@boundless.network/setup 0.1.0

package/dist/harnesses/codex.js

@@ -0,0 +1,61 @@
+import { join } from "node:path";
+import { parse, stringify } from "smol-toml";
+import { KEY_ENV } from "../lib/config.js";
+import { codexHome } from "../lib/env.js";
+import { installed } from "../lib/files.js";
+import { backup, readText, tilde, writePrivate } from "../lib/files.js";
+export const codex = {
+    backgroundDefault: null,
+    defaultModel: "qwen3.6",
+    detect: () => installed("codex"),
+    id: "codex",
+    name: "Codex CLI",
+    plan: (input) => {
+        const path = join(codexHome(), "config.toml");
+        return Promise.resolve({
+            changes: [
+                {
+                    apply: async () => {
+                        const current = parse((await readText(path)) ?? "");
+                        const providers = (current.model_providers ?? {});
+                        const next = {
+                            ...current,
+                            model: input.primary,
+                            model_provider: "boundless",
+                            model_providers: {
+                                ...providers,
+                                boundless: {
+                                    base_url: `${input.gatewayUrl}/v1`,
+                                    env_key: KEY_ENV,
+                                    name: "Boundless",
+                                    wire_api: "responses",
+                                },
+                            },
+                            model_reasoning_effort: "low",
+                            model_reasoning_summary: "none",
+                        };
+                        const saved = await backup(path);
+                        await writePrivate(path, stringify(next));
+                        return { backup: saved };
+                    },
+                    path,
+                    summary: `model ${input.primary}, provider boundless → ${input.gatewayUrl}/v1 (responses), key read from ${KEY_ENV}`,
+                },
+            ],
+            manual: [],
+            notes: [
+                `Codex keeps one configuration in ${tilde(path)}; it reads the key from ${KEY_ENV} in your shell environment.`,
+                ...(input.scope === "project" && input.keyFile
+                    ? [`Project scope: export ${KEY_ENV}="$(cat ${tilde(input.keyFile)})" before running codex in this project.`]
+                    : []),
+                "Comments in an existing config.toml are not preserved; the backup keeps the original.",
+            ],
+        });
+    },
+    smoke: (input) => ({
+        args: ["exec", "--skip-git-repo-check", "-m", input.primary, "Reply with exactly the word: boundless"],
+        command: "codex",
+        expect: /boundless/i,
+    }),
+    wire: "openai",
+};

package/dist/harnesses/gui.js

@@ -0,0 +1,43 @@
+import { anyExists, home } from "../lib/files.js";
+import { readExpression } from "../lib/store.js";
+function reveal(input) {
+    if (input.keyFile) {
+        return `cat "${input.keyFile}"`;
+    }
+    return input.store ? readExpression(input.store) : "echo $BOUNDLESS_API_KEY";
+}
+export const cursor = {
+    backgroundDefault: null,
+    defaultModel: "glm-5.2",
+    detect: () => anyExists(["/Applications/Cursor.app", home(".cursor")]),
+    id: "cursor",
+    name: "Cursor",
+    plan: (input) => Promise.resolve({
+        changes: [],
+        manual: [
+            "Open Cursor → Settings → Models.",
+            `Set "Override OpenAI Base URL" to ${input.gatewayUrl}/v1.`,
+            `Paste your key into "OpenAI API Key". Reveal it with: ${reveal(input)}`,
+            `Add ${input.primary} under "Custom models" and select it explicitly (Auto stays on Cursor's own models).`,
+        ],
+        notes: ["Tab completion keeps using a Cursor model; only chat and the custom model route through Boundless."],
+    }),
+    wire: "openai",
+};
+export const copilot = {
+    backgroundDefault: null,
+    defaultModel: "glm-5.2",
+    detect: () => anyExists([home(".vscode"), home(".copilot")]),
+    id: "copilot",
+    name: "GitHub Copilot",
+    plan: (input) => Promise.resolve({
+        changes: [],
+        manual: [
+            'In VS Code run "Chat: Manage Language Models", choose Custom Endpoint.',
+            `Base URL ${input.gatewayUrl}/v1, key revealed with: ${reveal(input)}`,
+            `For the Copilot CLI export COPILOT_PROVIDER_BASE_URL="${input.gatewayUrl}/v1", COPILOT_PROVIDER_API_KEY="$BOUNDLESS_API_KEY" and COPILOT_MODEL="${input.primary}".`,
+        ],
+        notes: ["BYOK covers chat only; inline suggestions keep using Copilot's models."],
+    }),
+    wire: "openai",
+};

