@omnicross/subscriptions 0.2.1 → 0.3.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Sayo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Sayo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -1,16 +1,16 @@
-@omnicross/subscriptions — THIRD-PARTY NOTICES
-==============================================
-
-This package contains the subscription-as-provider block (auth strategies,
-account service, provider registry, dispatcher, and OpenCodeGo routing) and uses
-the following third-party dependency. Its license applies to that dependency.
-
---------------------------------------------------------------------------------
-1. js-tiktoken  (MIT License)
---------------------------------------------------------------------------------
-
-`src/opencodego/token-count.ts` lazily imports `js-tiktoken` (cl100k_base
-encoding) to estimate input-token counts for OpenCodeGo scenario routing.
-
-    https://github.com/dqbd/tiktoken
-    Licensed under the MIT License.
+@omnicross/subscriptions — THIRD-PARTY NOTICES
+==============================================
+
+This package contains the subscription-as-provider block (auth strategies,
+account service, provider registry, dispatcher, and OpenCodeGo routing) and uses
+the following third-party dependency. Its license applies to that dependency.
+
+--------------------------------------------------------------------------------
+1. js-tiktoken  (MIT License)
+--------------------------------------------------------------------------------
+
+`src/opencodego/token-count.ts` lazily imports `js-tiktoken` (cl100k_base
+encoding) to estimate input-token counts for OpenCodeGo scenario routing.
+
+    https://github.com/dqbd/tiktoken
+    Licensed under the MIT License.

package/README.md

@@ -1,15 +1,15 @@
-# @omnicross/subscriptions
-
-omnicross subscription-as-provider support — pass-through / OAuth-bearer / static-bearer auth strategies, the Claude / Codex / Gemini OAuth flows, and the OpenCodeGo scenario dispatcher + fallback chain.
-
-Part of the [omnicross](https://github.com/Dumoedss/omnicross) monorepo — see the root README for the full overview.
-
-```bash
-npm install @omnicross/subscriptions
-```
-
-## License
-
-[MIT](LICENSE) 
-
-This package adapts third-party work under its own license — see the `NOTICE` file.
+# @omnicross/subscriptions
+
+omnicross subscription-as-provider support — pass-through / OAuth-bearer / static-bearer auth strategies, the Claude / Codex / Gemini OAuth flows, and the OpenCodeGo scenario dispatcher + fallback chain.
+
+Part of the [omnicross](https://github.com/Dumoedss/omnicross) monorepo — see the root README for the full overview.
+
+```bash
+npm install @omnicross/subscriptions
+```
+
+## License
+
+[MIT](LICENSE) 
+
+This package adapts third-party work under its own license — see the `NOTICE` file.

package/dist/{chunk-UXUMAXZJ.cjs → chunk-B2LHAP4F.cjs}

@@ -1,7 +1,181 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 var _chunk75ZPJI57cjs = require('./chunk-75ZPJI57.cjs');
 
