@undefineds.co/xpod 0.4.3 → 0.4.5

package/dist/api/ai-gateway/connect/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProviderConnectService = exports.DeepSeekConnectAdapter = exports.KimiDeviceCodeConnectAdapter = exports.BrowserAssistedApiKeyConnectAdapter = exports.InMemoryConnectAttemptStore = exports.PodConnectedCredentialRepository = exports.OpenAiSubscriptionSessionImportAdapter = exports.requireKimiOAuthClientId = exports.OAuthIntegrationRegistry = exports.OAuthConnectCredentialStore = void 0;
+exports.ProviderConnectService = exports.DeepSeekConnectAdapter = exports.AuthorizationCodeConnectAdapter = exports.DeviceCodeConnectAdapter = exports.BrowserAssistedApiKeyConnectAdapter = exports.InMemoryConnectAttemptStore = exports.PodConnectedCredentialRepository = exports.LoopbackAuthorizationCallbackReceiver = exports.OpenAiSubscriptionSessionImportAdapter = exports.requireTrustedOAuthIntegration = exports.OAuthIntegrationRegistry = exports.OAuthConnectCredentialStore = void 0;
 exports.customModelsFromMetadata = customModelsFromMetadata;
 const node_crypto_1 = require("node:crypto");
 const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
@@ -10,17 +10,19 @@ const ProviderRegistry_1 = require("../providers/ProviderRegistry");
 const CallerPodAccess_1 = require("../auth/CallerPodAccess");
 const PodBaseUrlResolver_1 = require("../pod/PodBaseUrlResolver");
 const OAuthConnectAdapter_1 = require("./OAuthConnectAdapter");
-const OAuthIntegrationRegistry_1 = require("./OAuthIntegrationRegistry");
 const provider_http_transport_1 = require("../../service/provider-http-transport");
 const n3_1 = require("n3");
 var OAuthConnectAdapter_2 = require("./OAuthConnectAdapter");
 Object.defineProperty(exports, "OAuthConnectCredentialStore", { enumerable: true, get: function () { return OAuthConnectAdapter_2.OAuthConnectCredentialStore; } });
-var OAuthIntegrationRegistry_2 = require("./OAuthIntegrationRegistry");
-Object.defineProperty(exports, "OAuthIntegrationRegistry", { enumerable: true, get: function () { return OAuthIntegrationRegistry_2.OAuthIntegrationRegistry; } });
-Object.defineProperty(exports, "requireKimiOAuthClientId", { enumerable: true, get: function () { return OAuthIntegrationRegistry_2.requireKimiOAuthClientId; } });
+var OAuthIntegrationRegistry_1 = require("./OAuthIntegrationRegistry");
+Object.defineProperty(exports, "OAuthIntegrationRegistry", { enumerable: true, get: function () { return OAuthIntegrationRegistry_1.OAuthIntegrationRegistry; } });
+Object.defineProperty(exports, "requireTrustedOAuthIntegration", { enumerable: true, get: function () { return OAuthIntegrationRegistry_1.requireTrustedOAuthIntegration; } });
 var OpenAiSubscriptionSessionImportAdapter_1 = require("./OpenAiSubscriptionSessionImportAdapter");
 Object.defineProperty(exports, "OpenAiSubscriptionSessionImportAdapter", { enumerable: true, get: function () { return OpenAiSubscriptionSessionImportAdapter_1.OpenAiSubscriptionSessionImportAdapter; } });
+var LoopbackAuthorizationCallbackReceiver_1 = require("./LoopbackAuthorizationCallbackReceiver");
+Object.defineProperty(exports, "LoopbackAuthorizationCallbackReceiver", { enumerable: true, get: function () { return LoopbackAuthorizationCallbackReceiver_1.LoopbackAuthorizationCallbackReceiver; } });
 const CREDENTIAL_COLLECTION_QUERY_UNSUPPORTED = 'credential_collection_query_unsupported';
+const credentialUpdateLocks = new Map();
 class PodConnectedCredentialRepository {
     constructor(options = {}) {
         this.internalPodAccess = options.internalPodAccess;
@@ -164,6 +166,7 @@ class PodConnectedCredentialRepository {
         });
         const expectedVersionString = String(expectedVersion ?? currentVersion);
         const updated = await updateByCredentialIdAndVersion({
+            owner: input.webId,
             db,
             credential,
             credentialId: input.credentialId,
@@ -250,17 +253,20 @@ class PodConnectedCredentialRepository {
         if (input.expectedVersion === undefined || currentVersion !== input.expectedVersion) {
             return false;
         }
-        const updated = await db.update(credential)
-            .set({
-            encryptedSecret: JSON.stringify(input.encryptedSecret),
-            wrappedDataKey: input.encryptedSecret.wrappedDek,
-            encryptionAlgorithm: input.encryptedSecret.algorithm,
-            keyVersion: String(currentVersion + 1),
-        })
-            .where((0, drizzle_solid_1.and)((0, drizzle_solid_1.eq)(credential.id, input.credentialId), (0, drizzle_solid_1.eq)(credential.keyVersion, String(input.expectedVersion))))
-            .returning()
-            .execute();
-        return updated.length === 1;
+        const updated = await updateByCredentialIdAndVersion({
+            owner: input.webId,
+            db,
+            credential,
+            credentialId: input.credentialId,
+            expectedVersion: String(input.expectedVersion),
+            patch: {
+                encryptedSecret: JSON.stringify(input.encryptedSecret),
+                wrappedDataKey: input.encryptedSecret.wrappedDek,
+                encryptionAlgorithm: input.encryptedSecret.algorithm,
+                keyVersion: String(currentVersion + 1),
+            },
+        });
+        return updated !== null;
     }
     async markReauthRequired(input) {
         const current = await this.getActiveCredential(input);
@@ -449,7 +455,7 @@ class InMemoryConnectAttemptStore {
         }
         return attempt ? cloneAttempt(attempt) : undefined;
     }
-    async consume(id, now) {
+    async consume(id, now, terminalStatus) {
         this.pruneExpired(now, id);
         const attempt = this.attempts.get(id);
         if (!attempt) {
@@ -463,6 +469,7 @@ class InMemoryConnectAttemptStore {
             throw new Error('Connect attempt expired');
         }
         attempt.consumedAt = new Date(now);
+        attempt.terminalStatus = terminalStatus;
         return cloneAttempt(attempt);
     }
     async claimPoll(id, now) {
@@ -523,10 +530,9 @@ class InMemoryConnectAttemptStore {
     }
 }
 exports.InMemoryConnectAttemptStore = InMemoryConnectAttemptStore;
-class BrowserAssistedApiKeyConnectAdapter {
+class SignedConnectAttemptAdapterBase {
     constructor(options) {
         this.provider = normalizeProvider(options.provider);
-        this.consoleUrl = options.consoleUrl;
         this.attempts = options.attempts;
         this.credentialRepository = options.credentialRepository;
         this.vault = options.vault;
@@ -535,6 +541,91 @@ class BrowserAssistedApiKeyConnectAdapter {
         this.randomBytes = options.randomBytes ?? node_crypto_1.randomBytes;
         this.signingSecret = options.signingSecret;
     }
+    async createAttempt(input, expiresAt, extra = {}) {
+        const attemptWithoutSignature = {
+            id: token(this.randomBytes),
+            provider: this.provider,
+            deployment: input.deployment,
+            webId: input.webId,
+            mode: input.requestedMode,
+            offeringId: extra.offeringId ?? input.offeringId,
+            authorizationMethodId: extra.authorizationMethodId ?? input.authorizationMethodId,
+            state: token(this.randomBytes),
+            expiresAt,
+            expectedCredentialVersion: input.expectedCredentialVersion,
+            ...extra,
+        };
+        const signature = signAttempt(attemptWithoutSignature, this.signingSecret);
+        return this.attempts.create({ ...attemptWithoutSignature, signature });
+    }
+    async loadAttemptForStatus(input, mode) {
+        const attempt = await this.attempts.get(input.attemptId, this.now());
+        if (!attempt) {
+            throw new Error('Connect attempt not found');
+        }
+        if (attempt.webId !== input.webId) {
+            throw new Error('Connect attempt is bound to a different WebID');
+        }
+        if (attempt.deployment !== input.deployment) {
+            throw new Error('Connect attempt is bound to a different deployment');
+        }
+        if (attempt.provider !== normalizeProvider(input.provider)) {
+            throw new Error('Connect attempt is bound to a different provider');
+        }
+        if (attempt.mode !== mode) {
+            throw new Error('Connect attempt mode mismatch');
+        }
+        if (input.offeringId && attempt.offeringId !== input.offeringId) {
+            throw new Error('Connect attempt is bound to a different offering');
+        }
+        if (attempt.state !== input.state) {
+            throw new Error('Invalid Connect attempt state');
+        }
+        if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {
+            throw new Error('Invalid Connect attempt signature');
+        }
+        return attempt;
+    }
+    async loadConsumableAttempt(input, mode) {
+        const attempt = await this.loadAttemptForStatus(input, mode);
+        if (attempt.expiresAt.getTime() <= this.now().getTime()) {
+            throw new Error('Connect attempt expired');
+        }
+        if (attempt.consumedAt) {
+            throw new Error('Connect attempt already consumed');
+        }
+        return attempt;
+    }
+    statusForAttempt(attempt) {
+        if (attempt.expiresAt.getTime() <= this.now().getTime()) {
+            return 'expired';
+        }
+        if (attempt.terminalStatus) {
+            return attempt.terminalStatus;
+        }
+        return attempt.consumedAt ? 'completed' : 'pending';
+    }
+    assertInput(input, mode) {
+        if (normalizeProvider(input.provider) !== this.provider) {
+            throw new Error('Connect provider mismatch');
+        }
+        if (input.deployment !== this.deployment) {
+            throw new Error('Connect deployment mismatch');
+        }
+        if (input.requestedMode !== mode) {
+            throw new Error('Unsupported Connect mode');
+        }
+        if (!input.webId) {
+            throw new Error('Connect WebID is required');
+        }
+    }
+}
+class BrowserAssistedApiKeyConnectAdapter extends SignedConnectAttemptAdapterBase {
+    constructor(options) {
+        super(options);
+        this.mode = 'browserAssistedApiKey';
+        this.consoleUrl = options.consoleUrl;
+    }
     async begin(input) {
         this.assertInput(input, 'browserAssistedApiKey');
         const now = this.now();
@@ -547,6 +638,7 @@ class BrowserAssistedApiKeyConnectAdapter {
             mode: 'browserAssistedApiKey',
             status: 'pending',
             provider: this.provider,
+            offeringId: attempt.offeringId,
             deployment: this.deployment,
             attemptId: attempt.id,
             state: attempt.state,
@@ -567,6 +659,7 @@ class BrowserAssistedApiKeyConnectAdapter {
         });
         const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, this.provider, { type: 'apiKey', apiKey: input.apiKey });
         const metadata = metadataWithoutUndefined({
+            offeringId: attempt.offeringId,
             baseUrl: input.baseUrl,
             health: 'unknown',
         });
@@ -581,6 +674,7 @@ class BrowserAssistedApiKeyConnectAdapter {
             status: 'active',
             accountLabel: input.accountLabel,
             expectedVersion: consumed.expectedCredentialVersion,
+            offeringId: attempt.offeringId,
             health: 'unknown',
             metadata: Object.keys(metadata).length > 0 ? metadata : undefined,
         }, { auth: input.auth });
@@ -588,6 +682,7 @@ class BrowserAssistedApiKeyConnectAdapter {
             mode: 'browserAssistedApiKey',
             status: 'completed',
             provider: this.provider,
+            offeringId: attempt.offeringId,
             deployment: input.deployment,
             attemptId: attempt.id,
             credentialId: record.id,
@@ -599,6 +694,7 @@ class BrowserAssistedApiKeyConnectAdapter {
             mode: attempt.mode,
             status: this.statusForAttempt(attempt),
             provider: this.provider,
+            offeringId: attempt.offeringId,
             deployment: input.deployment,
             attemptId: attempt.id,
             expiresAt: attempt.expiresAt.toISOString(),
@@ -613,239 +709,556 @@ class BrowserAssistedApiKeyConnectAdapter {
             auth: input.auth,
         });
     }
-    async createAttempt(input, expiresAt, extra = {}) {
-        const attemptWithoutSignature = {
-            id: token(this.randomBytes),
-            provider: this.provider,
-            deployment: input.deployment,
-            webId: input.webId,
-            mode: input.requestedMode,
-            state: token(this.randomBytes),
-            expiresAt,
-            expectedCredentialVersion: input.expectedCredentialVersion,
-            ...extra,
-        };
-        const signature = signAttempt(attemptWithoutSignature, this.signingSecret);