package/dist/harnesses/hermes.js

@@ -0,0 +1,46 @@
+import { Document, parseDocument } from "yaml";
+import { KEY_ENV } from "../lib/config.js";
+import { installed } from "../lib/files.js";
+import { backup, home, readText, writePrivate } from "../lib/files.js";
+export const hermes = {
+    backgroundDefault: null,
+    defaultModel: "qwen3.6",
+    detect: () => installed("hermes"),
+    id: "hermes",
+    name: "Hermes",
+    plan: (input) => {
+        const path = home(".hermes", "config.yaml");
+        return Promise.resolve({
+            changes: [
+                {
+                    apply: async () => {
+                        const text = (await readText(path))?.trim();
+                        const doc = text ? parseDocument(text) : new Document({});
+                        const context = input.catalog.find((model) => model.id === input.primary)?.contextTokens ?? 262_144;
+                        doc.setIn(["providers", "boundless"], {
+                            api: `${input.gatewayUrl}/v1`,
+                            key_env: KEY_ENV,
+                            models: { [input.primary]: { context_length: context } },
+                            transport: "chat_completions",
+                        });
+                        doc.setIn(["model", "provider"], "custom:boundless");
+                        doc.setIn(["model", "default"], input.primary);
+                        const saved = await backup(path);
+                        await writePrivate(path, doc.toString());
+                        return { backup: saved };
+                    },
+                    path,
+                    summary: `provider boundless → ${input.gatewayUrl}/v1, default model ${input.primary}, key read from ${KEY_ENV}`,
+                },
+            ],
+            manual: [],
+            notes: [`Hermes reads the key from ${KEY_ENV} in your shell environment.`],
+        });
+    },
+    smoke: () => ({
+        args: ["chat", "--toolsets", "terminal", "-q", "Use the terminal tool to run printf boundless, then report the output."],
+        command: "hermes",
+        expect: /boundless/i,
+    }),
+    wire: "openai",
+};

package/dist/harnesses/index.js

@@ -0,0 +1,7 @@
+import { claudeCode } from "./claude-code.js";
+import { codex } from "./codex.js";
+import { copilot, cursor } from "./gui.js";
+import { hermes } from "./hermes.js";
+import { omp } from "./omp.js";
+import { opencode } from "./opencode.js";
+export const HARNESSES = [claudeCode, codex, opencode, hermes, omp, cursor, copilot];

package/dist/harnesses/omp.js

@@ -0,0 +1,41 @@
+import { Document, parseDocument } from "yaml";
+import { KEY_ENV } from "../lib/config.js";
+import { installed } from "../lib/files.js";
+import { backup, home, readText, writePrivate } from "../lib/files.js";
+export const omp = {
+    backgroundDefault: "dsv4",
+    defaultModel: "glm-5.2",
+    detect: () => installed("omp"),
+    id: "omp",
+    name: "omp (Oh My Pi)",
+    plan: (input) => {
+        const path = home(".omp", "agent", "models.yml");
+        return Promise.resolve({
+            changes: [
+                {
+                    apply: async () => {
+                        const text = (await readText(path))?.trim();
+                        const doc = text ? parseDocument(text) : new Document({});
+                        doc.setIn(["providers", "boundless"], {
+                            api: "openai-completions",
+                            apiKey: KEY_ENV,
+                            baseUrl: `${input.gatewayUrl}/v1`,
+                            compat: { reasoningContentField: "reasoning_content" },
+                            discovery: { type: "litellm" },
+                        });
+                        doc.setIn(["modelRoles", "default"], `boundless/${input.primary}`);
+                        doc.setIn(["modelRoles", "tiny"], `boundless/${input.background}`);
+                        const saved = await backup(path);
+                        await writePrivate(path, doc.toString());
+                        return { backup: saved };
+                    },
+                    path,
+                    summary: `provider boundless → ${input.gatewayUrl}/v1 with discovery, default boundless/${input.primary}, tiny boundless/${input.background}`,
+                },
+            ],
+            manual: [],
+            notes: [`omp reads the key from ${KEY_ENV}; models and prices are discovered from the gateway at start.`],
+        });
+    },
+    wire: "openai",
+};

