,MAAM,QAAQ,MAAM,MAAM,kBAAkB;CAC5C,IAAI,CAAC,OAAO,OAAO;CAGnB,OAAO,WAFW,MAAM,EACC,CAAC,QAAQ,YAAY,MACtB;AAC1B;;;;;AAMA,SAAgB,wBAAwB,OAAgB,kBAAmC;CACzF,IAAI,OAAO;EACT,MAAM,YAAY,oBAAoB,KAAK;EAC3C,IAAI,WAAW,OAAO;CACxB;CACA,IAAI,kBAAkB,OAAO,uBAAuB;CACpD,OAAO;AACT;AAEA,eAAe,UAAU,KAAa,MAAmB,QAAwC;CAC/F,MAAM,WAAW,MAAM,MAAM,KAAK,SAAS;EAAE,GAAG;EAAM;CAAO,IAAI,IAAI;CACrE,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,GAAG,SAAS,OAAO,GAAG,SAAS,WAAW,IAAI,MAAM;CACtE;CACA,OAAO,SAAS,KAAK;AACvB;AAEA,eAAe,gBAAgB,QAAgB,QAAmD;CAEhG,MAAM,OAAO,MAAM,UADN,QAAQ,MAEhB,CAAC,CAAC,eACL;EACE,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,IAAI,gBAAgB;GACxB,WAAW;GACX,OAAO;EACT,CAAC;CACH,GACA,MACF;CAEA,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,MAAM,IAAI,MAAM,8BAA8B;CAGhD,MAAM,MAAM;CACZ,MAAM,aAAa,IAAI;CACvB,MAAM,WAAW,IAAI;CACrB,MAAM,kBAAkB,IAAI;CAC5B,MAAM,WAAW,IAAI;CACrB,MAAM,YAAY,IAAI;CAEtB,IACE,OAAO,eAAe,YACtB,OAAO,aAAa,YACpB,OAAO,oBAAoB,YAC3B,OAAO,aAAa,YACpB,OAAO,cAAc,UAErB,MAAM,IAAI,MAAM,qCAAqC;CAGvD,OAAO;EACL,aAAa;EACb,WAAW;EACX,kBAAkB;EAClB;EACA,YAAY;CACd;AACF;;AAGA,SAAS,eAAe,IAAY,QAAqC;CACvE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,QAAQ,SAAS;GACnB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;GACnC;EACF;EAEA,IAAI;EACJ,MAAM,gBAAgB;GACpB,aAAa,OAAO;GACpB,uBAAO,IAAI,MAAM,iBAAiB,CAAC;EACrC;EAEA,UAAU,iBAAiB;GACzB,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EAEL,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;;AAgCA,SAAgB,uBAAuB,SAA4C;CACjF,OAAO,KAAK,KAAK,QAAQ,aAAa,QAAQ,kBAAkB;AAClE;;;;;;AAOA,eAAsB,8BACpB,kBACA,SACoC;CACpC,MAAM,SAAS,oBAAoB;CACnC,MAAM,SAAS,MAAM,gBAAgB,QAAQ,SAAS,MAAM;CAE5D,OAAO;EACL;EACA,GAAI,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;EAC/C,YAAY,OAAO;EACnB,UAAU,OAAO;EACjB,KAAK,OAAO;EACZ,cAAc,eAAe,OAAO;EACpC,YAAY,KAAK,IAAI,KAAM,KAAK,MAAM,OAAO,WAAW,GAAI,CAAC;EAC7D,oBAAoB;EACpB,eAAe;EACf,YAAY,KAAK,IAAI,IAAI,OAAO,aAAa;CAC/C;AACF;;;;;;;AAQA,eAAsB,6BACpB,SACA,SACkC;CAClC,IAAI,KAAK,IAAI,KAAK,QAAQ,YAAY;EACpC,IAAI,QAAQ,gBAAgB,GAC1B,OAAO;GACL,QAAQ;GACR,OACE;EACJ;EAEF,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAwB;CAC5D;CAGA,MAAM,MAAM,MAAM,UADL,QAAQ,QAAQ,MAExB,CAAC,CAAC,gBACL;EACE,QAAQ;EACR,SAAS;GACP,QAAQ;GACR,gBAAgB;GAChB,cAAc;EAChB;EACA,MAAM,IAAI,gBAAgB;GACxB,WAAW;GACX,aAAa,QAAQ;GACrB,YAAY;EACd,CAAC;CACH,GACA,SAAS,MACX;CAEA,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAmC,iBAAiB,UAAU;EAC1G,MAAM,oBAAqB,IAAmC;EAC9D,SAAS,aAAa,2BAA2B;EAEjD,OAAO;GAAE,QAAQ;GAAY,aAAA,MADH,0BAA0B,mBAAmB,QAAQ,kBAAkB,SAAS,MAAM;EACvE;CAC3C;CAEA,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAQ,IAAiC,UAAU,UAAU;EACjG,MAAM,EAAE,OAAO,mBAAmB,aAAa,aAAa;EAE5D,IAAI,UAAU,aAAa;GACzB,MAAM,OAAkC;IACtC,GAAG;IACH,eAAe,QAAQ,gBAAgB;IACvC,YACE,OAAO,aAAa,YAAY,WAAW,IAAI,WAAW,MAAO,KAAK,IAAI,KAAM,QAAQ,aAAa,GAAI;IAC3G,oBAAoB;GACtB;GACA,OAAO;IAAE,QAAQ;IAAW,SAAS;IAAM,YAAY,uBAAuB,IAAI;GAAE;EACtF;EAEA,IAAI,UAAU,yBAEZ,OAAO;GAAE,QAAQ;GAAU,OAAO,uBAAuB,QAD/B,cAAc,KAAK,gBAAgB;EACwB;CAEzF;CAGA,OAAO;EAAE,QAAQ;EAAW;EAAS,YAAY,uBAAuB,OAAO;CAAE;AACnF;;;;;;;AAQA,eAAsB,0BACpB,cACA,kBACA,QACmC;CAInC,MAAM,MAAM,MAAM,UAFL,QADE,oBAAoB,YAI9B,CAAC,CAAC,iBACL,EACE,SAAS;EACP,QAAQ;EACR,eAAe,UAAU;EACzB,GAAG;CACL,EACF,GACA,MACF;CAEA,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,MAAM,IAAI,MAAM,gCAAgC;CAGlD,MAAM,MAAM;CACZ,MAAM,QAAQ,IAAI;CAClB,MAAM,YAAY,IAAI;CAEtB,IAAI,OAAO,UAAU,YAAY,OAAO,cAAc,UACpD,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,cAAwC;EAC5C,SAAS;EACT,QAAQ;EAER,SAAS,YAAY,MAAO,MAAS;CACvC;CACA,IAAI,kBACF,YAAY,gBAAgB;CAE9B,OAAO;AACT;;;;;;;AAQA,eAAsB,mBAAmB,SAKH;CACpC,MAAM,QAAQ,MAAM,QAAQ,SAAS;EACnC,SAAS;EACT,aAAa;EACb,YAAY;CACd,CAAC;CAED,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;CAGnC,MAAM,UAAU,MAAM,KAAK;CAC3B,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,IAAI,WAAW,CAAC,kBACd,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,UAAU,MAAM,8BAA8B,oBAAoB,KAAA,GAAW,EAAE,QAAQ,QAAQ,OAAO,CAAC;CAC3G,QAAQ,OAAO,QAAQ,KAAK,QAAQ,YAAY;CAEhD,OAAO,MAAM;EACX,IAAI,QAAQ,QAAQ,SAClB,MAAM,IAAI,MAAM,iBAAiB;EAInC,MAAM,cAAc,KAAK,IAAI,QAAQ,aAAa,KAAK,IAAI,GAAG,CAAC;EAC/D,MAAM,eAAe,KAAK,IAAI,uBAAuB,OAAO,GAAG,WAAW,GAAG,QAAQ,MAAM;EAE3F,MAAM,SAAS,MAAM,6BAA6B,SAAS;GACzD,QAAQ,QAAQ;GAChB,YAAY,QAAQ;EACtB,CAAC;EACD,IAAI,OAAO,WAAW,YACpB,OAAO,OAAO;EAEhB,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,MAAM,OAAO,KAAK;EAE9B,UAAU,OAAO;CACnB;AACF;;;;;;;;;;;AAsCA,eAAsB,mBAAmB,MAIR;CAC/B,MAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,EAAE;CAC/C,MAAM,WAAW,MAAM,MAAM,KAAK;EAChC,SAAS;GACP,QAAQ;GACR,eAAe,UAAU,KAAK;GAC9B,GAAG;EACL;EACA,QAAQ,KAAK;CACf,CAAC;CAED,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,mCAAmC,SAAS,OAAO,GAAG,SAAS,WAAW,IAAI,MAAM;CACtG;CAEA,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;CACnD,IAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAS,KAA4B,IAAI,GACvF,MAAM,IAAI,MAAM,uDAAuD;CAGzE,MAAM,OAAQ,KAA6B;CAC3C,MAAM,SAA8B,CAAC;CAErC,KAAK,MAAM,QAAQ,MAAM;EACvB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;EACvC,MAAM,MAAM;EAEZ,IAAI,IAAI,yBAAyB,MAAM;EAEvC,MAAM,SAAS,IAAI;EACnB,IAAI,UAAU,OAAO,UAAU,YAAY;EAE3C,MAAM,KAAK,IAAI;EACf,IAAI,OAAO,OAAO,YAAY,CAAC,IAAI;EAEnC,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO;EACvD,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;EAG7D,MAAM,WADe,IAAI,cACM;EAC/B,MAAM,iBAAiB,UAAU,WAAW;EAC5C,MAAM,oBAAoB,UAAU,eAAe;EAEnD,MAAM,eAAe,IAAI;EACzB,MAAM,qBAAqB,MAAM,QAAQ,YAAY,IACjD,aAAa,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAC7D,CAAC;EACL,MAAM,oBAAoB,mBAAmB,SAAS,cAAc;EAEpE,OAAO,KAAK;GACV;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH;CAEA,OAAO;AACT;AAEA,MAAa,6BAAqD;CAChE,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,mBAAmB;GACxB,SAAS,KAAK,iBAAiB,UAAU,OAAO;IAAE;IAAK;GAAa,CAAC;GACrE,UAAU,UAAU;GACpB,YAAY,UAAU;GACtB,QAAQ,UAAU;EACpB,CAAC;CACH;CAEA,MAAM,aAAa,aAA0D;EAC3E,MAAM,QAAQ;EACd,OAAO,0BAA0B,MAAM,SAAS,MAAM,aAAa;CACrE;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}

package/dist/auth/providers/kimi-coding.d.ts

@@ -0,0 +1,38 @@
+import type { DeviceCodePollState } from '../device-code.js';
+import type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';
+export declare function createKimiCodingDeviceId(): string;
+export declare function isKimiCodingDeviceId(value: unknown): value is string;
+export declare function getKimiCodingDeviceHeaders(deviceId: string): Record<string, string>;
+export interface KimiCodingDeviceLoginPending {
+    clientId: string;
+    deviceId: string;
+    deviceCode: string;
+    userCode: string;
+    url: string;
+    instructions: string;
+    state: DeviceCodePollState;
+}
+export type KimiCodingDevicePollResult = {
+    status: 'complete';
+    credentials: OAuthCredentials;
+} | {
+    status: 'pending';
+    nextPollMs: number;
+    pending: KimiCodingDeviceLoginPending;
+} | {
+    status: 'failed';
+    error: string;
+};
+export declare function startKimiCodingDeviceLogin(options?: {
+    signal?: AbortSignal;
