@code-yeongyu/senpi-ai 2026.9.30 → 2026.10.1-2

package/dist/auth/oauth/callback-server.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Loopback OAuth redirect handler shared by the browser sign-in flows.
+ *
+ * NOTE: This module uses node:http. It is only reachable through the lazily
+ * loaded OAuth flow modules, never from browser-facing entry points.
+ */
+import type { ProviderAuthInteraction } from "../types.ts";
+export interface OAuthCallbackServerOptions<T> {
+    /** Provider name used on the browser page, for example `OpenAI`. */
+    providerName: string;
+    /** Address to listen on. */
+    host: string;
+    /** Port to listen on; `0` picks a free port. */
+    port: number;
+    path: string;
+    /** Host in `redirectUri` when it differs from `host`, for example `localhost`. */
+    redirectHost?: string;
+    /** Expected `state` parameter. Omit when the provider does not send one. */
+    state?: string;
+    /**
+     * Finishes the sign-in with the received code before the browser page is sent, so the page can
+     * show exchange failures. Pass `async (code) => code` to exchange the code later.
+     */
+    complete: (code: string) => Promise<T>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export interface OAuthCallbackServer<T> {
+    redirectUri: string;
+    /**
+     * Resolves with the result of `complete`, or `undefined` after `cancel()`. Rejects when the provider
+     * redirects with an error, `complete` fails, the signal aborts, or the timeout elapses.
+     */
+    wait(): Promise<T | undefined>;
+    /** Stop waiting for the browser unless a callback is already being completed. */
+    cancel(): void;
+    close(): void;
+}
+export declare function startOAuthCallbackServer<T>(options: OAuthCallbackServerOptions<T>): Promise<OAuthCallbackServer<T>>;
+/**
+ * Wait for the browser callback, or for the user to paste the code or redirect URL when the browser
+ * cannot reach the loopback server (for example over SSH). Without a callback server only the manual
+ * prompt is used.
+ */
+export declare function waitForCallbackOrManualInput<T>(interaction: ProviderAuthInteraction, callback: OAuthCallbackServer<T> | undefined, prompt: {
+    message: string;
+    placeholder: string;
+}): Promise<{
+    type: "callback";
+    value: T;
+} | {
+    type: "manual";
+    input: string;
+}>;
+//# sourceMappingURL=callback-server.d.ts.map