package/dist/harnesses/opencode.js

@@ -0,0 +1,66 @@
+import { join } from "node:path";
+import { KEY_ENV } from "../lib/config.js";
+import { installed } from "../lib/files.js";
+import { backup, home, merge, readJson, writePrivate } from "../lib/files.js";
+function modelEntry(model) {
+    const inputs = ["text", ...["image", "audio", "video"].filter((kind) => model.supports.includes(`${kind} input`))];
+    return {
+        limit: { context: model.contextTokens, output: 32_000 },
+        name: model.name,
+        reasoning: model.supports.includes("reasoning"),
+        tool_call: model.supports.includes("tool-use"),
+        ...(inputs.length > 1 ? { modalities: { input: inputs } } : {}),
+    };
+}
+function configPath(input) {
+    if (input.scope === "project") {
+        return join(input.env.cwd, "opencode.json");
+    }
+    return join(process.env.XDG_CONFIG_HOME ?? home(".config"), "opencode", "opencode.json");
+}
+export const opencode = {
+    backgroundDefault: "dsv4",
+    defaultModel: "qwen3.6",
+    detect: () => installed("opencode"),
+    id: "opencode",
+    name: "OpenCode",
+    plan: (input) => {
+        const path = configPath(input);
+        const apiKey = input.scope === "project" && input.keyFile ? `{file:${input.keyFile}}` : `{env:${KEY_ENV}}`;
+        return Promise.resolve({
+            changes: [
+                {
+                    apply: async () => {
+                        const current = await readJson(path);
+                        const next = merge(current, {
+                            $schema: "https://opencode.ai/config.json",
+                            model: `boundless/${input.primary}`,
+                            provider: {
+                                boundless: {
+                                    models: Object.fromEntries(input.catalog.map((model) => [model.id, modelEntry(model)])),
+                                    name: "Boundless",
+                                    npm: "@ai-sdk/openai-compatible",
+                                    options: { apiKey, baseURL: `${input.gatewayUrl}/v1` },
+                                },
+                            },
+                            small_model: `boundless/${input.background}`,
+                        });
+                        const saved = await backup(path);
+                        await writePrivate(path, `${JSON.stringify(next, null, 2)}\n`);
+                        return { backup: saved };
+                    },
+                    path,
+                    summary: `provider boundless with ${input.catalog.length} models, model boundless/${input.primary}, small_model boundless/${input.background}, apiKey ${apiKey}`,
+                },
+            ],
+            manual: [],
+            notes: [],
+        });
+    },
+    smoke: (input) => ({
+        args: ["run", "--model", `boundless/${input.primary}`, "Use the bash tool to run printf boundless, then report the output."],
+        command: "opencode",
+        expect: /boundless/i,
+    }),
+    wire: "openai",
+};

package/dist/harnesses/types.js

@@ -0,0 +1 @@
+export {};

package/dist/lib/browser.js

@@ -0,0 +1,21 @@
+import { spawn } from "node:child_process";
+export function openBrowser(url) {
+    const [command, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["cmd", ["/c", "start", "", url.replaceAll("&", "^&")]]
+            : ["xdg-open", [url]];
+    return new Promise((resolve) => {
+        try {
+            const child = spawn(command, args, { detached: true, stdio: "ignore" });
+            child.once("error", () => resolve(false));
+            child.once("spawn", () => {
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}

package/dist/lib/catalog.js

@@ -0,0 +1,29 @@
+import { CONSOLE, request, SetupError } from "./config.js";
+export async function listModels(gatewayUrl, key) {
+    const [catalog, served] = await Promise.all([
+        request(`${CONSOLE}/api/catalog`),
+        request(`${gatewayUrl}/v1/models`, { headers: { authorization: `Bearer ${key}` } }),
+    ]);
+    if (!catalog.ok) {
+        throw new SetupError(`The model catalog answered HTTP ${catalog.status}.`, "catalog_failed");
+    }
+    if (!served.ok) {
+        throw new SetupError(`${gatewayUrl}/v1/models answered HTTP ${served.status} with the new key.`, "models_failed");
+    }
+    const { data } = (await catalog.json());
+    const ids = new Set((await served.json()).data.map((model) => model.id));
+    return data.filter((model) => model.serving && ids.has(model.id));
+}
+export async function keyWorks(gatewayUrl, key) {
+    try {
+        const response = await request(`${gatewayUrl}/v1/models`, { headers: { authorization: `Bearer ${key}` } });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/** Exact USD, never rounded away: trailing zeros trimmed, up to twelve decimals. */
+export function usd(amount) {
+    return `$${amount.toFixed(12).replace(/0+$/, "").replace(/\.$/, "")}`;
+}

