@omnicross/subscriptions 0.2.1 → 0.3.1

package/dist/{chunk-4HYDPKHR.js → chunk-ZB3GA2Y2.js}

@@ -2,6 +2,180 @@ import {
   __export
 } from "./chunk-MLKGABMK.js";
 
+// src/oauth/flows/kimi.ts
+var kimi_exports = {};
+__export(kimi_exports, {
+  KIMI_CLI_VERSION: () => KIMI_CLI_VERSION,
+  KIMI_OAUTH_CONFIG: () => KIMI_OAUTH_CONFIG,
+  awaitDeviceToken: () => awaitDeviceToken,
+  generateKimiDeviceId: () => generateKimiDeviceId,
+  kimiAccountIdFromAccessToken: () => kimiAccountIdFromAccessToken,
+  kimiFingerprintHeaders: () => kimiFingerprintHeaders,
+  pollDeviceToken: () => pollDeviceToken,
+  refreshAccessToken: () => refreshAccessToken,
+  requestDeviceAuthorization: () => requestDeviceAuthorization
+});
+import crypto from "crypto";
+import * as os from "os";
+var KIMI_OAUTH_CONFIG = {
+  clientId: "17e5f671-d194-4dfb-9706-5516cb48c098",
+  deviceAuthorizationEndpoint: "https://auth.kimi.com/api/oauth/device_authorization",
+  tokenEndpoint: "https://auth.kimi.com/api/oauth/token"
+};
+var KIMI_CLI_VERSION = process.env["KIMI_CLI_VERSION"] ?? "1.0.0";
+function sanitizeHeaderValue(value, fallback = "") {
+  const sanitized = value.replace(/[^\x20-\x7E]/g, "").trim();
+  return sanitized || fallback;
+}
+function deviceModel() {
+  const platform2 = os.platform();
+  const label = platform2 === "darwin" ? "macOS" : platform2 === "win32" ? "Windows" : platform2 === "linux" ? "Linux" : platform2;
+  return [label, os.release(), os.arch()].filter(Boolean).join(" ").trim();
+}
+function kimiFingerprintHeaders(deviceId) {
+  return {
+    "User-Agent": `KimiCLI/${KIMI_CLI_VERSION}`,
+    "X-Msh-Platform": "kimi_cli",
+    "X-Msh-Version": KIMI_CLI_VERSION,
+    "X-Msh-Device-Name": sanitizeHeaderValue(os.hostname(), "unknown"),
+    "X-Msh-Device-Model": sanitizeHeaderValue(deviceModel(), "unknown"),
+    "X-Msh-Os-Version": sanitizeHeaderValue(os.version(), "unknown"),
+    ...deviceId ? { "X-Msh-Device-Id": sanitizeHeaderValue(deviceId) } : {}
+  };
+}
+function generateKimiDeviceId() {
+  return crypto.randomUUID().replace(/-/g, "");
+}
+async function postFormRaw(fetchImpl, url, params, headers, timeoutMs = 3e4) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", ...headers },
+      body: params.toString(),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) throw new Error("token endpoint timed out");
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+  const text = await response.text();
+  let body;
+  try {
+    const parsed = JSON.parse(text);
+    body = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    body = {};
+  }
+  return { status: response.status, body };
+}
+async function requestDeviceAuthorization(fetchImpl, fingerprint) {
+  const { status, body } = await postFormRaw(
+    fetchImpl,
+    KIMI_OAUTH_CONFIG.deviceAuthorizationEndpoint,
+    new URLSearchParams({ client_id: KIMI_OAUTH_CONFIG.clientId }),
+    fingerprint ?? {}
+  );
+  const userCode = typeof body["user_code"] === "string" ? body["user_code"] : void 0;
+  const deviceCode = typeof body["device_code"] === "string" ? body["device_code"] : void 0;
+  const verificationUri = typeof body["verification_uri"] === "string" ? body["verification_uri"] : void 0;
+  if (status >= 400 || !userCode || !deviceCode || !verificationUri) {
+    const message = typeof body["error_description"] === "string" ? body["error_description"] : typeof body["msg"] === "string" ? body["msg"] : `device authorization failed (HTTP ${status})`;
+    throw new Error(message);
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri,
+    ...typeof body["verification_uri_complete"] === "string" ? { verificationUriComplete: body["verification_uri_complete"] } : {},
+    ...typeof body["interval"] === "number" ? { interval: body["interval"] } : {},
+    ...typeof body["expires_in"] === "number" ? { expiresIn: body["expires_in"] } : {}
+  };
+}
+async function pollDeviceToken(deviceCode, fetchImpl, fingerprint) {
+  const { status, body } = await postFormRaw(
+    fetchImpl,
+    KIMI_OAUTH_CONFIG.tokenEndpoint,
