@omnicross/subscriptions 0.2.1 → 0.3.1

package/dist/index.cjs

@@ -2,7 +2,9 @@
 
 
 
-var _chunkUXUMAXZJcjs = require('./chunk-UXUMAXZJ.cjs');
+
+
+var _chunkB2LHAP4Fcjs = require('./chunk-B2LHAP4F.cjs');
 
 
 
@@ -125,13 +127,15 @@ var ACCOUNTS_KEY = {
   claude: "claudeAccounts",
   codex: "codexAccounts",
   gemini: "geminiAccounts",
-  opencodego: "opencodegoAccounts"
+  opencodego: "opencodegoAccounts",
+  kimi: "kimiAccounts"
 };
 var ACTIVE_KEY = {
   claude: "activeClaudeAccountId",
   codex: "activeCodexAccountId",
   gemini: "activeGeminiAccountId",
-  opencodego: "activeOpencodegoAccountId"
+  opencodego: "activeOpencodegoAccountId",
+  kimi: "activeKimiAccountId"
 };
 function gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById) {
   if (!health && !resolvedModel || accounts.length < 2) return accounts;
@@ -421,13 +425,17 @@ var OAuthBearerAuthStrategy = (_class2 = class {
       return;
     }
     headers["Authorization"] = `Bearer ${token}`;
+    if (this.providerId === "kimi") {
+      const deviceId = await this.resolveKimiDeviceId(_optionalChain([hints, 'optionalAccess', _29 => _29.sessionKey]));
+      Object.assign(headers, _chunkB2LHAP4Fcjs.kimiFingerprintHeaders.call(void 0, deviceId));
+    }
   }
   async onUnauthorized(sessionKey) {
     const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, this.providerId, sessionKey);
     if (byId !== null) return byId;
     return this.mutex.run(`${this.providerId}:refresh`, async () => {
       try {
-        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+        return this.refreshActive();
       } catch (err) {
         console.warn(`[OAuthBearerAuthStrategy] ${this.providerId} refresh failed:`, err);
         return false;
@@ -436,8 +444,8 @@ var OAuthBearerAuthStrategy = (_class2 = class {
   }
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
-    const entry = this.providerId === "codex" ? config.codex : config.gemini;
-    if (!_optionalChain([entry, 'optionalAccess', _29 => _29.accessToken])) {
+    const entry = this.tokenBlock(config);
+    if (!_optionalChain([entry, 'optionalAccess', _30 => _30.accessToken])) {
       return { providerId: this.providerId, ok: false, reason: "missing-credential" };
     }
     if (entry.status === "expired") {
@@ -453,22 +461,53 @@ var OAuthBearerAuthStrategy = (_class2 = class {
   /** Read the current token, refreshing in-line if it's within the lead window. */
   async resolveAccessToken() {
     const config = await this.tokens.getFullConfig();
-    const entry = this.providerId === "codex" ? config.codex : config.gemini;
-    if (!_optionalChain([entry, 'optionalAccess', _30 => _30.accessToken])) return null;
+    const entry = this.tokenBlock(config);
+    if (!_optionalChain([entry, 'optionalAccess', _31 => _31.accessToken])) return null;
     const expiresAtMs = entry.expiresAt ? new Date(entry.expiresAt).getTime() : 0;
     const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - REFRESH_LEAD_MS;
     if (expiringSoon && entry.refreshToken) {
       const refreshed = await this.mutex.run(`${this.providerId}:refresh`, async () => {
-        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+        return this.refreshActive();
       });
       if (!refreshed) return null;
       const fresh = await this.tokens.getFullConfig();
-      const freshEntry = this.providerId === "codex" ? fresh.codex : fresh.gemini;
-      return _nullishCoalesce(_optionalChain([freshEntry, 'optionalAccess', _31 => _31.accessToken]), () => ( null));
+      return _nullishCoalesce(_optionalChain([this, 'access', _32 => _32.tokenBlock, 'call', _33 => _33(fresh), 'optionalAccess', _34 => _34.accessToken]), () => ( null));
     }
     if (entry.status === "expired") return null;
     return entry.accessToken;
   }
+  /** The active account's refresh, dispatched per provider. */
+  refreshActive() {
+    switch (this.providerId) {
+      case "codex":
+        return this.tokens.refreshCodexToken();
+      case "gemini":
+        return this.tokens.refreshGeminiToken();
+      case "kimi":
+        return this.tokens.refreshKimiToken ? this.tokens.refreshKimiToken() : Promise.resolve(false);
+    }
+  }
+  tokenBlock(config) {
+    switch (this.providerId) {
+      case "codex":
+        return config.codex;
+      case "gemini":
+        return config.gemini;
+      case "kimi":
+        return config.kimi;
+    }
+  }
+  /**
+   * Best-effort device id for the fingerprint header. Selection already ran in
+   * `applyHeaders`; rather than re-deriving it, read the active block's id (a
+   * pool-served non-active account momentarily reports the active id — the
+   * header is per-INSTALL identity, so this is cosmetic, not auth).
+   */
+  async resolveKimiDeviceId(_sessionKey) {
+    void _sessionKey;
+    const config = await this.tokens.getFullConfig();
+    return _nullishCoalesce(_optionalChain([config, 'access', _35 => _35.kimi, 'optionalAccess', _36 => _36.deviceId]), () => ( _optionalChain([config, 'access', _37 => _37.kimiAccounts, 'optionalAccess', _38 => _38[0], 'optionalAccess', _39 => _39.tokens, 'access', _40 => _40.deviceId])));
+  }
 }, _class2);
 
