@omnicross/subscriptions 0.3.0 → 0.4.0

package/dist/index.d.cts

@@ -9,7 +9,7 @@ import { TransformerChainExecutor } from '@omnicross/core/transformer/Transforme
 import { TransformerService } from '@omnicross/core/transformer/TransformerService';
 import { Transformer } from '@omnicross/core/transformer/types';
 export { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver';
-export { claudeOAuth, codexOAuth, geminiOAuth } from './oauth.cjs';
+export { COPILOT_GITHUB_HEADERS, claudeOAuth, codexOAuth, copilotOAuth, geminiOAuth, grokOAuth, kimiFingerprintHeaders, kimiOAuth } from './oauth.cjs';
 import { ImageProvider } from '@omnicross/core/image-generation';
 import { ImageCapabilityEvidenceLayer, ImageQuality, ImageBackground, ImageOutputFormat, ImageModeration } from '@omnicross/contracts/image-generation-types';
 
@@ -49,6 +49,23 @@ interface SubscriptionCredentialStore {
     refreshCodexToken(): Promise<boolean>;
     /** Force a Gemini (Google) OAuth token refresh; `true` on success. */
     refreshGeminiToken(): Promise<boolean>;
+    /**
+     * Force a Kimi Code OAuth token refresh; `true` on success. OPTIONAL for
+     * lightweight test doubles (the kimi strategy catches its absence like a
+     * failed refresh) — the daemon's store implements it.
+     */
+    refreshKimiToken?(): Promise<boolean>;
+    /**
+     * Force a Grok (xAI SuperGrok) OAuth token refresh; `true` on success.
+     * OPTIONAL for lightweight test doubles (the grok strategy catches its
+     * absence like a failed refresh) — the daemon's store implements it.
+     */
+    refreshGrokToken?(): Promise<boolean>;
+    /**
+     * "Refresh" a GitHub Copilot token — a LOCAL no-op (ghu_ tokens are
+     * long-lived with no exchange endpoint). OPTIONAL like the others.
+     */
+    refreshCopilotToken?(): Promise<boolean>;
     /** Current valid OpenCodeGo static API key; `null` if none. */
     getValidOpenCodeGoApiKey(): Promise<string | null>;
     /**
@@ -351,6 +368,62 @@ declare class SubscriptionDispatcher {
     private buildRequestSummary;
 }
 
