@undefineds.co/xpod 0.4.3-rc.159 → 0.4.5

package/dist/api/ai-gateway/connect/OAuthConnectAdapter.js

@@ -4,6 +4,7 @@ exports.OAuthConnectCredentialStore = void 0;
 class OAuthConnectCredentialStore {
     constructor(options) {
         this.provider = options.provider.toLowerCase();
+        this.offeringId = options.offeringId;
         this.credentialRepository = options.credentialRepository;
         this.vault = options.vault;
     }
@@ -26,7 +27,7 @@ class OAuthConnectCredentialStore {
                 metadata: {
                     ...(input.current.metadata ?? {}),
                     ...input.metadata,
-                    offeringId: 'official-subscription',
+                    offeringId: this.offeringId,
                     enabled: true,
                     health: 'healthy',
                 },

package/dist/api/ai-gateway/connect/OAuthIntegrationRegistry.d.ts

@@ -1,21 +1,25 @@
-export interface OAuthIntegration {
-    provider: 'kimi';
-    integrationId: typeof XPOD_KIMI_OAUTH_INTEGRATION_ID;
-    issuedBy: 'xpod';
-    clientId: string;
-}
+import type { AuthorizationCodeOAuthIntegration, AuthorizationCodeProtocolDescriptor, DeviceCodeOAuthIntegration, DeviceCodeProtocolDescriptor, OAuthConnectMode, OAuthIntegration } from './DeviceCodeProtocol';
+export type { AuthorizationCodeOAuthIntegration, AuthorizationCodeProtocolDescriptor, DeviceCodeOAuthIntegration, DeviceCodeProtocolDescriptor, OAuthConnectMode, OAuthIntegration, } from './DeviceCodeProtocol';
 export interface OAuthIntegrationRegistryConfig {
-    kimi?: {
-        integrationId?: string;
-        issuedBy?: string;
+    integrations?: Array<{
+        provider: string;
+        offeringId: string;
+        mode?: OAuthConnectMode;
+        integrationId: string;
+        issuedBy: string;
         clientId?: string;
-    };
+        protocol: DeviceCodeProtocolDescriptor | AuthorizationCodeProtocolDescriptor;
+        accountLabel?: string;
+        accountId?: string;
+    }>;
 }
-export declare const XPOD_KIMI_OAUTH_INTEGRATION_ID = "xpod-kimi-oauth";
 export declare class OAuthIntegrationRegistry {
     private readonly integrations;
     static fromServerConfig(config: OAuthIntegrationRegistryConfig): OAuthIntegrationRegistry;
     register(integration: OAuthIntegration): void;
-    require(provider: string): OAuthIntegration;
+    require(provider: string, offeringId?: string, mode?: 'deviceCodeOAuth'): DeviceCodeOAuthIntegration;
+    require(provider: string, offeringId: string | undefined, mode: 'authorizationCodeOAuth'): AuthorizationCodeOAuthIntegration;
+    private onlyIntegration;
 }
-export declare function requireKimiOAuthClientId(value: OAuthIntegrationRegistryConfig['kimi'] | OAuthIntegration | undefined): string;
+type OAuthIntegrationConfigRecord = NonNullable<OAuthIntegrationRegistryConfig['integrations']>[number];
+export declare function requireTrustedOAuthIntegration(value: OAuthIntegrationConfigRecord | OAuthIntegration): OAuthIntegration;