+}): Promise<KimiCodingDeviceLoginPending>;
+export declare function pollKimiCodingDeviceLogin(pending: KimiCodingDeviceLoginPending, options?: {
+    signal?: AbortSignal;
+}): Promise<KimiCodingDevicePollResult>;
+export declare function loginKimiCoding(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshKimiCodingToken(refreshToken: string, options: {
+    signal?: AbortSignal;
+    deviceId: string;
+}): Promise<OAuthCredentials>;
+export declare const kimiCodingOAuthProvider: OAuthProviderInterface;
+//# sourceMappingURL=kimi-coding.d.ts.map

package/dist/auth/providers/kimi-coding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-coding.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/kimi-coding.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAyB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAuBjG,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKnF;AA6CD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,gBAAgB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,4BAA4B,CAAA;CAAE,GAChF;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE;IACzD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAsDxC;AAgDD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACjC,OAAO,CAAC,0BAA0B,CAAC,CASrC;AAED,wBAAsB,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS/F;AAED,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC,gBAAgB,CAAC,CAoC3B;AAED,eAAO,MAAM,uBAAuB,EAAE,sBASrC,CAAC"}

package/dist/auth/providers/kimi-coding.js

@@ -0,0 +1,232 @@
+import { getCurrentVersion } from "../../utils/update-check.js";
+import { abortableSleep, createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from "../device-code.js";
+import { randomUUID } from "crypto";
+import { arch, hostname, platform, release } from "os";
+//#region src/auth/providers/kimi-coding.ts
+const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+const OAUTH_HOST = "https://auth.kimi.com";
+const DEVICE_ID_PATTERN = /^[0-9a-f]{32}$/;
+const DEFAULT_EXPIRES_IN_SECONDS = 900;
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const REQUEST_TIMEOUT_MS = 3e4;
+const REFRESH_MAX_RETRIES = 3;
+function asciiHeaderValue(value) {
+	return value.replace(/[^\x20-\x7E]/g, "").trim() || "unknown";
+}
+const KIMI_DEVICE_DETAILS = {
+	"X-Msh-Platform": "mastracode",
+	"X-Msh-Version": asciiHeaderValue(getCurrentVersion()),
+	"X-Msh-Device-Name": asciiHeaderValue(hostname()),
+	"X-Msh-Device-Model": asciiHeaderValue(`${platform()} ${arch()}`),
+	"X-Msh-Os-Version": asciiHeaderValue(release())
+};
+function createKimiCodingDeviceId() {
+	return randomUUID().replaceAll("-", "");
+}
+function isKimiCodingDeviceId(value) {
+	return typeof value === "string" && DEVICE_ID_PATTERN.test(value);
+}
+function getKimiCodingDeviceHeaders(deviceId) {
+	if (!isKimiCodingDeviceId(deviceId)) throw new Error("Kimi For Coding credentials have an invalid device ID. Please reconnect the account.");
+	return {
+		...KIMI_DEVICE_DETAILS,
+		"X-Msh-Device-Id": deviceId
+	};
+}
+function requestSignal(signal) {
+	const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	return signal ? AbortSignal.any([timeout, signal]) : timeout;
+}
+function trustedHttpUrl(value) {
+	if (typeof value !== "string" || !value) return null;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" ? url.href : null;
+	} catch {
+		return null;
+	}
+}
+async function readJson(response) {
+	try {
+		const value = await response.json();