-        return this.attempts.create({ ...attemptWithoutSignature, signature });
-    }
-    async loadAttemptForStatus(input, mode) {
-        const attempt = await this.attempts.get(input.attemptId, this.now());
-        if (!attempt) {
-            throw new Error('Connect attempt not found');
-        }
-        if (attempt.webId !== input.webId) {
-            throw new Error('Connect attempt is bound to a different WebID');
-        }
-        if (attempt.deployment !== input.deployment) {
-            throw new Error('Connect attempt is bound to a different deployment');
-        }
-        if (attempt.provider !== normalizeProvider(input.provider)) {
-            throw new Error('Connect attempt is bound to a different provider');
-        }
-        if (attempt.mode !== mode) {
-            throw new Error('Connect attempt mode mismatch');
-        }
-        if (attempt.state !== input.state) {
-            throw new Error('Invalid Connect attempt state');
-        }
-        if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {
-            throw new Error('Invalid Connect attempt signature');
-        }
-        return attempt;
-    }
-    async loadConsumableAttempt(input, mode) {
-        const attempt = await this.loadAttemptForStatus(input, mode);
-        if (attempt.expiresAt.getTime() <= this.now().getTime()) {
-            throw new Error('Connect attempt expired');
-        }
-        if (attempt.consumedAt) {
-            throw new Error('Connect attempt already consumed');
-        }
-        return attempt;
-    }
-    statusForAttempt(attempt) {
-        if (attempt.expiresAt.getTime() <= this.now().getTime()) {
-            return 'expired';
-        }
-        return attempt.consumedAt ? 'completed' : 'pending';
-    }
-    assertInput(input, mode) {
-        if (normalizeProvider(input.provider) !== this.provider) {
-            throw new Error('Connect provider mismatch');
-        }
-        if (input.deployment !== this.deployment) {
-            throw new Error('Connect deployment mismatch');
-        }
-        if (input.requestedMode !== mode) {
-            throw new Error('Unsupported Connect mode');
-        }
-        if (!input.webId) {
-            throw new Error('Connect WebID is required');
-        }
-    }
 }
 exports.BrowserAssistedApiKeyConnectAdapter = BrowserAssistedApiKeyConnectAdapter;
-class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
+class DeviceCodeConnectAdapter extends SignedConnectAttemptAdapterBase {
     constructor(options) {
         super({
             ...options,
-            provider: 'kimi',
-            consoleUrl: 'https://kimi.moonshot.cn/device',
+            provider: options.integration.provider,
         });
+        this.mode = 'deviceCodeOAuth';
+        this.authorizationMethodId = 'device-code';
+        this.integration = options.integration;
+        this.offeringId = options.integration.offeringId;
         this.fetchImpl = options.fetch ?? fetch;
-        this.clientId = (0, OAuthIntegrationRegistry_1.requireKimiOAuthClientId)(options.oauthIntegration);
-        this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';
-        this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';
+        this.clientId = options.integration.clientId;
+        this.protocol = options.integration.protocol;
+        this.requestTimeoutMs = options.requestTimeoutMs ?? 10_000;
         this.oauthCredentials = new OAuthConnectAdapter_1.OAuthConnectCredentialStore({
-            provider: 'kimi',
+            provider: this.provider,
+            offeringId: this.offeringId,
             deployment: options.deployment,
             credentialRepository: options.credentialRepository,
             vault: options.vault,
         });
-        assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');
-        assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');
+        assertTrustedEndpoint(this.protocol.begin);
+        assertTrustedEndpoint(this.protocol.poll);
+        if (this.protocol.tokenExchange) {
+            assertTrustedEndpoint(this.protocol.tokenExchange);
+        }
+        if (this.protocol.refresh) {
+            assertTrustedEndpoint(this.protocol.refresh);
+        }
     }
     async begin(input) {
         this.assertInput(input, 'deviceCodeOAuth');
+        this.assertOfferingInput(input.offeringId);
+        this.assertAuthorizationMethodInput(input.authorizationMethodId);
         const now = this.now();
-        const verifier = token(this.randomBytes);
-        const challenge = codeChallenge(verifier);
-        const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {
+        const usesPkce = this.protocol.begin.codec === 'oauthDeviceCodePkce' || this.protocol.poll.codec === 'oauthDeviceCodePkce';
+        const verifier = usesPkce ? token(this.randomBytes) : undefined;
+        const challenge = verifier ? codeChallenge(verifier) : undefined;
+        const response = await this.fetchImpl(this.protocol.begin.endpoint, this.providerRequest({
             method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                client_id: this.clientId,
-                code_challenge: challenge,
-                code_challenge_method: 'S256',
-            }),
-        });
+            ...deviceCodeBeginRequest(this.protocol, this.clientId, challenge),
+        }));
         const body = await safeJson(response);
         if (!response.ok) {
-            throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);
-        }
-        requireStringField(body, 'device_code');
-        requireStringField(body, 'user_code');
-        requireStringField(body, 'verification_uri_complete');
-        const expiresIn = numberFrom(body.expires_in, 300);
-        const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {
+            throw new Error(`Device authorization failed: ${safeProviderError(body)}`);
+        }
+        const deviceCode = requireProtocolStringField(body, this.protocol.begin.deviceCodeField ?? ['device_code', 'device_auth_id']);
+        const userCode = requireProtocolStringField(body, this.protocol.begin.userCodeField ?? ['user_code', 'usercode']);
+        if (!stringFrom(body[this.protocol.begin.verificationUriCompleteField ?? 'verification_uri_complete'])
+            && !stringFrom(body[this.protocol.begin.verificationUriField ?? 'verification_uri'])
+            && !this.protocol.defaultVerificationUri) {
+            throw new Error('Provider response missing required field: verification_uri_complete');
+        }
+        const verificationUri = verifiedVerificationUri(body, this.protocol);
+        const expiresAt = deviceCodeExpiresAt(body, this.protocol, now);
+        const intervalSeconds = numberFrom(body[this.protocol.begin.intervalField ?? 'interval'], this.protocol.begin.defaultIntervalSeconds ?? 5);
+        const attempt = await this.createAttempt(input, expiresAt, {
             mode: 'deviceCodeOAuth',
+            offeringId: this.offeringId,
+            authorizationMethodId: this.authorizationMethodId,
             codeVerifier: verifier,
-            deviceCode: stringFrom(body.device_code),
-            intervalSeconds: numberFrom(body.interval, 5),
-            currentPollIntervalSeconds: numberFrom(body.interval, 5),
-            nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),
+            deviceCode,
+            userCode,
+            intervalSeconds,
+            currentPollIntervalSeconds: intervalSeconds,
+            nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),
         });
         return {
             mode: 'deviceCodeOAuth',
             status: 'pending',
-            provider: 'kimi',
+            provider: this.provider,
+            offeringId: this.offeringId,
             deployment: input.deployment,
             attemptId: attempt.id,
             state: attempt.state,
             signature: attempt.signature,
             expiresAt: attempt.expiresAt.toISOString(),
             pkceChallenge: challenge,
-            deviceCode: attempt.deviceCode,
-            userCode: stringFrom(body.user_code),
-            verificationUri: stringFrom(body.verification_uri),
-            verificationUriComplete: stringFrom(body.verification_uri_complete),
+            userCode,
+            verificationUri: verificationUri.verificationUri,
+            verificationUriComplete: verificationUri.verificationUriComplete,
             intervalSeconds: attempt.intervalSeconds,
         };
     }
     async pollDevice(input) {
         const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');
+        this.assertAttemptOffering(attempt);
         const now = this.nowForConsume();
         const claim = await this.attempts.claimPoll(input.attemptId, now);
         if (!claim.claimed) {
             return pendingResult(input, claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending', claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds);
         }
         try {
-            const response = await this.fetchImpl(this.tokenEndpoint, {
+            const response = await this.fetchImpl(this.protocol.poll.endpoint, this.providerRequest({
                 method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: new URLSearchParams({
-                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                    device_code: attempt.deviceCode ?? '',
-                    client_id: this.clientId,
-                    code_verifier: attempt.codeVerifier ?? '',
-                }),
-            });
+                ...deviceCodePollRequest(this.protocol, this.clientId, attempt),
+            }));
             const body = await safeJson(response);
             if (!response.ok) {
-                if (body.error === 'authorization_pending' || body.error === 'slow_down') {
-                    const status = body.error;
-                    const intervalSeconds = status === 'slow_down'
+                const pendingStatus = this.pendingPollStatus(response, body);
+                if (pendingStatus) {
+                    const intervalSeconds = pendingStatus === 'slow_down'
                         ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5
                         : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);
                     await this.attempts.updatePollSchedule(input.attemptId, {
                         intervalSeconds,
                         nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),
-                        lastPollStatus: status,
+                        lastPollStatus: pendingStatus,
                     });
-                    return pendingResult(input, status, intervalSeconds);
+                    return pendingResult(input, pendingStatus, intervalSeconds, this.provider, this.offeringId);
                 }
                 if (body.error === 'expired_token') {
-                    await this.attempts.consume(input.attemptId, this.nowForConsume());
-                    return pendingResult(input, 'expired');
+                    await this.attempts.consume(input.attemptId, this.nowForConsume(), 'expired');
+                    return pendingResult(input, 'expired', undefined, this.provider, this.offeringId);
+                }
+                if (body.error === 'access_denied') {
+                    await this.attempts.consume(input.attemptId, this.nowForConsume(), 'denied');
+                    return pendingResult(input, 'denied', undefined, this.provider, this.offeringId);
                 }
-                throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);
+                throw new Error(`Device token failed: ${safeProviderError(body)}`);
             }
+            const tokenBody = await this.resolveTokenBody(body, attempt);
             await this.attempts.consume(input.attemptId, this.nowForConsume());
-            requireStringField(body, 'access_token');
-            requireStringField(body, 'refresh_token');
+            requireStringField(tokenBody, 'access_token');
+            requireStringField(tokenBody, 'refresh_token');
             return {
                 mode: 'deviceCodeOAuth',
                 status: 'completed',
-                provider: 'kimi',
+                provider: this.provider,
+                offeringId: this.offeringId,
                 deployment: input.deployment,
                 attemptId: input.attemptId,
-                oauthCredential: oneTimeOAuthCredential(body, this.now(), attempt.expectedCredentialVersion),
+                oauthCredential: oneTimeOAuthCredential(tokenBody, this.now(), attempt.expectedCredentialVersion, this.integration, undefined, this.authorizationMethodId),
             };
         }
         catch (error) {
             await this.attempts.releasePollClaim(input.attemptId);
