@d-ai/magpie 0.1.2 → 0.1.4

package/README.md

@@ -13,16 +13,23 @@ One `ddsk_…` API key is one account, and magpie keeps several.
 magpie plugin add mdddj/d-ai-magpie       # from GitHub
 magpie plugin add @d-ai/magpie            # from npm, once published
 magpie plugin add ./sdks/d-ai-magpie      # from a folder, for development
-magpie plugin login dai                   # asks for the API key
+magpie plugin login dai oauth             # sign in with a browser
+magpie plugin login dai                   # or choose the API key method
 magpie provider test dai                  # one tiny call per API
 ```
 
 Then pick a model anywhere magpie does: `dai/claude-opus-5-5`,
 `dai/gpt-6-astra`, `dai/deepseek-v4.1-flash`, …
 
-The key comes from the D.AI console (`/#/apikeys`). Custom deployments can point
-at another host with `magpie plugin options dai '{"baseUrl":"https://dai.example"}'`
-or `DAI_BASE_URL`.
+The browser sign-in uses OAuth 2.1 authorization code with PKCE S256 and a
+loopback callback on a random `127.0.0.1` port, so no fixed port is reserved and
+the refresh token stays in magpie's auth store. It uses the first-party public
+client `ddc_i4mhCndrFLK3LAYBaK8d` by default. The API key remains available as
+the fallback; keys come from the D.AI console (`/#/apikeys`). Custom deployments
+can point at another host with
+`magpie plugin options @d-ai/magpie@latest '{"baseUrl":"https://dai.example"}'`
+or `DAI_BASE_URL`. `plugin options` takes the installed plugin spec, not the
+provider id (`dai`).
 
 ## Chat models
 
@@ -76,17 +83,29 @@ Paid generation and account-scoped job tools are intentionally not included.
 Magpie's tool process does not receive the signed-in `dai` provider's API key,
 so adding generation here would require a separate tool-auth design.
 
+For a deployment with its own OAuth registration, add an `oauthClientId` option
+next to `baseUrl`; the default remains the first-party
+`ddc_i4mhCndrFLK3LAYBaK8d`. A custom client must register a loopback callback
+for `http://127.0.0.1:<random port>/callback`, which the deployment's
+authorization server accepts under RFC 8252.
+
 ## Usage
 
-`magpie quota` shows the account behind the key: the wallet balance and pending
-reservation, the tier and its cycle, included USD, the key's own reservation and
-daily limits, and how many calls it made today. That comes from
-`GET /api/ai/account`, an endpoint authenticated by the `ddsk_` key itself.
+`magpie quota` shows the account behind either sign-in: the wallet balance and
+pending reservation, the tier and its cycle, included USD, the API key's own
+reservation and daily limits (if any), and how many calls it made today. That
+comes from `GET /api/ai/account`, which accepts both a `ddsk_` API key and an
+OAuth access token carrying the `media` scope. OAuth has no key envelope or
+key-level daily limits; it spends the same shared wallet.
 
 A D.AI key has no plan window — it spends the account's shared wallet — so the
 card reads as a balance, not a quota window. Two keys of one account show the
 same balance but their own reservations and call counts.
 
+Magpie renews OAuth access tokens before they expire through `auth.refresh`;
+the rotated refresh token is written back to the same auth store. OAuth requests
+send only `Authorization: Bearer <token>` and never `x-api-key`.
+
 ## Notes
 
 - Chat models use the provider API. Image, video and audio models are separate
@@ -99,6 +118,7 @@ same balance but their own reservations and call counts.
   counts instead of a balance.
 - The plugin never rewrites request bodies. Thinking levels are offered as
   model variants, and the gateway passes `reasoning_effort` through.
-- Requests go out with `Authorization: Bearer <key>` plus `x-api-key`, and carry
-  `x-dai-client: magpie/0.1.2`. Gateway requests also carry the stable Magpie
+- API-key requests go out with `Authorization: Bearer <key>` plus `x-api-key`;
+  OAuth requests send only the bearer token. Both carry
+  `x-dai-client: magpie/0.1.4`. Gateway requests also carry the stable Magpie
   session as `x-dai-session`.