+/**
+ * GitHub Copilot model-wire map — which of the catalog's three wires each
+ * served model rides, and the per-wire upstream path + provider transformer
+ * chain. Verified ids/wires from the audit source's frozen census; models are
+ * grouped by wire exactly as `SUBSCRIPTION_MODEL_CATALOG.copilot` lists them.
+ *
+ * The three faces live on ONE host (the Copilot API base):
+ *  - anthropic-messages → `/v1/messages`   (Claude family; same-format relay
+ *    for Anthropic-shape clients — the URL suffix is what the core plan
+ *    builder keys same-format detection on)
+ *  - openai-responses    → `/v1/responses`
+ *  - openai chat         → `/v1/chat/completions`
+ *
+ * @module @omnicross/subscriptions/copilot/models
+ */
+/** The three Copilot wire shapes. */
+type CopilotWire = 'anthropic' | 'responses' | 'chat';
+/** Classify a resolved model id; UNKNOWN ids fall to the responses wire (the
+ *  newest models land there first). */
+declare function copilotWireFor(modelId: string): CopilotWire;
+/** The per-wire upstream PATH under the Copilot API base. */
+declare function copilotPathFor(wire: CopilotWire): string;
+/** The per-wire provider transformer chain (mirrors the opencodego shape seam). */
+declare function copilotTransformerNamesForWire(wire: CopilotWire): readonly string[];
+/** Resolve the account-effective Copilot API base (discovered endpoint wins). */
+declare function copilotBaseUrl(config: {
+    apiEndpoint?: string;
+    enterpriseUrl?: string;
+} | undefined): string;
+/**
+ * The GitHub REST base for an account (identity / quota / discovery probes).
+ * GHE domains route to `api.<domain>` — the data-residency plane convention
+ * (e.g. `company.ghe.com` → `api.company.ghe.com`); an explicit scheme or
+ * `api.` prefix is honored verbatim, personal accounts stay on api.github.com.
+ * Self-hosted GHES `/api/v3` path-style hosts are NOT derived here — pass the
+ * full `api.<host>` (or scheme-qualified) form via `enterpriseUrl`.
+ */
+declare function copilotGitHubApiBase(enterpriseUrl?: string): string;
+
+/**
+ * Default OpenCodeGo upstream URLs (both provider halves).
+ *
+ * There are two provider halves under the same account key:
+ *   - GO  (`opencode-go`):  `https://opencode.ai/zen/go/v1/...` — chat + anthropic.
+ *   - ZEN (`opencode-zen`): `https://opencode.ai/zen/v1/...`    — chat + anthropic
+ *     + responses + gemini (per-model colon-method).
+ *
+ * The user may override each half's host independently:
+ *   - `OpenCodeGoTokenConfig.baseUrl`    → GO half.
+ *   - `OpenCodeGoTokenConfig.zenBaseUrl` → ZEN half.
+ * A go-half override NEVER redirects zen traffic and vice-versa.
+ */
+
+/** Strip a trailing slash and `/v1[/]*` suffix from a user override host. */
+declare function normalizeOpenCodeGoBaseUrl(base: string): string;
+
 /** Safe evidence request; accountId is trusted-process input and must not be logged. */
 interface CodexImageCapabilityEvidenceRequest {
     readonly accountId: string;
@@ -445,4 +518,4 @@ interface CodexImageLiveVerifier {
 }
 declare function createCodexImageLiveVerifier(options: CodexImageLiveVerifierOptions): CodexImageLiveVerifier;
 
-export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, setSubscriptionAccountService, setSubscriptionProviderRegistry };
+export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, copilotBaseUrl, copilotGitHubApiBase, copilotPathFor, copilotTransformerNamesForWire, copilotWireFor, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, normalizeOpenCodeGoBaseUrl, setSubscriptionAccountService, setSubscriptionProviderRegistry };

package/dist/index.d.ts

@@ -9,7 +9,7 @@ import { TransformerChainExecutor } from '@omnicross/core/transformer/Transforme
 import { TransformerService } from '@omnicross/core/transformer/TransformerService';
 import { Transformer } from '@omnicross/core/transformer/types';
 export { FetchLike } from '@omnicross/core/auth/GeminiCodeAssistProjectResolver';
-export { claudeOAuth, codexOAuth, geminiOAuth } from './oauth.js';
+export { COPILOT_GITHUB_HEADERS, claudeOAuth, codexOAuth, copilotOAuth, geminiOAuth, grokOAuth, kimiFingerprintHeaders, kimiOAuth } from './oauth.js';
 import { ImageProvider } from '@omnicross/core/image-generation';
 import { ImageCapabilityEvidenceLayer, ImageQuality, ImageBackground, ImageOutputFormat, ImageModeration } from '@omnicross/contracts/image-generation-types';
 
