@code-yeongyu/senpi-ai 2026.9.30 → 2026.10.1

package/dist/auth/oauth/openai-chatgpt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * OpenAI Responses API token sharing through Sign in with ChatGPT.
+ *
+ * This public-client flow uses no client secret and sends the resulting user
+ * access token directly to api.openai.com.
+ */
+import type { OAuthAuth } from "../types.ts";
+export declare const openaiChatGPTOAuth: OAuthAuth;
+//# sourceMappingURL=openai-chatgpt.d.ts.map

package/dist/auth/oauth/openai-chatgpt.js

@@ -0,0 +1,266 @@
+/**
+ * OpenAI Responses API token sharing through Sign in with ChatGPT.
+ *
+ * This public-client flow uses no client secret and sends the resulting user
+ * access token directly to api.openai.com.
+ */
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { oauthErrorHtml, oauthSuccessHtml } from "../../utils/oauth-page.js";
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+import { generatePKCE } from "./pkce.js";
+// every login registers a new client with this ID; OpenAI returns the issued client ID in the callback
+const DYNAMIC_CLIENT_ID = "dynamic_agent_client";
+const AGENT_NAME_HINT = "Pi";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const AUTHORIZE_URL = "https://auth.openai.com/api/accounts/authorize";
+const TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+const RESOURCE = "https://api.openai.com/v1";
+const CALLBACK_HOST = getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const DIRECT_TOKEN_SCOPE = "chatgpt.tokens.use.direct";
+const SCOPE = `openid profile email offline_access resource.invoke ${DIRECT_TOKEN_SCOPE}`;
+// Refresh this long before the real expiry so a request never starts with a token about to expire.
+const EXPIRY_MARGIN_MS = 3 * 60 * 1000;
+function randomValue() {
+    return randomBytes(32).toString("base64url");
+}
+function authorizationResultFromCallback(url, expectedState) {
+    const code = url.searchParams.get("code");
+    if (!code)
+        throw new Error("Missing authorization code");
+    const state = url.searchParams.get("state");
+    if (!state)
+        throw new Error("Missing OAuth state");
+    if (state !== expectedState)
+        throw new Error("OAuth state mismatch");
+    const clientId = url.searchParams.get("client_id")?.trim();
+    if (!clientId)
+        throw new Error("OpenAI OAuth registration callback did not contain an issued client ID");
+    return { code, clientId };
+}
+function authorizationResultFromManualInput(input, expectedState) {
+    let url;
+    try {
+        url = new URL(input.trim());
+    }
+    catch {
+        throw new Error("Paste the full callback URL from the browser");
+    }
+    const expected = new URL(REDIRECT_URI);
+    if (url.origin !== expected.origin || url.pathname !== expected.pathname) {
+        throw new Error(`The pasted callback URL must start with ${REDIRECT_URI}`);
+    }
+    const error = url.searchParams.get("error");
+    if (error)
+        throw new Error(`ChatGPT authorization failed: ${error}`);
+    return authorizationResultFromCallback(url, expectedState);
+}
+function sendHtml(response, status, body) {
+    response.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(body);
+}
+function startCallbackServer(expectedState) {
+    return new Promise((resolve, reject) => {
+        let resolveResult;
+        let rejectResult;
+        const result = new Promise((resolveAuthorization, rejectAuthorization) => {
+            resolveResult = resolveAuthorization;
+            rejectResult = rejectAuthorization;
+        });
+        const server = createServer((request, response) => {
+            try {
+                const url = new URL(request.url || "", REDIRECT_URI);
+                if (url.pathname !== CALLBACK_PATH) {
+                    sendHtml(response, 404, oauthErrorHtml("Callback route not found."));
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                if (error) {
+                    sendHtml(response, 400, oauthErrorHtml("ChatGPT was not connected.", `Error: ${error}`));
+                    rejectResult(new Error(`ChatGPT authorization failed: ${error}`));
+                    return;
+                }
+                let authorizationResult;
+                try {
+                    authorizationResult = authorizationResultFromCallback(url, expectedState);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : "Invalid callback";
+                    sendHtml(response, 400, oauthErrorHtml(message));
+                    return;
+                }
+                sendHtml(response, 200, oauthSuccessHtml("ChatGPT authentication completed. You can close this window."));
+                resolveResult(authorizationResult);
+            }
+            catch {
+                sendHtml(response, 500, oauthErrorHtml("Internal error while processing the callback."));
+            }
+        });
+        server.once("error", reject);
+        server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+            server.removeListener("error", reject);
+            server.on("error", rejectResult);
+            resolve({ server, result });
+        });
+    });
+}
+async function requestToken(body, signal) {
+    const response = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: {
+            accept: "application/json",
+            "content-type": "application/x-www-form-urlencoded",
+        },
+        body,
+        signal,
+    });
+    if (!response.ok) {
+        const responseBody = await response.text().catch(() => "");
+        throw new Error(`OpenAI OAuth token request failed (${response.status}): ${responseBody || response.statusText}`);
+    }
+    const data = await response.json();
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+        throw new Error("OpenAI OAuth token response must be an object");