 // src/auth/PassThroughAuthStrategy.ts
@@ -490,15 +529,15 @@ var PassThroughAuthStrategy = (_class3 = class {
       this.selector,
       this.tokens,
       "claude",
-      _optionalChain([hints, 'optionalAccess', _32 => _32.sessionKey]),
+      _optionalChain([hints, 'optionalAccess', _41 => _41.sessionKey]),
       () => this.tokens.getValidClaudeAccessToken(),
       {
         health: this.health,
-        reportSelection: _optionalChain([hints, 'optionalAccess', _33 => _33.reportSelection]),
-        resolvedModel: _optionalChain([hints, 'optionalAccess', _34 => _34.resolvedModel]),
-        preferredAccountId: _optionalChain([hints, 'optionalAccess', _35 => _35.preferredAccountId]),
-        preferredAccountGroup: _optionalChain([hints, 'optionalAccess', _36 => _36.preferredAccountGroup]),
-        boundAccountFallbackPolicy: _optionalChain([hints, 'optionalAccess', _37 => _37.boundAccountFallbackPolicy])
+        reportSelection: _optionalChain([hints, 'optionalAccess', _42 => _42.reportSelection]),
+        resolvedModel: _optionalChain([hints, 'optionalAccess', _43 => _43.resolvedModel]),
+        preferredAccountId: _optionalChain([hints, 'optionalAccess', _44 => _44.preferredAccountId]),
+        preferredAccountGroup: _optionalChain([hints, 'optionalAccess', _45 => _45.preferredAccountGroup]),
+        boundAccountFallbackPolicy: _optionalChain([hints, 'optionalAccess', _46 => _46.boundAccountFallbackPolicy])
       }
     );
     if (!token) return;
@@ -519,7 +558,7 @@ var PassThroughAuthStrategy = (_class3 = class {
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
     const claude = config.claude;
-    if (!_optionalChain([claude, 'optionalAccess', _38 => _38.accessToken])) {
+    if (!_optionalChain([claude, 'optionalAccess', _47 => _47.accessToken])) {
       return { providerId: "claude", ok: false, reason: "missing-credential" };
     }
     if (claude.status === "expired") {
@@ -575,22 +614,22 @@ var StaticBearerAuthStrategy = (_class5 = class {
       this.selector,
       this.tokens,
       "opencodego",
-      _optionalChain([hints, 'optionalAccess', _39 => _39.sessionKey]),
+      _optionalChain([hints, 'optionalAccess', _48 => _48.sessionKey]),
       () => this.tokens.getValidOpenCodeGoApiKey(),
       {
         health: this.health,
-        reportSelection: _optionalChain([hints, 'optionalAccess', _40 => _40.reportSelection]),
-        resolvedModel: _optionalChain([hints, 'optionalAccess', _41 => _41.resolvedModel]),
-        preferredAccountId: _optionalChain([hints, 'optionalAccess', _42 => _42.preferredAccountId]),
-        preferredAccountGroup: _optionalChain([hints, 'optionalAccess', _43 => _43.preferredAccountGroup]),
-        boundAccountFallbackPolicy: _optionalChain([hints, 'optionalAccess', _44 => _44.boundAccountFallbackPolicy])
+        reportSelection: _optionalChain([hints, 'optionalAccess', _49 => _49.reportSelection]),
+        resolvedModel: _optionalChain([hints, 'optionalAccess', _50 => _50.resolvedModel]),
+        preferredAccountId: _optionalChain([hints, 'optionalAccess', _51 => _51.preferredAccountId]),
+        preferredAccountGroup: _optionalChain([hints, 'optionalAccess', _52 => _52.preferredAccountGroup]),
+        boundAccountFallbackPolicy: _optionalChain([hints, 'optionalAccess', _53 => _53.boundAccountFallbackPolicy])
       }
     );
     if (!key) {
       return;
     }
     headers["Authorization"] = `Bearer ${key}`;
-    if (_optionalChain([hints, 'optionalAccess', _45 => _45.upstreamUrl, 'optionalAccess', _46 => _46.includes, 'call', _47 => _47(ANTHROPIC_SHAPE_PATH)])) {
+    if (_optionalChain([hints, 'optionalAccess', _54 => _54.upstreamUrl, 'optionalAccess', _55 => _55.includes, 'call', _56 => _56(ANTHROPIC_SHAPE_PATH)])) {
       headers["x-api-key"] = key;
     }
   }
@@ -600,7 +639,7 @@ var StaticBearerAuthStrategy = (_class5 = class {
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
     const oc = config.opencodego;
-    if (!_optionalChain([oc, 'optionalAccess', _48 => _48.apiKey])) {
+    if (!_optionalChain([oc, 'optionalAccess', _57 => _57.apiKey])) {
       return { providerId: "opencodego", ok: false, reason: "missing-credential" };
     }
     if (oc.status === "error") {
@@ -615,7 +654,8 @@ var DISPLAY_NAMES = {
   claude: "Claude (Anthropic OAuth)",
   codex: "Codex (ChatGPT OAuth)",
   gemini: "Gemini (Google OAuth)",
-  opencodego: "OpenCodeGo (Bearer key)"
+  opencodego: "OpenCodeGo (Bearer key)",
+  kimi: "Kimi Code (Moonshot OAuth)"
 };
 var SubscriptionAccountService = (_class6 = class {
   __init10() {this.mutex = new RefreshMutex()}
@@ -629,7 +669,8 @@ var SubscriptionAccountService = (_class6 = class {
       ["claude", new PassThroughAuthStrategy(tokens, this.mutex, this.selector, health)],
       ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex, this.selector, health)],
       ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex, this.selector, health)],
-      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)]
+      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)],