+// src/oauth/flows/kimi.ts
+var kimi_exports = {};
+_chunk75ZPJI57cjs.__export.call(void 0, kimi_exports, {
+  KIMI_CLI_VERSION: () => KIMI_CLI_VERSION,
+  KIMI_OAUTH_CONFIG: () => KIMI_OAUTH_CONFIG,
+  awaitDeviceToken: () => awaitDeviceToken,
+  generateKimiDeviceId: () => generateKimiDeviceId,
+  kimiAccountIdFromAccessToken: () => kimiAccountIdFromAccessToken,
+  kimiFingerprintHeaders: () => kimiFingerprintHeaders,
+  pollDeviceToken: () => pollDeviceToken,
+  refreshAccessToken: () => refreshAccessToken,
+  requestDeviceAuthorization: () => requestDeviceAuthorization
+});
+var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
+var _os = require('os'); var os = _interopRequireWildcard(_os);
+var KIMI_OAUTH_CONFIG = {
+  clientId: "17e5f671-d194-4dfb-9706-5516cb48c098",
+  deviceAuthorizationEndpoint: "https://auth.kimi.com/api/oauth/device_authorization",
+  tokenEndpoint: "https://auth.kimi.com/api/oauth/token"
+};
+var KIMI_CLI_VERSION = _nullishCoalesce(process.env["KIMI_CLI_VERSION"], () => ( "1.0.0"));
+function sanitizeHeaderValue(value, fallback = "") {
+  const sanitized = value.replace(/[^\x20-\x7E]/g, "").trim();
+  return sanitized || fallback;
+}
+function deviceModel() {
+  const platform2 = os.platform();
+  const label = platform2 === "darwin" ? "macOS" : platform2 === "win32" ? "Windows" : platform2 === "linux" ? "Linux" : platform2;
+  return [label, os.release(), os.arch()].filter(Boolean).join(" ").trim();
+}
+function kimiFingerprintHeaders(deviceId) {
+  return {
+    "User-Agent": `KimiCLI/${KIMI_CLI_VERSION}`,
+    "X-Msh-Platform": "kimi_cli",
+    "X-Msh-Version": KIMI_CLI_VERSION,
+    "X-Msh-Device-Name": sanitizeHeaderValue(os.hostname(), "unknown"),
+    "X-Msh-Device-Model": sanitizeHeaderValue(deviceModel(), "unknown"),
+    "X-Msh-Os-Version": sanitizeHeaderValue(os.version(), "unknown"),
+    ...deviceId ? { "X-Msh-Device-Id": sanitizeHeaderValue(deviceId) } : {}
+  };
+}
+function generateKimiDeviceId() {
+  return _crypto2.default.randomUUID().replace(/-/g, "");
+}
+async function postFormRaw(fetchImpl, url, params, headers, timeoutMs = 3e4) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", ...headers },
+      body: params.toString(),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) throw new Error("token endpoint timed out");
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+  const text = await response.text();
+  let body;
+  try {
+    const parsed = JSON.parse(text);
+    body = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch (e2) {
+    body = {};
+  }
+  return { status: response.status, body };
+}
+async function requestDeviceAuthorization(fetchImpl, fingerprint) {
+  const { status, body } = await postFormRaw(
+    fetchImpl,
+    KIMI_OAUTH_CONFIG.deviceAuthorizationEndpoint,
+    new URLSearchParams({ client_id: KIMI_OAUTH_CONFIG.clientId }),
+    _nullishCoalesce(fingerprint, () => ( {}))
+  );
+  const userCode = typeof body["user_code"] === "string" ? body["user_code"] : void 0;
+  const deviceCode = typeof body["device_code"] === "string" ? body["device_code"] : void 0;
+  const verificationUri = typeof body["verification_uri"] === "string" ? body["verification_uri"] : void 0;
+  if (status >= 400 || !userCode || !deviceCode || !verificationUri) {
+    const message = typeof body["error_description"] === "string" ? body["error_description"] : typeof body["msg"] === "string" ? body["msg"] : `device authorization failed (HTTP ${status})`;
+    throw new Error(message);
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri,
+    ...typeof body["verification_uri_complete"] === "string" ? { verificationUriComplete: body["verification_uri_complete"] } : {},
+    ...typeof body["interval"] === "number" ? { interval: body["interval"] } : {},
+    ...typeof body["expires_in"] === "number" ? { expiresIn: body["expires_in"] } : {}
+  };
+}
+async function pollDeviceToken(deviceCode, fetchImpl, fingerprint) {
+  const { status, body } = await postFormRaw(
+    fetchImpl,
+    KIMI_OAUTH_CONFIG.tokenEndpoint,
+    new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: KIMI_OAUTH_CONFIG.clientId,
+      device_code: deviceCode
+    }),
+    _nullishCoalesce(fingerprint, () => ( {}))
+  );
+  const accessToken = typeof body["access_token"] === "string" ? body["access_token"] : void 0;
+  const refreshToken = typeof body["refresh_token"] === "string" ? body["refresh_token"] : void 0;
+  if (accessToken && refreshToken) {
+    const expiresIn = typeof body["expires_in"] === "number" && body["expires_in"] > 0 ? body["expires_in"] : 3600;
+    return { state: "done", accessToken, refreshToken, expiresIn };
+  }
+  const error = typeof body["error"] === "string" ? body["error"] : void 0;
+  if (error === "authorization_pending") return { state: "pending" };
+  if (error === "slow_down") return { state: "pending", intervalSeconds: 5 };
+  if (status < 400 && !error) return { state: "pending" };
+  const message = typeof body["error_description"] === "string" && body["error_description"] ? body["error_description"] : _nullishCoalesce(error, () => ( `device token poll failed (HTTP ${status})`));
+  return { state: "failed", message };
+}
+async function awaitDeviceToken(authorization, fetchImpl, options = {}) {
+  const sleep = _nullishCoalesce(options.sleep, () => ( ((ms) => new Promise((resolve) => setTimeout(resolve, ms)))));
+  const deadline = Date.now() + (_nullishCoalesce(options.deadlineMs, () => ( 15 * 6e4)));
+  const baseIntervalMs = _nullishCoalesce(options.intervalMs, () => ( (_nullishCoalesce(authorization.interval, () => ( 5))) * 1e3));
+  let intervalMs = Math.max(1e3, baseIntervalMs);
+  for (; ; ) {
+    const result = await pollDeviceToken(authorization.deviceCode, fetchImpl, options.fingerprint);
+    if (result.state === "done") return result;
+    if (result.state === "failed") throw new Error(result.message);
+    if (result.state === "pending" && result.intervalSeconds) intervalMs += result.intervalSeconds * 1e3;
+    _optionalChain([options, 'access', _ => _.onPending, 'optionalCall', _2 => _2()]);
+    if (Date.now() + intervalMs > deadline) throw new Error("device authorization timed out");
+    await sleep(intervalMs);
+  }
+}
+async function refreshAccessToken(refreshToken, fetchImpl, fingerprint) {
+  const { status, body } = await postFormRaw(
+    fetchImpl,
+    KIMI_OAUTH_CONFIG.tokenEndpoint,
+    new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: KIMI_OAUTH_CONFIG.clientId,
+      refresh_token: refreshToken
+    }),
+    _nullishCoalesce(fingerprint, () => ( {}))
+  );
+  const accessToken = typeof body["access_token"] === "string" ? body["access_token"] : void 0;
+  if (status >= 400 || !accessToken) {
+    const message = typeof body["error_description"] === "string" && body["error_description"] ? body["error_description"] : typeof body["error"] === "string" ? body["error"] : `refresh failed (HTTP ${status})`;
+    throw new Error(message);
+  }
+  return {
+    accessToken,
+    // Kimi rotates the refresh token; keep the old one when the response omits it.
+    refreshToken: typeof body["refresh_token"] === "string" && body["refresh_token"] ? body["refresh_token"] : refreshToken,
+    expiresIn: typeof body["expires_in"] === "number" && body["expires_in"] > 0 ? body["expires_in"] : 3600
+  };
+}
+function kimiAccountIdFromAccessToken(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    if (!claims || typeof claims !== "object" || Array.isArray(claims)) return void 0;
+    const record = claims;
+    for (const key of ["user_id", "sub"]) {
+      const value = record[key];
+      if (typeof value === "string" && value.trim()) return value.trim();
+    }
+    return void 0;
+  } catch (e3) {
+    return void 0;
+  }
+}
+
 // src/oauth/flows/claude.ts
 var claude_exports = {};
 _chunk75ZPJI57cjs.__export.call(void 0, claude_exports, {
@@ -9,9 +183,9 @@ _chunk75ZPJI57cjs.__export.call(void 0, claude_exports, {
   exchangeSetupTokenCode: () => exchangeSetupTokenCode,
   generateAuthParams: () => generateAuthParams,
   generateSetupTokenParams: () => generateSetupTokenParams,
-  refreshAccessToken: () => refreshAccessToken
+  refreshAccessToken: () => refreshAccessToken2
 });
-var _crypto = require('crypto'); var _crypto2 = _interopRequireDefault(_crypto);
+
 