package/dist/auth/oauth/callback-server.js

@@ -0,0 +1,146 @@
+/**
+ * Loopback OAuth redirect handler shared by the browser sign-in flows.
+ *
+ * NOTE: This module uses node:http. It is only reachable through the lazily
+ * loaded OAuth flow modules, never from browser-facing entry points.
+ */
+import { createServer } from "node:http";
+import { oauthErrorHtml, oauthSuccessHtml } from "../../utils/oauth-page.js";
+function sendPage(response, status, html) {
+    response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+    response.end(html);
+}
+export async function startOAuthCallbackServer(options) {
+    const { providerName, signal } = options;
+    if (signal?.aborted)
+        throw new Error("Login cancelled");
+    let resolveWait = () => { };
+    let rejectWait = () => { };
+    const waitPromise = new Promise((resolve, reject) => {
+        resolveWait = resolve;
+        rejectWait = reject;
+    });
+    // A cancelled or closed wait may never be observed.
+    waitPromise.catch(() => undefined);
+    let claimed = false;
+    let settled = false;
+    let timer;
+    const onAbort = () => finish({ error: new Error("Login cancelled") });
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timer)
+            clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        if ("error" in result)
+            rejectWait(result.error);
+        else
+            resolveWait(result.value);
+    };
+    const server = createServer((request, response) => {
+        void (async () => {
+            const url = new URL(request.url ?? "/", "http://localhost");
+            if (request.method !== "GET" || url.pathname !== options.path) {
+                sendPage(response, 404, oauthErrorHtml("Callback route not found."));
+                return;
+            }
+            if (options.state !== undefined && url.searchParams.get("state") !== options.state) {
+                sendPage(response, 400, oauthErrorHtml("State mismatch."));
+                return;
+            }
+            if (claimed || settled) {
+                sendPage(response, 409, oauthErrorHtml("This sign-in has already been handled."));
+                return;
+            }
+            const error = url.searchParams.get("error");
+            if (error) {
+                const description = url.searchParams.get("error_description") ?? error;
+                sendPage(response, 400, oauthErrorHtml(`${providerName} authorization failed.`, description));
+                finish({ error: new Error(`${providerName} authorization failed: ${description}`) });
+                return;
+            }
+            const code = url.searchParams.get("code");
+            if (!code) {
+                sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
+                return;
+            }
+            claimed = true;
+            try {
+                const value = await options.complete(code);
+                sendPage(response, 200, oauthSuccessHtml(`Signed in to ${providerName}. You may now close this page.`));
+                finish({ value });
+            }
+            catch (error) {
+                const failure = error instanceof Error ? error : new Error(String(error));
+                sendPage(response, 502, oauthErrorHtml(`${providerName} sign-in failed.`, failure.message));
+                finish({ error: failure });
+            }
+        })();
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new Error("OAuth callback server did not bind to TCP");
+    }
+    server.on("error", (error) => finish({ error }));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (options.timeoutMs !== undefined) {
+        timer = setTimeout(() => finish({ error: new Error(`${providerName} sign-in timed out`) }), options.timeoutMs);
+    }
+    const redirectHost = options.redirectHost ?? options.host;
+    return {
+        redirectUri: `http://${redirectHost.includes(":") ? `[${redirectHost}]` : redirectHost}:${address.port}${options.path}`,
+        wait: () => waitPromise,
+        cancel: () => {
+            if (!claimed)
+                finish({ value: undefined });
+        },
+        close: () => {
+            finish({ error: new Error("OAuth callback server closed") });
+            server.close();
+        },
+    };
+}
+/**
+ * Wait for the browser callback, or for the user to paste the code or redirect URL when the browser
+ * cannot reach the loopback server (for example over SSH). Without a callback server only the manual
+ * prompt is used.
+ */
+export async function waitForCallbackOrManualInput(interaction, callback, prompt) {
+    const manualAbort = new AbortController();
+    let manualError;
+    const manual = interaction
+        .prompt({ type: "manual_code", ...prompt, signal: manualAbort.signal })
+        .then((input) => {
+        callback?.cancel();
+        return input;
+    })
+        .catch((error) => {
+        manualError = error instanceof Error ? error : new Error(String(error));
+        callback?.cancel();
+        return undefined;
+    });
+    try {
+        const value = await callback?.wait();
+        if (manualError)
+            throw manualError;
+        if (value !== undefined)
+            return { type: "callback", value };
+        const input = await manual;
+        if (manualError)
+            throw manualError;
+        return { type: "manual", input: input ?? "" };
+    }
+    finally {
+        manualAbort.abort();
+    }
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/auth/oauth/chatgpt-subscription.d.ts

@@ -1,7 +1,7 @@
 /**
  * ChatGPT Subscription OAuth flow
  *
- * NOTE: This module uses Node.js crypto and http for the OAuth callback.
+ * NOTE: This module uses Node.js crypto and http (via callback-server.ts) for the OAuth callback.
  * It is only intended for CLI use, not browser environments.
  */
 import type { OAuthAuth } from "../types.ts";

