@omnicross/subscriptions 0.2.1 → 0.3.1

package/dist/index.js

@@ -1,8 +1,10 @@
 import {
   claude_exports,
   codex_exports,
-  gemini_exports
-} from "./chunk-4HYDPKHR.js";
+  gemini_exports,
+  kimiFingerprintHeaders,
+  kimi_exports
+} from "./chunk-ZB3GA2Y2.js";
 import {
   accountSupportsModel,
   remapReportForAccount
@@ -125,13 +127,15 @@ var ACCOUNTS_KEY = {
   claude: "claudeAccounts",
   codex: "codexAccounts",
   gemini: "geminiAccounts",
-  opencodego: "opencodegoAccounts"
+  opencodego: "opencodegoAccounts",
+  kimi: "kimiAccounts"
 };
 var ACTIVE_KEY = {
   claude: "activeClaudeAccountId",
   codex: "activeCodexAccountId",
   gemini: "activeGeminiAccountId",
-  opencodego: "activeOpencodegoAccountId"
+  opencodego: "activeOpencodegoAccountId",
+  kimi: "activeKimiAccountId"
 };
 function gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById) {
   if (!health && !resolvedModel || accounts.length < 2) return accounts;
@@ -421,13 +425,17 @@ var OAuthBearerAuthStrategy = class {
       return;
     }
     headers["Authorization"] = `Bearer ${token}`;
+    if (this.providerId === "kimi") {
+      const deviceId = await this.resolveKimiDeviceId(hints?.sessionKey);
+      Object.assign(headers, kimiFingerprintHeaders(deviceId));
+    }
   }
   async onUnauthorized(sessionKey) {
     const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, this.providerId, sessionKey);
     if (byId !== null) return byId;
     return this.mutex.run(`${this.providerId}:refresh`, async () => {
       try {
-        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+        return this.refreshActive();
       } catch (err) {
         console.warn(`[OAuthBearerAuthStrategy] ${this.providerId} refresh failed:`, err);
         return false;
@@ -436,7 +444,7 @@ var OAuthBearerAuthStrategy = class {
   }
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
-    const entry = this.providerId === "codex" ? config.codex : config.gemini;
+    const entry = this.tokenBlock(config);
     if (!entry?.accessToken) {
       return { providerId: this.providerId, ok: false, reason: "missing-credential" };
     }
@@ -453,22 +461,53 @@ var OAuthBearerAuthStrategy = class {
   /** Read the current token, refreshing in-line if it's within the lead window. */
   async resolveAccessToken() {
     const config = await this.tokens.getFullConfig();
-    const entry = this.providerId === "codex" ? config.codex : config.gemini;
+    const entry = this.tokenBlock(config);
     if (!entry?.accessToken) return null;
     const expiresAtMs = entry.expiresAt ? new Date(entry.expiresAt).getTime() : 0;
     const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - REFRESH_LEAD_MS;
     if (expiringSoon && entry.refreshToken) {
       const refreshed = await this.mutex.run(`${this.providerId}:refresh`, async () => {
-        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+        return this.refreshActive();
       });
       if (!refreshed) return null;
       const fresh = await this.tokens.getFullConfig();
-      const freshEntry = this.providerId === "codex" ? fresh.codex : fresh.gemini;
-      return freshEntry?.accessToken ?? null;
+      return this.tokenBlock(fresh)?.accessToken ?? null;
     }
     if (entry.status === "expired") return null;
     return entry.accessToken;
   }
+  /** The active account's refresh, dispatched per provider. */
+  refreshActive() {
+    switch (this.providerId) {
+      case "codex":
+        return this.tokens.refreshCodexToken();
+      case "gemini":
+        return this.tokens.refreshGeminiToken();
+      case "kimi":
+        return this.tokens.refreshKimiToken ? this.tokens.refreshKimiToken() : Promise.resolve(false);
+    }
+  }
+  tokenBlock(config) {
+    switch (this.providerId) {
+      case "codex":
+        return config.codex;
+      case "gemini":
+        return config.gemini;
+      case "kimi":
+        return config.kimi;
+    }
+  }
+  /**
+   * Best-effort device id for the fingerprint header. Selection already ran in
+   * `applyHeaders`; rather than re-deriving it, read the active block's id (a
+   * pool-served non-active account momentarily reports the active id — the
+   * header is per-INSTALL identity, so this is cosmetic, not auth).
+   */
+  async resolveKimiDeviceId(_sessionKey) {
+    void _sessionKey;
+    const config = await this.tokens.getFullConfig();
+    return config.kimi?.deviceId ?? config.kimiAccounts?.[0]?.tokens.deviceId;
+  }
 };
 