             throw error;
         }
-    }
-    async status(input) {
-        const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');
+    }
+    pendingPollStatus(response, body) {
+        if (body.error === 'authorization_pending' || body.error === 'slow_down') {
+            return body.error;
+        }
+        return this.protocol.poll.pendingHttpStatuses?.includes(response.status) ? 'authorization_pending' : undefined;
+    }
+    async status(input) {
+        const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');
+        this.assertAttemptOffering(attempt);
+        return {
+            mode: 'deviceCodeOAuth',
+            status: this.statusForAttempt(attempt),
+            provider: this.provider,
+            offeringId: this.offeringId,
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            expiresAt: attempt.expiresAt.toISOString(),
+            intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,
+        };
+    }
+    async cancel(input) {
+        const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');
+        this.assertAttemptOffering(attempt);
+        await this.attempts.consume(input.attemptId, this.nowForConsume(), 'cancelled');
+        return pendingResult(input, 'cancelled', undefined, this.provider, this.offeringId);
+    }
+    async refresh(input, current, secret) {
+        this.assertStoredOffering(current);
+        const refreshToken = stringFrom(secret.refreshToken);
+        if (!refreshToken) {
+            return this.credentialRepository.markReauthRequired({
+                webId: input.webId,
+                provider: this.provider,
+                deployment: input.deployment,
+                reason: 'missing_refresh_token',
+                expectedVersion: current.version,
+                auth: input.auth,
+            });
+        }
+        const refresh = this.protocol.refresh ?? this.protocol.poll;
+        const refreshResult = await executeOAuthRefreshRequest(this.fetchImpl, (init) => this.providerRequest(init), refresh, this.clientId, refreshToken);
+        const body = refreshResult.body;
+        if (!refreshResult.ok) {
+            return this.credentialRepository.markReauthRequired({
+                webId: input.webId,
+                provider: this.provider,
+                deployment: input.deployment,
+                reason: safeProviderError(body),
+                expectedVersion: current.version,
+                auth: input.auth,
+            });
+        }
+        requireStringField(body, 'access_token');
+        return this.updateOAuthCredential(input, body, current, secret);
+    }
+    async refreshCallerOwned(input) {
+        this.assertOfferingInput(input.offeringId);
+        if (!input.refreshToken.trim())
+            throw new Error('oauth_refresh_token_required');
+        const refresh = this.protocol.refresh ?? this.protocol.poll;
+        const refreshResult = await executeOAuthRefreshRequest(this.fetchImpl, (init) => this.providerRequest(init), refresh, this.clientId, input.refreshToken);
+        const body = refreshResult.body;
+        if (!refreshResult.ok) {
+            throw new Error(`OAuth refresh failed: ${safeProviderError(body)}`);
+        }
+        return {
+            mode: 'deviceCodeOAuth',
+            status: 'completed',
+            provider: this.provider,
+            offeringId: this.offeringId,
+            deployment: input.deployment,
+            credentialId: input.credentialId,
+            oauthCredential: oneTimeOAuthCredential(body, this.now(), input.expectedVersion, this.integration, input.refreshToken, this.authorizationMethodId),
+        };
+    }
+    async disconnect(input) {
+        this.assertOfferingInput(input.offeringId);
+        const current = await this.findOAuthCredential(input);
+        if (!current) {
+            throw new Error('oauth_credential_not_found');
+        }
+        return this.credentialRepository.revokeCredential({
+            webId: input.webId,
+            provider: this.provider,
+            deployment: input.deployment,
+            credentialId: current.id,
+            expectedVersion: current.version,
+            auth: input.auth,
+        });
+    }
+    nowForConsume() {
+        return this.now();
+    }
+    async updateOAuthCredential(input, body, current, currentSecret) {
+        const expiresAt = expiresAtFrom(body.expires_in, this.now());
+        const nextIdToken = stringFrom(body.id_token) || stringFrom(currentSecret.idToken);
+        const secret = {
+            type: 'deviceCodeOAuth',
+            accessToken: stringFrom(body.access_token),
+            refreshToken: stringFrom(body.refresh_token) || stringFrom(currentSecret.refreshToken),
+            expiresAt: expiresAt?.toISOString(),
+            scope: stringFrom(body.scope),
+            idToken: nextIdToken,
+            accountId: stringFrom(body.account_id)
+                || jwtClaim(nextIdToken, this.protocol.accountIdClaim)
+                || stringFrom(currentSecret.accountId),
+        };
+        return this.oauthCredentials.updateOAuthCredential({
+            current,
+            webId: input.webId,
+            deployment: input.deployment,
+            secret,
+            expiresAt,
+            auth: input.auth,
+            metadata: {
+                authoritativeSubject: decodeJwtSubject(nextIdToken),
+            },
+        });
+    }
+    async findOAuthCredential(input) {
+        const credentials = input.credentialId
+            ? [
+                await this.credentialRepository.getCredentialById({
+                    webId: input.webId,
+                    provider: this.provider,
+                    deployment: input.deployment,
+                    credentialId: input.credentialId,
+                    auth: input.auth,
+                }),
+            ]
+            : await this.credentialRepository.listProviderCredentials({
+                webId: input.webId,
+                provider: this.provider,
+                deployment: input.deployment,
+                auth: input.auth,
+            });
+        return credentials.find((credential) => credential && this.isProviderOAuthCredential(credential));
+    }
+    async resolveTokenBody(body, attempt) {
+        if (this.protocol.tokenExchange?.codec !== 'authorizationCodeForm') {
+            return body;
+        }
+        const code = requireProtocolStringField(body, this.protocol.tokenExchange.codeField ?? ['code', 'authorization_code']);
+        const codeVerifier = stringFrom(body[this.protocol.tokenExchange.codeVerifierField ?? 'code_verifier']) || attempt.codeVerifier;
+        if (!codeVerifier) {
+            throw new Error('Provider response missing required field: code_verifier');
+        }
+        const response = await this.fetchImpl(this.protocol.tokenExchange.endpoint, this.providerRequest({
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                code_verifier: codeVerifier,
+                client_id: this.clientId,
+                ...(this.protocol.tokenExchange.redirectUri ? { redirect_uri: this.protocol.tokenExchange.redirectUri } : {}),
+            }),
+        }));
+        const tokenBody = await safeJson(response);
+        if (!response.ok) {
+            throw new Error(`Device token exchange failed: ${safeProviderError(tokenBody)}`);
+        }
+        return tokenBody;
+    }
+    providerRequest(init) {
+        return {
+            ...init,
+            redirect: 'error',
+            signal: requestTimeoutSignal(this.requestTimeoutMs),
+        };
+    }
+    assertOfferingInput(offeringId) {
+        if (offeringId && normalizeProvider(offeringId) !== normalizeProvider(this.offeringId)) {
+            throw new Error('Connect offering mismatch');
+        }
+    }
+    assertAuthorizationMethodInput(authorizationMethodId) {
+        if (authorizationMethodId && normalizeProvider(authorizationMethodId) !== this.authorizationMethodId) {
+            throw new Error('Connect authorization method mismatch');
+        }
+    }
+    assertAttemptOffering(attempt) {
+        if (attempt.offeringId !== this.offeringId) {
+            throw new Error('Connect attempt is bound to a different offering');
+        }
+        if (attempt.authorizationMethodId !== this.authorizationMethodId) {
+            throw new Error('Connect attempt authorization method mismatch');
+        }
+    }
+    assertStoredOffering(current) {
+        const metadata = metadataFromRowValue(current.metadata) ?? {};
+        if ((current.offeringId ?? stringMetadata(metadata, 'offeringId')) !== this.offeringId) {
+            throw new Error('oauth_credential_not_found');
+        }
+    }
+    isProviderOAuthCredential(credential) {
+        if (!credential)
+            return false;
+        const metadata = metadataFromRowValue(credential.metadata) ?? {};
+        return credential.provider === this.provider
+            && isOAuthProviderCredential(credential)
+            && (credential.offeringId ?? stringMetadata(metadata, 'offeringId')) === this.offeringId;
+    }
+}
+exports.DeviceCodeConnectAdapter = DeviceCodeConnectAdapter;
+class AuthorizationCodeConnectAdapter extends SignedConnectAttemptAdapterBase {
+    constructor(options) {
+        super({
+            ...options,
+            provider: options.integration.provider,
+        });
+        this.mode = 'authorizationCodeOAuth';
+        this.authorizationMethodId = 'browser-oauth';
+        this.callbacks = new Map();
+        this.integration = options.integration;
+        this.offeringId = options.integration.offeringId;
+        this.fetchImpl = options.fetch ?? fetch;
+        this.clientId = options.integration.clientId;
+        this.callbackReceiver = options.callbackReceiver;
+        this.requestTimeoutMs = options.requestTimeoutMs ?? 10_000;
+        this.oauthCredentials = new OAuthConnectAdapter_1.OAuthConnectCredentialStore({
+            provider: this.provider,
+            offeringId: this.offeringId,
+            deployment: options.deployment,
+            credentialRepository: options.credentialRepository,
+            vault: options.vault,
+        });
+        assertTrustedEndpoint(this.integration.protocol.authorization);
+        assertTrustedEndpoint(this.integration.protocol.token);
+        if (this.integration.protocol.refresh) {
+            assertTrustedEndpoint(this.integration.protocol.refresh);
+        }
+    }
+    async begin(input) {
+        this.assertInput(input, 'authorizationCodeOAuth');
+        this.assertOfferingInput(input.offeringId);
+        this.assertAuthorizationMethodInput(input.authorizationMethodId);
+        const now = this.now();
+        const expiresAt = new Date(now.getTime() + 15 * 60 * 1000);
+        const verifier = token(this.randomBytes);
+        const challenge = codeChallenge(verifier);
+        const attempt = await this.createAttempt(input, expiresAt, {
+            mode: 'authorizationCodeOAuth',
+            offeringId: this.offeringId,
+            authorizationMethodId: this.authorizationMethodId,
+            codeVerifier: verifier,
+        });
+        let registration;
+        try {
+            registration = await this.callbackReceiver.register({
+                redirectUris: this.integration.protocol.authorization.redirectUris,
+                state: attempt.state,
+                expiresAt,
+                onCallback: async (result) => {
+                    const context = this.callbacks.get(attempt.id);
+                    if (!context)
+                        return;
+                    context.authorizationCode = result.code;
+                    context.error = result.error;
+                },
+            });
+            if (!this.integration.protocol.authorization.redirectUris.includes(registration.redirectUri)) {
+                registration.close();
+                await this.attempts.consume(attempt.id, this.now(), 'cancelled');
+                throw new Error('Authorization callback redirect URI is not allowlisted');
+            }
+            const expiresTimer = setTimeout(() => this.closeCallback(attempt.id), Math.max(0, expiresAt.getTime() - this.now().getTime()));
+            expiresTimer.unref();
+            this.callbacks.set(attempt.id, {
+                redirectUri: registration.redirectUri,
+                close: registration.close,
+                expiresTimer,
+            });
+        }
+        catch (error) {
+            registration?.close();
+            this.callbacks.delete(attempt.id);
+            try {
+                await this.attempts.consume(attempt.id, this.now(), 'cancelled');
+            }
+            catch {
+                // Attempt cleanup is best-effort when registration fails after expiry.