+		return value && typeof value === "object" ? value : null;
+	} catch {
+		return null;
+	}
+}
+function credentialsFromTokenResponse(value, operation, deviceId) {
+	const data = value ?? {};
+	const access = data.access_token;
+	const refresh = data.refresh_token;
+	const expiresIn = data.expires_in;
+	if (typeof access !== "string" || !access || typeof refresh !== "string" || !refresh || typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) throw new Error(`Kimi For Coding token ${operation} response missing fields`);
+	return {
+		access,
+		refresh,
+		expires: Date.now() + expiresIn * 1e3,
+		deviceId
+	};
+}
+async function startKimiCodingDeviceLogin(options) {
+	const clientId = CLIENT_ID;
+	const deviceId = createKimiCodingDeviceId();
+	const response = await fetch(`${OAUTH_HOST}/api/oauth/device_authorization`, {
+		method: "POST",
+		headers: {
+			...getKimiCodingDeviceHeaders(deviceId),
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json"
+		},
+		body: new URLSearchParams({ client_id: clientId }).toString(),
+		signal: requestSignal(options?.signal)
+	});
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`Kimi For Coding device authorization failed: ${response.status}${text ? ` ${text}` : ""}`);
+	}
+	const data = await readJson(response);
+	const deviceCode = data?.device_code;
+	const userCode = data?.user_code;
+	const verificationUri = trustedHttpUrl(data?.verification_uri);
+	const verificationUriComplete = trustedHttpUrl(data?.verification_uri_complete);
+	if (typeof deviceCode !== "string" || !deviceCode || typeof userCode !== "string" || !userCode || !verificationUri || !verificationUriComplete) throw new Error("Invalid Kimi For Coding device authorization response");
+	const interval = data?.interval;
+	const expiresIn = data?.expires_in;
+	return {
+		clientId,
+		deviceId,
+		deviceCode,
+		userCode,
+		url: verificationUriComplete,
+		instructions: `Enter code: ${userCode}`,
+		state: createDeviceCodePollState({
+			intervalSeconds: typeof interval === "number" && Number.isFinite(interval) && interval > 0 ? interval : DEFAULT_POLL_INTERVAL_SECONDS,
+			expiresInSeconds: typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : DEFAULT_EXPIRES_IN_SECONDS
+		})
+	};
+}
+async function pollKimiCodingTokenOnce(pending, signal) {
+	const response = await fetch(`${OAUTH_HOST}/api/oauth/token`, {
+		method: "POST",
+		headers: {
+			...getKimiCodingDeviceHeaders(pending.deviceId),
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json"
+		},
+		body: new URLSearchParams({
+			client_id: pending.clientId,
+			device_code: pending.deviceCode,
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+		}).toString(),
+		signal: requestSignal(signal)
+	});
+	const data = await readJson(response);
+	if (response.ok && typeof data?.access_token === "string") try {
+		return {
+			status: "complete",
+			result: credentialsFromTokenResponse(data, "poll", pending.deviceId)
+		};
+	} catch (error) {
+		return {
+			status: "failed",
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const error = data?.error;
+	if (error === "authorization_pending") return { status: "pending" };
+	if (error === "slow_down") return {
+		status: "slow_down",
+		intervalSeconds: typeof data?.interval === "number" && data.interval > 0 ? data.interval : void 0
+	};
+	if (error === "expired_token") return {
+		status: "failed",
+		error: "Kimi For Coding authorization expired. Please restart login."
