@d-ai/magpie 0.1.3 → 0.1.5

package/README.md

@@ -13,16 +13,23 @@ One `ddsk_…` API key is one account, and magpie keeps several.
 magpie plugin add mdddj/d-ai-magpie       # from GitHub
 magpie plugin add @d-ai/magpie            # from npm, once published
 magpie plugin add ./sdks/d-ai-magpie      # from a folder, for development
-magpie plugin login dai                   # asks for the API key
+magpie plugin login dai oauth             # sign in with a browser
+magpie plugin login dai                   # or choose the API key method
 magpie provider test dai                  # one tiny call per API
 ```
 
 Then pick a model anywhere magpie does: `dai/claude-opus-5-5`,
 `dai/gpt-6-astra`, `dai/deepseek-v4.1-flash`, …
 
-The key comes from the D.AI console (`/#/apikeys`). Custom deployments can point
-at another host with `magpie plugin options dai '{"baseUrl":"https://dai.example"}'`
-or `DAI_BASE_URL`.
+The browser sign-in uses OAuth 2.1 authorization code with PKCE S256 and a
+loopback callback on a random `127.0.0.1` port, so no fixed port is reserved and
+the refresh token stays in magpie's auth store. It uses the first-party public
+client `ddc_i4mhCndrFLK3LAYBaK8d` by default. The API key remains available as
+the fallback; keys come from the D.AI console (`/#/apikeys`). Custom deployments
+can point at another host with
+`magpie plugin options @d-ai/magpie@latest '{"baseUrl":"https://dai.example"}'`
+or `DAI_BASE_URL`. `plugin options` takes the installed plugin spec, not the
+provider id (`dai`).
 
 ## Chat models
 
@@ -76,17 +83,29 @@ Paid generation and account-scoped job tools are intentionally not included.
 Magpie's tool process does not receive the signed-in `dai` provider's API key,
 so adding generation here would require a separate tool-auth design.
 
+For a deployment with its own OAuth registration, add an `oauthClientId` option
+next to `baseUrl`; the default remains the first-party
+`ddc_i4mhCndrFLK3LAYBaK8d`. A custom client must register a loopback callback
+for `http://127.0.0.1:<random port>/callback`, which the deployment's
+authorization server accepts under RFC 8252.
+
 ## Usage
 
-`magpie quota` shows the account behind the key: the wallet balance and pending
-reservation, the tier and its cycle, included USD, the key's own reservation and
-daily limits, and how many calls it made today. That comes from
-`GET /api/ai/account`, an endpoint authenticated by the `ddsk_` key itself.
+`magpie quota` shows the account behind either sign-in: the wallet balance and
+pending reservation, the tier and its cycle, included USD, the API key's own
+reservation and daily limits (if any), and how many calls it made today. That
+comes from `GET /api/ai/account`, which accepts both a `ddsk_` API key and an
+OAuth access token carrying the `media` scope. OAuth has no key envelope or
+key-level daily limits; it spends the same shared wallet.
 
 A D.AI key has no plan window — it spends the account's shared wallet — so the
 card reads as a balance, not a quota window. Two keys of one account show the
 same balance but their own reservations and call counts.
 
+Magpie renews OAuth access tokens before they expire through `auth.refresh`;
+the rotated refresh token is written back to the same auth store. OAuth requests
+send only `Authorization: Bearer <token>` and never `x-api-key`.
+
 ## Notes
 
 - Chat models use the provider API. Image, video and audio models are separate
@@ -99,6 +118,7 @@ same balance but their own reservations and call counts.
   counts instead of a balance.
 - The plugin never rewrites request bodies. Thinking levels are offered as
   model variants, and the gateway passes `reasoning_effort` through.
-- Requests go out with `Authorization: Bearer <key>` plus `x-api-key`, and carry
-  `x-dai-client: magpie/0.1.3`. Gateway requests also carry the stable Magpie
+- API-key requests go out with `Authorization: Bearer <key>` plus `x-api-key`;
+  OAuth requests send only the bearer token. Both carry
+  `x-dai-client: magpie/0.1.5`. Gateway requests also carry the stable Magpie
   session as `x-dai-session`.

package/index.mjs

@@ -1,17 +1,17 @@
 // D.AI (dai.itbug.shop) as a magpie / OpenCode provider plugin.