+    }
+    return data;
+}
+function requireTokenString(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new Error(`OpenAI OAuth token response has invalid ${field}`);
+    }
+    return value;
+}
+function credentialFromTokenResponse(token, clientId) {
+    const access = requireTokenString(token.access_token, "access_token");
+    const refresh = requireTokenString(token.refresh_token, "refresh_token");
+    const scope = requireTokenString(token.scope, "scope");
+    if (typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0) {
+        throw new Error("OpenAI OAuth token response has invalid expires_in");
+    }
+    const scopes = scope.trim().split(/\s+/).filter(Boolean);
+    if (!scopes.includes(DIRECT_TOKEN_SCOPE)) {
+        throw new Error(`OpenAI OAuth grant did not include ${DIRECT_TOKEN_SCOPE}`);
+    }
+    return {
+        type: "oauth",
+        access,
+        refresh,
+        expires: Date.now() + token.expires_in * 1000 - EXPIRY_MARGIN_MS,
+        clientId,
+        scopes,
+    };
+}
+async function exchangeAuthorizationCode(code, verifier, clientId, signal) {
+    const token = await requestToken(new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: clientId,
+        code,
+        code_verifier: verifier,
+        redirect_uri: REDIRECT_URI,
+        resource: RESOURCE,
+    }), signal);
+    // Pi does not use the ID token to identify the user or read profile data.
+    // Keep the presence check as part of the token-response contract.
+    if (typeof token.id_token !== "string" || token.id_token.trim().length === 0) {
+        throw new Error("OpenAI OAuth token response did not contain an ID token");
+    }
+    return credentialFromTokenResponse(token, clientId);
+}
+async function refreshAccessToken(credential, signal) {
+    const clientId = credential.clientId;
+    if (typeof clientId !== "string" || clientId.trim().length === 0) {
+        throw new Error("Stored OpenAI OAuth credential does not contain an issued client ID; reconnect ChatGPT");
+    }
+    const token = await requestToken(new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: clientId,
+        refresh_token: credential.refresh,
+        resource: RESOURCE,
+    }), signal);
+    return credentialFromTokenResponse(token, clientId);
+}
+/** OpenAI identifies each installation ("agent host") by a stable URI such as `urn:uuid:<uuid>`. */
+function agentHostId(deviceId) {
+    if (!deviceId || !UUID_PATTERN.test(deviceId)) {
+        throw new Error("Sign in with ChatGPT requires a device ID (UUID) for this installation");
+    }
+    return `urn:uuid:${deviceId.toLowerCase()}`;
+}
+async function loginOpenAIChatGPT(interaction, options) {
+    const hostId = agentHostId(options?.getDeviceId?.());
+    const { verifier, challenge } = await generatePKCE();
+    const state = randomValue();
+    const nonce = randomValue();
+    let callback;
+    try {
+        callback = await startCallbackServer(state);
+    }
+    catch (error) {
+        interaction.notify({
+            type: "info",
+            message: `Could not listen on ${REDIRECT_URI}; paste the final redirect URL to continue. ${error instanceof Error ? error.message : String(error)}`,
+        });
+    }
+    const authorizationUrl = new URL(AUTHORIZE_URL);
+    authorizationUrl.search = new URLSearchParams({
+        client_id: DYNAMIC_CLIENT_ID,
+        agent_name_hint: AGENT_NAME_HINT,
+        ext_agent_host_id: hostId,
+        response_type: "code",
+        redirect_uri: REDIRECT_URI,
+        resource: RESOURCE,
+        scope: SCOPE,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        nonce,
+    }).toString();
+    interaction.notify({
+        type: "auth_url",
+        url: authorizationUrl.toString(),
+        instructions: "Complete sign-in in your browser. If the callback does not complete, paste the final redirect URL here.",
+    });
+    const manualAbort = new AbortController();
+    const manualCode = interaction
+        .prompt({
+        type: "manual_code",
+        message: "Complete login in your browser, or paste the final redirect URL here:",
+        placeholder: REDIRECT_URI,
+        signal: AbortSignal.any([manualAbort.signal, interaction.signal]),
+    })
+        .then((input) => authorizationResultFromManualInput(input, state));
+    try {
+        const result = await (callback ? Promise.race([callback.result, manualCode]) : manualCode);
+        interaction.notify({ type: "progress", message: "Exchanging authorization code for tokens..." });
+        return await exchangeAuthorizationCode(result.code, verifier, result.clientId, interaction.signal);
+    }
+    catch (error) {
+        if (interaction.signal.aborted)
+            throw new Error("Login cancelled");
+        throw error;
+    }
+    finally {
+        manualAbort.abort();
+        callback?.server.close();
+        // close() only stops accepting new connections. Browsers open spare connections ahead of
+        // time, and one that has not sent a request yet stays open and attached to this server.
+        // A later login in the same process starts a new server with a new state, but the browser
+        // may send that login's callback over the spare connection. This server would then handle
+        // it and reject it with "OAuth state mismatch", and the new login would never see it.
+        callback?.server.closeAllConnections();
+    }
+}
+export const openaiChatGPTOAuth = {
+    name: "OpenAI (ChatGPT subscription)",
+    isSubscription: true,
+    loginLabel: "Sign in with ChatGPT",
+    login: loginOpenAIChatGPT,
+    refresh: refreshAccessToken,
+    async toAuth(credential) {
+        return { apiKey: credential.access };
+    },
+};
+//# sourceMappingURL=openai-chatgpt.js.map