package/index.mjs

@@ -1,17 +1,17 @@
 // D.AI (dai.itbug.shop) as a magpie / OpenCode provider plugin.
 //
-// One D.AI API key (`ddsk_…`) signs an account in; magpie may hold several
-// under the same provider. Models come from D.AI's public capability catalog
+// A D.AI OAuth sign-in or API key (`ddsk_…`) signs an account in; magpie may
+// hold several under the same provider. Models come from D.AI's public capability catalog
 // (`GET /api/system/public/capability-docs`), narrowed to what the key may
 // actually call (`GET /v1/models`). Chat models run on D.AI's
 // OpenAI-compatible `/v1/chat/completions`, Claude models on `/v1/messages`.
 // `auth.usage` reads the account behind the key (`GET /api/ai/account`): the
 // wallet balance, the tier, and how much this key alone may spend.
 //
-// `auth.usage` reads `GET /api/ai/account`, a `ddsk_`-authenticated endpoint
-// added for exactly this: the wallet balance, the tier, and what the key has
-// used. The older JWT-only endpoints (`/api/usd/me`, `/api/user/usage-stats`)
-// cannot serve a plugin, and the key's call log only counts calls, not money.
+// `auth.usage` reads `GET /api/ai/account`, which accepts both a `ddsk_` key
+// and an OAuth access token with the `media` scope. The older JWT-only
+// endpoints (`/api/usd/me`, `/api/user/usage-stats`) cannot serve a plugin,
+// and the key's call log only counts calls, not money.
 //
 // Facts the tables below encode (checked 2026-10-22):
 //   - The capability codes carrying token-metered chat are
@@ -26,14 +26,21 @@
 //     until someone checks it. D.AI's own catalog is not consulted for either:
 //     it carries no per-model reasoning or modality metadata.
 //
+// OAuth uses the system browser with PKCE S256 and a loopback callback owned by
+// this plugin. The refresh token stays in magpie's auth store; access tokens
+// and their expiry are renewed by magpie before every request.
+//
 // The same module also gives a read-only media catalog tool. Magpie tools run
 // from a separate MCP server and do not receive the provider account's key, so
 // paid generation and account-scoped job tools are intentionally absent.
 //
 // Sections: constants · helpers · chat catalog · media catalog · plugin.
 
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
 const PROVIDER = "dai";
-const CLIENT = "magpie/0.1.2";
+const CLIENT = "magpie/0.1.4";
 const DEFAULT_BASE = "https://dai.itbug.shop";
 const OPENAI_NPM = "@ai-sdk/openai-compatible";
 const ANTHROPIC_NPM = "@ai-sdk/anthropic";
@@ -41,6 +48,27 @@ const CATALOG_TTL_MS = 5 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 20_000;
 const MEDIA_CATALOG_LIMIT = 20;
 const MEDIA_KINDS = new Set(["image", "video", "audio"]);
+const OAUTH_CLIENT_ID = "ddc_i4mhCndrFLK3LAYBaK8d";
+const OAUTH_SCOPES = "openid profile email offline_access media";
+const OAUTH_CALLBACK_PATH = "/callback";
+const OAUTH_SIGN_IN_TIMEOUT_MS = 5 * 60 * 1000;
+
+/** Display names for the public tiers; unknown codes stay unchanged. */
+const TIER_NAMES = {
+	starter: "入门版",
+	basic: "基础版",
+	pro: "专业版",
+	max: "旗舰版",
+	trial: "试用用户",
+};
+
+/** Billing cycles as the usage card says them. */
+const BILLING_CYCLES = {
+	monthly: "月付",
+	quarterly: "季付",
+	semiannual: "半年付",
+	annual: "年付",
+};
 
 /** Capability codes whose models are token-metered chat models. */
 const CHAT_CAPABILITIES = new Set(["openai_chat_completions", "claude_messages"]);
@@ -135,9 +163,39 @@ const isClaudeModel = (id) => id.startsWith("claude-");
 /** `ddsk_01ABC_secret` → what a card may show, never the secret itself. */
 function keyLabel(key) {
 	const id = textOf(key).replace(/^ddsk_/u, "").split("_")[0];
-	return id ? `key ${id}` : "API key";
+	return id ? `密钥 ${id}` : "API 密钥";
 }
 
+const isOAuthAuth = (auth) => auth?.type === "oauth";
+
+/** The credential a signed-in account uses for D.AI requests. */
+const credentialOf = (auth) =>
+	isOAuthAuth(auth) ? textOf(auth.access) : textOf(auth?.key);
+
+/** A label for a card when the account has no usable key prefix. */
+function authLabel(auth) {
+	if (!isOAuthAuth(auth)) return keyLabel(auth?.key);
+	return textOf(auth.accountId) || "OAuth 登录";
+}
+
+const tierLabel = (code) => TIER_NAMES[textOf(code)] ?? textOf(code);
+const cycleLabel = (cycle) => BILLING_CYCLES[textOf(cycle)] ?? textOf(cycle);
+const statusLabel = (status) => {
+	const value = textOf(status);
+	return (
+		{
+			success: "成功",
+			completed: "已完成",
+			failed: "失败",
+			processing: "处理中",
+			pending: "等待中",
+			cancelled: "已取消",
+			canceled: "已取消",
+			refunded: "已退款",
+		}[value] ?? value
+	);
+};
+
 function variantsOf(id) {
 	const levels =
 		VARIANTS[id] ??