@@ -49,6 +49,23 @@ interface SubscriptionCredentialStore {
     refreshCodexToken(): Promise<boolean>;
     /** Force a Gemini (Google) OAuth token refresh; `true` on success. */
     refreshGeminiToken(): Promise<boolean>;
+    /**
+     * Force a Kimi Code OAuth token refresh; `true` on success. OPTIONAL for
+     * lightweight test doubles (the kimi strategy catches its absence like a
+     * failed refresh) — the daemon's store implements it.
+     */
+    refreshKimiToken?(): Promise<boolean>;
+    /**
+     * Force a Grok (xAI SuperGrok) OAuth token refresh; `true` on success.
+     * OPTIONAL for lightweight test doubles (the grok strategy catches its
+     * absence like a failed refresh) — the daemon's store implements it.
+     */
+    refreshGrokToken?(): Promise<boolean>;
+    /**
+     * "Refresh" a GitHub Copilot token — a LOCAL no-op (ghu_ tokens are
+     * long-lived with no exchange endpoint). OPTIONAL like the others.
+     */
+    refreshCopilotToken?(): Promise<boolean>;
     /** Current valid OpenCodeGo static API key; `null` if none. */
     getValidOpenCodeGoApiKey(): Promise<string | null>;
     /**
@@ -351,6 +368,62 @@ declare class SubscriptionDispatcher {
     private buildRequestSummary;
 }
 
+/**
+ * GitHub Copilot model-wire map — which of the catalog's three wires each
+ * served model rides, and the per-wire upstream path + provider transformer
+ * chain. Verified ids/wires from the audit source's frozen census; models are
+ * grouped by wire exactly as `SUBSCRIPTION_MODEL_CATALOG.copilot` lists them.
+ *
+ * The three faces live on ONE host (the Copilot API base):
+ *  - anthropic-messages → `/v1/messages`   (Claude family; same-format relay
+ *    for Anthropic-shape clients — the URL suffix is what the core plan
+ *    builder keys same-format detection on)
+ *  - openai-responses    → `/v1/responses`
+ *  - openai chat         → `/v1/chat/completions`
+ *
+ * @module @omnicross/subscriptions/copilot/models
+ */
+/** The three Copilot wire shapes. */
+type CopilotWire = 'anthropic' | 'responses' | 'chat';
+/** Classify a resolved model id; UNKNOWN ids fall to the responses wire (the
+ *  newest models land there first). */
+declare function copilotWireFor(modelId: string): CopilotWire;
+/** The per-wire upstream PATH under the Copilot API base. */
+declare function copilotPathFor(wire: CopilotWire): string;
+/** The per-wire provider transformer chain (mirrors the opencodego shape seam). */
+declare function copilotTransformerNamesForWire(wire: CopilotWire): readonly string[];
+/** Resolve the account-effective Copilot API base (discovered endpoint wins). */
+declare function copilotBaseUrl(config: {
+    apiEndpoint?: string;
+    enterpriseUrl?: string;
+} | undefined): string;
+/**
+ * The GitHub REST base for an account (identity / quota / discovery probes).
+ * GHE domains route to `api.<domain>` — the data-residency plane convention
+ * (e.g. `company.ghe.com` → `api.company.ghe.com`); an explicit scheme or
+ * `api.` prefix is honored verbatim, personal accounts stay on api.github.com.
+ * Self-hosted GHES `/api/v3` path-style hosts are NOT derived here — pass the
+ * full `api.<host>` (or scheme-qualified) form via `enterpriseUrl`.
+ */
+declare function copilotGitHubApiBase(enterpriseUrl?: string): string;
+
+/**
+ * Default OpenCodeGo upstream URLs (both provider halves).
+ *
+ * There are two provider halves under the same account key:
+ *   - GO  (`opencode-go`):  `https://opencode.ai/zen/go/v1/...` — chat + anthropic.
+ *   - ZEN (`opencode-zen`): `https://opencode.ai/zen/v1/...`    — chat + anthropic
+ *     + responses + gemini (per-model colon-method).
+ *
+ * The user may override each half's host independently:
+ *   - `OpenCodeGoTokenConfig.baseUrl`    → GO half.
+ *   - `OpenCodeGoTokenConfig.zenBaseUrl` → ZEN half.
+ * A go-half override NEVER redirects zen traffic and vice-versa.
+ */
+
+/** Strip a trailing slash and `/v1[/]*` suffix from a user override host. */
+declare function normalizeOpenCodeGoBaseUrl(base: string): string;
+
 /** Safe evidence request; accountId is trusted-process input and must not be logged. */
 interface CodexImageCapabilityEvidenceRequest {
     readonly accountId: string;
@@ -445,4 +518,4 @@ interface CodexImageLiveVerifier {
 }
 declare function createCodexImageLiveVerifier(options: CodexImageLiveVerifierOptions): CodexImageLiveVerifier;
 