+    new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      client_id: KIMI_OAUTH_CONFIG.clientId,
+      device_code: deviceCode
+    }),
+    fingerprint ?? {}
+  );
+  const accessToken = typeof body["access_token"] === "string" ? body["access_token"] : void 0;
+  const refreshToken = typeof body["refresh_token"] === "string" ? body["refresh_token"] : void 0;
+  if (accessToken && refreshToken) {
+    const expiresIn = typeof body["expires_in"] === "number" && body["expires_in"] > 0 ? body["expires_in"] : 3600;
+    return { state: "done", accessToken, refreshToken, expiresIn };
+  }
+  const error = typeof body["error"] === "string" ? body["error"] : void 0;
+  if (error === "authorization_pending") return { state: "pending" };
+  if (error === "slow_down") return { state: "pending", intervalSeconds: 5 };
+  if (status < 400 && !error) return { state: "pending" };
+  const message = typeof body["error_description"] === "string" && body["error_description"] ? body["error_description"] : error ?? `device token poll failed (HTTP ${status})`;
+  return { state: "failed", message };
+}
+async function awaitDeviceToken(authorization, fetchImpl, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const deadline = Date.now() + (options.deadlineMs ?? 15 * 6e4);
+  const baseIntervalMs = options.intervalMs ?? (authorization.interval ?? 5) * 1e3;
+  let intervalMs = Math.max(1e3, baseIntervalMs);
+  for (; ; ) {
+    const result = await pollDeviceToken(authorization.deviceCode, fetchImpl, options.fingerprint);
+    if (result.state === "done") return result;
+    if (result.state === "failed") throw new Error(result.message);
+    if (result.state === "pending" && result.intervalSeconds) intervalMs += result.intervalSeconds * 1e3;
+    options.onPending?.();
+    if (Date.now() + intervalMs > deadline) throw new Error("device authorization timed out");
+    await sleep(intervalMs);
+  }
+}
+async function refreshAccessToken(refreshToken, fetchImpl, fingerprint) {
+  const { status, body } = await postFormRaw(
+    fetchImpl,
+    KIMI_OAUTH_CONFIG.tokenEndpoint,
+    new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: KIMI_OAUTH_CONFIG.clientId,
+      refresh_token: refreshToken
+    }),
+    fingerprint ?? {}
+  );
+  const accessToken = typeof body["access_token"] === "string" ? body["access_token"] : void 0;
+  if (status >= 400 || !accessToken) {
+    const message = typeof body["error_description"] === "string" && body["error_description"] ? body["error_description"] : typeof body["error"] === "string" ? body["error"] : `refresh failed (HTTP ${status})`;
+    throw new Error(message);
+  }
+  return {
+    accessToken,
+    // Kimi rotates the refresh token; keep the old one when the response omits it.
+    refreshToken: typeof body["refresh_token"] === "string" && body["refresh_token"] ? body["refresh_token"] : refreshToken,
+    expiresIn: typeof body["expires_in"] === "number" && body["expires_in"] > 0 ? body["expires_in"] : 3600
+  };
+}
+function kimiAccountIdFromAccessToken(accessToken) {
+  const parts = accessToken.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const json = Buffer.from(parts[1], "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    if (!claims || typeof claims !== "object" || Array.isArray(claims)) return void 0;
+    const record = claims;
+    for (const key of ["user_id", "sub"]) {
+      const value = record[key];
+      if (typeof value === "string" && value.trim()) return value.trim();
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+
 // src/oauth/flows/claude.ts
 var claude_exports = {};
 __export(claude_exports, {
@@ -9,9 +183,9 @@ __export(claude_exports, {
   exchangeSetupTokenCode: () => exchangeSetupTokenCode,
   generateAuthParams: () => generateAuthParams,
   generateSetupTokenParams: () => generateSetupTokenParams,
-  refreshAccessToken: () => refreshAccessToken
+  refreshAccessToken: () => refreshAccessToken2
 });
-import crypto from "crypto";
+import crypto2 from "crypto";
 