+            }
+            throw error;
+        }
+        return {
+            mode: 'authorizationCodeOAuth',
+            status: 'pending',
+            provider: this.provider,
+            offeringId: this.offeringId,
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            state: attempt.state,
+            signature: attempt.signature,
+            expiresAt: attempt.expiresAt.toISOString(),
+            pkceChallenge: challenge,
+            authorizationUrl: this.authorizationUrl(attempt, challenge, registration.redirectUri),
+        };
+    }
+    async pollDevice(input) {
+        const attempt = await this.loadAuthorizationAttempt(input, true);
+        this.assertAttemptOffering(attempt);
+        const context = this.callbacks.get(input.attemptId);
+        if (!context) {
+            throw new Error('Authorization callback listener not found');
+        }
+        if (context.error) {
+            this.closeCallback(input.attemptId);
+            await this.attempts.consume(input.attemptId, this.now(), 'denied');
+            return oauthPendingResult(input, 'denied', this.provider, this.offeringId, 'authorizationCodeOAuth');
+        }
+        if (!context.authorizationCode) {
+            return oauthPendingResult(input, 'authorization_pending', this.provider, this.offeringId, 'authorizationCodeOAuth');
+        }
+        const now = this.now();
+        const claim = await this.attempts.claimPoll(input.attemptId, now);
+        if (!claim.claimed) {
+            return oauthPendingResult(input, 'authorization_pending', this.provider, this.offeringId, 'authorizationCodeOAuth');
+        }
+        try {
+            const body = await this.exchangeAuthorizationCode(context.authorizationCode, attempt.codeVerifier, context.redirectUri);
+            const oauthCredential = oneTimeOAuthCredential(body, this.now(), attempt.expectedCredentialVersion, this.integration, undefined, this.authorizationMethodId);
+            await this.attempts.consume(input.attemptId, this.now());
+            this.closeCallback(input.attemptId);
+            return {
+                mode: 'authorizationCodeOAuth',
+                status: 'completed',
+                provider: this.provider,
+                offeringId: this.offeringId,
+                deployment: input.deployment,
+                attemptId: input.attemptId,
+                oauthCredential,
+            };
+        }
+        catch (error) {
+            this.closeCallback(input.attemptId);
+            try {
+                await this.attempts.consume(input.attemptId, this.now(), 'denied');
+            }
+            catch {
+                await this.attempts.releasePollClaim(input.attemptId);
+            }
+            throw error;
+        }
+    }
+    async status(input) {
+        const attempt = await this.loadAuthorizationAttempt(input, false);
+        this.assertAttemptOffering(attempt);
+        return {
+            mode: 'authorizationCodeOAuth',
+            status: this.statusForAttempt(attempt),
+            provider: this.provider,
+            offeringId: this.offeringId,
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            expiresAt: attempt.expiresAt.toISOString(),
+        };
+    }
+    async cancel(input) {
+        const attempt = await this.loadAuthorizationAttempt(input, true);
+        this.assertAttemptOffering(attempt);
+        this.closeCallback(input.attemptId);
+        await this.attempts.consume(input.attemptId, this.now(), 'cancelled');
+        return oauthPendingResult(input, 'cancelled', this.provider, this.offeringId, 'authorizationCodeOAuth');
+    }
+    async refreshCallerOwned(input) {
+        this.assertOfferingInput(input.offeringId);
+        if (input.authorizationMethodId) {
+            this.assertAuthorizationMethodInput(input.authorizationMethodId);
+        }
+        if (!input.refreshToken.trim())
+            throw new Error('oauth_refresh_token_required');
+        const refresh = this.integration.protocol.refresh ?? this.integration.protocol.token;
+        const refreshResult = await executeOAuthRefreshRequest(this.fetchImpl, (init) => this.providerRequest(init), refresh, this.clientId, input.refreshToken);
+        const body = refreshResult.body;
+        if (!refreshResult.ok) {
+            throw new Error(`OAuth refresh failed: ${safeProviderError(body)}`);
+        }
         return {
-            mode: 'deviceCodeOAuth',
-            status: this.statusForAttempt(attempt),
-            provider: 'kimi',
+            mode: 'authorizationCodeOAuth',
+            status: 'completed',
+            provider: this.provider,
+            offeringId: this.offeringId,
             deployment: input.deployment,
-            attemptId: attempt.id,
-            expiresAt: attempt.expiresAt.toISOString(),
-            deviceCode: attempt.deviceCode,
-            intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,
+            credentialId: input.credentialId,
+            oauthCredential: oneTimeOAuthCredential(body, this.now(), input.expectedVersion, this.integration, input.refreshToken, this.authorizationMethodId),
         };
     }
     async refresh(input, current, secret) {
+        this.assertStoredOffering(current);
         const refreshToken = stringFrom(secret.refreshToken);
         if (!refreshToken) {
             return this.credentialRepository.markReauthRequired({
                 webId: input.webId,
-                provider: 'kimi',
+                provider: this.provider,
                 deployment: input.deployment,
                 reason: 'missing_refresh_token',
                 expectedVersion: current.version,
                 auth: input.auth,
             });
         }
-        const response = await this.fetchImpl(this.tokenEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                grant_type: 'refresh_token',
-                refresh_token: refreshToken,
-                client_id: this.clientId,
-            }),
-        });
-        const body = await safeJson(response);
-        if (!response.ok) {
+        const refresh = this.integration.protocol.refresh ?? this.integration.protocol.token;
+        const refreshResult = await executeOAuthRefreshRequest(this.fetchImpl, (init) => this.providerRequest(init), refresh, this.clientId, refreshToken);
+        const body = refreshResult.body;
+        if (!refreshResult.ok) {
             return this.credentialRepository.markReauthRequired({
                 webId: input.webId,
-                provider: 'kimi',
+                provider: this.provider,
                 deployment: input.deployment,
                 reason: safeProviderError(body),
                 expectedVersion: current.version,
@@ -853,60 +1266,74 @@ class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
             });
         }
         requireStringField(body, 'access_token');
-        requireStringField(body, 'refresh_token');
-        return this.updateOAuthCredential(input, body, current);
-    }
-    async refreshCallerOwned(input) {
-        if (!input.refreshToken.trim())
-            throw new Error('oauth_refresh_token_required');
-        const response = await this.fetchImpl(this.tokenEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                grant_type: 'refresh_token',
-                refresh_token: input.refreshToken,
-                client_id: this.clientId,
-            }),
-        });
-        const body = await safeJson(response);
-        if (!response.ok) {
-            throw new Error(`Kimi OAuth refresh failed: ${safeProviderError(body)}`);
-        }
-        return {
-            mode: 'deviceCodeOAuth',
-            status: 'completed',
-            provider: 'kimi',
-            deployment: input.deployment,
-            credentialId: input.credentialId,
-            oauthCredential: oneTimeOAuthCredential(body, this.now(), input.expectedVersion),
-        };
+        return this.updateOAuthCredential(input, body, current, secret);
     }
     async disconnect(input) {
+        this.assertOfferingInput(input.offeringId);
         const current = await this.findOAuthCredential(input);
         if (!current) {
             throw new Error('oauth_credential_not_found');
         }
         return this.credentialRepository.revokeCredential({
             webId: input.webId,
-            provider: 'kimi',
+            provider: this.provider,
             deployment: input.deployment,
             credentialId: current.id,
             expectedVersion: current.version,
             auth: input.auth,
         });
     }
-    nowForConsume() {
-        return this.now();
+    authorizationUrl(attempt, challenge, redirectUri) {
+        const url = new URL(this.integration.protocol.authorization.endpoint);
+        url.searchParams.set('response_type', this.integration.protocol.authorization.responseType ?? 'code');
+        url.searchParams.set('client_id', this.clientId);
+        url.searchParams.set('redirect_uri', redirectUri);
+        url.searchParams.set('state', attempt.state);
+        url.searchParams.set('code_challenge', challenge);
+        url.searchParams.set('code_challenge_method', this.integration.protocol.authorization.codeChallengeMethod ?? 'S256');
+        const scopes = this.integration.protocol.authorization.scopes ?? [];
+        if (scopes.length > 0) {
+            url.searchParams.set('scope', scopes.join(' '));
+        }
+        for (const [key, value] of Object.entries(this.integration.protocol.authorization.extraParams ?? {})) {
+            url.searchParams.set(key, value);
+        }
+        return url.toString();
+    }
+    async exchangeAuthorizationCode(code, codeVerifier, redirectUri) {
+        if (!codeVerifier) {
+            throw new Error('Authorization code verifier is missing');
+        }
+        const response = await this.fetchImpl(this.integration.protocol.token.endpoint, this.providerRequest({
+            method: 'POST',
+            headers: withProtocolHeaders({ 'Content-Type': 'application/x-www-form-urlencoded' }, this.integration.protocol.token.headers),
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                code_verifier: codeVerifier,
+                client_id: this.clientId,
+                redirect_uri: redirectUri,
+            }),
+        }));
+        const body = await safeJson(response);
+        if (!response.ok) {
+            throw new Error(`Authorization code token exchange failed: ${safeProviderError(body)}`);
+        }
+        return body;
     }
-    async updateOAuthCredential(input, body, current) {
+    async updateOAuthCredential(input, body, current, currentSecret) {
         const expiresAt = expiresAtFrom(body.expires_in, this.now());