package/dist/lib/config.js

@@ -0,0 +1,42 @@
+import { VERSION } from "../version.js";
+export const CONSOLE = (process.env.BOUNDLESS_CONSOLE ?? "https://inference.boundless.network").replace(/\/+$/, "");
+export const USER_AGENT = `boundless-setup/${VERSION} (+https://boundless.md)`;
+export const KEY_ENV = "BOUNDLESS_API_KEY";
+export const KEYS_URL = `${CONSOLE}/api-keys`;
+export class SetupError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "SetupError";
+    }
+}
+/** Plain HTTP is tolerated only for a console running on this machine. */
+export const isLoopback = (url) => url.hostname === "localhost" || url.hostname === "127.0.0.1";
+export function request(url, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("user-agent", USER_AGENT);
+    return fetch(url, { ...init, headers });
+}
+export async function discoverSetup() {
+    const response = await request(`${CONSOLE}/api/setup`);
+    if (response.status === 503) {
+        throw new SetupError(`Automatic setup is not enabled on ${CONSOLE}. Create a key at ${KEYS_URL} instead.`, "setup_unavailable");
+    }
+    if (!response.ok) {
+        throw new SetupError(`${CONSOLE}/api/setup answered HTTP ${response.status}.`, "discovery_failed");
+    }
+    const config = (await response.json());
+    const issuer = new URL(config.issuer);
+    if (issuer.protocol !== "https:" && !isLoopback(issuer)) {
+        throw new SetupError("The authorization issuer must use HTTPS.", "insecure_issuer");
+    }
+    return { ...config, gatewayUrl: config.gatewayUrl.replace(/\/+$/, ""), issuer: issuer.origin };
+}
+export const sleep = (ms, signal) => new Promise((resolve, reject) => {
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener("abort", () => {
+        clearTimeout(timer);
+        reject(new SetupError("Cancelled.", "cancelled"));
+    });
+});

package/dist/lib/env.js

@@ -0,0 +1,35 @@
+import { arch, platform, release } from "node:os";
+import { basename } from "node:path";
+import { exists, home } from "./files.js";
+function shell() {
+    if (process.platform === "win32") {
+        return { shell: "powershell", shellLabel: "PowerShell" };
+    }
+    const name = basename(process.env.SHELL ?? "");
+    if (name === "zsh" || name === "bash" || name === "fish") {
+        return { shell: name, shellLabel: name };
+    }
+    return { shell: "other", shellLabel: name || "unknown" };
+}
+async function remote() {
+    if (process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT) {
+        return "SSH session";
+    }
+    if (process.env.CODESPACES) {
+        return "GitHub Codespace";
+    }
+    if ((await exists("/.dockerenv")) || (await exists("/run/.containerenv"))) {
+        return "container";
+    }
+    if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+        return "headless Linux";
+    }
+    return null;
+}
+export async function inspectEnvironment() {
+    const os = process.platform === "darwin" ? "macos" : process.platform === "win32" ? "windows" : "linux";
+    const osLabel = os === "macos" ? `macOS ${release()}` : os === "windows" ? `Windows ${release()}` : `${platform()} ${release()}`;
+    return { arch: arch(), cwd: process.cwd(), os, osLabel, remote: await remote(), ...shell() };
+}
+export const claudeHome = () => process.env.CLAUDE_CONFIG_DIR ?? home(".claude");
+export const codexHome = () => process.env.CODEX_HOME ?? home(".codex");