package/dist/auth/oauth/openrouter.d.ts

@@ -7,7 +7,7 @@
  * manual prompt so remote/headless sessions can paste the redirect URL when
  * the browser cannot reach the loopback server.
  *
- * NOTE: This module uses Node.js http.createServer for the OAuth callback server.
+ * NOTE: This module uses node:http (via callback-server.ts) for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
  */
 import type { OAuthAuth } from "../types.ts";

package/dist/auth/oauth/openrouter.js

@@ -7,12 +7,11 @@
  * manual prompt so remote/headless sessions can paste the redirect URL when
  * the browser cannot reach the loopback server.
  *
- * NOTE: This module uses Node.js http.createServer for the OAuth callback server.
+ * NOTE: This module uses node:http (via callback-server.ts) for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
  */
-import { createServer } from "node:http";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
-import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
+import { startOAuthCallbackServer, waitForCallbackOrManualInput } from "./callback-server.js";
 import { generatePKCE } from "./pkce.js";
 const AUTHORIZE_URL = "https://openrouter.ai/auth";
 const TOKEN_URL = "https://openrouter.ai/api/v1/auth/keys";
@@ -21,12 +20,6 @@ const TOKEN_EXCHANGE_TIMEOUT_MS = 30_000;
 function getCallbackHost() {
     return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
 }
-function sendHtml(response, status, html) {
-    response.statusCode = status;
-    response.setHeader("content-type", "text/html; charset=utf-8");
-    response.setHeader("cache-control", "no-store");
-    response.end(html);
-}
 function parseAuthorizationInput(input) {
     const value = input.trim();
     if (!value)
@@ -107,159 +100,47 @@ async function exchangeAuthorizationCode(code, verifier, signal) {
         expires: Number.MAX_SAFE_INTEGER,
     };
 }
-async function startCallbackServer(callbackPath, verifier, signal) {
-    if (signal.aborted)
-        throw new Error("Login cancelled");
-    const callbackHost = getCallbackHost();
-    let resolveCredential = () => { };
-    let rejectCredential = () => { };
-    const credential = new Promise((resolve, reject) => {
-        resolveCredential = resolve;
-        rejectCredential = reject;
-    });
-    let server;
-    let claimed = false;
-    let settled = false;
-    let timeout;
-    let onAbort;
-    const close = () => {
-        if (timeout)
-            clearTimeout(timeout);
-        if (onAbort)
-            signal.removeEventListener("abort", onAbort);
-        server.close();
-    };
-    const finish = (result) => {
-        if (settled)
-            return;
-        settled = true;
-        close();
-        if ("credential" in result)
-            resolveCredential(result.credential);
-        else
-            rejectCredential(result.error);
-    };
-    server = createServer((request, response) => {
-        void (async () => {
-            const requestUrl = new URL(request.url ?? "/", `http://${callbackHost}`);
-            if (request.method !== "GET" || requestUrl.pathname !== callbackPath) {
-                sendHtml(response, 404, oauthErrorHtml("OAuth callback route not found."));
-                return;
-            }
-            if (claimed || settled) {
-                sendHtml(response, 409, oauthErrorHtml("This OAuth callback has already been used."));
-                return;
-            }
-            const oauthError = requestUrl.searchParams.get("error");
-            if (oauthError) {
-                const description = requestUrl.searchParams.get("error_description") ?? oauthError;
-                sendHtml(response, 400, oauthErrorHtml("OpenRouter authorization was denied.", description));
-                finish({ error: new Error(`OpenRouter authorization failed: ${description}`) });
-                return;
-            }
-            const code = requestUrl.searchParams.get("code");
-            if (!code) {
-                sendHtml(response, 400, oauthErrorHtml("OpenRouter returned no authorization code."));
-                return;
-            }
-            claimed = true;
-            try {
-                const result = await exchangeAuthorizationCode(code, verifier, signal);
-                sendHtml(response, 200, oauthSuccessHtml("Signed in to OpenRouter. You may now close this page."));
-                finish({ credential: result });
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : "Unknown token exchange error";
-                sendHtml(response, 502, oauthErrorHtml("OpenRouter key exchange failed.", message));