+        const nextIdToken = stringFrom(body.id_token) || stringFrom(currentSecret.idToken);
         const secret = {
             type: 'deviceCodeOAuth',
             accessToken: stringFrom(body.access_token),
-            refreshToken: stringFrom(body.refresh_token),
+            refreshToken: stringFrom(body.refresh_token) || stringFrom(currentSecret.refreshToken),
             expiresAt: expiresAt?.toISOString(),
             scope: stringFrom(body.scope),
-            idToken: stringFrom(body.id_token),
+            idToken: nextIdToken,
+            accountId: stringFrom(body.account_id)
+                || jwtClaim(nextIdToken, this.integration.protocol.accountIdClaim)
+                || stringFrom(currentSecret.accountId),
         };
         return this.oauthCredentials.updateOAuthCredential({
             current,
@@ -916,7 +1343,8 @@ class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
             expiresAt,
             auth: input.auth,
             metadata: {
-                authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),
+                authoritativeSubject: decodeJwtSubject(nextIdToken),
+                authorizationMethodId: this.authorizationMethodId,
             },
         });
     }
@@ -925,7 +1353,7 @@ class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
             ? [
                 await this.credentialRepository.getCredentialById({
                     webId: input.webId,
-                    provider: 'kimi',
+                    provider: this.provider,
                     deployment: input.deployment,
                     credentialId: input.credentialId,
                     auth: input.auth,
@@ -933,14 +1361,74 @@ class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
             ]
             : await this.credentialRepository.listProviderCredentials({
                 webId: input.webId,
-                provider: 'kimi',
+                provider: this.provider,
                 deployment: input.deployment,
                 auth: input.auth,
             });
-        return credentials.find((credential) => credential && isKimiOAuthCredential(credential));
+        return credentials.find((credential) => credential && this.isProviderOAuthCredential(credential));
+    }
+    providerRequest(init) {
+        return {
+            ...init,
+            redirect: 'error',
+            signal: requestTimeoutSignal(this.requestTimeoutMs),
+        };
+    }
+    assertOfferingInput(offeringId) {
+        if (offeringId && normalizeProvider(offeringId) !== normalizeProvider(this.offeringId)) {
+            throw new Error('Connect offering mismatch');
+        }
+    }
+    assertAuthorizationMethodInput(authorizationMethodId) {
+        if (authorizationMethodId && normalizeProvider(authorizationMethodId) !== this.authorizationMethodId) {
+            throw new Error('Connect authorization method mismatch');
+        }
+    }
+    assertAttemptOffering(attempt) {
+        if (attempt.offeringId !== this.offeringId) {
+            throw new Error('Connect attempt is bound to a different offering');
+        }
+        if (attempt.authorizationMethodId !== this.authorizationMethodId) {
+            throw new Error('Connect attempt authorization method mismatch');
+        }
+    }
+    assertStoredOffering(current) {
+        const metadata = metadataFromRowValue(current.metadata) ?? {};
+        if ((current.offeringId ?? stringMetadata(metadata, 'offeringId')) !== this.offeringId) {
+            throw new Error('oauth_credential_not_found');
+        }
+    }
+    isProviderOAuthCredential(credential) {
+        if (!credential)
+            return false;
+        const metadata = metadataFromRowValue(credential.metadata) ?? {};
+        return credential.provider === this.provider
+            && isOAuthProviderCredential(credential)
+            && (credential.offeringId ?? stringMetadata(metadata, 'offeringId')) === this.offeringId;
+    }
+    async loadAuthorizationAttempt(input, consumable) {
+        try {
+            return consumable
+                ? await this.loadConsumableAttempt(input, 'authorizationCodeOAuth')
+                : await this.loadAttemptForStatus(input, 'authorizationCodeOAuth');
+        }
+        catch (error) {
+            if (isTerminalAttemptError(error)) {
+                this.closeCallback(input.attemptId);
+            }
+            throw error;
+        }
+    }
+    closeCallback(attemptId) {
+        const context = this.callbacks.get(attemptId);
+        if (!context)
+            return;
+        clearTimeout(context.expiresTimer);
+        context.close();
+        this.callbacks.delete(attemptId);
     }
 }
-exports.KimiDeviceCodeConnectAdapter = KimiDeviceCodeConnectAdapter;
+exports.AuthorizationCodeConnectAdapter = AuthorizationCodeConnectAdapter;
 class DeepSeekConnectAdapter {
     constructor() {
         this.provider = 'deepseek';
@@ -968,7 +1456,7 @@ class ProviderConnectService {
         this.credentialRepository = options.credentialRepository;
         this.vault = options.vault;
         for (const adapter of options.adapters) {
-            this.adapters.set(normalizeProvider(adapter.provider), adapter);
+            this.adapters.set(connectAdapterKey(adapter.provider, adapter.offeringId, adapter.mode), adapter);
         }
         for (const importer of options.localSessionImporters ?? []) {
             this.localSessionImporters.set(localSessionImporterKey(importer.provider, importer.offeringId), importer);
@@ -976,7 +1464,8 @@ class ProviderConnectService {
     }
     begin(input) {
         const descriptor = this.registry.requireProvider(input.provider);
-        if (descriptor.connect?.mode !== input.requestedMode) {
+        const offeringId = this.requireConnectOffering(input.provider, input.offeringId, input.requestedMode);
+        if (descriptor.connect?.mode !== input.requestedMode && !this.offeringSupportsConnectMode(input.provider, offeringId, input.requestedMode)) {
             throw new Error('Requested Connect mode does not match provider capability');
         }
         if (descriptor.connect?.configured === false) {
@@ -987,12 +1476,36 @@ class ProviderConnectService {
                 mode: descriptor.connect.mode,
                 status: 'unsupported',
                 provider: normalizeProvider(input.provider),
+                offeringId,
                 deployment: input.deployment,
                 apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,
                 message,
             });
         }
-        return this.requireAdapter(input.provider).begin(input);
+        return this.requireAdapter(input.provider, offeringId, input.requestedMode).begin({
+            ...input,
+            offeringId,
+        });
+    }
+    getAuthorizationMethods() {
+        return this.registry.listProducts().flatMap((product) => product.offerings.map((offering) => {
+            const authorizationMethods = (offering.authorizationMethods ?? []).map((method) => {
+                const unavailableReason = this.authorizationMethodUnavailableReason(product.id, offering.id, method);
+                return metadataWithoutUndefined({
+                    ...method,
+                    lifecycle: unavailableReason ? 'unavailable' : method.lifecycle,
+                    reason: unavailableReason ?? method.reason,
+                });
+            });
+            return {
+                provider: product.id,
+                offeringId: offering.id,
+                authorizationMethods,
+                ...(product.id === 'custom' ? {} : {
+                    endpoints: offering.endpoints.map((endpoint) => ({ ...endpoint })),
+                }),
+            };
+        }));
     }
     async listProviders(input) {
         return Promise.all(this.registry.listProviders().map(async (descriptor) => {
@@ -1100,11 +1613,30 @@ class ProviderConnectService {
         return publicPoolCredentialSummary(created);
     }
     async createLocalCredential(input) {
+        if (!this.credentialRepository || !this.vault)
+            throw new Error('credential_pool_not_configured');
+        const key = JSON.stringify([input.webId, input.deployment, normalizeProvider(input.provider),
+            this.requireLocalOffering(normalizeProvider(input.provider), input.offeringId)]);
+        const previous = ProviderConnectService.localImportLocks.get(key) ?? Promise.resolve();
+        let release;
+        const pending = new Promise((resolve) => { release = resolve; });
+        ProviderConnectService.localImportLocks.set(key, pending);
+        await previous;
+        try {
+            return await this.importLocalCredential(input);
+        }
+        finally {
+            release();
+            if (ProviderConnectService.localImportLocks.get(key) === pending) {
+                ProviderConnectService.localImportLocks.delete(key);
+            }
+        }
+    }
+    async importLocalCredential(input) {
         if (!this.credentialRepository || !this.vault)
             throw new Error('credential_pool_not_configured');
         const provider = normalizeProvider(input.provider);
         const offeringId = this.requireLocalOffering(provider, input.offeringId);
-        const { credentialId, credentialIri } = createPoolCredentialLocator(input.webId, input.deployment, provider);
         const importer = this.localSessionImporters.get(localSessionImporterKey(provider, offeringId));
         const offering = this.registry.getOffering(provider, offeringId);
         if (offering?.kind === 'oauth-subscription' && !importer) {
@@ -1115,7 +1647,79 @@ class ProviderConnectService {
             });
         }
         const imported = await importer?.importSession({ deployment: input.deployment });
-        const encryptedSecret = await this.vault.seal({ webId: input.webId }, credentialIri, provider, imported?.secret ?? { type: 'local' });
+        if (imported) {
+            const candidates = (await this.credentialRepository.listProviderCredentials({ ...input, provider }))
+                .sort((left, right) => (right.expiresAt?.getTime() ?? 0) - (left.expiresAt?.getTime() ?? 0)
+                || (right.version ?? 0) - (left.version ?? 0));
+            let refreshFailure;
+            for (const existing of candidates) {
+                if (existing.status !== 'active' || existing.offeringId !== offeringId)
+                    continue;
+                let secret;
+                try {
+                    secret = await this.vault.open({ webId: input.webId }, existing.credentialIri, provider, existing.encryptedSecret);
+                }
+                catch {
+                    // An unreadable credential cannot establish session identity.