-export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, setSubscriptionAccountService, setSubscriptionProviderRegistry };
+export { type CodexImageCapabilityEvidence, type CodexImageCapabilityEvidenceRequest, type CodexImageCapabilityEvidenceSource, type CodexImageCapabilityObservation, type CodexImageCapabilityObservedResponseFields, type CodexImageCapabilityTestedRequest, type CodexImageLiveVerificationRequest, type CodexImageLiveVerifier, type CodexImageLiveVerifierOptions, type CodexSubscriptionImageProviderOptions, DEFAULT_ACCOUNT_PRIORITY, type DispatchRequest, type DispatcherHooks, type ImageExecutionAccountKey, type ImageExecutionScheduler, type ImageExecutionSchedulerGrant, type ImageExecutionSchedulerRequest, LAST_USED_PERSIST_THROTTLE_MS, SESSION_AFFINITY_TTL_MS, type SchedulableAccount, type SelectInput, type SelectResult, SubscriptionAccountSelector, SubscriptionAccountService, type SubscriptionCredentialStore, SubscriptionDispatcher, SubscriptionProviderRegistry, copilotBaseUrl, copilotGitHubApiBase, copilotPathFor, copilotTransformerNamesForWire, copilotWireFor, createCodexImageLiveVerifier, createCodexSubscriptionImageProvider, getSubscriptionAccountService, getSubscriptionProviderRegistry, normalizeOpenCodeGoBaseUrl, setSubscriptionAccountService, setSubscriptionProviderRegistry };