 // src/oauth/fetchPort.ts
 function errorMessage(error, errorDescription) {
@@ -128,9 +302,9 @@ var SETUP_TOKEN_CONFIG = {
   // Only inference permission, no API key creation
 };
 function generatePkce() {
-  const codeVerifier = crypto.randomBytes(32).toString("base64url");
-  const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = crypto.randomBytes(16).toString("hex");
+  const codeVerifier = crypto2.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto2.randomBytes(16).toString("hex");
   return { codeVerifier, codeChallenge, state };
 }
 function generateAuthParams() {
@@ -212,7 +386,7 @@ async function exchangeSetupTokenCode(request, fetchImpl) {
     scopes: data.scope?.split(" ") || SETUP_TOKEN_CONFIG.scopes
   };
 }
-async function refreshAccessToken(refreshToken, fetchImpl) {
+async function refreshAccessToken2(refreshToken, fetchImpl) {
   const data = await postJson(
     fetchImpl,
     CLAUDE_OAUTH_CONFIG.tokenEndpoint,
@@ -236,9 +410,9 @@ var codex_exports = {};
 __export(codex_exports, {
   exchangeCodeForTokens: () => exchangeCodeForTokens2,
   generateAuthParams: () => generateAuthParams2,
-  refreshAccessToken: () => refreshAccessToken2
+  refreshAccessToken: () => refreshAccessToken3
 });
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 var CODEX_OAUTH_CONFIG = {
   clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
   authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
@@ -247,9 +421,9 @@ var CODEX_OAUTH_CONFIG = {
   scopes: ["openid", "profile", "email", "offline_access"]
 };
 function generateAuthParams2() {
-  const codeVerifier = crypto2.randomBytes(64).toString("hex");
-  const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = crypto2.randomBytes(16).toString("hex");
+  const codeVerifier = crypto3.randomBytes(64).toString("hex");
+  const codeChallenge = crypto3.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto3.randomBytes(16).toString("hex");
   const params = new URLSearchParams({
     response_type: "code",
     client_id: CODEX_OAUTH_CONFIG.clientId,
@@ -286,7 +460,7 @@ async function exchangeCodeForTokens2(request, fetchImpl) {
     expiresIn: data.expires_in
   };
 }
-async function refreshAccessToken2(refreshToken, fetchImpl) {
+async function refreshAccessToken3(refreshToken, fetchImpl) {
   const params = new URLSearchParams({
     grant_type: "refresh_token",
     client_id: CODEX_OAUTH_CONFIG.clientId,
@@ -312,9 +486,9 @@ var gemini_exports = {};
 __export(gemini_exports, {
   exchangeCodeForTokens: () => exchangeCodeForTokens3,
   generateAuthParams: () => generateAuthParams3,
-  refreshAccessToken: () => refreshAccessToken3
+  refreshAccessToken: () => refreshAccessToken4
 });
-import crypto3 from "crypto";
+import crypto4 from "crypto";
 var GEMINI_OAUTH_CONFIG = {
   clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
   // The Gemini CLI's *public* installed-app OAuth client secret (mirrors the
@@ -328,9 +502,9 @@ var GEMINI_OAUTH_CONFIG = {
   scopes: ["https://www.googleapis.com/auth/cloud-platform"]
 };
 function generateAuthParams3() {
-  const codeVerifier = crypto3.randomBytes(32).toString("base64url");
-  const codeChallenge = crypto3.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = crypto3.randomBytes(16).toString("hex");
+  const codeVerifier = crypto4.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto4.createHash("sha256").update(codeVerifier).digest("base64url");
+  const state = crypto4.randomBytes(16).toString("hex");
   const params = new URLSearchParams({
     client_id: GEMINI_OAUTH_CONFIG.clientId,
     redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri,
@@ -368,7 +542,7 @@ async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl
     expiresIn: data.expires_in
   };
 }
-async function refreshAccessToken3(refreshToken, fetchImpl) {
+async function refreshAccessToken4(refreshToken, fetchImpl) {
   const params = new URLSearchParams({
     grant_type: "refresh_token",
     client_id: GEMINI_OAUTH_CONFIG.clientId,
@@ -388,6 +562,8 @@ async function refreshAccessToken3(refreshToken, fetchImpl) {
 }
 
 export {
+  kimiFingerprintHeaders,
+  kimi_exports,
   claude_exports,
   codex_exports,
   gemini_exports