+                    continue;
+                }
+                if (!sameImportedSession(provider, secret, imported.secret))
+                    continue;
+                const importedExpired = (dateFrom(imported.secret.expiresAt)?.getTime() ?? Infinity) <= Date.now();
+                const existingExpiresAt = dateFrom(secret.expiresAt)?.getTime() ?? existing.expiresAt?.getTime() ?? 0;
+                const existingIsNewer = existingExpiresAt > (dateFrom(imported.secret.expiresAt)?.getTime() ?? 0);
+                const isPreviousImport = typeof secret.importedSessionFingerprint === 'string'
+                    && secret.importedSessionFingerprint === importedSessionFingerprint(imported.secret);
+                let nextSecret;
+                try {
+                    nextSecret = await this.refreshImportedSecret(importedExpired && (existingIsNewer || isPreviousImport) ? secret : imported.secret, { ...input, provider, offeringId, credentialId: existing.id, expectedVersion: existing.version ?? 0 });
+                }
+                catch (error) {
+                    if (!(error instanceof Error) || error.message !== 'local_session_reauth_required')
+                        throw error;
+                    refreshFailure = error;
+                    continue;
+                }
+                nextSecret.importedSessionFingerprint = importedSessionFingerprint(imported.secret);
+                const health = existing.enabled === false ? 'disabled' : 'healthy';
+                const updated = await this.credentialRepository.updateCredential({
+                    ...input,
+                    provider,
+                    credentialId: existing.id,
+                    expectedVersion: existing.version,
+                    patch: {
+                        encryptedSecret: await this.vault.seal({ webId: input.webId }, existing.credentialIri, provider, nextSecret),
+                        authMode: imported.credentialAuthMode ?? 'local',
+                        expiresAt: dateFrom(nextSecret.expiresAt),
+                        scopes: scopeListFromSecret(nextSecret),
+                        reauthRequired: false,
+                        health,
+                        metadata: metadataWithoutUndefined({
+                            ...imported.metadata,
+                            ...existing.metadata,
+                            offeringId,
+                            accountId: nextSecret.accountId,
+                            authoritativeSubject: nextSecret.accountSubject,
+                            health,
+                        }),
+                    },
+                });
+                if (!updated)
+                    throw new Error('credential_version_conflict');
+                return publicPoolCredentialSummary(updated);
+            }
+            if (refreshFailure)
+                throw refreshFailure;
+        }
+        const { credentialId, credentialIri } = createPoolCredentialLocator(input.webId, input.deployment, provider);
+        const nextSecret = imported
+            ? await this.refreshImportedSecret(imported.secret, {
+                ...input, provider, offeringId, credentialId, expectedVersion: 0,
+            })
+            : { type: 'local' };
+        if (imported)
+            nextSecret.importedSessionFingerprint = importedSessionFingerprint(imported.secret);
+        const encryptedSecret = await this.vault.seal({ webId: input.webId }, credentialIri, provider, nextSecret);
         const created = await this.credentialRepository.createCredential({
             id: credentialId,
             credentialIri,
@@ -1130,8 +1734,12 @@ class ProviderConnectService {
             priority: input.priority ?? 100,
             enabled: true,
             health: 'healthy',
+            expiresAt: dateFrom(nextSecret.expiresAt),
+            scopes: scopeListFromSecret(nextSecret),
             metadata: metadataWithoutUndefined({
                 ...imported?.metadata,
+                accountId: nextSecret.accountId,
+                authoritativeSubject: nextSecret.accountSubject,
                 offeringId,
                 priority: input.priority ?? 100,
                 enabled: true,
@@ -1141,6 +1749,31 @@ class ProviderConnectService {
         }, { auth: input.auth });
         return publicPoolCredentialSummary(created);
     }
+    async refreshImportedSecret(secret, input) {
+        if ((dateFrom(secret.expiresAt)?.getTime() ?? Infinity) > Date.now()) {
+            return { ...secret, ...metadataWithoutUndefined({ ...kimiAccountIdentityHint(input.provider, secret.accessToken) }) };
+        }
+        if (typeof secret.refreshToken !== 'string' || !secret.refreshToken) {
+            throw new Error('local_session_missing_refresh_token');
+        }
+        let refreshed;
+        try {
+            refreshed = await this.refreshCallerOwned({ ...input, refreshToken: secret.refreshToken });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : '';
+            throw new Error(/^OAuth refresh failed: (?:invalid_grant|invalid_token)$/u.test(message)
+                ? 'local_session_reauth_required' : 'local_session_refresh_failed');
+        }
+        if (refreshed.status !== 'completed' || !refreshed.oauthCredential?.accessToken) {
+            throw new Error('local_session_refresh_failed');
+        }
+        const result = { ...secret, ...metadataWithoutUndefined({ ...refreshed.oauthCredential }) };
+        if ((dateFrom(result.expiresAt)?.getTime() ?? Infinity) <= Date.now()) {
+            throw new Error('local_session_refresh_failed');
+        }
+        return { ...result, ...metadataWithoutUndefined({ ...kimiAccountIdentityHint(input.provider, result.accessToken) }) };
+    }
     async updateCredential(input) {
         if (!this.credentialRepository) {
             throw new Error('credential_pool_not_configured');
@@ -1252,21 +1885,24 @@ class ProviderConnectService {
         return offering.id;
     }
     completeApiKey(input) {
-        const adapter = this.requireAdapter(input.provider);
+        const adapter = this.requireAdapter(input.provider, input.offeringId, 'browserAssistedApiKey');
         if (!adapter.completeApiKey) {
             throw new Error('Provider does not support API key Connect completion');
         }
         return adapter.completeApiKey(input);
     }
-    pollDevice(input) {
-        const adapter = this.requireAdapter(input.provider);
-        if (!adapter.pollDevice) {
-            throw new Error('Provider does not support device-code polling');
+    async pollDevice(input) {
+        if (input.mode) {
+            const adapter = this.requireAdapter(input.provider, input.offeringId, input.mode);
+            if (!adapter.pollDevice) {
+                throw new Error('Provider does not support OAuth polling');
+            }
+            return adapter.pollDevice(input);
         }
-        return adapter.pollDevice(input);
+        return this.runAttemptOperation(input, 'pollDevice', 'Provider does not support OAuth polling');
     }
-    status(input) {
-        const adapter = this.requireAdapter(input.provider);
+    async status(input) {
+        const adapter = await this.requireAdapterForAttemptStatus(input);
         if (!adapter.status) {
             throw new Error('Provider does not support Connect status');
         }
@@ -1276,17 +1912,13 @@ class ProviderConnectService {
         return this.refreshWithRetry(input, 2);
     }
     refreshCallerOwned(input) {
-        const adapter = this.requireAdapter(input.provider);
+        const adapter = this.requireOAuthRefreshAdapter(input, 'refreshCallerOwned');
         if (!adapter.refreshCallerOwned) {
             throw new Error('Provider does not support caller-owned OAuth refresh');
         }
         return adapter.refreshCallerOwned(input);
     }
     async refreshWithRetry(input, remainingAttempts) {
-        const adapter = this.requireAdapter(input.provider);
-        if (!adapter.refresh) {
-            throw new Error('Provider does not support refresh');
-        }
         if (!this.credentialRepository || !this.vault) {
             throw new Error('CredentialVault and PodCredentialRepository are required for provider refresh');
         }
@@ -1294,6 +1926,10 @@ class ProviderConnectService {
         if (!current) {
             throw new Error('oauth_credential_not_found');
         }
+        const adapter = this.requireOAuthRefreshAdapter(input, 'refresh', current);
+        if (!adapter.refresh) {
+            throw new Error('Provider does not support refresh');
+        }
         const secret = await this.vault.open({ webId: input.webId }, current.credentialIri, normalizeProvider(input.provider), current.encryptedSecret);
         try {
             return await adapter.refresh(input, current, secret);
@@ -1309,12 +1945,64 @@ class ProviderConnectService {
             throw error;
         }
     }
-    disconnect(input) {
-        const adapter = this.requireAdapter(input.provider);
+    async disconnect(input) {
+        const adapter = await this.requireAdapterForDisconnect(input);
         if (!adapter.disconnect) {
             throw new Error('Provider does not support disconnect');
         }
-        return adapter.disconnect(input);
+        return adapter.disconnect({
+            ...input,
+            offeringId: input.offeringId ?? adapter.offeringId,
+        });
+    }
+    async cancel(input) {
+        if (input.mode) {
+            const adapter = this.requireAdapter(input.provider, input.offeringId, input.mode);
+            if (!adapter.cancel) {
+                throw new Error('Provider does not support Connect cancellation');
+            }
+            return adapter.cancel(input);
+        }
+        return this.runAttemptOperation(input, 'cancel', 'Provider does not support Connect cancellation');
+    }
+    async runAttemptOperation(input, operation, unsupportedMessage) {
+        const candidates = this.findAdapterCandidates(input.provider, input.offeringId).filter((adapter) => adapter[operation]);
+        let deferredError;
+        for (const adapter of candidates) {
+            try {
+                return await adapter[operation](input);
+            }
+            catch (error) {
+                if (!isAttemptBindingError(error)) {
+                    throw error;
+                }