package/dist/lib/exchange.js

@@ -0,0 +1,55 @@
+import { CONSOLE, KEYS_URL, request, SetupError, sleep } from "./config.js";
+const MESSAGES = {
+    key_limit_reached: `Your account has reached its key limit. Revoke one at ${KEYS_URL} and run setup again.`,
+    member_suspended: `This account is suspended. See ${CONSOLE}/ or contact support.`,
+    not_approved: `Your account is waiting for approval. Check ${CONSOLE}/ for its status.`,
+    team_conflict: "Your Team is being changed right now. Run setup again in a moment.",
+    team_not_provisioned: `Your Team is not set up for API access yet. See ${CONSOLE}/.`,
+    team_suspended: `Your Team is suspended. See ${CONSOLE}/ or contact support.`,
+    unauthorized: "The sign-in token was rejected. Run setup again to sign in afresh.",
+};
+export class RecoveryRequired extends SetupError {
+    keyName;
+    constructor(keyName) {
+        super(`A key named ${keyName} was already created for this sign-in and its secret cannot be shown again. Open ${KEYS_URL}, revoke that key, then run setup again.`, "setup_recovery_required");
+        this.keyName = keyName;
+    }
+}
+export async function exchangeForKey(accessToken, signal) {
+    const deadline = Date.now() + 60_000;
+    let backoff = 2_000;
+    for (;;) {
+        let response;
+        try {
+            response = await request(`${CONSOLE}/api/setup/key`, {
+                headers: { authorization: `Bearer ${accessToken}` },
+                method: "POST",
+                signal,
+            });
+        }
+        catch (error) {
+            if (signal.aborted || Date.now() + backoff > deadline) {
+                throw new SetupError(`Could not reach ${CONSOLE}: ${error.message}`, "network");
+            }
+            await sleep(backoff, signal);
+            backoff = Math.min(backoff * 2, 15_000);
+            continue;
+        }
+        if (response.ok) {
+            return (await response.json());
+        }
+        const body = (await response.json().catch(() => ({})));
+        const retryAfter = Number(response.headers.get("retry-after") ?? "0") * 1000;
+        const transient = body.error === "account_settling" || response.status === 502 || response.status === 503;
+        if ((transient || response.status === 429) && Date.now() + Math.max(retryAfter, backoff) <= deadline) {
+            await sleep(Math.max(retryAfter, backoff), signal);
+            backoff = Math.min(backoff * 2, 15_000);
+            continue;
+        }
+        if (body.error === "setup_recovery_required" && body.name) {
+            throw new RecoveryRequired(body.name);
+        }
+        const code = body.error ?? `http_${response.status}`;
+        throw new SetupError(MESSAGES[code] ?? `Creating the key failed (${code}). See ${KEYS_URL}.`, code);
+    }
+}

package/dist/lib/files.js

@@ -0,0 +1,116 @@
+import { execFile } from "node:child_process";
+import { chmod, copyFile, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+export const run = promisify(execFile);
+export function home(...parts) {
+    return join(homedir(), ...parts);
+}
+export function tilde(path) {
+    const root = homedir();
+    return path.startsWith(root) ? `~${path.slice(root.length)}` : path;
+}
+export async function exists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function readText(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+const stamp = () => new Date().toISOString().replace(/[:.]/g, "-");
+/** Copies a file next to itself before it is replaced. Returns the backup path, or null when there was nothing to back up. */
+export async function backup(path) {
+    if (!(await exists(path))) {
+        return null;
+    }
+    const target = `${path}.boundless-backup-${stamp()}`;
+    await copyFile(path, target);
+    await chmod(target, 0o600).catch(() => undefined);
+    return target;
+}
+async function writeAtomic(path, content, mode, directoryMode) {
+    await mkdir(dirname(path), { mode: directoryMode, recursive: true });
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile(temporary, content, { mode });
+    await rename(temporary, path);
+    await chmod(path, mode).catch(() => undefined);
+}
+/** Writes with private permissions: 0700 directory, 0600 file. */
+export const writePrivate = (path, content) => writeAtomic(path, content, 0o600, 0o700);
+/** Rewrites a file in place, keeping its existing mode (a shell profile stays 0644). */
+export async function writeKeepingMode(path, content) {
+    const mode = await stat(path).then((info) => info.mode & 0o777).catch(() => 0o644);
+    await writeAtomic(path, content, mode, 0o755);
+}
+export async function which(binary) {
+    try {
+        const { stdout } = await run(process.platform === "win32" ? "where" : "which", [binary]);
+        return stdout.trim().split(/\r?\n/)[0] || null;
+    }
+    catch {
+        return null;
+    }
+}
+export const installed = async (binary) => (await which(binary)) !== null;
+export async function anyExists(paths) {
+    for (const path of paths) {
+        if (await exists(path)) {
+            return true;
+        }
+    }
+    return false;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Deep-merges `patch` into `base`; objects merge recursively, everything else is replaced. */
+export function merge(base, patch) {
+    if (isObject(base) && isObject(patch)) {
+        const result = { ...base };
+        for (const [key, value] of Object.entries(patch)) {
+            result[key] = merge(base[key], value);
+        }
+        return result;
+    }
+    return patch;
+}
+export async function readJson(path) {
+    const text = await readText(path);
+    if (text === null || text.trim() === "") {
+        return {};
+    }
+    const parsed = JSON.parse(text);
+    if (!isObject(parsed)) {
+        throw new Error(`${path} is not a JSON object`);
+    }
+    return parsed;
+}
+export async function gitTracked(path, cwd) {
+    try {
+        await run("git", ["ls-files", "--error-unmatch", path], { cwd });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function ensureIgnored(cwd, pattern) {
+    const path = join(cwd, ".gitignore");
+    const current = (await readText(path)) ?? "";
+    if (current.split(/\r?\n/).some((line) => line.trim() === pattern)) {
+        return false;
+    }
+    await writeFile(path, `${current}${current.endsWith("\n") || current === "" ? "" : "\n"}${pattern}\n`);
+    return true;
+}