-                finish({ error: error instanceof Error ? error : new Error(message) });
-            }
-        })();
-    });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(0, callbackHost, () => {
-            server.removeListener("error", reject);
-            resolve();
-        });
-    });
-    server.on("error", (error) => finish({ error }));
-    onAbort = () => finish({ error: new Error("Login cancelled") });
-    signal.addEventListener("abort", onAbort, { once: true });
-    if (signal.aborted) {
-        close();
-        throw new Error("Login cancelled");
-    }
-    timeout = setTimeout(() => finish({ error: new Error("OpenRouter OAuth login timed out") }), LOGIN_TIMEOUT_MS);
-    const address = server.address();
-    if (!address || typeof address === "string") {
-        close();
-        throw new Error("Could not determine the OpenRouter OAuth callback port");
-    }
-    return {
-        callbackUrl: `http://${callbackHost}:${address.port}${callbackPath}`,
-        close,
-        // A claimed callback is already exchanging its code; let that exchange settle the login.
-        cancelWait: () => {
-            if (!claimed)
-                finish({ credential: null });
-        },
-        waitForCredential: () => credential,
-    };
-}
 async function loginOpenRouter(interaction) {
     const { verifier, challenge } = await generatePKCE();
-    const callbackPath = `/oauth/callback/${crypto.randomUUID()}`;
-    const callback = await startCallbackServer(callbackPath, verifier, interaction.signal);
-    const manualAbort = new AbortController();
-    let manualInput;
-    let manualError;
+    // OpenRouter sends no `state`; the random path keeps stray requests from completing the sign-in.
+    const callback = await startOAuthCallbackServer({
+        providerName: "OpenRouter",
+        host: getCallbackHost(),
+        port: 0,
+        path: `/oauth/callback/${crypto.randomUUID()}`,
+        complete: (code) => exchangeAuthorizationCode(code, verifier, interaction.signal),
+        signal: interaction.signal,
+        timeoutMs: LOGIN_TIMEOUT_MS,
+    });
     try {
         const authorizeUrl = new URL(AUTHORIZE_URL);
         authorizeUrl.search = new URLSearchParams({
-            callback_url: callback.callbackUrl,
+            callback_url: callback.redirectUri,
             code_challenge: challenge,
             code_challenge_method: "S256",
         }).toString();
         interaction.notify({
             type: "progress",
-            message: `Listening for OpenRouter OAuth callback on ${callback.callbackUrl}`,
+            message: `Listening for OpenRouter OAuth callback on ${callback.redirectUri}`,
         });
         interaction.notify({
             type: "auth_url",
             url: authorizeUrl.toString(),
             instructions: "Complete sign-in in your browser. If the browser is on another machine, paste the final redirect URL here.",
         });
-        const manualPromise = interaction
-            .prompt({
-            type: "manual_code",
+        const result = await waitForCallbackOrManualInput(interaction, callback, {
             message: "Complete sign-in in your browser, or paste the authorization code / redirect URL here:",
-            placeholder: callback.callbackUrl,
-            signal: manualAbort.signal,
-        })
-            .then((input) => {
-            manualInput = input;
-            callback.cancelWait();
-        })
-            .catch((error) => {
-            manualError = error instanceof Error ? error : new Error(String(error));
-            callback.cancelWait();
+            placeholder: callback.redirectUri,
         });
-        const credential = await callback.waitForCredential();
-        if (manualError)
-            throw manualError;
-        if (credential)
-            return credential;
-        await manualPromise;
-        if (manualError)
-            throw manualError;
-        const code = manualInput ? parseAuthorizationInput(manualInput) : undefined;
+        if (result.type === "callback")
+            return result.value;
+        const code = parseAuthorizationInput(result.input);
         if (!code)
             throw new Error("Missing authorization code");
         interaction.notify({ type: "progress", message: "Exchanging authorization code for an API key..." });
         return await exchangeAuthorizationCode(code, verifier, interaction.signal);
     }
     finally {
-        manualAbort.abort();
         callback.close();
     }
 }