+                deferredError ??= error;
+            }
+        }
+        if (deferredError)
+            throw deferredError;
+        throw new Error(unsupportedMessage);
+    }
+    requireOAuthRefreshAdapter(input, operation, current) {
+        if (input.mode) {
+            return this.requireAdapter(input.provider, input.offeringId, input.mode);
+        }
+        const authorizationMethodId = input.authorizationMethodId ?? credentialAuthorizationMethodId(current);
+        if (authorizationMethodId) {
+            const adapter = this.findAdapterCandidates(input.provider, input.offeringId)
+                .find((candidate) => candidate[operation] && candidate.authorizationMethodId === authorizationMethodId);
+            if (adapter)
+                return adapter;
+        }
+        if (operation === 'refreshCallerOwned' || current?.authMode === 'deviceCodeOAuth') {
+            return this.requireAdapter(input.provider, input.offeringId ?? credentialOfferingId(current), 'deviceCodeOAuth');
+        }
+        const candidates = this.findAdapterCandidates(input.provider, input.offeringId)
+            .filter((adapter) => adapter[operation] && (adapter.mode === 'deviceCodeOAuth' || adapter.mode === 'authorizationCodeOAuth'));
+        if (candidates.length === 1) {
+            return candidates[0];
+        }
+        return this.requireAdapter(input.provider, input.offeringId, 'deviceCodeOAuth');
     }
     async getRefreshCredential(input) {
         if (!this.credentialRepository) {
@@ -1326,18 +2014,109 @@ class ProviderConnectService {
                 credentialId: input.credentialId,
             })
             : (await this.credentialRepository.listProviderCredentials(input))
-                .find(isOAuthProviderCredential);
-        return credential && isOAuthProviderCredential(credential) ? credential : undefined;
+                .find((record) => isOAuthProviderCredential(record, input.offeringId));
+        return credential && isOAuthProviderCredential(credential, input.offeringId) ? credential : undefined;
     }
-    requireAdapter(provider) {
-        const adapter = this.adapters.get(normalizeProvider(provider));
+    requireAdapter(provider, offeringId, mode) {
+        const adapter = this.findAdapter(provider, offeringId, mode);
         if (!adapter) {
             throw new Error(`No Connect adapter registered for ${provider}`);
         }
         return adapter;
     }
+    async requireAdapterForAttemptStatus(input) {
+        const candidates = this.findAdapterCandidates(input.provider, input.offeringId).filter((adapter) => adapter.status);
+        let deferredError;
+        for (const adapter of candidates) {
+            try {
+                await adapter.status(input);
+                return adapter;
+            }
+            catch (error) {
+                if (!isAttemptBindingError(error)) {
+                    throw error;
+                }
+                deferredError ??= error;
+            }
+        }
+        if (deferredError)
+            throw deferredError;
+        throw new Error(`No Connect adapter registered for ${input.provider}`);
+    }
+    async requireAdapterForDisconnect(input) {
+        if (input.credentialId && this.credentialRepository) {
+            const credential = await this.credentialRepository.getCredentialById({
+                webId: input.webId,
+                provider: normalizeProvider(input.provider),
+                deployment: input.deployment,
+                credentialId: input.credentialId,
+                auth: input.auth,
+            });
+            if (credential) {
+                const mode = credential.authMode === 'apiKey'
+                    ? 'browserAssistedApiKey'
+                    : credential.authMode === 'deviceCodeOAuth'
+                        ? 'deviceCodeOAuth'
+                        : undefined;
+                return this.requireAdapter(input.provider, input.offeringId ?? credentialOfferingId(credential), mode);
+            }
+        }
+        return this.requireAdapter(input.provider, input.offeringId);
+    }
+    findAdapter(provider, offeringId, mode) {
+        const exact = this.adapters.get(connectAdapterKey(provider, offeringId, mode));
+        if (exact)
+            return exact;
+        const candidates = this.findAdapterCandidates(provider, offeringId, mode);
+        return candidates.length === 1 ? candidates[0] : undefined;
+    }
+    findAdapterCandidates(provider, offeringId, mode) {
+        const normalizedProvider = normalizeProvider(provider);
+        const normalizedOffering = offeringId ? normalizeProvider(offeringId) : undefined;
+        return [...this.adapters.values()].filter((adapter) => {
+            if (normalizeProvider(adapter.provider) !== normalizedProvider)
+                return false;
+            if (mode && adapter.mode && adapter.mode !== mode)
+                return false;
+            if ((mode === 'deviceCodeOAuth' || mode === 'authorizationCodeOAuth') && !adapter.mode)
+                return false;
+            if (!normalizedOffering)
+                return true;
+            if (normalizeProvider(adapter.offeringId ?? '') === normalizedOffering)
+                return true;
+            return !adapter.offeringId
+                && (!adapter.mode || adapter.mode === 'browserAssistedApiKey')
+                && (mode === undefined || mode === 'browserAssistedApiKey');
+        });
+    }
+    requireConnectOffering(provider, offeringId, mode) {
+        if (offeringId)
+            return offeringId;
+        const product = this.registry.getProduct(provider);
+        const candidates = product?.offerings.filter((offering) => this.offeringSupportsConnectMode(provider, offering.id, mode)) ?? [];
+        return candidates.length === 1 ? candidates[0].id : undefined;
+    }
+    offeringSupportsConnectMode(provider, offeringId, mode) {
+        if (!offeringId)
+            return false;
+        const offering = this.registry.getOffering(provider, offeringId);
+        return Boolean(offering?.authorizationMethods?.some((method) => method.connectMode === mode && method.lifecycle === 'active'));
+    }
+    authorizationMethodUnavailableReason(provider, offeringId, method) {
+        if (method.lifecycle === 'unavailable') {
+            return method.reason ?? 'authorization_method_unavailable';
+        }
+        if (method.connectMode && !this.findAdapter(provider, offeringId, method.connectMode)) {
+            return 'authorization_adapter_unavailable';
+        }
+        if (method.id === 'local-session-import' && !this.localSessionImporters.has(localSessionImporterKey(provider, offeringId))) {
+            return 'local_session_importer_unavailable';
+        }
+        return undefined;
+    }
 }
 exports.ProviderConnectService = ProviderConnectService;
+ProviderConnectService.localImportLocks = new Map();
 function token(randomBytes) {
     return randomBytes(32).toString('base64url');
 }
@@ -1348,6 +2127,7 @@ function publicOfferingSummary(offering) {
         kind: offering.kind,
         lifecycle: offering.lifecycle,
         authModes: offering.authModes,
+        authorizationMethods: offering.authorizationMethods,
         runtimeProviderIds: offering.runtimeProviderIds,
         productLabel: offering.productLabel,
         credentialPrefixHints: offering.credentialPrefixHints,
@@ -1382,18 +2162,23 @@ function publicPoolCredentialSummary(record) {
 function publicAuthMode(authMode) {
     return authMode === 'deviceCodeOAuth' ? 'deviceCode' : authMode;
 }
-function isOAuthProviderCredential(record) {
+function isOAuthProviderCredential(record, offeringId) {
     return record.status === 'active'
         && record.authMode === 'deviceCodeOAuth'
-        && credentialOfferingId(record) === 'official-subscription';
-}
-function isKimiOAuthCredential(record) {
-    return normalizeProvider(record.provider) === 'kimi' && isOAuthProviderCredential(record);
+        && (!offeringId || credentialOfferingId(record) === offeringId);
 }
 function credentialOfferingId(record) {
+    if (!record)
+        return undefined;
     const metadata = metadataFromRowValue(record.metadata) ?? {};
     return record.offeringId ?? stringMetadata(metadata, 'offeringId');
 }
+function credentialAuthorizationMethodId(record) {
+    if (!record)
+        return undefined;
+    const metadata = metadataFromRowValue(record.metadata) ?? {};
+    return stringMetadata(metadata, 'authorizationMethodId');
+}
 function publicCredentialHealth(record) {
     const metadata = metadataFromRowValue(record.metadata) ?? {};
     const health = record.health ?? stringMetadata(metadata, 'health');
@@ -1470,6 +2255,54 @@ function modelIdsFromMetadata(metadata) {
     }
     return [...ids];
 }
+function importedSessionFingerprint(secret) {
+    if (typeof secret.accessToken !== 'string' || !secret.accessToken)
+        return undefined;
+    return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify([
+        secret.accountId, secret.accountSubject, secret.accessToken, secret.refreshToken,
+    ])).digest('hex');
+}
+function kimiAccountIdentityHint(provider, accessToken) {
+    if (provider !== 'kimi' || typeof accessToken !== 'string' || jwtClaim(accessToken, 'iss') !== 'kimi-auth') {
+        return undefined;
+    }
+    // These unverified claims are comparison hints within an already authorized owner's
+    // credential pool. They must never authenticate a caller or grant Pod access.
+    const accountId = jwtClaim(accessToken, 'user_id');
+    const accountSubject = jwtClaim(accessToken, 'sub');
+    return {
+        accountId: accountId ? `kimi-auth:${accountId}` : undefined,
+        accountSubject: accountSubject ? `kimi-auth:${accountSubject}` : undefined,
+    };
+}
+function sameImportedSession(provider, existing, imported) {
+    const identityFields = ['accountId', 'accountSubject'];
+    const hasValue = (value) => typeof value === 'string' && value.trim().length > 0;
+    if (provider === 'kimi') {
+        const existingIssuer = jwtClaim(stringFrom(existing.accessToken), 'iss');
+        const importedIssuer = jwtClaim(stringFrom(imported.accessToken), 'iss');
+        if (existingIssuer && importedIssuer && existingIssuer !== importedIssuer)
+            return false;
+    }
+    // A shared token must not override an explicit account identity conflict.
