@omnicross/subscriptions 0.1.0 → 0.1.3

package/dist/chunk-IXGHVMZB.js

@@ -0,0 +1,365 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/oauth/flows/claude.ts
+var claude_exports = {};
+__export(claude_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens,
+  exchangeSetupTokenCode: () => exchangeSetupTokenCode,
+  generateAuthParams: () => generateAuthParams,
+  generateSetupTokenParams: () => generateSetupTokenParams,
+  refreshAccessToken: () => refreshAccessToken
+});
+import crypto from "crypto";
+
+// src/oauth/fetchPort.ts
+function errorMessage(error, errorDescription) {
+  if (errorDescription) return errorDescription;
+  if (typeof error === "string") return error;
+  if (error && typeof error === "object") {
+    const e = error;
+    if (typeof e.message === "string" && e.message) return e.message;
+    if (typeof e.error_description === "string" && e.error_description) {
+      return e.error_description;
+    }
+    return JSON.stringify(error);
+  }
+  return String(error);
+}
+async function postForm(fetchImpl, url, params, parseErrorMessage) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  });
+  const responseData = await response.text();
+  let data;
+  try {
+    data = JSON.parse(responseData);
+  } catch {
+    throw new Error(parseErrorMessage);
+  }
+  if (data.error) {
+    throw new Error(errorMessage(data.error, data.error_description));
+  }
+  return data;
+}
+async function postJson(fetchImpl, url, body, parseErrorMessage, extraHeaders = {}) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...extraHeaders },
+    body: JSON.stringify(body)
+  });
+  const responseData = await response.text();
+  let data;
+  try {
+    data = JSON.parse(responseData);
+  } catch {
+    throw new Error(parseErrorMessage);
+  }
+  if (data.error) {
+    throw new Error(errorMessage(data.error, data.error_description));
+  }
+  return data;
+}
+
+// src/oauth/flows/claude.ts
+var CLAUDE_TOKEN_HEADERS = {
+  "User-Agent": "claude-cli/1.0.56 (external, cli)",
+  Accept: "application/json, text/plain, */*",
+  "Accept-Language": "en-US,en;q=0.9",
+  Referer: "https://claude.ai/",
+  Origin: "https://claude.ai"
+};
+var CLAUDE_OAUTH_CONFIG = {
+  clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+  authorizationEndpoint: "https://claude.ai/oauth/authorize",
+  // The token endpoint moved to platform.claude.com alongside the OAuth
+  // callback (the old console.anthropic.com/v1/oauth/token now returns
+  // Anthropic's standard 404 `{"error":{"type":"not_found_error","message":
+  // "Not found"}}` — observed 2026-06). The redirect_uri MUST match what the
+  // client is registered for AND match between authorize + token exchange.
+  // Scopes mirror the live Claude Code authorize URL.
+  tokenEndpoint: "https://platform.claude.com/v1/oauth/token",
+  redirectUri: "https://platform.claude.com/oauth/code/callback",
+  scopes: [
+    "org:create_api_key",
+    "user:profile",
+    "user:inference",
+    "user:sessions:claude_code",
+    "user:mcp_servers",
+    "user:file_upload"
+  ]
+};
+var SETUP_TOKEN_CONFIG = {
+  scopes: ["user:inference"]
+  // Only inference permission, no API key creation
+};
+function generatePkce() {
+  const codeVerifier = crypto.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto.randomBytes(16).toString("hex");
+  return { codeVerifier, codeChallenge, state };
+}
+function generateAuthParams() {
+  const { codeVerifier, codeChallenge, state } = generatePkce();
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CONFIG.clientId,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+    scope: CLAUDE_OAUTH_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+function generateSetupTokenParams() {
+  const { codeVerifier, codeChallenge, state } = generatePkce();
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CONFIG.clientId,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+    scope: SETUP_TOKEN_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens(request, fetchImpl) {
+  const { authorizationCode, codeVerifier, state } = request;
+  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+      state
+    },
+    "Failed to parse token response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    // The authorization_code grant always returns a refresh_token; the original
+    // helper read it from an untyped `data` and declared the field `string`.