 // src/auth/PassThroughAuthStrategy.ts
@@ -615,7 +654,8 @@ var DISPLAY_NAMES = {
   claude: "Claude (Anthropic OAuth)",
   codex: "Codex (ChatGPT OAuth)",
   gemini: "Gemini (Google OAuth)",
-  opencodego: "OpenCodeGo (Bearer key)"
+  opencodego: "OpenCodeGo (Bearer key)",
+  kimi: "Kimi Code (Moonshot OAuth)"
 };
 var SubscriptionAccountService = class {
   mutex = new RefreshMutex();
@@ -629,7 +669,8 @@ var SubscriptionAccountService = class {
       ["claude", new PassThroughAuthStrategy(tokens, this.mutex, this.selector, health)],
       ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex, this.selector, health)],
       ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex, this.selector, health)],
-      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)]
+      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)],
+      ["kimi", new OAuthBearerAuthStrategy("kimi", tokens, this.mutex, this.selector, health)]
     ]);
   }
   /** Returns the strategy bound to a subscription provider, or `null` for unknown ids. */
@@ -1079,7 +1120,8 @@ var SubscriptionProviderRegistry = class {
     const codex = this.accounts.getStrategy("codex");
     const gemini = this.accounts.getStrategy("gemini");
     const opencodego = this.accounts.getStrategy("opencodego");
-    if (!claude || !codex || !gemini || !opencodego) {
+    const kimi = this.accounts.getStrategy("kimi");
+    if (!claude || !codex || !gemini || !opencodego || !kimi) {
       throw new Error("[SubscriptionProviderRegistry] Missing strategy in SubscriptionAccountService");
     }
     this.profiles = /* @__PURE__ */ new Map([
@@ -1221,6 +1263,25 @@ var SubscriptionProviderRegistry = class {
           // profile sets it — claude / codex / gemini leave it UNSET (no-op).
           recordModelOutcome: (modelId, ok) => ok ? this.breaker.recordSuccess(modelId) : this.breaker.recordFailure(modelId)
         }
+      ],
+      [
+        "kimi",
+        {
+          providerId: "kimi",
+          displayName: "Kimi Code (Moonshot OAuth)",
+          authStrategy: kimi,
+          mode: "transformer",
+          // Kimi Code's subscription surface speaks standard Anthropic Messages
+          // at `api.kimi.com/coding/v1/messages` (plus an OpenAI chat face on
+          // /chat/completions that a BYO kimi row already covers). The messages
+          // URL ending in `/v1/messages` makes the core plan builder treat it as
+          // same-format — the SDK's Anthropic body relays verbatim, with the
+          // OAuth bearer + X-Msh-* fingerprint headers injected by the strategy.
+          resolveUpstreamUrl: () => "https://api.kimi.com/coding/v1/messages",
+          // Route-to only (Responses/Chat ingress): Unified → Anthropic Messages.
+          providerTransformerNames: ["anthropic"],
+          modelTransformerNames: []
+        }
       ]
     ]);
   }
@@ -2548,6 +2609,9 @@ export {
   gemini_exports as geminiOAuth,
   getSubscriptionAccountService,
   getSubscriptionProviderRegistry,
+  kimiFingerprintHeaders,
+  kimi_exports as kimiOAuth,
+  normalizeOpenCodeGoBaseUrl,
   setSubscriptionAccountService,
   setSubscriptionProviderRegistry
 };

package/dist/oauth.cjs

@@ -2,10 +2,14 @@
 
 
 
-var _chunkUXUMAXZJcjs = require('./chunk-UXUMAXZJ.cjs');
+
+
+var _chunkB2LHAP4Fcjs = require('./chunk-B2LHAP4F.cjs');
 require('./chunk-75ZPJI57.cjs');
 