package/dist/api/ai-gateway/connect/OAuthIntegrationRegistry.js

@@ -1,44 +1,70 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthIntegrationRegistry = exports.XPOD_KIMI_OAUTH_INTEGRATION_ID = void 0;
-exports.requireKimiOAuthClientId = requireKimiOAuthClientId;
-exports.XPOD_KIMI_OAUTH_INTEGRATION_ID = 'xpod-kimi-oauth';
+exports.OAuthIntegrationRegistry = void 0;
+exports.requireTrustedOAuthIntegration = requireTrustedOAuthIntegration;
 class OAuthIntegrationRegistry {
     constructor() {
         this.integrations = new Map();
     }
     static fromServerConfig(config) {
         const registry = new OAuthIntegrationRegistry();
-        const kimi = config.kimi;
-        const kimiClientId = requireKimiOAuthClientId(kimi);
-        registry.register({
-            provider: 'kimi',
-            integrationId: exports.XPOD_KIMI_OAUTH_INTEGRATION_ID,
-            issuedBy: 'xpod',
-            clientId: kimiClientId,
-        });
+        for (const integration of config.integrations ?? []) {
+            registry.register(requireTrustedOAuthIntegration(integration));
+        }
+        if (registry.integrations.size === 0) {
+            throw new Error('auth_not_available');
+        }
         return registry;
     }
     register(integration) {
-        this.integrations.set(integration.provider, integration);
+        this.integrations.set(integrationKey(integration.provider, integration.offeringId, integration.mode), integration);
     }
-    require(provider) {
-        const integration = this.integrations.get(provider.toLowerCase());
+    require(provider, offeringId, mode = 'deviceCodeOAuth') {
+        const integration = offeringId
+            ? this.integrations.get(integrationKey(provider, offeringId, mode))
+            : this.onlyIntegration(provider, mode);
         if (!integration) {
             throw new Error('auth_not_available');
         }
         return integration;
     }
+    onlyIntegration(provider, mode) {
+        const candidates = [...this.integrations.values()].filter((integration) => integration.provider === provider.trim().toLowerCase() && integration.mode === mode);
+        return candidates.length === 1 ? candidates[0] : undefined;
+    }
 }
 exports.OAuthIntegrationRegistry = OAuthIntegrationRegistry;
-function requireKimiOAuthClientId(value) {
-    const clientId = normalizeClientId(value?.clientId);
+function requireTrustedOAuthIntegration(value) {
+    const clientId = normalizeClientId(value.clientId);
+    const mode = value.mode ?? 'deviceCodeOAuth';
     if (!clientId
-        || value?.integrationId !== exports.XPOD_KIMI_OAUTH_INTEGRATION_ID
-        || value?.issuedBy !== 'xpod') {
+        || !normalizeClientId(value.issuedBy)
+        || !value.provider.trim()
+        || !value.offeringId.trim()
+        || !value.integrationId.trim()
+        || !isTrustedProtocolForMode(value.protocol, mode)) {
         throw new Error('auth_not_available');
     }
-    return clientId;
+    return {
+        provider: value.provider.trim().toLowerCase(),
+        offeringId: value.offeringId.trim(),
+        mode,
+        integrationId: value.integrationId.trim(),
+        issuedBy: normalizeClientId(value.issuedBy),
+        clientId,
+        protocol: value.protocol,
+        accountLabel: normalizeOptionalString(value.accountLabel),
+        accountId: normalizeOptionalString(value.accountId),
+    };
+}
+function isTrustedProtocolForMode(protocol, mode) {
+    if (mode === 'deviceCodeOAuth') {
+        return 'begin' in protocol && 'poll' in protocol;
+    }
+    return 'authorization' in protocol
+        && 'token' in protocol
+        && protocol.authorization.redirectUris.length > 0
+        && protocol.token.codec === 'authorizationCodeForm';
 }
 function normalizeClientId(value) {
     if (typeof value !== 'string') {
@@ -47,4 +73,11 @@ function normalizeClientId(value) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : undefined;
 }
+function normalizeOptionalString(value) {
+    const normalized = normalizeClientId(value);
+    return normalized;
+}
+function integrationKey(provider, offeringId, mode) {
+    return `${provider.trim().toLowerCase()}:${offeringId.trim().toLowerCase()}:${mode}`;
+}
 //# sourceMappingURL=OAuthIntegrationRegistry.js.map

package/dist/api/ai-gateway/connect/OpenAiSubscriptionSessionImportAdapter.d.ts

@@ -1,31 +1,7 @@
-import type { ProviderSecret } from '../credentials/CredentialVault';
-export interface OpenAiSubscriptionSessionImportAdapterOptions {
-    homeDir?: string;
-    readFile?: (filePath: string, encoding: BufferEncoding) => Promise<string>;
+import { FileSessionImportAdapter, type FileSessionImportAdapterOptions, type LocalSessionImportAdapter, type LocalSessionImportInput, type LocalSessionImportResult } from './FileSessionImportAdapter';
+export type { LocalSessionImportAdapter, LocalSessionImportInput, LocalSessionImportResult, };
+export interface OpenAiSubscriptionSessionImportAdapterOptions extends Omit<FileSessionImportAdapterOptions, 'profile'> {
 }
-export interface LocalSessionImportResult {
-    secret: ProviderSecret;
-    /**
-     * How the imported credential authenticates upstream. The import itself is
-     * local, but an imported subscription session is still an OAuth credential.
-     */
-    credentialAuthMode?: 'deviceCodeOAuth' | 'local';
-    accountLabel?: string;
-    metadata?: Record<string, unknown>;
-}
-export interface LocalSessionImportInput {
-    deployment: 'local' | 'cloud';
-}
-export interface LocalSessionImportAdapter {
-    provider: string;
-    offeringId: string;
-    importSession(input: LocalSessionImportInput): Promise<LocalSessionImportResult>;
-}
-export declare class OpenAiSubscriptionSessionImportAdapter implements LocalSessionImportAdapter {
-    readonly provider = "openai";
-    readonly offeringId = "official-subscription";
-    private readonly authPath;
-    private readonly readFile;
+export declare class OpenAiSubscriptionSessionImportAdapter extends FileSessionImportAdapter implements LocalSessionImportAdapter {
     constructor(options?: OpenAiSubscriptionSessionImportAdapterOptions);
-    importSession(input: LocalSessionImportInput): Promise<LocalSessionImportResult>;
 }