package/dist/auth/oauth/chatgpt-subscription.js

@@ -1,25 +1,21 @@
 /**
  * ChatGPT Subscription OAuth flow
  *
- * NOTE: This module uses Node.js crypto and http for the OAuth callback.
+ * NOTE: This module uses Node.js crypto and http (via callback-server.ts) for the OAuth callback.
  * It is only intended for CLI use, not browser environments.
  */
 // NEVER convert to top-level imports - breaks browser/Vite builds
 let _randomBytes = null;
-let _http = null;
 if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
     import("node:crypto").then((m) => {
         _randomBytes = m.randomBytes;
     });
-    import("node:http").then((m) => {
-        _http = m;
-    });
 }
 import { extractChatGptSubscriptionAccountId } from "../../utils/chatgpt-subscription-auth.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { getWireIdentity } from "../../wire-identity.js";
+import { startOAuthCallbackServer, waitForCallbackOrManualInput } from "./callback-server.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
-import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_BASE_URL = "https://auth.openai.com";
@@ -230,81 +226,6 @@ async function createAuthorizationFlow(originator = getWireIdentity()) {
     url.searchParams.set("originator", originator);
     return { verifier, state, url: url.toString() };
 }
-function startLocalOAuthServer(state) {
-    if (!_http) {
-        throw new Error("ChatGPT Subscription OAuth is only available in Node.js environments");
-    }
-    let settleWait;
-    const waitForCodePromise = new Promise((resolve) => {
-        let settled = false;
-        settleWait = (value) => {
-            if (settled)
-                return;
-            settled = true;
-            resolve(value);
-        };
-    });
-    const server = _http.createServer((req, res) => {
-        try {
-            const url = new URL(req.url || "", "http://localhost");
-            if (url.pathname !== "/auth/callback") {
-                res.statusCode = 404;
-                res.setHeader("Content-Type", "text/html; charset=utf-8");
-                res.end(oauthErrorHtml("Callback route not found."));
-                return;
-            }
-            if (url.searchParams.get("state") !== state) {
-                res.statusCode = 400;
-                res.setHeader("Content-Type", "text/html; charset=utf-8");
-                res.end(oauthErrorHtml("State mismatch."));
-                return;
-            }
-            const code = url.searchParams.get("code");
-            if (!code) {
-                res.statusCode = 400;
-                res.setHeader("Content-Type", "text/html; charset=utf-8");
-                res.end(oauthErrorHtml("Missing authorization code."));
-                return;
-            }
-            res.statusCode = 200;
-            res.setHeader("Content-Type", "text/html; charset=utf-8");
-            res.end(oauthSuccessHtml("OpenAI authentication completed. You can close this window."));
-            settleWait?.({ code });
-        }
-        catch {
-            res.statusCode = 500;
-            res.setHeader("Content-Type", "text/html; charset=utf-8");
-            res.end(oauthErrorHtml("Internal error while processing OAuth callback."));
-        }
-    });
-    return new Promise((resolve) => {
-        server
-            .listen(1455, getCallbackHost(), () => {
-            resolve({
-                close: () => server.close(),
-                cancelWait: () => {
-                    settleWait?.(null);
-                },
-                waitForCode: () => waitForCodePromise,
-            });
-        })
-            .on("error", (_err) => {
-            settleWait?.(null);
-            resolve({
-                close: () => {
-                    try {
-                        server.close();
-                    }
-                    catch {
-                        // ignore
-                    }
-                },
-                cancelWait: () => { },
-                waitForCode: async () => null,
-            });
-        });
-    });
-}
 function getAccountId(accessToken) {
     return extractChatGptSubscriptionAccountId(accessToken) ?? null;
 }
@@ -338,67 +259,42 @@ async function loginChatGptSubscriptionDeviceCode(interaction) {
 }
 async function loginChatGptSubscription(interaction) {
     const { verifier, state, url } = await createAuthorizationFlow();
-    const server = await startLocalOAuthServer(state);
-    const manualAbort = new AbortController();
-    const onAbort = () => server.cancelWait();
-    interaction.signal.addEventListener("abort", onAbort, { once: true });
-    if (interaction.signal.aborted)
-        onAbort();
-    let code;
-    let manualCode;
-    let manualError;
+    // Port 1455 is shared with the Codex CLI; when it is taken, fall back to the pasted redirect URL.
+    const callback = await startOAuthCallbackServer({
+        providerName: "OpenAI",
+        host: getCallbackHost(),
+        port: 1455,
+        path: "/auth/callback",
+        state,
+        complete: async (code) => code,
+        signal: interaction.signal,
+    }).catch(() => undefined);
     interaction.notify({
         type: "auth_url",
         url,
         instructions: "A browser window should open. Complete login to finish.",
     });
     try {
-        const manualPromise = interaction
-            .prompt({
-            type: "manual_code",
+        const result = await waitForCallbackOrManualInput(interaction, callback, {
             message: "Complete login in your browser, or paste the authorization code / redirect URL here:",
             placeholder: REDIRECT_URI,
-            signal: manualAbort.signal,
-        })
-            .then((input) => {
-            manualCode = input;
-            server.cancelWait();
-        })
-            .catch((error) => {
-            manualError = error instanceof Error ? error : new Error(String(error));
-            server.cancelWait();
         });
-        const result = await server.waitForCode();
-        if (manualError)
-            throw manualError;
-        if (result?.code) {
-            code = result.code;
+        let code;
+        if (result.type === "callback") {
+            code = result.value;
         }
-        else if (manualCode) {
-            const parsed = parseAuthorizationInput(manualCode);
+        else {
+            const parsed = parseAuthorizationInput(result.input);
             if (parsed.state && parsed.state !== state)
                 throw new Error("State mismatch");
             code = parsed.code;
         }
-        if (!code) {
-            await manualPromise;
-            if (manualError)
-                throw manualError;
-            if (manualCode) {
-                const parsed = parseAuthorizationInput(manualCode);
-                if (parsed.state && parsed.state !== state)
-                    throw new Error("State mismatch");
-                code = parsed.code;
-            }
-        }
         if (!code)
             throw new Error("Missing authorization code");
-        return exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI, interaction.signal);
+        return await exchangeAuthorizationCodeForCredentials(code, verifier, REDIRECT_URI, interaction.signal);
     }
     finally {
-        interaction.signal.removeEventListener("abort", onAbort);
-        manualAbort.abort();
-        server.close();
+        callback?.close();
     }
 }
 /**