 // src/oauth/fetchPort.ts
 function errorMessage(error, errorDescription) {
@@ -60,7 +234,7 @@ async function postForm(fetchImpl, url, params, parseErrorMessage, timeoutMs = D
   let data;
   try {
     data = JSON.parse(responseData);
-  } catch (e2) {
+  } catch (e4) {
     throw new Error(withStatus(parseErrorMessage, response));
   }
   if (data.error) {
@@ -83,7 +257,7 @@ async function postJson(fetchImpl, url, body, parseErrorMessage, extraHeaders =
   let data;
   try {
     data = JSON.parse(responseData);
-  } catch (e3) {
+  } catch (e5) {
     throw new Error(withStatus(parseErrorMessage, response));
   }
   if (data.error) {
@@ -165,7 +339,7 @@ function generateSetupTokenParams() {
 }
 async function exchangeCodeForTokens(request, fetchImpl) {
   const { authorizationCode, codeVerifier, state } = request;
-  const code = _nullishCoalesce(_optionalChain([authorizationCode, 'access', _ => _.split, 'call', _2 => _2("#"), 'access', _3 => _3[0], 'optionalAccess', _4 => _4.split, 'call', _5 => _5("&"), 'access', _6 => _6[0]]), () => ( authorizationCode));
+  const code = _nullishCoalesce(_optionalChain([authorizationCode, 'access', _3 => _3.split, 'call', _4 => _4("#"), 'access', _5 => _5[0], 'optionalAccess', _6 => _6.split, 'call', _7 => _7("&"), 'access', _8 => _8[0]]), () => ( authorizationCode));
   const data = await postJson(
     fetchImpl,
     CLAUDE_OAUTH_CONFIG.tokenEndpoint,
@@ -186,12 +360,12 @@ async function exchangeCodeForTokens(request, fetchImpl) {
     // helper read it from an untyped `data` and declared the field `string`.
     refreshToken: data.refresh_token,
     expiresIn: data.expires_in,
-    scopes: _optionalChain([data, 'access', _7 => _7.scope, 'optionalAccess', _8 => _8.split, 'call', _9 => _9(" ")]) || CLAUDE_OAUTH_CONFIG.scopes
+    scopes: _optionalChain([data, 'access', _9 => _9.scope, 'optionalAccess', _10 => _10.split, 'call', _11 => _11(" ")]) || CLAUDE_OAUTH_CONFIG.scopes
   };
 }
 async function exchangeSetupTokenCode(request, fetchImpl) {
   const { authorizationCode, codeVerifier, state } = request;
-  const code = _nullishCoalesce(_optionalChain([authorizationCode, 'access', _10 => _10.split, 'call', _11 => _11("#"), 'access', _12 => _12[0], 'optionalAccess', _13 => _13.split, 'call', _14 => _14("&"), 'access', _15 => _15[0]]), () => ( authorizationCode));
+  const code = _nullishCoalesce(_optionalChain([authorizationCode, 'access', _12 => _12.split, 'call', _13 => _13("#"), 'access', _14 => _14[0], 'optionalAccess', _15 => _15.split, 'call', _16 => _16("&"), 'access', _17 => _17[0]]), () => ( authorizationCode));
   const data = await postJson(
     fetchImpl,
     CLAUDE_OAUTH_CONFIG.tokenEndpoint,
@@ -209,10 +383,10 @@ async function exchangeSetupTokenCode(request, fetchImpl) {
   return {
     accessToken: data.access_token,
     expiresIn: data.expires_in,
-    scopes: _optionalChain([data, 'access', _16 => _16.scope, 'optionalAccess', _17 => _17.split, 'call', _18 => _18(" ")]) || SETUP_TOKEN_CONFIG.scopes
+    scopes: _optionalChain([data, 'access', _18 => _18.scope, 'optionalAccess', _19 => _19.split, 'call', _20 => _20(" ")]) || SETUP_TOKEN_CONFIG.scopes
   };
 }
-async function refreshAccessToken(refreshToken, fetchImpl) {
+async function refreshAccessToken2(refreshToken, fetchImpl) {
   const data = await postJson(
     fetchImpl,
     CLAUDE_OAUTH_CONFIG.tokenEndpoint,
@@ -236,7 +410,7 @@ var codex_exports = {};
 _chunk75ZPJI57cjs.__export.call(void 0, codex_exports, {
   exchangeCodeForTokens: () => exchangeCodeForTokens2,
   generateAuthParams: () => generateAuthParams2,
-  refreshAccessToken: () => refreshAccessToken2
+  refreshAccessToken: () => refreshAccessToken3
 });
 