 
 
 
-exports.claudeOAuth = _chunkUXUMAXZJcjs.claude_exports; exports.codexOAuth = _chunkUXUMAXZJcjs.codex_exports; exports.geminiOAuth = _chunkUXUMAXZJcjs.gemini_exports;
+
+
+exports.claudeOAuth = _chunkB2LHAP4Fcjs.claude_exports; exports.codexOAuth = _chunkB2LHAP4Fcjs.codex_exports; exports.geminiOAuth = _chunkB2LHAP4Fcjs.gemini_exports; exports.kimiFingerprintHeaders = _chunkB2LHAP4Fcjs.kimiFingerprintHeaders; exports.kimiOAuth = _chunkB2LHAP4Fcjs.kimi_exports;

package/dist/oauth.d.cts

@@ -2,6 +2,123 @@ import { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver'
 export { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver';
 import { TokenExchangeRequest, OAuthParams } from '@omnicross/contracts/account-tokens-types';
 
+/**
+ * Kimi Code OAuth flow — RFC 8628 device authorization grant (host-clean).
+ *
+ * Matches the official Kimi CLI's client at `auth.kimi.com`: a form-encoded
+ * device-authorization request, the user approving at `verification_uri`, and a
+ * polled token request whose RFC error codes (`authorization_pending` /
+ * `slow_down` / `expired_token` / `access_denied`) arrive as HTTP 400 bodies —
+ * which is why the poll does NOT use `postForm` (that helper rejects on
+ * `error`). No PKCE, no client secret, no scopes. Refresh is a standard
+ * `refresh_token` grant on the same endpoint.
+ *
+ * The access token's JWT payload carries `user_id` (fallback `sub`) — that is
+ * the account id. Inference and the `/coding/v1/usages` quota endpoint ride
+ * `api.kimi.com/coding/v1`; every Kimi request also carries the
+ * `X-Msh-*` fingerprint headers (`kimiFingerprintHeaders`).
+ *
+ * @module @omnicross/subscriptions/oauth/flows/kimi
+ */
+
+/** Kimi CLI OAuth configuration (public client, matches the official CLI). */
+declare const KIMI_OAUTH_CONFIG: {
+    readonly clientId: "17e5f671-d194-4dfb-9706-5516cb48c098";
+    readonly deviceAuthorizationEndpoint: "https://auth.kimi.com/api/oauth/device_authorization";
+    readonly tokenEndpoint: "https://auth.kimi.com/api/oauth/token";
+};
+/**
+ * The client version reported in `User-Agent`/`X-Msh-Version`. Kimi's backend
+ * gates on the CLI identity; this mirrors a current official CLI version.
+ * Overridable via `KIMI_CLI_VERSION` when the upstream moves.
+ */
+declare const KIMI_CLI_VERSION: string;
+/** Device-authorization response (RFC 8628 §3.2). */
+interface KimiDeviceAuthorization {
+    userCode: string;
+    deviceCode: string;
+    /** Preferred: pre-fills the code when opened in the user's browser. */
+    verificationUri: string;
+    verificationUriComplete?: string;
+    /** Poll interval in seconds (RFC default 5). */
+    interval?: number;
+    /** Lifetime in seconds. */
+    expiresIn?: number;
+}
+/** One polled token attempt's outcome. */
+type KimiDevicePoll = {
+    state: 'pending';
+    intervalSeconds?: number;
+} | {
+    state: 'done';
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+} | {
+    state: 'failed';
+    message: string;
+};
+/**
+ * The fingerprint headers every Kimi API request carries (auth, inference,
+ * usage). `deviceId` is the per-account stable device id stored on the token
+ * config — NOT a host-global value, so two accounts on one install present two
+ * device identities, matching how the CLI scopes its `kimi-device-id` file per
+ * credential store.
+ */
+declare function kimiFingerprintHeaders(deviceId: string | undefined): Record<string, string>;
+/** Mint the stable per-account device id (hex UUID, no dashes). */
+declare function generateKimiDeviceId(): string;
+/** Request a device code the user approves at `verification_uri`. */