+      ["kimi", new OAuthBearerAuthStrategy("kimi", tokens, this.mutex, this.selector, health)]
     ]);
   }
   /** Returns the strategy bound to a subscription provider, or `null` for unknown ids. */
@@ -958,11 +999,11 @@ function resolveOpenCodeGoShape(entry) {
 function resolveOpenCodeGoHalf(modelId, config) {
   if (!config) return "go";
   for (const entry of Object.values(_nullishCoalesce(config.modelMap, () => ( {})))) {
-    if (_optionalChain([entry, 'optionalAccess', _49 => _49.modelId]) === modelId) return _nullishCoalesce(entry.provider, () => ( "go"));
+    if (_optionalChain([entry, 'optionalAccess', _58 => _58.modelId]) === modelId) return _nullishCoalesce(entry.provider, () => ( "go"));
   }
   for (const list of Object.values(_nullishCoalesce(config.fallbacks, () => ( {})))) {
     for (const entry of _nullishCoalesce(list, () => ( []))) {
-      if (_optionalChain([entry, 'optionalAccess', _50 => _50.modelId]) === modelId) return _nullishCoalesce(entry.provider, () => ( "go"));
+      if (_optionalChain([entry, 'optionalAccess', _59 => _59.modelId]) === modelId) return _nullishCoalesce(entry.provider, () => ( "go"));
     }
   }
   return "go";
@@ -1039,7 +1080,7 @@ function hasBackgroundPattern(loweredSlices) {
   return containsAny(loweredSlices, BACKGROUND_KEYWORDS);
 }
 function resolveOpenCodeGoScenario(summary, config) {
-  const longContextThreshold = _nullishCoalesce(_optionalChain([config, 'optionalAccess', _51 => _51.modelMap, 'optionalAccess', _52 => _52.long_context, 'optionalAccess', _53 => _53.contextThreshold]), () => ( DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD));
+  const longContextThreshold = _nullishCoalesce(_optionalChain([config, 'optionalAccess', _60 => _60.modelMap, 'optionalAccess', _61 => _61.long_context, 'optionalAccess', _62 => _62.contextThreshold]), () => ( DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD));
   if (summary.estimatedInputTokens >= longContextThreshold) {
     return "long_context";
   }
@@ -1079,7 +1120,8 @@ var SubscriptionProviderRegistry = (_class9 = class {
     const codex = this.accounts.getStrategy("codex");
     const gemini = this.accounts.getStrategy("gemini");
     const opencodego = this.accounts.getStrategy("opencodego");
-    if (!claude || !codex || !gemini || !opencodego) {
+    const kimi = this.accounts.getStrategy("kimi");
+    if (!claude || !codex || !gemini || !opencodego || !kimi) {
       throw new Error("[SubscriptionProviderRegistry] Missing strategy in SubscriptionAccountService");
     }
     this.profiles = /* @__PURE__ */ new Map([
@@ -1169,7 +1211,7 @@ var SubscriptionProviderRegistry = (_class9 = class {
           resolveUpstreamUrl: (model, config) => {
             const oc = config;
             const { half, shape } = resolveOpenCodeGoTarget(model, oc);
-            const override = half === "zen" ? _optionalChain([oc, 'optionalAccess', _54 => _54.zenBaseUrl]) : _optionalChain([oc, 'optionalAccess', _55 => _55.baseUrl]);
+            const override = half === "zen" ? _optionalChain([oc, 'optionalAccess', _63 => _63.zenBaseUrl]) : _optionalChain([oc, 'optionalAccess', _64 => _64.baseUrl]);
             return buildOpenCodeGoUrl(half, shape, override);
           },
           // zen seam (Decision 3): vary the provider transformer chain by resolved
@@ -1187,7 +1229,7 @@ var SubscriptionProviderRegistry = (_class9 = class {
           modelTransformerNames: [],
           modelMapper: (sdkModel, summary, config) => {
             const scenario = resolveOpenCodeGoScenario(summary, config);
-            const entry = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([config, 'optionalAccess', _56 => _56.modelMap, 'optionalAccess', _57 => _57[scenario]]), () => ( _optionalChain([config, 'optionalAccess', _58 => _58.modelMap, 'optionalAccess', _59 => _59.default]))), () => ( DEFAULT_OPENCODEGO_MODEL_MAP[scenario])), () => ( DEFAULT_OPENCODEGO_MODEL_MAP.default));
+            const entry = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([config, 'optionalAccess', _65 => _65.modelMap, 'optionalAccess', _66 => _66[scenario]]), () => ( _optionalChain([config, 'optionalAccess', _67 => _67.modelMap, 'optionalAccess', _68 => _68.default]))), () => ( DEFAULT_OPENCODEGO_MODEL_MAP[scenario])), () => ( DEFAULT_OPENCODEGO_MODEL_MAP.default));
             if (!entry) {
               return { resolvedModel: sdkModel, scenario };
             }
@@ -1205,7 +1247,7 @@ var SubscriptionProviderRegistry = (_class9 = class {
           // wedge permanently in half-open). When NO circuit is open this returns
           // the same first non-attempted entry as the prior `!attempted` filter.
           nextFallback: (scenario, attempted, config) => {
-            const list = _nullishCoalesce(_nullishCoalesce(_optionalChain([config, 'optionalAccess', _60 => _60.fallbacks, 'optionalAccess', _61 => _61[scenario]]), () => ( DEFAULT_OPENCODEGO_FALLBACKS[scenario])), () => ( []));
+            const list = _nullishCoalesce(_nullishCoalesce(_optionalChain([config, 'optionalAccess', _69 => _69.fallbacks, 'optionalAccess', _70 => _70[scenario]]), () => ( DEFAULT_OPENCODEGO_FALLBACKS[scenario])), () => ( []));