+	};
+	if (error === "access_denied") return {
+		status: "failed",
+		error: "Kimi For Coding login was denied."
+	};
+	const description = typeof data?.error_description === "string" ? `: ${data.error_description}` : "";
+	return {
+		status: "failed",
+		error: `Kimi For Coding token request failed: ${response.status}${typeof error === "string" ? ` ${error}${description}` : ""}`
+	};
+}
+async function pollKimiCodingDeviceLogin(pending, options) {
+	const step = await stepDeviceCodePoll(pending.state, () => pollKimiCodingTokenOnce(pending, options?.signal));
+	if (step.status === "complete") return {
+		status: "complete",
+		credentials: step.result
+	};
+	if (step.status === "failed") return {
+		status: "failed",
+		error: step.error
+	};
+	return {
+		status: "pending",
+		nextPollMs: step.nextPollMs,
+		pending: {
+			...pending,
+			state: step.state
+		}
+	};
+}
+async function loginKimiCoding(callbacks) {
+	const pending = await startKimiCodingDeviceLogin({ signal: callbacks.signal });
+	callbacks.onAuth({
+		url: pending.url,
+		instructions: pending.instructions
+	});
+	callbacks.onProgress?.("Waiting for Kimi For Coding device authorization...");
+	return pollDeviceCodeUntilComplete({
+		state: pending.state,
+		pollOnce: () => pollKimiCodingTokenOnce(pending, callbacks.signal),
+		signal: callbacks.signal
+	});
+}
+async function refreshKimiCodingToken(refreshToken, options) {
+	const clientId = CLIENT_ID;
+	const deviceHeaders = getKimiCodingDeviceHeaders(options.deviceId);
+	let lastError;
+	for (let attempt = 0; attempt <= REFRESH_MAX_RETRIES; attempt++) {
+		if (attempt > 0) await abortableSleep(1e3 * 2 ** (attempt - 1), options.signal);
+		let response;
+		try {
+			response = await fetch(`${OAUTH_HOST}/api/oauth/token`, {
+				method: "POST",
+				headers: {
+					...deviceHeaders,
+					"Content-Type": "application/x-www-form-urlencoded",
+					Accept: "application/json"
+				},
+				body: new URLSearchParams({
+					client_id: clientId,
+					grant_type: "refresh_token",
+					refresh_token: refreshToken
+				}).toString(),
+				signal: requestSignal(options.signal)
+			});
+		} catch (error) {
+			lastError = error instanceof Error ? error : new Error(String(error));
+			if (attempt === REFRESH_MAX_RETRIES) throw lastError;
+			continue;
+		}
+		const data = await readJson(response);
+		if (response.ok) return credentialsFromTokenResponse(data, "refresh", options.deviceId);
+		const error = typeof data?.error === "string" ? ` ${data.error}` : "";
+		lastError = /* @__PURE__ */ new Error(`Kimi For Coding token refresh failed: ${response.status}${error}`);
+		if (!(response.status === 429 || response.status >= 500) || attempt === REFRESH_MAX_RETRIES) throw lastError;
+	}
+	throw lastError ?? /* @__PURE__ */ new Error("Kimi For Coding token refresh failed");
+}
+const kimiCodingOAuthProvider = {
+	id: "kimi-for-coding",
+	name: "Kimi For Coding",
+	login: loginKimiCoding,
+	refreshToken: (credentials) => refreshKimiCodingToken(credentials.refresh, { deviceId: typeof credentials.deviceId === "string" ? credentials.deviceId : "" }),
+	getApiKey: (credentials) => credentials.access
+};
+//#endregion
+export { createKimiCodingDeviceId, getKimiCodingDeviceHeaders, isKimiCodingDeviceId, kimiCodingOAuthProvider, loginKimiCoding, pollKimiCodingDeviceLogin, refreshKimiCodingToken, startKimiCodingDeviceLogin };
+
+//# sourceMappingURL=kimi-coding.js.map