package/dist/index.js

@@ -1,8 +1,19 @@
 import {
+  COPILOT_API_HEADERS,
+  COPILOT_GITHUB_HEADERS,
   claude_exports,
   codex_exports,
-  gemini_exports
-} from "./chunk-4HYDPKHR.js";
+  copilotBaseUrl,
+  copilotGitHubApiBase,
+  copilotPathFor,
+  copilotTransformerNamesForWire,
+  copilotWireFor,
+  copilot_exports,
+  gemini_exports,
+  grok_exports,
+  kimiFingerprintHeaders,
+  kimi_exports
+} from "./chunk-L77HJY6V.js";
 import {
   accountSupportsModel,
   remapReportForAccount
@@ -125,13 +136,19 @@ var ACCOUNTS_KEY = {
   claude: "claudeAccounts",
   codex: "codexAccounts",
   gemini: "geminiAccounts",
-  opencodego: "opencodegoAccounts"
+  opencodego: "opencodegoAccounts",
+  kimi: "kimiAccounts",
+  grok: "grokAccounts",
+  copilot: "copilotAccounts"
 };
 var ACTIVE_KEY = {
   claude: "activeClaudeAccountId",
   codex: "activeCodexAccountId",
   gemini: "activeGeminiAccountId",
-  opencodego: "activeOpencodegoAccountId"
+  opencodego: "activeOpencodegoAccountId",
+  kimi: "activeKimiAccountId",
+  grok: "activeGrokAccountId",
+  copilot: "activeCopilotAccountId"
 };
 function gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById) {
   if (!health && !resolvedModel || accounts.length < 2) return accounts;
@@ -421,13 +438,20 @@ var OAuthBearerAuthStrategy = class {
       return;
     }
     headers["Authorization"] = `Bearer ${token}`;
+    if (this.providerId === "kimi") {
+      const deviceId = await this.resolveKimiDeviceId(hints?.sessionKey);
+      Object.assign(headers, kimiFingerprintHeaders(deviceId));
+    }
+    if (this.providerId === "copilot") {
+      Object.assign(headers, COPILOT_API_HEADERS);
+    }
   }
   async onUnauthorized(sessionKey) {
     const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, this.providerId, sessionKey);
     if (byId !== null) return byId;
     return this.mutex.run(`${this.providerId}:refresh`, async () => {
       try {
-        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+        return this.refreshActive();
       } catch (err) {
         console.warn(`[OAuthBearerAuthStrategy] ${this.providerId} refresh failed:`, err);
         return false;
@@ -436,7 +460,7 @@ var OAuthBearerAuthStrategy = class {
   }
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
-    const entry = this.providerId === "codex" ? config.codex : config.gemini;
+    const entry = this.tokenBlock(config);
     if (!entry?.accessToken) {
       return { providerId: this.providerId, ok: false, reason: "missing-credential" };
     }
@@ -453,22 +477,61 @@ var OAuthBearerAuthStrategy = class {
   /** Read the current token, refreshing in-line if it's within the lead window. */
   async resolveAccessToken() {
     const config = await this.tokens.getFullConfig();
-    const entry = this.providerId === "codex" ? config.codex : config.gemini;
+    const entry = this.tokenBlock(config);
     if (!entry?.accessToken) return null;
     const expiresAtMs = entry.expiresAt ? new Date(entry.expiresAt).getTime() : 0;
     const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - REFRESH_LEAD_MS;
     if (expiringSoon && entry.refreshToken) {
       const refreshed = await this.mutex.run(`${this.providerId}:refresh`, async () => {
-        return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
+        return this.refreshActive();
       });
       if (!refreshed) return null;
       const fresh = await this.tokens.getFullConfig();
-      const freshEntry = this.providerId === "codex" ? fresh.codex : fresh.gemini;
-      return freshEntry?.accessToken ?? null;
+      return this.tokenBlock(fresh)?.accessToken ?? null;
     }
     if (entry.status === "expired") return null;
     return entry.accessToken;
   }
+  /** The active account's refresh, dispatched per provider. */
+  refreshActive() {
+    switch (this.providerId) {
+      case "codex":
+        return this.tokens.refreshCodexToken();
+      case "gemini":
+        return this.tokens.refreshGeminiToken();
+      case "kimi":
+        return this.tokens.refreshKimiToken ? this.tokens.refreshKimiToken() : Promise.resolve(false);
+      case "grok":
+        return this.tokens.refreshGrokToken ? this.tokens.refreshGrokToken() : Promise.resolve(false);
+      case "copilot":
+        return this.tokens.refreshCopilotToken ? this.tokens.refreshCopilotToken() : Promise.resolve(false);
+    }
+  }
+  tokenBlock(config) {
+    switch (this.providerId) {
+      case "codex":
+        return config.codex;
+      case "gemini":
+        return config.gemini;
+      case "kimi":
+        return config.kimi;
+      case "grok":
+        return config.grok;
+      case "copilot":
+        return config.copilot;
+    }
+  }
+  /**
+   * Best-effort device id for the fingerprint header. Selection already ran in
+   * `applyHeaders`; rather than re-deriving it, read the active block's id (a
+   * pool-served non-active account momentarily reports the active id — the
+   * header is per-INSTALL identity, so this is cosmetic, not auth).
+   */
+  async resolveKimiDeviceId(_sessionKey) {
+    void _sessionKey;
+    const config = await this.tokens.getFullConfig();
+    return config.kimi?.deviceId ?? config.kimiAccounts?.[0]?.tokens.deviceId;
+  }
 };
 