 //
-// One D.AI API key (`ddsk_…`) signs an account in; magpie may hold several
-// under the same provider. Models come from D.AI's public capability catalog
+// A D.AI OAuth sign-in or API key (`ddsk_…`) signs an account in; magpie may
+// hold several under the same provider. Models come from D.AI's public capability catalog
 // (`GET /api/system/public/capability-docs`), narrowed to what the key may
 // actually call (`GET /v1/models`). Chat models run on D.AI's
 // OpenAI-compatible `/v1/chat/completions`, Claude models on `/v1/messages`.
 // `auth.usage` reads the account behind the key (`GET /api/ai/account`): the
 // wallet balance, the tier, and how much this key alone may spend.
 //
-// `auth.usage` reads `GET /api/ai/account`, a `ddsk_`-authenticated endpoint
-// added for exactly this: the wallet balance, the tier, and what the key has
-// used. The older JWT-only endpoints (`/api/usd/me`, `/api/user/usage-stats`)
-// cannot serve a plugin, and the key's call log only counts calls, not money.
+// `auth.usage` reads `GET /api/ai/account`, which accepts both a `ddsk_` key
+// and an OAuth access token with the `media` scope. The older JWT-only
+// endpoints (`/api/usd/me`, `/api/user/usage-stats`) cannot serve a plugin,
+// and the key's call log only counts calls, not money.
 //
 // Facts the tables below encode (checked 2026-10-22):
 //   - The capability codes carrying token-metered chat are
@@ -26,14 +26,21 @@
 //     until someone checks it. D.AI's own catalog is not consulted for either:
 //     it carries no per-model reasoning or modality metadata.
 //
+// OAuth uses the system browser with PKCE S256 and a loopback callback owned by
+// this plugin. The refresh token stays in magpie's auth store; access tokens
+// and their expiry are renewed by magpie before every request.
+//
 // The same module also gives a read-only media catalog tool. Magpie tools run
 // from a separate MCP server and do not receive the provider account's key, so
 // paid generation and account-scoped job tools are intentionally absent.
 //
 // Sections: constants · helpers · chat catalog · media catalog · plugin.
 
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
 const PROVIDER = "dai";
-const CLIENT = "magpie/0.1.3";
+const CLIENT = "magpie/0.1.5";
 const DEFAULT_BASE = "https://dai.itbug.shop";
 const OPENAI_NPM = "@ai-sdk/openai-compatible";
 const ANTHROPIC_NPM = "@ai-sdk/anthropic";
@@ -41,6 +48,10 @@ const CATALOG_TTL_MS = 5 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 20_000;
 const MEDIA_CATALOG_LIMIT = 20;
 const MEDIA_KINDS = new Set(["image", "video", "audio"]);
+const OAUTH_CLIENT_ID = "ddc_i4mhCndrFLK3LAYBaK8d";
+const OAUTH_SCOPES = "openid profile email offline_access media";
+const OAUTH_CALLBACK_PATH = "/callback";
+const OAUTH_SIGN_IN_TIMEOUT_MS = 5 * 60 * 1000;
 
 /** Display names for the public tiers; unknown codes stay unchanged. */
 const TIER_NAMES = {
@@ -48,7 +59,7 @@ const TIER_NAMES = {
 	basic: "基础版",
 	pro: "专业版",
 	max: "旗舰版",
-	trial: "体验版",
+	trial: "试用用户",
 };
 
 /** Billing cycles as the usage card says them. */
@@ -155,6 +166,18 @@ function keyLabel(key) {
 	return id ? `密钥 ${id}` : "API 密钥";
 }
 
+const isOAuthAuth = (auth) => auth?.type === "oauth";
+
+/** The credential a signed-in account uses for D.AI requests. */
+const credentialOf = (auth) =>
+	isOAuthAuth(auth) ? textOf(auth.access) : textOf(auth?.key);
+
+/** A label for a card when the account has no usable key prefix. */
+function authLabel(auth) {
+	if (!isOAuthAuth(auth)) return keyLabel(auth?.key);
+	return textOf(auth.accountId) || "OAuth 登录";
+}
+
 const tierLabel = (code) => TIER_NAMES[textOf(code)] ?? textOf(code);
 const cycleLabel = (cycle) => BILLING_CYCLES[textOf(cycle)] ?? textOf(cycle);
 const statusLabel = (status) => {
@@ -205,9 +228,18 @@ function buildModel(id, base, rate = {}) {
 		output: numberOr(rate.output_usd_per_1m_tokens, 0),
 	};
 	const cacheRead = cacheRate(id, rate);
-	if (cacheRead !== undefined) cost.cache_read = cacheRead;
 	const cacheWrite = positiveNumber(rules.cache_write_usd_per_1m_tokens);
+	if (cacheRead !== undefined) cost.cache_read = cacheRead;
 	if (cacheWrite !== undefined) cost.cache_write = cacheWrite;
+	// OpenCode reads the flat `cache_read` / `cache_write` above; magpie's
+	// plugin reader looks under `cache.read` / `cache.write`, so it saw every
+	// subscription model as having free cache (a real D.AI model showed
+	// 0.002 / 0.02 here and 0 / 0 in the price panel). Send both shapes.