 var CODEX_OAUTH_CONFIG = {
@@ -286,7 +460,7 @@ async function exchangeCodeForTokens2(request, fetchImpl) {
     expiresIn: data.expires_in
   };
 }
-async function refreshAccessToken2(refreshToken, fetchImpl) {
+async function refreshAccessToken3(refreshToken, fetchImpl) {
   const params = new URLSearchParams({
     grant_type: "refresh_token",
     client_id: CODEX_OAUTH_CONFIG.clientId,
@@ -312,7 +486,7 @@ var gemini_exports = {};
 _chunk75ZPJI57cjs.__export.call(void 0, gemini_exports, {
   exchangeCodeForTokens: () => exchangeCodeForTokens3,
   generateAuthParams: () => generateAuthParams3,
-  refreshAccessToken: () => refreshAccessToken3
+  refreshAccessToken: () => refreshAccessToken4
 });
 
 var GEMINI_OAUTH_CONFIG = {
@@ -368,7 +542,7 @@ async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl
     expiresIn: data.expires_in
   };
 }
-async function refreshAccessToken3(refreshToken, fetchImpl) {
+async function refreshAccessToken4(refreshToken, fetchImpl) {
   const params = new URLSearchParams({
     grant_type: "refresh_token",
     client_id: GEMINI_OAUTH_CONFIG.clientId,
@@ -391,4 +565,6 @@ async function refreshAccessToken3(refreshToken, fetchImpl) {
 
 
 
-exports.claude_exports = claude_exports; exports.codex_exports = codex_exports; exports.gemini_exports = gemini_exports;
+
+
+exports.kimiFingerprintHeaders = kimiFingerprintHeaders; exports.kimi_exports = kimi_exports; exports.claude_exports = claude_exports; exports.codex_exports = codex_exports; exports.gemini_exports = gemini_exports;