package/dist/api/ai-gateway/connect/OpenAiSubscriptionSessionImportAdapter.js

@@ -1,66 +1,15 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenAiSubscriptionSessionImportAdapter = void 0;
-const node_fs_1 = require("node:fs");
-const node_os_1 = __importDefault(require("node:os"));
-const node_path_1 = __importDefault(require("node:path"));
-class OpenAiSubscriptionSessionImportAdapter {
+const FileSessionImportAdapter_1 = require("./FileSessionImportAdapter");
+const SessionImportProfiles_1 = require("./SessionImportProfiles");
+class OpenAiSubscriptionSessionImportAdapter extends FileSessionImportAdapter_1.FileSessionImportAdapter {
     constructor(options = {}) {
-        this.provider = 'openai';
-        this.offeringId = 'official-subscription';
-        this.authPath = node_path_1.default.join(options.homeDir ?? node_os_1.default.homedir(), '.codex', 'auth.json');
-        this.readFile = options.readFile ?? node_fs_1.promises.readFile;
-    }
-    async importSession(input) {
-        if (input.deployment !== 'local') {
-            throw new Error('openai_subscription_session_unavailable_in_cloud');
-        }
-        const payload = parseAuthJson(await this.readFile(this.authPath, 'utf8'));
-        const tokens = objectValue(payload.tokens);
-        const accessToken = stringValue(tokens?.access_token);
-        const refreshToken = stringValue(tokens?.refresh_token);
-        const idToken = stringValue(tokens?.id_token);
-        const accountId = stringValue(tokens?.account_id);
-        if (!accessToken || !refreshToken) {
-            throw new Error('openai_subscription_session_missing_tokens');
-        }
-        return {
-            secret: {
-                type: 'deviceCodeOAuth',
-                authMode: stringValue(payload.auth_mode),
-                accessToken,
-                refreshToken,
-                ...(idToken ? { idToken } : {}),
-                ...(accountId ? { accountId } : {}),
-            },
-            credentialAuthMode: 'deviceCodeOAuth',
-            accountLabel: accountId ? `OpenAI Subscription ${accountId}` : 'OpenAI Subscription',
-            metadata: {
-                source: 'local-codex-auth-json',
-                sessionPath: '~/.codex/auth.json',
-                ...(stringValue(payload.auth_mode) ? { authMode: stringValue(payload.auth_mode) } : {}),
-                ...(accountId ? { accountId } : {}),
-            },
-        };
+        super({
+            ...options,
+            profile: SessionImportProfiles_1.OPENAI_CODEX_SESSION_IMPORT_PROFILE,
+        });
     }
 }
 exports.OpenAiSubscriptionSessionImportAdapter = OpenAiSubscriptionSessionImportAdapter;
-function parseAuthJson(raw) {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        throw new Error('openai_subscription_session_invalid_auth_json');
-    }
-    return parsed;
-}
-function objectValue(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function stringValue(value) {
-    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
-}
 //# sourceMappingURL=OpenAiSubscriptionSessionImportAdapter.js.map

package/dist/api/ai-gateway/connect/ProviderAuthorizationProfiles.d.ts

@@ -0,0 +1,4 @@
+import type { DeviceCodeOAuthIntegration, AuthorizationCodeOAuthIntegration } from './DeviceCodeProtocol';
+export declare function createProviderOAuthIntegrations(): DeviceCodeOAuthIntegration[];
+/** Browser authorization shares the public client identity and token lifecycle. */
+export declare function createBrowserOAuthIntegrations(): AuthorizationCodeOAuthIntegration[];