@@ -226,7 +284,10 @@ function fallbackCatalog(base) {
 
 // ---- chat catalog --------------------------------------------------------------
 
-async function fetchJson(url, { apiKey, signal, headers: extraHeaders } = {}) {
+async function fetchJson(
+	url,
+	{ apiKey, oauth = false, signal, headers: extraHeaders } = {},
+) {
 	const controller = new AbortController();
 	const onAbort = () => controller.abort();
 	const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
@@ -235,7 +296,7 @@ async function fetchJson(url, { apiKey, signal, headers: extraHeaders } = {}) {
 	headers.set("x-dai-client", CLIENT);
 	if (apiKey) {
 		headers.set("Authorization", `Bearer ${apiKey}`);
-		headers.set("x-api-key", apiKey);
+		if (!oauth) headers.set("x-api-key", apiKey);
 	}
 	try {
 		const res = await fetch(url, { headers, signal: controller.signal });
@@ -249,6 +310,259 @@ async function fetchJson(url, { apiKey, signal, headers: extraHeaders } = {}) {
 	}
 }
 
+// ---- OAuth ---------------------------------------------------------------------
+
+function pkcePair() {
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	return { verifier, challenge };
+}
+
+function oauthForm(values) {
+	const body = new URLSearchParams();
+	for (const [key, value] of Object.entries(values)) {
+		if (value !== undefined && value !== null && String(value) !== "") {
+			body.set(key, String(value));
+		}
+	}
+	return body;
+}
+
+async function tokenRequest(base, values, signal) {
+	const res = await fetch(`${base}/api/oauth/token`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json",
+			"x-dai-client": CLIENT,
+		},
+		body: oauthForm(values),
+		signal: signal
+			? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+			: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+	});
+	const payload = await res.json().catch(() => null);
+	if (!res.ok) {
+		return {
+			status: res.status,
+			error: textOf(payload?.error),
+			description: textOf(payload?.error_description),
+		};
+	}
+	return payload ?? {};
+}
+
+/**
+ * A loopback callback for one OAuth sign-in. Binding to port 0 keeps the
+ * callback flexible without reserving a fixed port on the user's Mac.