             for (const entry of list) {
               if (attempted.includes(entry.modelId)) continue;
               if (this.breaker.allowRequest(entry.modelId)) return entry;
@@ -1221,6 +1263,25 @@ var SubscriptionProviderRegistry = (_class9 = class {
           // profile sets it — claude / codex / gemini leave it UNSET (no-op).
           recordModelOutcome: (modelId, ok) => ok ? this.breaker.recordSuccess(modelId) : this.breaker.recordFailure(modelId)
         }
+      ],
+      [
+        "kimi",
+        {
+          providerId: "kimi",
+          displayName: "Kimi Code (Moonshot OAuth)",
+          authStrategy: kimi,
+          mode: "transformer",
+          // Kimi Code's subscription surface speaks standard Anthropic Messages
+          // at `api.kimi.com/coding/v1/messages` (plus an OpenAI chat face on
+          // /chat/completions that a BYO kimi row already covers). The messages
+          // URL ending in `/v1/messages` makes the core plan builder treat it as
+          // same-format — the SDK's Anthropic body relays verbatim, with the
+          // OAuth bearer + X-Msh-* fingerprint headers injected by the strategy.
+          resolveUpstreamUrl: () => "https://api.kimi.com/coding/v1/messages",
+          // Route-to only (Responses/Chat ingress): Unified → Anthropic Messages.
+          providerTransformerNames: ["anthropic"],
+          modelTransformerNames: []
+        }
       ]
     ]);
   }
@@ -1308,7 +1369,7 @@ var SubscriptionDispatcher = class {
       scenario = mapped.scenario;
       req.anthropicBody.model = resolvedModel;
     }
-    const upstreamUrl = _optionalChain([this, 'access', _62 => _62.profile, 'access', _63 => _63.resolveUpstreamUrl, 'optionalCall', _64 => _64(resolvedModel, ocConfig)]);
+    const upstreamUrl = _optionalChain([this, 'access', _71 => _71.profile, 'access', _72 => _72.resolveUpstreamUrl, 'optionalCall', _73 => _73(resolvedModel, ocConfig)]);
     if (!upstreamUrl) {
       throw new Error(`[SubscriptionDispatcher] profile=${this.profile.providerId} missing resolveUpstreamUrl`);
     }
@@ -1340,7 +1401,7 @@ var SubscriptionDispatcher = class {
       );
       try {
         const upstream = await this.hooks.fetchWithRetry(upstreamUrl, headers, req.anthropicBody, currentModel);
-        _optionalChain([this, 'access', _65 => _65.profile, 'access', _66 => _66.recordModelOutcome, 'optionalCall', _67 => _67(currentModel, true)]);
+        _optionalChain([this, 'access', _74 => _74.profile, 'access', _75 => _75.recordModelOutcome, 'optionalCall', _76 => _76(currentModel, true)]);
         this.markHealth(usedAccountId, 200);
         await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
         return;
@@ -1349,7 +1410,7 @@ var SubscriptionDispatcher = class {
         if (handled.retryOnce) {
           try {
             const upstream = await this.hooks.fetchWithRetry(upstreamUrl, handled.headers, req.anthropicBody, currentModel);
-            _optionalChain([this, 'access', _68 => _68.profile, 'access', _69 => _69.recordModelOutcome, 'optionalCall', _70 => _70(currentModel, true)]);
+            _optionalChain([this, 'access', _77 => _77.profile, 'access', _78 => _78.recordModelOutcome, 'optionalCall', _79 => _79(currentModel, true)]);
             this.markHealth(usedAccountId, 200);
             await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
             return;
@@ -1359,10 +1420,10 @@ var SubscriptionDispatcher = class {
           }
         }
         if (caughtErrorBreakerOutcome(err) === "failure") {
-          _optionalChain([this, 'access', _71 => _71.profile, 'access', _72 => _72.recordModelOutcome, 'optionalCall', _73 => _73(currentModel, false)]);
+          _optionalChain([this, 'access', _80 => _80.profile, 'access', _81 => _81.recordModelOutcome, 'optionalCall', _82 => _82(currentModel, false)]);
         }
         this.markHealth(usedAccountId, errStatus(err), err);
-        const next = _optionalChain([this, 'access', _74 => _74.profile, 'access', _75 => _75.nextFallback, 'optionalCall', _76 => _76(scenario, attempted, ocConfig)]);
+        const next = _optionalChain([this, 'access', _83 => _83.profile, 'access', _84 => _84.nextFallback, 'optionalCall', _85 => _85(scenario, attempted, ocConfig)]);
         if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
           throw err;
         }
@@ -1376,7 +1437,7 @@ var SubscriptionDispatcher = class {
   }
   /** Standard subscription transformer chain — Codex/Gemini/OpenCodeGo OpenAI-shape. */
   async dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey) {
-    const providerNames = _nullishCoalesce(_optionalChain([this, 'access', _77 => _77.profile, 'access', _78 => _78.resolveProviderTransformerNames, 'optionalCall', _79 => _79(resolvedModel, ocConfig)]), () => ( this.profile.providerTransformerNames));
+    const providerNames = _nullishCoalesce(_optionalChain([this, 'access', _86 => _86.profile, 'access', _87 => _87.resolveProviderTransformerNames, 'optionalCall', _88 => _88(resolvedModel, ocConfig)]), () => ( this.profile.providerTransformerNames));