package/dist/auth/oauth/radius.d.ts

@@ -5,7 +5,7 @@
  * gateway; only the interactive browser authorization endpoint is discovered.
  * Model catalog loading is owned by the Radius provider.
  *
- * NOTE: This module uses node:http for the OAuth callback server.
+ * NOTE: This module uses node:http (via callback-server.ts) for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
  */
 import type { OAuthAuth } from "../types.ts";

package/dist/auth/oauth/radius.js

@@ -5,19 +5,12 @@
  * gateway; only the interactive browser authorization endpoint is discovered.
  * Model catalog loading is owned by the Radius provider.
  *
- * NOTE: This module uses node:http for the OAuth callback server.
+ * NOTE: This module uses node:http (via callback-server.ts) for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
  */
-// NEVER convert to top-level imports - breaks browser/Vite builds
-let _http = null;
-if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
-    import("node:http").then((m) => {
-        _http = m;
-    });
-}
 import { normalizeRadiusGatewayUrl } from "../../providers/radius-config.js";
+import { startOAuthCallbackServer } from "./callback-server.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
-import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
 import { generatePKCE } from "./pkce.js";
 const CALLBACK_HOST = "127.0.0.1";
 const CALLBACK_PORT = 1456;
@@ -99,71 +92,6 @@ async function requestOAuthToken(gateway, body, signal) {
         scope: data.scope,
     };
 }
-function startOAuthCallbackServer(expectedState, signal) {
-    if (!_http) {
-        throw new Error("Radius OAuth is only available in Node.js environments");
-    }
-    let settle = () => { };
-    let settled = false;
-    const wait = new Promise((resolve) => {
-        settle = resolve;
-    });
-    const finish = (code) => {
-        if (settled) {
-            return;
-        }
-        settled = true;
-        signal.removeEventListener("abort", onAbort);
-        settle(code);
-    };
-    const onAbort = () => finish(null);
-    signal.addEventListener("abort", onAbort, { once: true });
-    const sendPage = (response, status, html) => {
-        response.statusCode = status;
-        response.setHeader("content-type", "text/html; charset=utf-8");
-        response.end(html);
-    };
-    const server = _http.createServer((request, response) => {
-        const url = new URL(request.url ?? "/", REDIRECT_URI);
-        if (url.pathname !== CALLBACK_PATH) {
-            sendPage(response, 404, oauthErrorHtml("Callback route not found."));
-            return;
-        }
-        if (url.searchParams.get("state") !== expectedState) {
-            sendPage(response, 400, oauthErrorHtml("OAuth state mismatch."));
-            return;
-        }
-        const error = url.searchParams.get("error");
-        if (error) {
-            sendPage(response, 400, oauthErrorHtml(url.searchParams.get("error_description") ?? error));
-            finish(null);
-            return;
-        }
-        const code = url.searchParams.get("code");
-        if (!code) {
-            sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
-            return;
-        }
-        sendPage(response, 200, oauthSuccessHtml("Signed in to Radius. You may now close this page."));
-        finish(code);
-    });
-    return new Promise((resolve) => {
-        server
-            .listen(CALLBACK_PORT, CALLBACK_HOST, () => {
-            resolve({
-                waitForCode: () => wait,
-                close: () => {
-                    finish(null);