+ */
+function callbackServer() {
+	return new Promise((resolve, reject) => {
+		const server = createServer();
+		const sockets = new Set();
+		const waiters = new Set();
+		let accepted = false;
+		let settled = false;
+		let closed = false;
+		const settle = (query) => {
+			if (settled) return false;
+			settled = true;
+			for (const waiter of waiters) waiter(query);
+			waiters.clear();
+			return true;
+		};
+		const close = () => {
+			if (closed) return;
+			closed = true;
+			server.close(() => {
+				for (const socket of sockets) socket.destroy();
+			});
+		};
+		server.on("connection", (socket) => {
+			sockets.add(socket);
+			socket.on("close", () => sockets.delete(socket));
+		});
+		server.on("error", reject);
+		server.on("request", (req, res) => {
+			const url = new URL(req.url ?? "/", "http://127.0.0.1");
+			if (url.pathname !== OAUTH_CALLBACK_PATH) {
+				res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+				res.end("not found");
+				return;
+			}
+			if (accepted) {
+				res.writeHead(409, { "content-type": "text/plain; charset=utf-8" });
+				res.end("callback already received");
+				return;
+			}
+			accepted = true;
+			res.writeHead(200, {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": "no-store",
+			});
+			res.end(
+				'<!doctype html><meta charset="utf-8"><title>D.AI 回调</title><p>回调已收到，请返回 Magpie 查看结果。</p>',
+				() => {
+					settle(url.searchParams);
+					close();
+				},
+			);
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			if (!address || typeof address === "string") {
+				server.close();
+				reject(new Error("无法创建 D.AI 本地回调"));
+				return;
+			}
+			const redirectUri = `http://127.0.0.1:${address.port}${OAUTH_CALLBACK_PATH}`;
+			resolve({
+				redirectUri,
+				wait({ signal, timeoutMs = OAUTH_SIGN_IN_TIMEOUT_MS } = {}) {
+					return new Promise((done, fail) => {
+						if (signal?.aborted) {
+							close();
+							fail(new Error("D.AI 登录已取消"));
+							return;
+						}
+						let finished = false;
+						let timer;
+						const cleanup = () => {
+							if (timer) clearTimeout(timer);
+							waiters.delete(waiter);
+							signal?.removeEventListener("abort", onAbort);
+						};
+						const finish = (ok, value) => {
+							if (finished) return;
+							finished = true;
+							cleanup();
+							if (ok) done(value);
+							else fail(value);
+						};
+						const onAbort = () => {
+							close();
+							finish(false, new Error("D.AI 登录已取消"));
+						};
+						const waiter = (query) => {
+							finish(true, { query });
+						};
+						waiters.add(waiter);
+						timer = setTimeout(() => {
+							close();
+							finish(false, new Error("D.AI 登录超时，请重新登录"));
+						}, timeoutMs);
+						signal?.addEventListener("abort", onAbort, { once: true });
+					});
+				},
+				close,
+			});
+		});
+	});
+}
+
+/** Browser sign-in: authorization code + PKCE, callback owned by the plugin. */
+async function browserSignIn(base, clientId = OAUTH_CLIENT_ID) {
+	const { verifier, challenge } = pkcePair();
+	const state = randomBytes(16).toString("base64url");
+	const nonce = randomBytes(16).toString("base64url");
+	const callback = await callbackServer();
+	const authorize = new URL(`${base}/api/oauth/authorize`);
+	authorize.searchParams.set("client_id", clientId);
+	authorize.searchParams.set("redirect_uri", callback.redirectUri);
+	authorize.searchParams.set("response_type", "code");
+	authorize.searchParams.set("scope", OAUTH_SCOPES);
+	authorize.searchParams.set("state", state);
+	authorize.searchParams.set("nonce", nonce);
+	authorize.searchParams.set("code_challenge", challenge);
+	authorize.searchParams.set("code_challenge_method", "S256");
+	return {
+		url: authorize.toString(),
+		instructions: "在浏览器中登录 D.AI 并同意授权；完成后会自动回到 Magpie。",
+		method: "auto",
+		async callback({ signal, timeoutMs = OAUTH_SIGN_IN_TIMEOUT_MS } = {}) {
+			try {
+				const { query } = await callback.wait({ signal, timeoutMs });
+				if (textOf(query.get("state")) !== state) {
+					return { type: "failed", error: "D.AI 登录状态校验失败" };
+				}
+				const error = textOf(query.get("error"));
+				if (error) {
+					return {
+						type: "failed",
+						error: textOf(query.get("error_description")) || `D.AI 登录失败：${error}`,
+					};
+				}
+				const code = textOf(query.get("code"));