package/dist/api/ai-gateway/connect/ProviderAuthorizationProfiles.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProviderOAuthIntegrations = createProviderOAuthIntegrations;
+exports.createBrowserOAuthIntegrations = createBrowserOAuthIntegrations;
+const OfferingAuthorization_1 = require("../providers/OfferingAuthorization");
+// Public first-party client profiles, not Xpod-owned registrations. These values
+// are trusted application configuration; management requests never supply them.
+// Wire formats and source revisions are recorded in docs/ai-authorization-mechanisms.md.
+const CLIENT_PROFILES = {
+    'openai-codex-public': {
+        issuedBy: 'openai/codex',
+        clientId: 'app_EMoamEEZ73f0CkXaXp7hrann',
+        accountLabel: 'OpenAI Subscription',
+        protocol: {
+            id: 'device-code-json-authorization-code-pkce',
+            verificationUriOrigins: ['https://auth.openai.com'],
+            begin: {
+                endpoint: 'https://auth.openai.com/api/accounts/deviceauth/usercode',
+                codec: 'deviceCodeJson',
+                expiresAtField: 'expires_at',
+                defaultExpiresInSeconds: 900,
+                defaultIntervalSeconds: 5,
+            },
+            poll: {
+                endpoint: 'https://auth.openai.com/api/accounts/deviceauth/token',
+                codec: 'deviceCodeJson',
+                pendingHttpStatuses: [403, 404],
+            },
+            tokenExchange: {
+                endpoint: 'https://auth.openai.com/oauth/token',
+                codec: 'authorizationCodeForm',
+                redirectUri: 'https://auth.openai.com/deviceauth/callback',
+            },
+            refresh: {
+                endpoint: 'https://auth.openai.com/oauth/token',
+                codec: 'refreshTokenForm',
+            },
+            defaultVerificationUri: 'https://auth.openai.com/codex/device',
+            accountIdClaim: ['https://api.openai.com/auth', 'chatgpt_account_id'],
+        },
+    },
+    'kimi-code-public': {
+        issuedBy: 'MoonshotAI/kimi-cli',
+        clientId: '17e5f671-d194-4dfb-9706-5516cb48c098',
+        accountLabel: 'Kimi Subscription',
+        protocol: {
+            id: 'oauth-device-code-form',
+            verificationUriOrigins: ['https://www.kimi.com'],
+            begin: {
+                endpoint: 'https://auth.kimi.com/api/oauth/device_authorization',
+                codec: 'oauthDeviceCode',
+                headers: { 'X-Msh-Platform': 'xpod' },
+            },
+            poll: {
+                endpoint: 'https://auth.kimi.com/api/oauth/token',
+                headers: { 'X-Msh-Platform': 'xpod' },
+                codec: 'oauthDeviceCode',
+            },
+            refresh: {
+                endpoint: 'https://auth.kimi.com/api/oauth/token',
+                headers: { 'X-Msh-Platform': 'xpod' },
+                codec: 'refreshTokenForm',
+            },
+        },
+    },
+};
+function createProviderOAuthIntegrations() {
+    return OfferingAuthorization_1.SUBSCRIPTION_AUTHORIZATION_BINDINGS.map((binding) => {
+        const profile = CLIENT_PROFILES[binding.integrationId];
+        if (!profile)
+            throw new Error(`OAuth client profile is not registered: ${binding.integrationId}`);
+        return {
+            ...binding,
+            ...structuredClone(profile),
+            mode: 'deviceCodeOAuth',
+        };
+    });
+}
+const BROWSER_PROTOCOLS = {
+    'openai-codex-browser-public': {
+        id: 'authorization-code-pkce-loopback',
+        authorization: {
+            endpoint: 'https://auth.openai.com/oauth/authorize',
+            redirectUris: ['http://localhost:1455/auth/callback', 'http://localhost:1457/auth/callback'],
+            scopes: ['openid', 'profile', 'email', 'offline_access'],
+            extraParams: { id_token_add_organizations: 'true', codex_cli_simplified_flow: 'true', originator: 'xpod' },
+        },
+        token: { endpoint: 'https://auth.openai.com/oauth/token', codec: 'authorizationCodeForm' },
+    },
+};
+/** Browser authorization shares the public client identity and token lifecycle. */
+function createBrowserOAuthIntegrations() {
+    return OfferingAuthorization_1.SUBSCRIPTION_AUTHORIZATION_BINDINGS.flatMap((binding) => {
+        if (!('browserIntegrationId' in binding))
+            return [];
+        const profile = CLIENT_PROFILES[binding.integrationId];
+        const protocol = BROWSER_PROTOCOLS[binding.browserIntegrationId];
+        if (!profile || !protocol)
+            throw new Error(`OAuth browser profile is not registered: ${binding.browserIntegrationId}`);
+        return [{
+                provider: binding.provider,
+                offeringId: binding.offeringId,
+                integrationId: binding.browserIntegrationId,
+                issuedBy: profile.issuedBy,
+                clientId: profile.clientId,
+                accountLabel: profile.accountLabel,
+                mode: 'authorizationCodeOAuth',
+                protocol: {
+                    ...structuredClone(protocol),
+                    refresh: structuredClone(profile.protocol.refresh),
+                    accountIdClaim: structuredClone(profile.protocol.accountIdClaim),
+                },
+            }];
+    });
+}
+//# sourceMappingURL=ProviderAuthorizationProfiles.js.map