     const providerTransformers = this.resolveTransformers(providerNames);
     const modelTransformers = this.resolveTransformers(this.profile.modelTransformerNames);
     const transformerProvider = {
@@ -1417,7 +1478,7 @@ var SubscriptionDispatcher = class {
       );
       try {
         const upstream = await this.hooks.fetchWithRetry(fetchUrl, headers, requestBody, currentModel);
-        _optionalChain([this, 'access', _80 => _80.profile, 'access', _81 => _81.recordModelOutcome, 'optionalCall', _82 => _82(currentModel, true)]);
+        _optionalChain([this, 'access', _89 => _89.profile, 'access', _90 => _90.recordModelOutcome, 'optionalCall', _91 => _91(currentModel, true)]);
         this.markHealth(usedAccountId, 200);
         const finalResponse = await this.hooks.executor.executeResponseChain(
           requestBody,
@@ -1433,7 +1494,7 @@ var SubscriptionDispatcher = class {
         if (handled.retryOnce) {
           try {
             const upstream = await this.hooks.fetchWithRetry(fetchUrl, handled.headers, requestBody, currentModel);
-            _optionalChain([this, 'access', _83 => _83.profile, 'access', _84 => _84.recordModelOutcome, 'optionalCall', _85 => _85(currentModel, true)]);
+            _optionalChain([this, 'access', _92 => _92.profile, 'access', _93 => _93.recordModelOutcome, 'optionalCall', _94 => _94(currentModel, true)]);
             this.markHealth(usedAccountId, 200);
             const finalResponse = await this.hooks.executor.executeResponseChain(
               requestBody,
@@ -1450,10 +1511,10 @@ var SubscriptionDispatcher = class {
           }
         }
         if (caughtErrorBreakerOutcome(err) === "failure") {
-          _optionalChain([this, 'access', _86 => _86.profile, 'access', _87 => _87.recordModelOutcome, 'optionalCall', _88 => _88(currentModel, false)]);
+          _optionalChain([this, 'access', _95 => _95.profile, 'access', _96 => _96.recordModelOutcome, 'optionalCall', _97 => _97(currentModel, false)]);
         }
         this.markHealth(usedAccountId, errStatus(err), err);
-        const next = _optionalChain([this, 'access', _89 => _89.profile, 'access', _90 => _90.nextFallback, 'optionalCall', _91 => _91(scenario, attempted, ocConfig)]);
+        const next = _optionalChain([this, 'access', _98 => _98.profile, 'access', _99 => _99.nextFallback, 'optionalCall', _100 => _100(scenario, attempted, ocConfig)]);
         if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
           throw err;
         }
@@ -1483,7 +1544,7 @@ var SubscriptionDispatcher = class {
       return { firstModel: primaryModel, attempted: [] };
     }
     const skipped = [primaryModel];
-    const firstAdmitting = _optionalChain([this, 'access', _92 => _92.profile, 'access', _93 => _93.nextFallback, 'optionalCall', _94 => _94(scenario, skipped, ocConfig)]);
+    const firstAdmitting = _optionalChain([this, 'access', _101 => _101.profile, 'access', _102 => _102.nextFallback, 'optionalCall', _103 => _103(scenario, skipped, ocConfig)]);
     if (firstAdmitting) {
       console.warn(
         `[AgentProxy:subscription] opencodego primary ${primaryModel} circuit open -> first admitting fallback ${firstAdmitting.modelId}`
@@ -1501,7 +1562,7 @@ var SubscriptionDispatcher = class {
    * successfully (caller should retry once); otherwise re-throws.
    */
   async maybeRetryAfterError(err, headers, req, resolvedModel, sessionKey) {
-    const status = _nullishCoalesce(_optionalChain([err, 'optionalAccess', _95 => _95.status]), () => ( 0));
+    const status = _nullishCoalesce(_optionalChain([err, 'optionalAccess', _104 => _104.status]), () => ( 0));
     if (status !== 401) {
       return { retryOnce: false, headers };
     }
@@ -1624,11 +1685,11 @@ var SubscriptionDispatcher = class {
 };
 var MAX_FALLBACK_ATTEMPTS_LOCAL = 3;
 function errStatus(err) {
-  const status = _optionalChain([err, 'optionalAccess', _96 => _96.status]);
+  const status = _optionalChain([err, 'optionalAccess', _105 => _105.status]);
   return typeof status === "number" ? status : null;
 }
 function errHeaders(err) {
-  const h = _optionalChain([err, 'optionalAccess', _97 => _97.headers]);
+  const h = _optionalChain([err, 'optionalAccess', _106 => _106.headers]);
   if (!h) return void 0;
   if (typeof h.get === "function") return h;
   if (typeof h === "object") return h;
@@ -1636,11 +1697,11 @@ function errHeaders(err) {
 }
 function errBodyText(err) {
   const e = err;
-  const raw = typeof _optionalChain([e, 'optionalAccess', _98 => _98.bodyText]) === "string" ? e.bodyText : typeof _optionalChain([e, 'optionalAccess', _99 => _99.body]) === "string" ? e.body : void 0;
-  return _optionalChain([raw, 'optionalAccess', _100 => _100.slice, 'call', _101 => _101(0, 2048)]);
+  const raw = typeof _optionalChain([e, 'optionalAccess', _107 => _107.bodyText]) === "string" ? e.bodyText : typeof _optionalChain([e, 'optionalAccess', _108 => _108.body]) === "string" ? e.body : void 0;