+				if (!code) return { type: "failed", error: "D.AI 没有返回授权码" };
+				const token = await tokenRequest(
+					base,
+					{
+						grant_type: "authorization_code",
+						client_id: clientId,
+						code,
+						redirect_uri: callback.redirectUri,
+						code_verifier: verifier,
+					},
+					signal,
+				);
+				if (!token.access_token) {
+					return {
+						type: "failed",
+						error:
+							token.description ||
+							token.error ||
+							`D.AI 换取令牌失败（HTTP ${token.status ?? "?"}）`,
+					};
+				}
+				const who = await fetchJson(`${base}/api/oauth/userinfo`, {
+					apiKey: token.access_token,
+					oauth: true,
+				}).catch(() => null);
+				const accountId =
+					textOf(who?.email) || textOf(who?.preferred_username) || textOf(who?.sub);
+				return {
+					type: "success",
+					access: token.access_token,
+					refresh: token.refresh_token ?? "",
+					expires: Date.now() + numberOr(token.expires_in, 3600) * 1000,
+					...(accountId ? { accountId } : {}),
+					...(textOf(who?.sub) ? { uid: textOf(who.sub) } : {}),
+				};
+			} catch (error) {
+				return { type: "failed", error: String(error?.message ?? error) };
+			} finally {
+				callback.close();
+			}
+		},
+	};
+}
+
+async function refreshOAuth(base, auth, clientId = OAUTH_CLIENT_ID) {
+	if (!isOAuthAuth(auth)) return;
+	const refresh = textOf(auth?.refresh);
+	if (!refresh) throw Object.assign(new Error("D.AI 登录已失效"), { signIn: "expired" });
+	const token = await tokenRequest(base, {
+		grant_type: "refresh_token",
+		client_id: clientId,
+		refresh_token: refresh,
+	});
+	if (!token.access_token) {
+		const expired =
+			token.status === 400 ||
+			token.error === "invalid_grant" ||
+			token.error === "invalid_refresh_token";
+		throw Object.assign(
+			new Error(token.description || token.error || "D.AI 刷新登录失败"),
+			expired ? { signIn: "expired" } : {},
+		);
+	}
+	return {
+		access: token.access_token,
+		refresh: token.refresh_token ?? refresh,
+		expires: Date.now() + numberOr(token.expires_in, 3600) * 1000,
+	};
+}
+
 /**
  * Every chat model D.AI publishes, keyed by model id. With a key the catalog is
  * narrowed to the models that key may call; a `/v1/models` failure leaves the
@@ -259,7 +573,11 @@ async function fetchCatalog(base, { key, signal } = {}) {
 	const models = chatModelsFromDocs(docs, base);
 	if (!key || !Object.keys(models).length) return models;
 	try {
-		const listed = await fetchJson(`${apiBase(base)}/models`, { apiKey: key, signal });
+		const listed = await fetchJson(`${apiBase(base)}/models`, {
+			apiKey: key,
+			oauth: key.startsWith("ddoa_"),
+			signal,
+		});
 		const allowed = new Set(
 			(listed?.data ?? []).map((model) => textOf(model?.id)).filter(Boolean),
 		);
@@ -269,7 +587,7 @@ async function fetchCatalog(base, { key, signal } = {}) {
 		// A refused key must reach Magpie as a sign-in failure. A network or
 		// server failure keeps the last good catalog instead.
 		if (error?.status === 401 || error?.status === 403) {
-			throw Object.assign(new Error("D.AI refused the API key; sign in again"), {
+			throw Object.assign(new Error("D.AI 登录已失效，请重新登录"), {
 				status: error.status,
 				signIn: "expired",
 			});
@@ -308,44 +626,44 @@ function balanceCard(account, key) {
 	const total = optionalNumber(balance.total);
 	const pending = optionalNumber(balance.pending_reserved);
 	const calls = optionalNumber(account?.tokens?.today?.calls);
-	const parts = [`$${usd(total ?? 0)} left`];
-	if (pending && pending > 0) parts.push(`$${usd(pending)} pending`);
+	const parts = [`余额 $${usd(total ?? 0)}`];
+	if (pending && pending > 0) parts.push(`待结算 $${usd(pending)}`);
 	if (textOf(tier.code)) {
 		parts.push(
 			[
-				textOf(tier.code),
-				textOf(tier.billing_cycle),
+				tierLabel(tier.code),
+				cycleLabel(tier.billing_cycle),
 				optionalNumber(tier.expires_in_days) === undefined
 					? undefined
-					: `${tier.expires_in_days}d left`,
+					: `剩余 ${tier.expires_in_days} 天`,
 			]
 				.filter(Boolean)
 				.join(" · "),
 		);
 	}
 	const included = optionalNumber(tier.included_usd_total);
-	if (included && included > 0) parts.push(`$${usd(included)} included`);
+	if (included && included > 0) parts.push(`套餐额度 $${usd(included)}`);
 	// Only a key with a budget envelope has a reservation; the shared pool has none.