package/dist/api/ai-gateway/connect/SessionImportProfiles.d.ts

@@ -0,0 +1,10 @@
+import type { LocalSessionImportResult } from './FileSessionImportAdapter';
+export interface SessionImportProfile {
+    id: string;
+    provider: string;
+    offeringId: string;
+    resolvePath(homeDir: string): string;
+    importSession(payload: Record<string, unknown>): LocalSessionImportResult;
+}
+export declare const OPENAI_CODEX_SESSION_IMPORT_PROFILE: SessionImportProfile;
+export declare const KIMI_CODE_SESSION_IMPORT_PROFILE: SessionImportProfile;

package/dist/api/ai-gateway/connect/SessionImportProfiles.js

@@ -0,0 +1,112 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KIMI_CODE_SESSION_IMPORT_PROFILE = exports.OPENAI_CODEX_SESSION_IMPORT_PROFILE = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+exports.OPENAI_CODEX_SESSION_IMPORT_PROFILE = {
+    id: 'openai-codex-auth-json',
+    provider: 'openai',
+    offeringId: 'official-subscription',
+    resolvePath: (homeDir) => node_path_1.default.join(homeDir, '.codex', 'auth.json'),
+    importSession: importOpenAiCodexSession,
+};
+exports.KIMI_CODE_SESSION_IMPORT_PROFILE = {
+    id: 'kimi-code-credentials-json',
+    provider: 'kimi',
+    offeringId: 'subscription-key',
+    resolvePath: (homeDir) => node_path_1.default.join(homeDir, '.kimi', 'credentials', 'kimi-code.json'),
+    importSession: importKimiCodeSession,
+};
+function importOpenAiCodexSession(payload) {
+    const tokens = objectValue(payload.tokens);
+    const accessToken = stringValue(tokens?.access_token);
+    const refreshToken = stringValue(tokens?.refresh_token);
+    const idToken = stringValue(tokens?.id_token);
+    const accountId = stringValue(tokens?.account_id);
+    const authMode = stringValue(payload.auth_mode);
+    if (!accessToken || !refreshToken) {
+        throw new Error('local_session_missing_tokens');
+    }
+    return {
+        secret: withoutUndefined({
+            type: 'deviceCodeOAuth',
+            authMode,
+            accessToken,
+            refreshToken,
+            idToken,
+            accountId,
+        }),
+        credentialAuthMode: 'deviceCodeOAuth',
+        accountLabel: accountId ? `OpenAI Subscription ${accountId}` : 'OpenAI Subscription',
+        metadata: withoutUndefined({
+            source: 'local-codex-auth-json',
+            sessionPath: '~/.codex/auth.json',
+            authMode,
+            accountId,
+        }),
+    };
+}
+function importKimiCodeSession(payload) {
+    const accessToken = stringValue(payload.access_token);
+    const refreshToken = stringValue(payload.refresh_token);
+    const expiresAt = unixSecondsIsoValue(payload.expires_at);
+    const scope = stringValue(payload.scope);
+    const tokenType = stringValue(payload.token_type);
+    const expiresIn = numberValue(payload.expires_in);
+    if (!accessToken || !refreshToken) {
+        throw new Error('local_session_missing_tokens');
+    }
+    return {
+        secret: withoutUndefined({
+            type: 'deviceCodeOAuth',
+            accessToken,
+            refreshToken,
+            expiresAt,
+            scope,
+            tokenType,
+            expiresIn,
+        }),
+        credentialAuthMode: 'deviceCodeOAuth',
+        accountLabel: 'Kimi Subscription',
+        metadata: {
+            source: 'local-kimi-code-credentials-json',
+            sessionPath: '~/.kimi/credentials/kimi-code.json',
+        },
+    };
+}
+function objectValue(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function stringValue(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function numberValue(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+}
+function unixSecondsIsoValue(value) {
+    const seconds = numberValue(value);
+    if (seconds === undefined || seconds <= 0) {
+        return undefined;
+    }
+    const milliseconds = seconds * 1000;
+    if (!Number.isFinite(milliseconds)) {
+        return undefined;
+    }
+    const date = new Date(milliseconds);
+    return Number.isNaN(date.getTime()) ? undefined : date.toISOString();
+}
+function withoutUndefined(input) {
+    return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined));
+}
+//# sourceMappingURL=SessionImportProfiles.js.map