+declare function requestDeviceAuthorization(fetchImpl: FetchLike, fingerprint?: Record<string, string>): Promise<KimiDeviceAuthorization>;
+/**
+ * Poll the token endpoint ONCE. RFC 8628 §3.5 semantics: `authorization_pending`
+ * keeps polling, `slow_down` adds 5s to the interval, anything else fails. The
+ * error codes arrive on HTTP 400 with an `error` JSON field, so this deliberately
+ * does NOT route through `postForm` (which rejects on any `error` body).
+ */
+declare function pollDeviceToken(deviceCode: string, fetchImpl: FetchLike, fingerprint?: Record<string, string>): Promise<KimiDevicePoll>;
+/**
+ * Drive the device-code login to completion: poll at the device flow's interval
+ * (`slow_down` +5s each time) until done/expired/denied or `deadlineMs` elapses.
+ * `onPending` fires after each pending poll (so a CLI can render a spinner).
+ */
+declare function awaitDeviceToken(authorization: KimiDeviceAuthorization, fetchImpl: FetchLike, options?: {
+    fingerprint?: Record<string, string>;
+    intervalMs?: number;
+    deadlineMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    onPending?: () => void;
+}): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+/** Refresh the access token with a `refresh_token` grant. */
+declare function refreshAccessToken$3(refreshToken: string, fetchImpl: FetchLike, fingerprint?: Record<string, string>): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+/**
+ * Decode the access-token JWT's `user_id | sub` claim (no verification — the
+ * issuer is trusted; we only read an id).
+ */
+declare function kimiAccountIdFromAccessToken(accessToken: string): string | undefined;
+
+declare const kimi_KIMI_CLI_VERSION: typeof KIMI_CLI_VERSION;
+declare const kimi_KIMI_OAUTH_CONFIG: typeof KIMI_OAUTH_CONFIG;
+type kimi_KimiDeviceAuthorization = KimiDeviceAuthorization;
+type kimi_KimiDevicePoll = KimiDevicePoll;
+declare const kimi_awaitDeviceToken: typeof awaitDeviceToken;
+declare const kimi_generateKimiDeviceId: typeof generateKimiDeviceId;
+declare const kimi_kimiAccountIdFromAccessToken: typeof kimiAccountIdFromAccessToken;
+declare const kimi_kimiFingerprintHeaders: typeof kimiFingerprintHeaders;
+declare const kimi_pollDeviceToken: typeof pollDeviceToken;
+declare const kimi_requestDeviceAuthorization: typeof requestDeviceAuthorization;
+declare namespace kimi {
+  export { kimi_KIMI_CLI_VERSION as KIMI_CLI_VERSION, kimi_KIMI_OAUTH_CONFIG as KIMI_OAUTH_CONFIG, type kimi_KimiDeviceAuthorization as KimiDeviceAuthorization, type kimi_KimiDevicePoll as KimiDevicePoll, kimi_awaitDeviceToken as awaitDeviceToken, kimi_generateKimiDeviceId as generateKimiDeviceId, kimi_kimiAccountIdFromAccessToken as kimiAccountIdFromAccessToken, kimi_kimiFingerprintHeaders as kimiFingerprintHeaders, kimi_pollDeviceToken as pollDeviceToken, refreshAccessToken$3 as refreshAccessToken, kimi_requestDeviceAuthorization as requestDeviceAuthorization };
+}
+
 /**
  * Claude OAuth flow — host-clean PKCE logic.
  *
@@ -123,4 +240,4 @@ declare namespace gemini {
   export { gemini_exchangeCodeForTokens as exchangeCodeForTokens, gemini_generateAuthParams as generateAuthParams, gemini_refreshAccessToken as refreshAccessToken };
 }
 
-export { claude as claudeOAuth, codex as codexOAuth, gemini as geminiOAuth };
+export { claude as claudeOAuth, codex as codexOAuth, gemini as geminiOAuth, kimiFingerprintHeaders, kimi as kimiOAuth };

package/dist/oauth.d.ts

@@ -2,6 +2,123 @@ import { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver'
 export { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver';
 import { TokenExchangeRequest, OAuthParams } from '@omnicross/contracts/account-tokens-types';
 