+	if (cacheRead !== undefined || cacheWrite !== undefined) {
+		cost.cache = {};
+		if (cacheRead !== undefined) cost.cache.read = cacheRead;
+		if (cacheWrite !== undefined) cost.cache.write = cacheWrite;
+	}
 	return {
 		id,
 		name: id,
@@ -261,7 +293,10 @@ function fallbackCatalog(base) {
 
 // ---- chat catalog --------------------------------------------------------------
 
-async function fetchJson(url, { apiKey, signal, headers: extraHeaders } = {}) {
+async function fetchJson(
+	url,
+	{ apiKey, oauth = false, signal, headers: extraHeaders } = {},
+) {
 	const controller = new AbortController();
 	const onAbort = () => controller.abort();
 	const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
@@ -270,7 +305,7 @@ async function fetchJson(url, { apiKey, signal, headers: extraHeaders } = {}) {
 	headers.set("x-dai-client", CLIENT);
 	if (apiKey) {
 		headers.set("Authorization", `Bearer ${apiKey}`);
-		headers.set("x-api-key", apiKey);
+		if (!oauth) headers.set("x-api-key", apiKey);
 	}
 	try {
 		const res = await fetch(url, { headers, signal: controller.signal });
@@ -284,6 +319,259 @@ async function fetchJson(url, { apiKey, signal, headers: extraHeaders } = {}) {
 	}
 }
 
+// ---- OAuth ---------------------------------------------------------------------
+
+function pkcePair() {
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	return { verifier, challenge };
+}
+
+function oauthForm(values) {
+	const body = new URLSearchParams();
+	for (const [key, value] of Object.entries(values)) {
+		if (value !== undefined && value !== null && String(value) !== "") {
+			body.set(key, String(value));
+		}
+	}
+	return body;
+}
+
+async function tokenRequest(base, values, signal) {
+	const res = await fetch(`${base}/api/oauth/token`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json",
+			"x-dai-client": CLIENT,
+		},
+		body: oauthForm(values),
+		signal: signal
+			? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+			: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+	});
+	const payload = await res.json().catch(() => null);
+	if (!res.ok) {
+		return {
+			status: res.status,
+			error: textOf(payload?.error),
+			description: textOf(payload?.error_description),
+		};
+	}
+	return payload ?? {};
+}
+
+/**
+ * A loopback callback for one OAuth sign-in. Binding to port 0 keeps the
+ * callback flexible without reserving a fixed port on the user's Mac.