package/dist/auth/oauth/devin-callback.js

@@ -7,9 +7,9 @@
  * before spending the code, and renders the shared OAuth result pages.
  */
 import { createServer } from "node:http";
+import { oauthErrorHtml, oauthSuccessHtml } from "../../utils/oauth-page.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { exchangeDevinAuthorizationCode } from "./devin-token.js";
-import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 export const DEVIN_CALLBACK_PORT = 59653;
 export const DEVIN_CALLBACK_PATH = "/callback";
 function callbackHost() {

package/dist/auth/oauth/load.d.ts

@@ -2,9 +2,11 @@ import type { OAuthAuth } from "../types.ts";
 type OAuthFlowLoaders = {
     anthropic: () => OAuthAuth | Promise<OAuthAuth>;
     chatgptSubscription: () => OAuthAuth | Promise<OAuthAuth>;
+    openaiChatGPT: () => OAuthAuth | Promise<OAuthAuth>;
     githubCopilot: () => OAuthAuth | Promise<OAuthAuth>;
     openrouter: () => OAuthAuth | Promise<OAuthAuth>;
     kimiCoding: () => OAuthAuth | Promise<OAuthAuth>;
+    meta: () => OAuthAuth | Promise<OAuthAuth>;
     xai: () => OAuthAuth | Promise<OAuthAuth>;
     cursor: () => OAuthAuth | Promise<OAuthAuth>;
     devin: () => OAuthAuth | Promise<OAuthAuth>;
@@ -17,9 +19,11 @@ type OAuthFlowLoaders = {
 export declare function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void;
 export declare const loadAnthropicOAuth: () => Promise<OAuthAuth>;
 export declare const loadChatGptSubscriptionOAuth: () => Promise<OAuthAuth>;
+export declare const loadOpenAIChatGPTOAuth: () => Promise<OAuthAuth>;
 export declare const loadGitHubCopilotOAuth: () => Promise<OAuthAuth>;
 export declare const loadOpenRouterOAuth: () => Promise<OAuthAuth>;
 export declare const loadKimiCodingOAuth: () => Promise<OAuthAuth>;
+export declare const loadMetaOAuth: () => Promise<OAuthAuth>;
 export declare const loadXaiOAuth: () => Promise<OAuthAuth>;
 export declare const loadCursorOAuth: () => Promise<OAuthAuth>;
 export declare const loadDevinOAuth: () => Promise<OAuthAuth>;