+/**
+ * Kimi Code OAuth flow — RFC 8628 device authorization grant (host-clean).
+ *
+ * Matches the official Kimi CLI's client at `auth.kimi.com`: a form-encoded
+ * device-authorization request, the user approving at `verification_uri`, and a
+ * polled token request whose RFC error codes (`authorization_pending` /
+ * `slow_down` / `expired_token` / `access_denied`) arrive as HTTP 400 bodies —
+ * which is why the poll does NOT use `postForm` (that helper rejects on
+ * `error`). No PKCE, no client secret, no scopes. Refresh is a standard
+ * `refresh_token` grant on the same endpoint.
+ *
+ * The access token's JWT payload carries `user_id` (fallback `sub`) — that is
+ * the account id. Inference and the `/coding/v1/usages` quota endpoint ride
+ * `api.kimi.com/coding/v1`; every Kimi request also carries the
+ * `X-Msh-*` fingerprint headers (`kimiFingerprintHeaders`).
+ *
+ * @module @omnicross/subscriptions/oauth/flows/kimi
+ */
+
+/** Kimi CLI OAuth configuration (public client, matches the official CLI). */
+declare const KIMI_OAUTH_CONFIG: {
+    readonly clientId: "17e5f671-d194-4dfb-9706-5516cb48c098";
+    readonly deviceAuthorizationEndpoint: "https://auth.kimi.com/api/oauth/device_authorization";
+    readonly tokenEndpoint: "https://auth.kimi.com/api/oauth/token";
+};
+/**
+ * The client version reported in `User-Agent`/`X-Msh-Version`. Kimi's backend
+ * gates on the CLI identity; this mirrors a current official CLI version.
+ * Overridable via `KIMI_CLI_VERSION` when the upstream moves.
+ */
+declare const KIMI_CLI_VERSION: string;
+/** Device-authorization response (RFC 8628 §3.2). */
+interface KimiDeviceAuthorization {
+    userCode: string;
+    deviceCode: string;
+    /** Preferred: pre-fills the code when opened in the user's browser. */
+    verificationUri: string;
+    verificationUriComplete?: string;
+    /** Poll interval in seconds (RFC default 5). */
+    interval?: number;
+    /** Lifetime in seconds. */
+    expiresIn?: number;
+}
+/** One polled token attempt's outcome. */
+type KimiDevicePoll = {
+    state: 'pending';
+    intervalSeconds?: number;
+} | {
+    state: 'done';
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+} | {
+    state: 'failed';
+    message: string;
+};
+/**
+ * The fingerprint headers every Kimi API request carries (auth, inference,
+ * usage). `deviceId` is the per-account stable device id stored on the token
+ * config — NOT a host-global value, so two accounts on one install present two
+ * device identities, matching how the CLI scopes its `kimi-device-id` file per
+ * credential store.
+ */
+declare function kimiFingerprintHeaders(deviceId: string | undefined): Record<string, string>;
+/** Mint the stable per-account device id (hex UUID, no dashes). */
+declare function generateKimiDeviceId(): string;
+/** Request a device code the user approves at `verification_uri`. */
+declare function requestDeviceAuthorization(fetchImpl: FetchLike, fingerprint?: Record<string, string>): Promise<KimiDeviceAuthorization>;
+/**
+ * Poll the token endpoint ONCE. RFC 8628 §3.5 semantics: `authorization_pending`
+ * keeps polling, `slow_down` adds 5s to the interval, anything else fails. The
+ * error codes arrive on HTTP 400 with an `error` JSON field, so this deliberately
+ * does NOT route through `postForm` (which rejects on any `error` body).
+ */
+declare function pollDeviceToken(deviceCode: string, fetchImpl: FetchLike, fingerprint?: Record<string, string>): Promise<KimiDevicePoll>;
+/**
+ * Drive the device-code login to completion: poll at the device flow's interval
+ * (`slow_down` +5s each time) until done/expired/denied or `deadlineMs` elapses.
+ * `onPending` fires after each pending poll (so a CLI can render a spinner).
+ */
+declare function awaitDeviceToken(authorization: KimiDeviceAuthorization, fetchImpl: FetchLike, options?: {
+    fingerprint?: Record<string, string>;
+    intervalMs?: number;
+    deadlineMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    onPending?: () => void;
+}): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+/** Refresh the access token with a `refresh_token` grant. */
+declare function refreshAccessToken$3(refreshToken: string, fetchImpl: FetchLike, fingerprint?: Record<string, string>): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
+/**
+ * Decode the access-token JWT's `user_id | sub` claim (no verification — the
+ * issuer is trusted; we only read an id).
+ */
+declare function kimiAccountIdFromAccessToken(accessToken: string): string | undefined;
+
+declare const kimi_KIMI_CLI_VERSION: typeof KIMI_CLI_VERSION;
+declare const kimi_KIMI_OAUTH_CONFIG: typeof KIMI_OAUTH_CONFIG;
+type kimi_KimiDeviceAuthorization = KimiDeviceAuthorization;
+type kimi_KimiDevicePoll = KimiDevicePoll;
+declare const kimi_awaitDeviceToken: typeof awaitDeviceToken;
+declare const kimi_generateKimiDeviceId: typeof generateKimiDeviceId;
+declare const kimi_kimiAccountIdFromAccessToken: typeof kimiAccountIdFromAccessToken;
+declare const kimi_kimiFingerprintHeaders: typeof kimiFingerprintHeaders;
+declare const kimi_pollDeviceToken: typeof pollDeviceToken;
+declare const kimi_requestDeviceAuthorization: typeof requestDeviceAuthorization;
+declare namespace kimi {
+  export { kimi_KIMI_CLI_VERSION as KIMI_CLI_VERSION, kimi_KIMI_OAUTH_CONFIG as KIMI_OAUTH_CONFIG, type kimi_KimiDeviceAuthorization as KimiDeviceAuthorization, type kimi_KimiDevicePoll as KimiDevicePoll, kimi_awaitDeviceToken as awaitDeviceToken, kimi_generateKimiDeviceId as generateKimiDeviceId, kimi_kimiAccountIdFromAccessToken as kimiAccountIdFromAccessToken, kimi_kimiFingerprintHeaders as kimiFingerprintHeaders, kimi_pollDeviceToken as pollDeviceToken, refreshAccessToken$3 as refreshAccessToken, kimi_requestDeviceAuthorization as requestDeviceAuthorization };
+}
+
 /**
  * Claude OAuth flow — host-clean PKCE logic.
  *
@@ -123,4 +240,4 @@ declare namespace gemini {
   export { gemini_exchangeCodeForTokens as exchangeCodeForTokens, gemini_generateAuthParams as generateAuthParams, gemini_refreshAccessToken as refreshAccessToken };
 }
 