 // src/auth/PassThroughAuthStrategy.ts
@@ -615,7 +678,10 @@ var DISPLAY_NAMES = {
   claude: "Claude (Anthropic OAuth)",
   codex: "Codex (ChatGPT OAuth)",
   gemini: "Gemini (Google OAuth)",
-  opencodego: "OpenCodeGo (Bearer key)"
+  opencodego: "OpenCodeGo (Bearer key)",
+  kimi: "Kimi Code (Moonshot OAuth)",
+  grok: "Grok (xAI SuperGrok OAuth)",
+  copilot: "Copilot (GitHub OAuth)"
 };
 var SubscriptionAccountService = class {
   mutex = new RefreshMutex();
@@ -629,7 +695,10 @@ var SubscriptionAccountService = class {
       ["claude", new PassThroughAuthStrategy(tokens, this.mutex, this.selector, health)],
       ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex, this.selector, health)],
       ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex, this.selector, health)],
-      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)]
+      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)],
+      ["kimi", new OAuthBearerAuthStrategy("kimi", tokens, this.mutex, this.selector, health)],
+      ["grok", new OAuthBearerAuthStrategy("grok", tokens, this.mutex, this.selector, health)],
+      ["copilot", new OAuthBearerAuthStrategy("copilot", tokens, this.mutex, this.selector, health)]
     ]);
   }
   /** Returns the strategy bound to a subscription provider, or `null` for unknown ids. */
@@ -1079,7 +1148,10 @@ var SubscriptionProviderRegistry = class {
     const codex = this.accounts.getStrategy("codex");
     const gemini = this.accounts.getStrategy("gemini");
     const opencodego = this.accounts.getStrategy("opencodego");
-    if (!claude || !codex || !gemini || !opencodego) {
+    const kimi = this.accounts.getStrategy("kimi");
+    const grok = this.accounts.getStrategy("grok");
+    const copilot = this.accounts.getStrategy("copilot");
+    if (!claude || !codex || !gemini || !opencodego || !kimi || !grok || !copilot) {
       throw new Error("[SubscriptionProviderRegistry] Missing strategy in SubscriptionAccountService");
     }
     this.profiles = /* @__PURE__ */ new Map([
@@ -1221,6 +1293,67 @@ var SubscriptionProviderRegistry = class {
           // profile sets it — claude / codex / gemini leave it UNSET (no-op).
           recordModelOutcome: (modelId, ok) => ok ? this.breaker.recordSuccess(modelId) : this.breaker.recordFailure(modelId)
         }
+      ],
+      [
+        "kimi",
+        {
+          providerId: "kimi",
+          displayName: "Kimi Code (Moonshot OAuth)",
+          authStrategy: kimi,
+          mode: "transformer",
+          // Kimi Code's subscription surface speaks standard Anthropic Messages
+          // at `api.kimi.com/coding/v1/messages` (plus an OpenAI chat face on
+          // /chat/completions that a BYO kimi row already covers). The messages
+          // URL ending in `/v1/messages` makes the core plan builder treat it as
+          // same-format — the SDK's Anthropic body relays verbatim, with the
+          // OAuth bearer + X-Msh-* fingerprint headers injected by the strategy.
+          resolveUpstreamUrl: () => "https://api.kimi.com/coding/v1/messages",
+          // Route-to only (Responses/Chat ingress): Unified → Anthropic Messages.
+          providerTransformerNames: ["anthropic"],
+          modelTransformerNames: []
+        }
+      ],
+      [
+        "grok",
+        {
+          providerId: "grok",
+          displayName: "Grok (xAI SuperGrok OAuth)",
+          authStrategy: grok,
+          mode: "transformer",
+          // SuperGrok's subscription surface speaks the OpenAI Responses API at
+          // `api.x.ai/v1/responses` with the OAuth access token as Bearer (the
+          // same token shape the paid API-key product uses on this endpoint).
+          // Mirrors the codex profile: Unified → Responses via the
+          // `openai-response` encoder; effort negotiation is capability-driven
+          // (the omit-effort grok models carry `thinkingLevels: ['none']` in the
+          // canonical registry, so `reasoning.effort` is never sent to them).
+          resolveUpstreamUrl: () => "https://api.x.ai/v1/responses",
+          providerTransformerNames: ["openai-response"],
+          modelTransformerNames: []
+        }
+      ],
+      [
+        "copilot",
+        {
+          providerId: "copilot",
+          displayName: "Copilot (GitHub OAuth)",
+          authStrategy: copilot,
+          mode: "transformer",
+          // GitHub Copilot serves THREE wires on ONE host, per model (the
+          // opencodego shape-seam pattern): the Claude family rides
+          // anthropic-messages at `/v1/messages` (same-format verbatim relay
+          // for Anthropic-shape clients), the GPT/Grok/mai-code families ride
+          // Responses at `/v1/responses`, and the Gemini/Kimi/raptor families
+          // ride chat-completions at `/v1/chat/completions`. The base honors
+          // the account's discovered `apiEndpoint` (or GHE domain) via the
+          // threaded config, defaulting to api.githubcopilot.com. The identity
+          // header set (incl. X-GitHub-Api-Version, which unlocks long-context
+          // tiers) is injected by the auth strategy.
+          resolveUpstreamUrl: (model, config) => `${copilotBaseUrl(config)}${copilotPathFor(copilotWireFor(model))}`,
+          resolveProviderTransformerNames: (model) => copilotTransformerNamesForWire(copilotWireFor(model)),
+          providerTransformerNames: ["openai-response"],
+          modelTransformerNames: []
+        }
       ]
     ]);
   }
@@ -2534,6 +2667,7 @@ function createCodexImageLiveVerifier(options) {
   return new DefaultCodexImageLiveVerifier(options);
 }
 export {
+  COPILOT_GITHUB_HEADERS,
   DEFAULT_ACCOUNT_PRIORITY,
   LAST_USED_PERSIST_THROTTLE_MS,
   SESSION_AFFINITY_TTL_MS,
@@ -2543,11 +2677,21 @@ export {
   SubscriptionProviderRegistry,
   claude_exports as claudeOAuth,
   codex_exports as codexOAuth,
+  copilotBaseUrl,
+  copilotGitHubApiBase,
+  copilot_exports as copilotOAuth,
+  copilotPathFor,
+  copilotTransformerNamesForWire,
+  copilotWireFor,
   createCodexImageLiveVerifier,
   createCodexSubscriptionImageProvider,
   gemini_exports as geminiOAuth,
   getSubscriptionAccountService,
   getSubscriptionProviderRegistry,
+  grok_exports as grokOAuth,
+  kimiFingerprintHeaders,
+  kimi_exports as kimiOAuth,
+  normalizeOpenCodeGoBaseUrl,
   setSubscriptionAccountService,
   setSubscriptionProviderRegistry
 };