+  return _optionalChain([raw, 'optionalAccess', _109 => _109.slice, 'call', _110 => _110(0, 2048)]);
 }
 function caughtErrorBreakerOutcome(err) {
-  const status = _optionalChain([err, 'optionalAccess', _102 => _102.status]);
+  const status = _optionalChain([err, 'optionalAccess', _111 => _111.status]);
   if (typeof status !== "number") return "failure";
   if (status === 0) return "neutral";
   if (status >= 500 || status === 429) return "failure";
@@ -1797,7 +1858,7 @@ async function encodeInputImage(asset, signal) {
   try {
     bytes = await _imagegeneration.readImageAssetBytes.call(void 0, asset, MAX_INPUT_IMAGE_BYTES, signal);
   } catch (cause) {
-    if (_optionalChain([signal, 'optionalAccess', _103 => _103.aborted])) throw signal.reason;
+    if (_optionalChain([signal, 'optionalAccess', _112 => _112.aborted])) throw signal.reason;
     if (cause instanceof RangeError) {
       throw new (0, _imagegeneration.ImageGenerationError)("image_too_large", { param: "image", cause });
     }
@@ -1901,8 +1962,8 @@ async function readCandidateCodexImageResponseBody(response) {
 }
 function selectVerifiedCandidateResponseMetadata(parsed, verified) {
   return {
-    ..._optionalChain([verified, 'optionalAccess', _104 => _104.usage]) && parsed.usage ? { usage: parsed.usage } : {},
-    ..._optionalChain([verified, 'optionalAccess', _105 => _105.revisedPrompt]) && parsed.revisedPrompt ? { revisedPrompt: parsed.revisedPrompt } : {}
+    ..._optionalChain([verified, 'optionalAccess', _113 => _113.usage]) && parsed.usage ? { usage: parsed.usage } : {},
+    ..._optionalChain([verified, 'optionalAccess', _114 => _114.revisedPrompt]) && parsed.revisedPrompt ? { revisedPrompt: parsed.revisedPrompt } : {}
   };
 }
 function protocolChanged(cause) {
@@ -2032,7 +2093,7 @@ async function parseCandidateCodexImageResponse(body, expectedCount, expectedFor
       return item;
     });
     const images2 = await Promise.all(rows.map((item) => createAsset(item.b64_json, expectedFormat)));
-    const revised2 = rows.length === 1 && typeof _optionalChain([rows, 'access', _106 => _106[0], 'optionalAccess', _107 => _107.revised_prompt]) === "string" ? rows[0].revised_prompt : void 0;
+    const revised2 = rows.length === 1 && typeof _optionalChain([rows, 'access', _115 => _115[0], 'optionalAccess', _116 => _116.revised_prompt]) === "string" ? rows[0].revised_prompt : void 0;
     return {
       images: images2,
       revisedPrompt: revised2,
@@ -2048,7 +2109,7 @@ async function parseCandidateCodexImageResponse(body, expectedCount, expectedFor
     if (call.status !== "completed" || typeof call.result !== "string") return protocolChanged();
     return createAsset(call.result, expectedFormat);
   }));
-  const revised = calls.length === 1 && typeof _optionalChain([calls, 'access', _108 => _108[0], 'optionalAccess', _109 => _109.revised_prompt]) === "string" ? calls[0].revised_prompt : void 0;
+  const revised = calls.length === 1 && typeof _optionalChain([calls, 'access', _117 => _117[0], 'optionalAccess', _118 => _118.revised_prompt]) === "string" ? calls[0].revised_prompt : void 0;
   return {
     images,
     revisedPrompt: revised,
@@ -2092,7 +2153,7 @@ async function parseCandidateCodexImageSse(body, expectedCount, expectedFormat)
       }
     }
   }
-  const output = _optionalChain([completedResponse, 'optionalAccess', _110 => _110.output]);
+  const output = _optionalChain([completedResponse, 'optionalAccess', _119 => _119.output]);
   const calls = Array.isArray(output) ? output.filter(
     (item) => !!item && typeof item === "object" && !Array.isArray(item) && item.type === "image_generation_call"
   ) : [];
@@ -2103,15 +2164,15 @@ async function parseCandidateCodexImageSse(body, expectedCount, expectedFormat)
     return protocolChanged();
   }
   const images = await Promise.all(Array.from({ length: expectedCount }, async (_unused, index) => {
-    const encoded = _nullishCoalesce(_nullishCoalesce(best.get(index), () => ( completedEventResults[index])), () => ( _optionalChain([finalResults, 'access', _111 => _111[index], 'optionalAccess', _112 => _112.result])));
+    const encoded = _nullishCoalesce(_nullishCoalesce(best.get(index), () => ( completedEventResults[index])), () => ( _optionalChain([finalResults, 'access', _120 => _120[index], 'optionalAccess', _121 => _121.result])));
     if (!encoded) return protocolChanged();
     return createAsset(encoded, expectedFormat);
   }));
-  const revised = calls.length === 1 && typeof _optionalChain([calls, 'access', _113 => _113[0], 'optionalAccess', _114 => _114.revised_prompt]) === "string" ? calls[0].revised_prompt : void 0;
+  const revised = calls.length === 1 && typeof _optionalChain([calls, 'access', _122 => _122[0], 'optionalAccess', _123 => _123.revised_prompt]) === "string" ? calls[0].revised_prompt : void 0;
   return {
     images,
     revisedPrompt: revised,
-    usage: parseUsage(_optionalChain([completedResponse, 'optionalAccess', _115 => _115.usage]))
+    usage: parseUsage(_optionalChain([completedResponse, 'optionalAccess', _124 => _124.usage]))
   };
 }
 