package/dist/auth/oauth/load.js

@@ -32,6 +32,11 @@ export const loadChatGptSubscriptionOAuth = async () => {
     return (await importOAuthModule("./chatgpt-subscription.ts"))
         .chatgptSubscriptionOAuth;
 };
+export const loadOpenAIChatGPTOAuth = async () => {
+    if (bundledLoaders)
+        return bundledLoaders.openaiChatGPT();
+    return (await importOAuthModule("./openai-chatgpt.ts")).openaiChatGPTOAuth;
+};
 export const loadGitHubCopilotOAuth = async () => {
     if (bundledLoaders)
         return bundledLoaders.githubCopilot();
@@ -47,6 +52,11 @@ export const loadKimiCodingOAuth = async () => {
         return bundledLoaders.kimiCoding();
     return (await importOAuthModule("./kimi-coding.ts")).kimiCodingOAuth;
 };
+export const loadMetaOAuth = async () => {
+    if (bundledLoaders)
+        return bundledLoaders.meta();
+    return (await importOAuthModule("./meta.ts")).metaOAuth;
+};
 export const loadXaiOAuth = async () => {
     if (bundledLoaders)
         return bundledLoaders.xai();

package/dist/auth/oauth/meta.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Meta Model API OAuth flow
+ *
+ * RFC 8628 device authorization grant against https://auth.meta.com (JSON
+ * responses). Meta splits identity from API access: the resulting identity
+ * token is not accepted for inference, so it is exchanged for a Model API
+ * key via the Muse Code key-mint endpoint (minted keys live about a day).
+ * The identity token is stored as `refresh` and the minted key as `access`,
+ * so the standard OAuth scheduler re-mints the key when it expires with no
+ * bespoke renewal machinery. The identity token itself is not renewable
+ * (auth.meta.com answers grant_type=refresh_token with 404 and issues no
+ * refresh_token), so a 401/403 from mint means the session is dead and the
+ * user must sign in again.
+ */
+import type { OAuthAuth } from "../types.ts";
+export declare const metaOAuth: OAuthAuth;
+//# sourceMappingURL=meta.d.ts.map