-                    server.close();
-                },
-            });
-        })
-            .once("error", () => {
-            finish(null);
-            resolve({ waitForCode: async () => null, close: () => { } });
-        });
-    });
-}
 async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
     const { verifier, challenge } = await generatePKCE();
     const state = crypto.randomUUID();
@@ -178,7 +106,21 @@ async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
         handoff: "url",
         state,
     }).toString();
-    const callbackServer = await startOAuthCallbackServer(state, interaction.signal);
+    const callback = await startOAuthCallbackServer({
+        providerName: "Radius",
+        host: CALLBACK_HOST,
+        port: CALLBACK_PORT,
+        path: CALLBACK_PATH,
+        state,
+        complete: (code) => requestOAuthToken(gateway, new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: OAUTH_CLIENT_ID,
+            redirect_uri: REDIRECT_URI,
+            code,
+            code_verifier: verifier,
+        }), interaction.signal),
+        signal: interaction.signal,
+    });
     interaction.notify({ type: "progress", message: `Listening for OAuth callback on ${REDIRECT_URI}` });
     interaction.notify({
         type: "auth_url",
@@ -186,23 +128,13 @@ async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
         instructions: "Continue in your browser.",
     });
     try {
-        const code = await callbackServer.waitForCode();
-        if (!code) {
-            if (interaction.signal.aborted) {
-                throw new Error("Login cancelled");
-            }
+        const credential = await callback.wait();
+        if (!credential)
             throw new Error("OAuth callback did not complete.");
-        }
-        return await requestOAuthToken(gateway, new URLSearchParams({
-            grant_type: "authorization_code",
-            client_id: OAUTH_CLIENT_ID,
-            redirect_uri: REDIRECT_URI,
-            code,
-            code_verifier: verifier,
-        }), interaction.signal);
+        return credential;
     }
     finally {
-        callbackServer.close();
+        callback.close();
     }
 }
 async function requestDeviceAuthorization(gateway, signal) {

package/dist/auth/resolve.d.ts

@@ -1,6 +1,7 @@
 import type { ProviderEnv } from "../types.ts";
+import { ModelsError } from "../utils/models-error.ts";
+export { ModelsError, type ModelsErrorCode } from "../utils/models-error.ts";
 import type { AuthContext, AuthResult, CredentialStore, ProviderAuth } from "./types.ts";
-export type ModelsErrorCode = "model_source" | "model_validation" | "provider" | "stream" | "auth" | "oauth";
 export interface AuthResolutionOverrides {
     apiKey?: string;
     env?: ProviderEnv;
@@ -28,14 +29,8 @@ export interface AuthResolutionOverrides {
  */
 export declare const PROVIDER_NOT_CONFIGURED_PREFIX = "Provider is not configured: ";
 export declare function providerNotConfiguredMessage(providerId: string): string;
-export declare class ModelsError extends Error {
-    readonly code: ModelsErrorCode;
-    constructor(code: ModelsErrorCode, message: string, options?: {
-        cause?: unknown;
-    });
-}
 /**
- * Auth resolution shared by the `Models` and `ImagesModels` collections.
+ * Auth resolution shared by all operations in a `Models` collection.
  * A stored credential owns the provider: ambient/env is consulted only when
  * nothing is stored. No silent env fallback after a failed refresh or for a
  * credential type without a matching handler.