+    if (identityFields.some((field) => hasValue(existing[field]) && hasValue(imported[field])
+        && existing[field] !== imported[field]))
+        return false;
+    const existingIdentity = kimiAccountIdentityHint(provider, existing.accessToken);
+    const importedIdentity = kimiAccountIdentityHint(provider, imported.accessToken);
+    if (existingIdentity && importedIdentity) {
+        if (identityFields.some((field) => hasValue(existingIdentity[field]) && hasValue(importedIdentity[field])
+            && existingIdentity[field] !== importedIdentity[field]))
+            return false;
+        if (identityFields.some((field) => hasValue(existingIdentity[field])
+            && existingIdentity[field] === importedIdentity[field]))
+            return true;
+    }
+    if (existing.importedSessionFingerprint === importedSessionFingerprint(imported)
+        && typeof existing.importedSessionFingerprint === 'string')
+        return true;
+    return [...identityFields, 'accessToken', 'refreshToken'].some((field) => hasValue(existing[field]) && existing[field] === imported[field]);
+}
 function createPoolCredentialLocator(webId, deployment, provider) {
     const key = `${deployment}-${provider}-${(0, node_crypto_1.randomUUID)()}`;
     return {
@@ -2075,6 +2908,8 @@ function signAttempt(attempt, secret) {
         deployment: attempt.deployment,
         webId: attempt.webId,
         mode: attempt.mode,
+        offeringId: attempt.offeringId,
+        authorizationMethodId: attempt.authorizationMethodId,
         state: attempt.state,
         expiresAt: attempt.expiresAt.toISOString(),
     }))
@@ -2219,7 +3054,14 @@ function stringFrom(value) {
     return typeof value === 'string' ? value : '';
 }
 function numberFrom(value, fallback) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : fallback;
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : fallback;
+    }
+    return fallback;
 }
 function expiresAtFrom(expiresIn, now) {
     if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {
@@ -2227,16 +3069,26 @@ function expiresAtFrom(expiresIn, now) {
     }
     return new Date(now.getTime() + expiresIn * 1000);
 }
-function oneTimeOAuthCredential(body, now, expectedVersion) {
+function oneTimeOAuthCredential(body, now, expectedVersion, integration, fallbackRefreshToken, authorizationMethodId) {
     requireStringField(body, 'access_token');
-    requireStringField(body, 'refresh_token');
+    const refreshToken = stringFrom(body.refresh_token) || fallbackRefreshToken;
+    if (!refreshToken) {
+        throw new Error('Provider response missing required field: refresh_token');
+    }
+    const identityHint = kimiAccountIdentityHint(integration?.provider, body.access_token);
     return {
         accessToken: stringFrom(body.access_token),
-        refreshToken: stringFrom(body.refresh_token),
+        refreshToken,
         expiresAt: expiresAtFrom(body.expires_in, now)?.toISOString(),
         scope: stringFrom(body.scope),
         idToken: stringFrom(body.id_token),
-        accountSubject: decodeJwtSubject(stringFrom(body.id_token)),
+        accountSubject: identityHint?.accountSubject ?? decodeJwtSubject(stringFrom(body.id_token)),
+        accountLabel: integration?.accountLabel,
+        accountId: integration?.accountId
+            ?? identityHint?.accountId
+            ?? (stringFrom(body.account_id) || jwtClaim(stringFrom(body.id_token), integration?.protocol.accountIdClaim)),
+        offeringId: integration?.offeringId,
+        authorizationMethodId,
         expectedVersion,
     };
 }
@@ -2261,26 +3113,153 @@ const SAFE_PROVIDER_ERROR_CODES = new Set([
     'invalid_grant',
     'invalid_client',
 ]);
-function pendingResult(input, status, intervalSeconds) {
+function pendingResult(input, status, intervalSeconds, provider = normalizeProvider(input.provider), offeringId = input.offeringId) {
+    return oauthPendingResult(input, status, provider, offeringId, 'deviceCodeOAuth', intervalSeconds);
+}
+function oauthPendingResult(input, status, provider, offeringId, mode, intervalSeconds) {
     return {
-        mode: 'deviceCodeOAuth',
+        mode,
         status,
-        provider: 'kimi',
+        provider,
+        offeringId,
         deployment: input.deployment,
         attemptId: input.attemptId,
         intervalSeconds,
     };
 }
-function assertKimiEndpoint(endpoint, pathname) {
-    const url = new URL(endpoint);
-    if (url.origin !== 'https://auth.kimi.com'
-        || url.pathname !== pathname
+function connectAdapterKey(provider, offeringId, mode) {
+    return `${normalizeProvider(provider)}:${normalizeProvider(offeringId ?? '')}:${mode ?? ''}`;
+}
+function isAttemptBindingError(error) {
+    if (!(error instanceof Error))
+        return false;
+    return error.message === 'Connect attempt not found'
+        || error.message.startsWith('Connect attempt is bound to a different ')
+        || error.message === 'Connect attempt mode mismatch';
+}
+function isTerminalAttemptError(error) {
+    if (!(error instanceof Error))
+        return false;
+    return error.message === 'Connect attempt not found'
+        || error.message === 'Connect attempt expired'
+        || error.message === 'Connect attempt already consumed';
+}
+function assertTrustedEndpoint(descriptor) {
+    const url = new URL(descriptor.endpoint);
+    if (url.protocol !== 'https:'
         || url.search
         || url.hash
         || url.username
         || url.password) {
-        throw new Error('Kimi Connect endpoint is not allowlisted');
+        throw new Error('Device Connect endpoint is not allowlisted');
+    }
+}
+function deviceCodeBeginRequest(protocol, clientId, challenge) {
+    if (protocol.begin.codec === 'oauthDeviceCodePkce' && !challenge) {
+        throw new Error('Device authorization PKCE challenge is required');
+    }
+    if (protocol.begin.codec === 'oauthDeviceCode' || protocol.begin.codec === 'oauthDeviceCodePkce') {
+        return {
+            headers: withProtocolHeaders({ 'Content-Type': 'application/x-www-form-urlencoded' }, protocol.begin.headers),
+            body: new URLSearchParams(metadataWithoutUndefined({
+                client_id: clientId,
+                code_challenge: protocol.begin.codec === 'oauthDeviceCodePkce' ? challenge : undefined,
+                code_challenge_method: protocol.begin.codec === 'oauthDeviceCodePkce' ? 'S256' : undefined,
+            })),
+        };
+    }
+    return {
+        headers: withProtocolHeaders({ 'Content-Type': 'application/json' }, protocol.begin.headers),
+        body: JSON.stringify({ client_id: clientId }),
+    };
+}
+function deviceCodePollRequest(protocol, clientId, attempt) {
+    if (protocol.poll.codec === 'oauthDeviceCode' || protocol.poll.codec === 'oauthDeviceCodePkce') {
+        return {
+            headers: withProtocolHeaders({ 'Content-Type': 'application/x-www-form-urlencoded' }, protocol.poll.headers),
+            body: new URLSearchParams(metadataWithoutUndefined({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: attempt.deviceCode ?? '',
+                client_id: clientId,
+                code_verifier: protocol.poll.codec === 'oauthDeviceCodePkce' ? attempt.codeVerifier ?? '' : undefined,
+            })),
+        };
+    }
+    return {
+        headers: withProtocolHeaders({ 'Content-Type': 'application/json' }, protocol.poll.headers),
+        body: JSON.stringify(metadataWithoutUndefined({
+            [deviceCodePollField(protocol)]: attempt.deviceCode ?? '',
+            user_code: attempt.userCode,
+        })),
+    };
+}
+function deviceCodePollField(protocol) {
+    return protocol.poll.deviceCodeField
+        ?? protocol.begin.deviceCodeField
+        ?? (protocol.poll.codec === 'deviceCodeJson' ? 'device_auth_id' : 'device_code');
+}
+async function executeOAuthRefreshRequest(fetchImpl, request, refresh, clientId, refreshToken) {
+    const response = await fetchImpl(refresh.endpoint, request({
+        method: 'POST',
+        headers: withProtocolHeaders({ 'Content-Type': 'application/x-www-form-urlencoded' }, refresh.headers),
+        body: new URLSearchParams(metadataWithoutUndefined({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: clientId,
+        })),
+    }));
+    return { ok: response.ok, body: await safeJson(response) };
+}
+function withProtocolHeaders(base, extra) {
+    return { ...base, ...(extra ?? {}) };
+}
+function verifiedVerificationUri(body, protocol) {
+    const verificationUri = stringFrom(body[protocol.begin.verificationUriField ?? 'verification_uri'])
+        || protocol.defaultVerificationUri;
+    const verificationUriComplete = stringFrom(body[protocol.begin.verificationUriCompleteField ?? 'verification_uri_complete'])
+        || verificationUri;
+    const origins = protocol.verificationUriOrigins ?? [];
+    for (const candidate of [verificationUri, verificationUriComplete]) {
+        if (!candidate || origins.length === 0)
+            continue;
+        const url = new URL(candidate);
+        if (!origins.includes(url.origin)) {
+            throw new Error('Provider verification URI is not allowlisted');
+        }
+    }
+    return { verificationUri, verificationUriComplete };
+}
+function deviceCodeExpiresAt(body, protocol, now) {
+    const expiresAtField = protocol.begin.expiresAtField;
+    const expiresAt = expiresAtField ? absoluteExpiresAtFrom(body[expiresAtField]) : undefined;
+    if (expiresAt)
+        return expiresAt;
+    const expiresIn = numberFrom(body[protocol.begin.expiresInField ?? 'expires_in'], protocol.begin.defaultExpiresInSeconds ?? 300);
+    return new Date(now.getTime() + expiresIn * 1000);
+}
+function absoluteExpiresAtFrom(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return new Date(value * 1000);
+    }
+    if (typeof value === 'string' && value.trim()) {
+        const asNumber = Number(value);
+        const parsed = Number.isFinite(asNumber) ? new Date(asNumber * 1000) : new Date(value);
+        return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+    }
+    return undefined;
+}
+function requireProtocolStringField(body, field) {
+    const fields = Array.isArray(field) ? field : [field];
+    for (const candidate of fields) {
+        const value = stringFrom(body[candidate]);
+        if (value)
+            return value;
     }
+    throw new Error(`Provider response missing required field: ${fields[0]}`);
+}
+function requestTimeoutSignal(timeoutMs) {
+    const timeoutFactory = AbortSignal.timeout;
+    return typeof timeoutFactory === 'function' ? timeoutFactory(timeoutMs) : undefined;
 }
 function requireStringField(body, field) {
     if (typeof body[field] !== 'string' || !body[field].trim()) {
@@ -2303,6 +3282,34 @@ function decodeJwtSubject(idToken) {
         return undefined;
     }
 }
+function jwtClaim(idToken, claim) {
+    if (!claim)
+        return undefined;
+    const payload = idToken.split('.')[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        const path = Array.isArray(claim) ? claim : [claim];
+        let value = decoded;
+        for (const segment of path) {
+            if (!value || typeof value !== 'object' || Array.isArray(value))
+                return undefined;
+            value = value[segment];
+        }
+        return typeof value === 'string' && value.trim() ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function scopeListFromSecret(secret) {
+    const scope = stringFrom(secret?.scope);
+    if (!scope)
+        return undefined;
+    const scopes = scope.split(/\s+/u).map((value) => value.trim()).filter(Boolean);
+    return scopes.length > 0 ? scopes : undefined;
+}
 function defaultOfferingFor(provider, authMode) {
     const normalized = normalizeProvider(provider);
     const product = providerProductFor(normalized);
@@ -2352,16 +3359,26 @@ function offeringMatchesAuthMode(offeringAuthModes, authMode) {
     return offeringAuthModes.includes('oauth') || offeringAuthModes.includes('deviceCode');
 }
 async function updateByCredentialIdAndVersion(params) {
-    const { db, credential, credentialId, expectedVersion, patch } = params;
-    const updated = await db
-        .update(credential)
-        .set({ ...patch })
-        .where((0, drizzle_solid_1.and)((0, drizzle_solid_1.eq)(credential.id, credentialId), (0, drizzle_solid_1.eq)(credential.keyVersion, expectedVersion)))
-        .returning()
-        .execute();
-    if (updated.length === 1) {
-        return updated[0];
-    }
-    return null;
+    const { owner, db, credential, credentialId, expectedVersion, patch } = params;
+    const key = JSON.stringify([owner, credentialId]);
+    const previous = credentialUpdateLocks.get(key) ?? Promise.resolve();
+    let release;
+    const pending = new Promise((resolve) => { release = resolve; });
+    credentialUpdateLocks.set(key, pending);
+    await previous;
+    try {
+        // The exact API does not accept a version predicate. Serialize local writers
+        // and recheck the exact row immediately before updating it.
+        const current = await db.findById(credential, credentialId);
+        if (!current || String(versionFromRow(current)) !== expectedVersion)
+            return null;
+        const { id: _id, '@id': _iri, ...values } = patch;
+        return await db.updateById(credential, credentialId, values);
+    }
+    finally {
+        release();
+        if (credentialUpdateLocks.get(key) === pending)
+            credentialUpdateLocks.delete(key);
+    }
 }
 //# sourceMappingURL=index.js.map