package/dist/oauth.cjs

@@ -2,10 +2,20 @@
 
 
 
-var _chunkUXUMAXZJcjs = require('./chunk-UXUMAXZJ.cjs');
+
+
+
+
+
+var _chunkQKWL53TJcjs = require('./chunk-QKWL53TJ.cjs');
 require('./chunk-75ZPJI57.cjs');
 
 
 
 
-exports.claudeOAuth = _chunkUXUMAXZJcjs.claude_exports; exports.codexOAuth = _chunkUXUMAXZJcjs.codex_exports; exports.geminiOAuth = _chunkUXUMAXZJcjs.gemini_exports;
+
+
+
+
+
+exports.COPILOT_GITHUB_HEADERS = _chunkQKWL53TJcjs.COPILOT_GITHUB_HEADERS; exports.claudeOAuth = _chunkQKWL53TJcjs.claude_exports; exports.codexOAuth = _chunkQKWL53TJcjs.codex_exports; exports.copilotOAuth = _chunkQKWL53TJcjs.copilot_exports; exports.geminiOAuth = _chunkQKWL53TJcjs.gemini_exports; exports.grokOAuth = _chunkQKWL53TJcjs.grok_exports; exports.kimiFingerprintHeaders = _chunkQKWL53TJcjs.kimiFingerprintHeaders; exports.kimiOAuth = _chunkQKWL53TJcjs.kimi_exports;