-export { claude as claudeOAuth, codex as codexOAuth, gemini as geminiOAuth };
+export { claude as claudeOAuth, codex as codexOAuth, gemini as geminiOAuth, kimiFingerprintHeaders, kimi as kimiOAuth };

package/dist/oauth.js

@@ -1,11 +1,15 @@
 import {
   claude_exports,
   codex_exports,
-  gemini_exports
-} from "./chunk-4HYDPKHR.js";
+  gemini_exports,
+  kimiFingerprintHeaders,
+  kimi_exports
+} from "./chunk-ZB3GA2Y2.js";
 import "./chunk-MLKGABMK.js";
 export {
   claude_exports as claudeOAuth,
   codex_exports as codexOAuth,
-  gemini_exports as geminiOAuth
+  gemini_exports as geminiOAuth,
+  kimiFingerprintHeaders,
+  kimi_exports as kimiOAuth
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnicross/subscriptions",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Omnicross subscription-as-provider auth strategies, OAuth flows, and the OpenCodeGo scenario dispatcher.",
   "license": "MIT",
   "author": "Sayo (https://github.com/Dumoedss)",
@@ -52,8 +52,8 @@
     "typecheck": "tsc -p tsconfig.typecheck.json --noEmit"
   },
   "dependencies": {
-    "@omnicross/contracts": "^0.2.1",
-    "@omnicross/core": "^0.2.1",
+    "@omnicross/contracts": "^0.3.1",
+    "@omnicross/core": "^0.3.1",
     "js-tiktoken": "^1.0.21",
     "sharp": "^0.35.4"
   }