@@ -2266,7 +2327,7 @@ var CodexSubscriptionImageProvider = (_class10 = class {
           }
           schedulerGrantSignal = schedulerGrant.signal;
           if (schedulerGrantSignal) {
-            onSchedulerAbort = () => controller.abort(_optionalChain([schedulerGrantSignal, 'optionalAccess', _116 => _116.reason]));
+            onSchedulerAbort = () => controller.abort(_optionalChain([schedulerGrantSignal, 'optionalAccess', _125 => _125.reason]));
             if (schedulerGrantSignal.aborted) onSchedulerAbort();
             else schedulerGrantSignal.addEventListener("abort", onSchedulerAbort, { once: true });
           }
@@ -2550,4 +2611,7 @@ function createCodexImageLiveVerifier(options) {
 
 
 
-exports.DEFAULT_ACCOUNT_PRIORITY = DEFAULT_ACCOUNT_PRIORITY; exports.LAST_USED_PERSIST_THROTTLE_MS = LAST_USED_PERSIST_THROTTLE_MS; exports.SESSION_AFFINITY_TTL_MS = SESSION_AFFINITY_TTL_MS; exports.SubscriptionAccountSelector = SubscriptionAccountSelector; exports.SubscriptionAccountService = SubscriptionAccountService; exports.SubscriptionDispatcher = SubscriptionDispatcher; exports.SubscriptionProviderRegistry = SubscriptionProviderRegistry; exports.claudeOAuth = _chunkUXUMAXZJcjs.claude_exports; exports.codexOAuth = _chunkUXUMAXZJcjs.codex_exports; exports.createCodexImageLiveVerifier = createCodexImageLiveVerifier; exports.createCodexSubscriptionImageProvider = createCodexSubscriptionImageProvider; exports.geminiOAuth = _chunkUXUMAXZJcjs.gemini_exports; exports.getSubscriptionAccountService = getSubscriptionAccountService; exports.getSubscriptionProviderRegistry = getSubscriptionProviderRegistry; exports.setSubscriptionAccountService = setSubscriptionAccountService; exports.setSubscriptionProviderRegistry = setSubscriptionProviderRegistry;
+
+
+
+exports.DEFAULT_ACCOUNT_PRIORITY = DEFAULT_ACCOUNT_PRIORITY; exports.LAST_USED_PERSIST_THROTTLE_MS = LAST_USED_PERSIST_THROTTLE_MS; exports.SESSION_AFFINITY_TTL_MS = SESSION_AFFINITY_TTL_MS; exports.SubscriptionAccountSelector = SubscriptionAccountSelector; exports.SubscriptionAccountService = SubscriptionAccountService; exports.SubscriptionDispatcher = SubscriptionDispatcher; exports.SubscriptionProviderRegistry = SubscriptionProviderRegistry; exports.claudeOAuth = _chunkB2LHAP4Fcjs.claude_exports; exports.codexOAuth = _chunkB2LHAP4Fcjs.codex_exports; exports.createCodexImageLiveVerifier = createCodexImageLiveVerifier; exports.createCodexSubscriptionImageProvider = createCodexSubscriptionImageProvider; exports.geminiOAuth = _chunkB2LHAP4Fcjs.gemini_exports; exports.getSubscriptionAccountService = getSubscriptionAccountService; exports.getSubscriptionProviderRegistry = getSubscriptionProviderRegistry; exports.kimiFingerprintHeaders = _chunkB2LHAP4Fcjs.kimiFingerprintHeaders; exports.kimiOAuth = _chunkB2LHAP4Fcjs.kimi_exports; exports.normalizeOpenCodeGoBaseUrl = normalizeOpenCodeGoBaseUrl; exports.setSubscriptionAccountService = setSubscriptionAccountService; exports.setSubscriptionProviderRegistry = setSubscriptionProviderRegistry;