package/dist/auth/oauth/meta.js

@@ -0,0 +1,190 @@
+/**
+ * Meta Model API OAuth flow
+ *
+ * RFC 8628 device authorization grant against https://auth.meta.com (JSON
+ * responses). Meta splits identity from API access: the resulting identity
+ * token is not accepted for inference, so it is exchanged for a Model API
+ * key via the Muse Code key-mint endpoint (minted keys live about a day).
+ * The identity token is stored as `refresh` and the minted key as `access`,
+ * so the standard OAuth scheduler re-mints the key when it expires with no
+ * bespoke renewal machinery. The identity token itself is not renewable
+ * (auth.meta.com answers grant_type=refresh_token with 404 and issues no
+ * refresh_token), so a 401/403 from mint means the session is dead and the
+ * user must sign in again.
+ */
+import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+// Muse Code CLI client id.
+const CLIENT_ID = "1031625952748946";
+const AUTH_HOST = "https://auth.meta.com";
+const DEVICE_AUTHORIZATION_URL = `${AUTH_HOST}/oidc/device/authorization/`;
+const DEVICE_TOKEN_URL = `${AUTH_HOST}/oidc/device/token/`;
+const API_KEY_MINT_URL = "https://api.meta.ai/muse-code/key";
+const API_KEY_LIFETIME_MS = 24 * 60 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 30 * 1000;
+function requestSignal(signal) {
+    return AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), signal]);
+}
+async function readJson(response) {
+    try {
+        const json = await response.json();
+        return json && typeof json === "object" ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+function errorDetail(json) {
+    for (const key of ["error_description", "detail", "message", "error"]) {
+        const value = json?.[key];
+        if (typeof value === "string" && value.trim())
+            return `: ${value.trim()}`;
+    }
+    return "";
+}
+/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */
+function trustedHttpUrl(value) {
+    if (typeof value !== "string" || !value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" && url.protocol !== "http:")
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+function positiveNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
+async function startDeviceAuthorization(signal) {
+    const response = await fetch(DEVICE_AUTHORIZATION_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams({ client_id: CLIENT_ID }).toString(),
+        signal: requestSignal(signal),
+    });
+    const json = await readJson(response);
+    if (!response.ok) {
+        throw new Error(`Meta device authorization failed with status ${response.status}${errorDetail(json)}`);
+    }
+    const deviceCode = json?.device_code;
+    const userCode = json?.user_code;
+    const verificationUri = trustedHttpUrl(json?.verification_uri_complete) ?? trustedHttpUrl(json?.verification_uri);
+    if (typeof deviceCode !== "string" || !deviceCode || typeof userCode !== "string" || !userCode || !verificationUri) {
+        throw new Error(`Invalid Meta device authorization response: ${JSON.stringify(json)}`);
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        intervalSeconds: positiveNumber(json?.interval),
+        expiresInSeconds: positiveNumber(json?.expires_in),
+    };
+}
+async function pollForIdentityToken(device, signal) {
+    return pollOAuthDeviceCodeFlow({
+        intervalSeconds: device.intervalSeconds,
+        expiresInSeconds: device.expiresInSeconds,
+        waitBeforeFirstPoll: true,
+        signal,
+        poll: async () => {
+            const response = await fetch(DEVICE_TOKEN_URL, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                },
+                body: new URLSearchParams({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: device.deviceCode,
+                    client_id: CLIENT_ID,
+                }).toString(),
+                signal: requestSignal(signal),
+            });
+            const json = await readJson(response);
+            if (response.ok && typeof json?.access_token === "string" && json.access_token) {
+                return { status: "complete", value: json.access_token };
+            }
+            switch (json?.error) {
+                case "authorization_pending":
+                    return { status: "pending" };
+                case "slow_down":
+                    return { status: "slow_down", intervalSeconds: positiveNumber(json?.interval) };
+                case "access_denied":
+                    return { status: "failed", message: "Meta login was denied." };
+                case "expired_token":
+                    return { status: "failed", message: "Meta device authorization expired. Please restart login." };
+                default:
+                    return {
+                        status: "failed",
+                        message: `Meta device token request failed with status ${response.status}${errorDetail(json)}`,
+                    };
+            }
+        },
+    });
+}
+/** Exchange an identity token for a Model API key. Keys are valid for about a day. */
+async function mintApiKey(identityToken, signal) {
+    const response = await fetch(API_KEY_MINT_URL, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${identityToken}`,
+            "Content-Type": "application/json",
+            "x-api-version": "1.0.0",
+        },
+        body: "{}",
+        signal: requestSignal(signal),
+    });
+    const json = await readJson(response);
+    if (response.status === 401 || response.status === 403) {
+        // Identity token is not renewable (see file header); only a fresh device flow helps.
+        throw new Error(`Meta session expired (status ${response.status}). Run \`/login meta\` to sign in again.${errorDetail(json)}`);
+    }
+    if (!response.ok) {
+        throw new Error(`Meta API key mint failed with status ${response.status}${errorDetail(json)}`);
+    }
+    const apiKey = json?.api_key;
+    if (typeof apiKey !== "string" || !apiKey) {
+        const actionUrl = trustedHttpUrl(json?.action_url);
+        throw new Error(`Meta did not issue an API key.${actionUrl ? ` Complete setup at ${actionUrl}` : ""}`);
+    }
+    return { type: "oauth", refresh: identityToken, access: apiKey, expires: Date.now() + API_KEY_LIFETIME_MS };
+}
+async function loginMeta(interaction) {
+    try {
+        const device = await startDeviceAuthorization(interaction.signal);
+        interaction.notify({
+            type: "device_code",
+            userCode: device.userCode,
+            verificationUri: device.verificationUri,
+            intervalSeconds: device.intervalSeconds,
+            expiresInSeconds: device.expiresInSeconds,
+        });
+        const identityToken = await pollForIdentityToken(device, interaction.signal);
+        interaction.notify({ type: "progress", message: "Enabling Meta Model API access..." });
+        return await mintApiKey(identityToken, interaction.signal);
+    }
+    catch (e) {
+        // An in-flight fetch rejects with a DOMException on abort; the login UI matches on this message.
+        if (interaction.signal.aborted)
+            throw new Error("Login cancelled");
+        throw e;
+    }
+}
+export const metaOAuth = {
+    name: "Meta (Muse subscription)",
+    isSubscription: true,
+    loginLabel: "Sign in with Meta",
+    login: loginMeta,
+    refresh: (credential, signal) => mintApiKey(credential.refresh, signal),
+    async toAuth(credential) {
+        return { apiKey: credential.access };
+    },
+};
+//# sourceMappingURL=meta.js.map