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in,
+    scopes: data.scope?.split(" ") || CLAUDE_OAUTH_CONFIG.scopes
+  };
+}
+async function exchangeSetupTokenCode(request, fetchImpl) {
+  const { authorizationCode, codeVerifier, state } = request;
+  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "authorization_code",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      code,
+      code_verifier: codeVerifier,
+      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
+      state
+    },
+    "Failed to parse setup token response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in,
+    scopes: data.scope?.split(" ") || SETUP_TOKEN_CONFIG.scopes
+  };
+}
+async function refreshAccessToken(refreshToken, fetchImpl) {
+  const data = await postJson(
+    fetchImpl,
+    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
+    {
+      grant_type: "refresh_token",
+      client_id: CLAUDE_OAUTH_CONFIG.clientId,
+      refresh_token: refreshToken
+    },
+    "Failed to parse refresh response",
+    CLAUDE_TOKEN_HEADERS
+  );
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresIn: data.expires_in
+  };
+}
+
+// src/oauth/flows/codex.ts
+var codex_exports = {};
+__export(codex_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens2,
+  generateAuthParams: () => generateAuthParams2,
+  refreshAccessToken: () => refreshAccessToken2
+});
+import crypto2 from "crypto";
+var CODEX_OAUTH_CONFIG = {
+  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+  authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
+  tokenEndpoint: "https://auth.openai.com/oauth/token",
+  redirectUri: "http://localhost:1455/auth/callback",
+  scopes: ["openid", "profile", "email", "offline_access"]
+};
+function generateAuthParams2() {
+  const codeVerifier = crypto2.randomBytes(64).toString("hex");
+  const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto2.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri,
+    scope: CODEX_OAUTH_CONFIG.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  const authUrl = `${CODEX_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens2(request, fetchImpl) {
+  const { authorizationCode, codeVerifier } = request;
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri
+  });
+  const data = await postForm(
+    fetchImpl,
+    CODEX_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse token response"
+  );
+  return {
+    accessToken: data.access_token,
+    // authorization_code grant returns both; the original helper read them from
+    // an untyped `data` and declared the fields `string`.
+    refreshToken: data.refresh_token,
+    idToken: data.id_token,
+    expiresIn: data.expires_in
+  };
+}
+async function refreshAccessToken2(refreshToken, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: CODEX_OAUTH_CONFIG.clientId,
+    refresh_token: refreshToken,
+    scope: "openid profile email"
+  });
+  const data = await postForm(
+    fetchImpl,
+    CODEX_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse refresh response"
+  );
+  return {
+    accessToken: data.access_token,
+    idToken: data.id_token,
+    refreshToken: data.refresh_token || refreshToken,
+    expiresIn: data.expires_in || 3600
+  };
+}
+
+// src/oauth/flows/gemini.ts
+var gemini_exports = {};
+__export(gemini_exports, {
+  exchangeCodeForTokens: () => exchangeCodeForTokens3,
+  generateAuthParams: () => generateAuthParams3,
+  refreshAccessToken: () => refreshAccessToken3
+});
+import crypto3 from "crypto";
+var GEMINI_OAUTH_CONFIG = {
+  clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
+  // The Gemini CLI's *public* installed-app OAuth client secret (mirrors the
+  // upstream CLI). Per Google's OAuth docs, native-app client secrets are not
+  // treated as confidential — not a leaked key.
+  clientSecret: "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",
+  // allowlist-secret
+  authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenEndpoint: "https://oauth2.googleapis.com/token",
+  redirectUri: "urn:ietf:wg:oauth:2.0:oob",
+  scopes: ["https://www.googleapis.com/auth/cloud-platform"]
+};
+function generateAuthParams3() {
+  const codeVerifier = crypto3.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto3.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto3.randomBytes(16).toString("hex");
+  const params = new URLSearchParams({
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri,
+    scope: GEMINI_OAUTH_CONFIG.scopes.join(" "),
+    response_type: "code",
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    access_type: "offline",
+    prompt: "consent"
+  });
+  const authUrl = `${GEMINI_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
+  return { authUrl, codeVerifier, state };
+}
+async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
+    code: authorizationCode,
+    code_verifier: codeVerifier,
+    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri
+  });
+  const data = await postForm(
+    fetchImpl,
+    GEMINI_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse token response"
+  );
+  return {
+    accessToken: data.access_token,
+    // authorization_code grant returns a refresh_token; the original helper read
+    // it from an untyped `data` and declared the field `string`.
+    refreshToken: data.refresh_token,
+    expiresIn: data.expires_in
+  };
+}
+async function refreshAccessToken3(refreshToken, fetchImpl) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: GEMINI_OAUTH_CONFIG.clientId,
+    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
+    refresh_token: refreshToken
+  });
+  const data = await postForm(
+    fetchImpl,
+    GEMINI_OAUTH_CONFIG.tokenEndpoint,
+    params,
+    "Failed to parse refresh response"
+  );
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in
+  };
+}
+
+export {
+  claude_exports,
+  codex_exports,
+  gemini_exports
+};