package/dist/index.d.cts

@@ -9,7 +9,7 @@ import { TransformerChainExecutor } from '@omnicross/core/transformer/Transforme
 import { TransformerService } from '@omnicross/core/transformer/TransformerService';
 import { Transformer } from '@omnicross/core/transformer/types';
 export { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver';
-export { claudeOAuth, codexOAuth, geminiOAuth } from './oauth.cjs';
+export { claudeOAuth, codexOAuth, geminiOAuth, kimiFingerprintHeaders, kimiOAuth } from './oauth.cjs';
 import { ImageProvider } from '@omnicross/core/image-generation';
 import { ImageCapabilityEvidenceLayer, ImageQuality, ImageBackground, ImageOutputFormat, ImageModeration } from '@omnicross/contracts/image-generation-types';
 
@@ -49,6 +49,12 @@ interface SubscriptionCredentialStore {
     refreshCodexToken(): Promise<boolean>;
     /** Force a Gemini (Google) OAuth token refresh; `true` on success. */
     refreshGeminiToken(): Promise<boolean>;
+    /**
+     * Force a Kimi Code OAuth token refresh; `true` on success. OPTIONAL for
+     * lightweight test doubles (the kimi strategy catches its absence like a
+     * failed refresh) — the daemon's store implements it.
+     */
+    refreshKimiToken?(): Promise<boolean>;
     /** Current valid OpenCodeGo static API key; `null` if none. */
     getValidOpenCodeGoApiKey(): Promise<string | null>;
     /**
@@ -351,6 +357,23 @@ declare class SubscriptionDispatcher {
     private buildRequestSummary;
 }
 
+/**
+ * Default OpenCodeGo upstream URLs (both provider halves).
+ *
+ * There are two provider halves under the same account key:
+ *   - GO  (`opencode-go`):  `https://opencode.ai/zen/go/v1/...` — chat + anthropic.
+ *   - ZEN (`opencode-zen`): `https://opencode.ai/zen/v1/...`    — chat + anthropic
+ *     + responses + gemini (per-model colon-method).
+ *
+ * The user may override each half's host independently:
+ *   - `OpenCodeGoTokenConfig.baseUrl`    → GO half.
+ *   - `OpenCodeGoTokenConfig.zenBaseUrl` → ZEN half.
+ * A go-half override NEVER redirects zen traffic and vice-versa.
+ */
+
+/** Strip a trailing slash and `/v1[/]*` suffix from a user override host. */
+declare function normalizeOpenCodeGoBaseUrl(base: string): string;
+
 /** Safe evidence request; accountId is trusted-process input and must not be logged. */
 interface CodexImageCapabilityEvidenceRequest {
     readonly accountId: string;
@@ -445,4 +468,4 @@ interface CodexImageLiveVerifier {
 }
 declare function createCodexImageLiveVerifier(options: CodexImageLiveVerifierOptions): CodexImageLiveVerifier;
 
-export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, setSubscriptionAccountService, setSubscriptionProviderRegistry };
+export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, normalizeOpenCodeGoBaseUrl, setSubscriptionAccountService, setSubscriptionProviderRegistry };

package/dist/index.d.ts

@@ -9,7 +9,7 @@ import { TransformerChainExecutor } from '@omnicross/core/transformer/Transforme
 import { TransformerService } from '@omnicross/core/transformer/TransformerService';
 import { Transformer } from '@omnicross/core/transformer/types';
 export { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver';
-export { claudeOAuth, codexOAuth, geminiOAuth } from './oauth.js';
+export { claudeOAuth, codexOAuth, geminiOAuth, kimiFingerprintHeaders, kimiOAuth } from './oauth.js';
 import { ImageProvider } from '@omnicross/core/image-generation';
 import { ImageCapabilityEvidenceLayer, ImageQuality, ImageBackground, ImageOutputFormat, ImageModeration } from '@omnicross/contracts/image-generation-types';
 
@@ -49,6 +49,12 @@ interface SubscriptionCredentialStore {
     refreshCodexToken(): Promise<boolean>;
     /** Force a Gemini (Google) OAuth token refresh; `true` on success. */
     refreshGeminiToken(): Promise<boolean>;
+    /**
+     * Force a Kimi Code OAuth token refresh; `true` on success. OPTIONAL for
+     * lightweight test doubles (the kimi strategy catches its absence like a
+     * failed refresh) — the daemon's store implements it.
+     */
+    refreshKimiToken?(): Promise<boolean>;
     /** Current valid OpenCodeGo static API key; `null` if none. */
     getValidOpenCodeGoApiKey(): Promise<string | null>;
     /**
@@ -351,6 +357,23 @@ declare class SubscriptionDispatcher {
     private buildRequestSummary;
 }
 
+/**
+ * Default OpenCodeGo upstream URLs (both provider halves).
+ *
+ * There are two provider halves under the same account key:
+ *   - GO  (`opencode-go`):  `https://opencode.ai/zen/go/v1/...` — chat + anthropic.
+ *   - ZEN (`opencode-zen`): `https://opencode.ai/zen/v1/...`    — chat + anthropic
+ *     + responses + gemini (per-model colon-method).
+ *
+ * The user may override each half's host independently:
+ *   - `OpenCodeGoTokenConfig.baseUrl`    → GO half.
+ *   - `OpenCodeGoTokenConfig.zenBaseUrl` → ZEN half.
+ * A go-half override NEVER redirects zen traffic and vice-versa.
+ */
+
+/** Strip a trailing slash and `/v1[/]*` suffix from a user override host. */
+declare function normalizeOpenCodeGoBaseUrl(base: string): string;
+
 /** Safe evidence request; accountId is trusted-process input and must not be logged. */
 interface CodexImageCapabilityEvidenceRequest {
     readonly accountId: string;
@@ -445,4 +468,4 @@ interface CodexImageLiveVerifier {
 }
 declare function createCodexImageLiveVerifier(options: CodexImageLiveVerifierOptions): CodexImageLiveVerifier;
 
-export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, setSubscriptionAccountService, setSubscriptionProviderRegistry };
+export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, normalizeOpenCodeGoBaseUrl, setSubscriptionAccountService, setSubscriptionProviderRegistry };