 	if (self.envelope_active) {
 		const reserved =
 			(optionalNumber(self.reserved_package_usd) ?? 0) +
 			(optionalNumber(self.reserved_recharge_usd) ?? 0);
-		if (reserved > 0) parts.push(`this key $${usd(reserved)}`);
+		if (reserved > 0) parts.push(`本密钥 $${usd(reserved)}`);
 	}
 	const requestLimit = optionalNumber(self.daily_request_limit);
 	const usdLimit = optionalNumber(self.daily_usd_limit);
 	const limits = [
-		requestLimit === undefined ? undefined : `${requestLimit} requests/day`,
-		usdLimit === undefined ? undefined : `$${usd(usdLimit)}/day`,
+		requestLimit === undefined ? undefined : `${requestLimit} 次/天`,
+		usdLimit === undefined ? undefined : `$${usd(usdLimit)}/天`,
 	].filter(Boolean);
-	if (limits.length) parts.push(`limits ${limits.join(", ")}`);
+	if (limits.length) parts.push(`限额 ${limits.join("，")}`);
 	if (calls !== undefined) {
-		parts.push(`${calls} call${calls === 1 ? "" : "s"} today`);
+		parts.push(`今日 ${calls} 次调用`);
 	}
 	return {
-		plan: textOf(tier.code) || keyLabel(key),
+		plan: tierLabel(tier.code) || key || "D.AI 账号",
 		balance: total === undefined ? "" : `$${usd(total)}`,
-		windows: [{ name: "D.AI balance", display: parts.join(" · ") }],
+		windows: [{ name: "D.AI 余额", display: parts.join(" · ") }],
 	};
 }
 
@@ -359,14 +677,14 @@ async function callLogCard(base, key) {
 	});
 	const total = numberOr(log?.total, 0);
 	const last = Array.isArray(log?.data) ? log.data[0] : undefined;
-	const parts = [`${total} call${total === 1 ? "" : "s"}`];
+	const parts = [`${total} 次调用`];
 	if (last) {
 		const settled = optionalNumber(last.settled_usd);
 		parts.push(
 			[
 				textOf(last.created_at).replace("T", " ").slice(0, 16),
 				textOf(last.model_code),
-				textOf(last.status),
+				statusLabel(last.status),
 				settled === undefined ? undefined : `$${usd(settled)}`,
 			]
 				.filter(Boolean)
@@ -375,7 +693,7 @@ async function callLogCard(base, key) {
 	}
 	return {
 		plan: keyLabel(key),
-		windows: [{ name: "D.AI calls", display: parts.join(" · ") }],
+		windows: [{ name: "D.AI 调用", display: parts.join(" · ") }],
 	};
 }
 
@@ -531,6 +849,7 @@ async function mediaCatalog(base, input, signal) {
 
 const DaiPlugin = async (_input, options = {}) => {
 	const base = normalizeBase(options?.baseUrl ?? process.env.DAI_BASE_URL) ?? DEFAULT_BASE;
+	const oauthClientId = textOf(options?.oauthClientId) || OAUTH_CLIENT_ID;
 	const offline = fallbackCatalog(base);
 
 	// One catalog read per account, reused until it goes stale. Keyed by the
@@ -564,43 +883,70 @@ const DaiPlugin = async (_input, options = {}) => {
 		auth: {
 			provider: PROVIDER,
 
-			methods: [{ type: "api", label: "D.AI API key", placeholder: "ddsk_…" }],
+			refreshLead: 5 * 60 * 1000,
+
+			async refresh(auth) {
+				return refreshOAuth(base, auth, oauthClientId);
+			},
+
+			methods: [
+				{
+					type: "oauth",
+					label: "使用 D.AI 账号登录",
+					authorize: () => browserSignIn(base, oauthClientId),
+				},
+				{ type: "api", label: "D.AI API 密钥", placeholder: "ddsk_…" },
+			],
 
 			async loader(getAuth) {
 				const auth = await getAuth();
-				const key = textOf(auth?.key);
-				if (auth?.type !== "api" || !key) return {};
+				const credential = credentialOf(auth);
+				if (!credential) return {};
+				if (isOAuthAuth(auth)) {
+					return {
+						baseURL: apiBase(base),
+						apiKey: credential,
+						headers: { "x-dai-client": CLIENT },
+						fetch(input, init) {
+							const headers = new Headers(init?.headers);
+							headers.delete("x-api-key");
+							headers.set("authorization", `Bearer ${credential}`);
+							return fetch(input, { ...init, headers });
+						},
+					};
+				}
 				return {
 					baseURL: apiBase(base),
-					apiKey: key,
+					apiKey: credential,
 					headers: { "x-dai-client": CLIENT },
 				};
 			},
 
-			// The account behind the key: wallet balance, tier and token totals,
-			// from D.AI's own endpoint (`GET /api/ai/account`). A `ddsk_` key may
-			// call it, which is the point: the plugin can show what a D.AI key
-			// cannot otherwise read. The card says the balance as the wallet's
-			// total, then how much of it this key may spend and what it has used.