package/dist/lib/oauth.js

@@ -0,0 +1,89 @@
+import { CONSOLE, isLoopback, request, SetupError, sleep } from "./config.js";
+function endpoint(issuer, value, name) {
+    if (!value) {
+        throw new SetupError(`The authorization server advertises no ${name}.`, "no_device_grant");
+    }
+    const url = new URL(value);
+    if ((url.protocol !== "https:" && !isLoopback(url)) || url.origin !== issuer) {
+        throw new SetupError(`The advertised ${name} is not on ${issuer}.`, "foreign_endpoint");
+    }
+    return url.toString();
+}
+export async function startDeviceGrant(config) {
+    const discovery = await request(`${config.issuer}/.well-known/oauth-authorization-server`);
+    if (!discovery.ok) {
+        throw new SetupError(`Authorization server discovery answered HTTP ${discovery.status}.`, "discovery_failed");
+    }
+    const metadata = (await discovery.json());
+    const deviceEndpoint = endpoint(config.issuer, metadata.device_authorization_endpoint, "device authorization endpoint");
+    const tokenEndpoint = endpoint(config.issuer, metadata.token_endpoint, "token endpoint");
+    const response = await request(deviceEndpoint, {
+        body: new URLSearchParams({ client_id: config.clientId, scope: "profile" }),
+        method: "POST",
+    });
+    if (!response.ok) {
+        throw new SetupError(`Starting browser sign-in failed with HTTP ${response.status}.`, "device_start_failed");
+    }
+    const grant = (await response.json());
+    const verificationUriComplete = grant.verification_uri_complete ?? grant.verification_uri;
+    return {
+        deviceCode: grant.device_code,
+        expiresAt: Date.now() + (grant.expires_in ?? 600) * 1000,
+        interval: Math.max(grant.interval ?? 5, 1),
+        tokenEndpoint,
+        userCode: grant.user_code,
+        verificationUri: grant.verification_uri,
+        verificationUriComplete,
+    };
+}
+/** The console sign-in page that lands on the approval page with the code already applied. */
+export function approvalUrl(grant) {
+    return `${CONSOLE}/authorize?redirect_url=${encodeURIComponent(grant.verificationUriComplete)}`;
+}
+export async function waitForAccessToken(config, grant, signal) {
+    let interval = grant.interval;
+    let failures = 0;
+    while (Date.now() < grant.expiresAt) {
+        await sleep(interval * 1000, signal);
+        let response;
+        try {
+            response = await request(grant.tokenEndpoint, {
+                body: new URLSearchParams({
+                    client_id: config.clientId,
+                    device_code: grant.deviceCode,
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                }),
+                method: "POST",
+                signal,
+            });
+        }
+        catch (error) {
+            if (signal.aborted) {
+                throw new SetupError("Cancelled.", "cancelled");
+            }
+            failures += 1;
+            if (failures > 6) {
+                throw new SetupError(`Could not reach the authorization server: ${error.message}`, "network");
+            }
+            continue;
+        }
+        const body = (await response.json().catch(() => ({})));
+        if (response.ok && body.access_token) {
+            return body.access_token;
+        }
+        switch (body.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                interval += 5;
+                continue;
+            case "access_denied":
+                throw new SetupError("You declined the sign-in in the browser.", "access_denied");
+            case "expired_token":
+                throw new SetupError("The sign-in request expired before it was approved.", "expired");
+            default:
+                throw new SetupError(`Sign-in failed: ${body.error ?? `HTTP ${response.status}`}.`, body.error ?? "oauth_error");
+        }
+    }
+    throw new SetupError("The sign-in request expired before it was approved.", "expired");
+}