+			// The account behind either sign-in: wallet balance, tier and token
+			// totals from `GET /api/ai/account`. The card says the balance as the
+			// wallet's total, then what this key may spend and what it has used.
 			async usage(getAuth) {
 				const auth = await getAuth();
-				const key = textOf(auth?.key);
-				if (auth?.type !== "api" || !key) {
-					return { windows: [], error: "D.AI: sign in with an API key" };
+				const credential = credentialOf(auth);
+				if (!credential) {
+					return { windows: [], error: "D.AI：请先登录" };
 				}
 				try {
-					const account = await fetchJson(`${base}/api/ai/account`, { apiKey: key });
-					return balanceCard(account, key);
+					const account = await fetchJson(`${base}/api/ai/account`, {
+						apiKey: credential,
+						oauth: isOAuthAuth(auth),
+					});
+					return balanceCard(account, authLabel(auth));
 				} catch (error) {
 					const status = error?.status;
 					if (status === 401 || status === 403) {
-						return { windows: [], error: "D.AI refused the API key", signIn: "expired" };
+						return { windows: [], error: "D.AI 登录已失效", signIn: "expired" };
 					}
 					// A deployment older than the endpoint answers 404. Its call log
 					// is still there, and counting calls beats showing an error.
-					if (status === 404) {
+					if (status === 404 && !isOAuthAuth(auth)) {
 						try {
-							return await callLogCard(base, key);
+							return await callLogCard(base, credential);
 						} catch (fallbackError) {
 							return { windows: [], error: String(fallbackError?.message ?? fallbackError) };
 						}
@@ -616,10 +962,10 @@ const DaiPlugin = async (_input, options = {}) => {
 			// The account's own list when D.AI answers, else the catalog the
 			// config hook declared, so a failed fetch never empties the provider.
 			async models(provider, { auth } = {}) {
-				const key = textOf(auth?.key);
-				if (!key) return provider.models;
+				const credential = credentialOf(auth);
+				if (!credential) return provider.models;
 				try {
-					const models = await catalogFor(key, undefined);
+					const models = await catalogFor(credential, undefined);
 					return models ?? provider.models;
 				} catch (error) {
 					if (error?.signIn === "expired") throw error;
@@ -686,8 +1032,10 @@ export default { id: PROVIDER, server: DaiPlugin };
 
 /** For tests and manual probing: the pure pieces, never called as a plugin. */
 export const _internal = {
+	authLabel,
 	balanceCard,
 	buildModel,
+	browserSignIn,
 	fallbackCatalog,
 	fetchCatalog,
 	fetchGatewayModels,
@@ -698,4 +1046,7 @@ export const _internal = {
 	mediaModel,
 	mediaRows,
 	normalizeBase,
+	pkcePair,
+	refreshOAuth,
+	tokenRequest,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@d-ai/magpie",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "D.AI (dai.itbug.shop) chat models in magpie and OpenCode, plus a read-only image/video/audio model catalog",
   "type": "module",
   "main": "./index.mjs",