+ */
+function callbackServer() {
+	return new Promise((resolve, reject) => {
+		const server = createServer();
+		const sockets = new Set();
+		const waiters = new Set();
+		let accepted = false;
+		let settled = false;
+		let closed = false;
+		const settle = (query) => {
+			if (settled) return false;
+			settled = true;
+			for (const waiter of waiters) waiter(query);
+			waiters.clear();
+			return true;
+		};
+		const close = () => {
+			if (closed) return;
+			closed = true;
+			server.close(() => {
+				for (const socket of sockets) socket.destroy();
+			});
+		};
+		server.on("connection", (socket) => {
+			sockets.add(socket);
+			socket.on("close", () => sockets.delete(socket));
+		});
+		server.on("error", reject);
+		server.on("request", (req, res) => {
+			const url = new URL(req.url ?? "/", "http://127.0.0.1");
+			if (url.pathname !== OAUTH_CALLBACK_PATH) {
+				res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+				res.end("not found");
+				return;
+			}
+			if (accepted) {
+				res.writeHead(409, { "content-type": "text/plain; charset=utf-8" });
+				res.end("callback already received");
+				return;
+			}
+			accepted = true;
+			res.writeHead(200, {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": "no-store",
+			});
+			res.end(
+				'<!doctype html><meta charset="utf-8"><title>D.AI 回调</title><p>回调已收到，请返回 Magpie 查看结果。</p>',
+				() => {
+					settle(url.searchParams);
+					close();
+				},
+			);
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const address = server.address();
+			if (!address || typeof address === "string") {
+				server.close();
+				reject(new Error("无法创建 D.AI 本地回调"));
+				return;
+			}
+			const redirectUri = `http://127.0.0.1:${address.port}${OAUTH_CALLBACK_PATH}`;
+			resolve({
+				redirectUri,
+				wait({ signal, timeoutMs = OAUTH_SIGN_IN_TIMEOUT_MS } = {}) {
+					return new Promise((done, fail) => {
+						if (signal?.aborted) {
+							close();
+							fail(new Error("D.AI 登录已取消"));
+							return;
+						}
+						let finished = false;
+						let timer;
+						const cleanup = () => {
+							if (timer) clearTimeout(timer);
+							waiters.delete(waiter);
+							signal?.removeEventListener("abort", onAbort);
+						};
+						const finish = (ok, value) => {
+							if (finished) return;
+							finished = true;
+							cleanup();
+							if (ok) done(value);
+							else fail(value);
+						};
+						const onAbort = () => {
+							close();
+							finish(false, new Error("D.AI 登录已取消"));
+						};
+						const waiter = (query) => {
+							finish(true, { query });
+						};
+						waiters.add(waiter);
+						timer = setTimeout(() => {
+							close();
+							finish(false, new Error("D.AI 登录超时，请重新登录"));
+						}, timeoutMs);
+						signal?.addEventListener("abort", onAbort, { once: true });
+					});
+				},
+				close,
+			});
+		});
+	});
+}
+
+/** Browser sign-in: authorization code + PKCE, callback owned by the plugin. */
+async function browserSignIn(base, clientId = OAUTH_CLIENT_ID) {
+	const { verifier, challenge } = pkcePair();
+	const state = randomBytes(16).toString("base64url");
+	const nonce = randomBytes(16).toString("base64url");
+	const callback = await callbackServer();
+	const authorize = new URL(`${base}/api/oauth/authorize`);
+	authorize.searchParams.set("client_id", clientId);
+	authorize.searchParams.set("redirect_uri", callback.redirectUri);
+	authorize.searchParams.set("response_type", "code");
+	authorize.searchParams.set("scope", OAUTH_SCOPES);
+	authorize.searchParams.set("state", state);
+	authorize.searchParams.set("nonce", nonce);
+	authorize.searchParams.set("code_challenge", challenge);
+	authorize.searchParams.set("code_challenge_method", "S256");
+	return {
+		url: authorize.toString(),
+		instructions: "在浏览器中登录 D.AI 并同意授权；完成后会自动回到 Magpie。",
+		method: "auto",
+		async callback({ signal, timeoutMs = OAUTH_SIGN_IN_TIMEOUT_MS } = {}) {
+			try {
+				const { query } = await callback.wait({ signal, timeoutMs });
+				if (textOf(query.get("state")) !== state) {
+					return { type: "failed", error: "D.AI 登录状态校验失败" };
+				}
+				const error = textOf(query.get("error"));
+				if (error) {
+					return {
+						type: "failed",
+						error: textOf(query.get("error_description")) || `D.AI 登录失败：${error}`,
+					};
+				}
+				const code = textOf(query.get("code"));
+				if (!code) return { type: "failed", error: "D.AI 没有返回授权码" };
+				const token = await tokenRequest(
+					base,
+					{
+						grant_type: "authorization_code",
+						client_id: clientId,
+						code,
+						redirect_uri: callback.redirectUri,
+						code_verifier: verifier,
+					},
+					signal,
+				);
+				if (!token.access_token) {
+					return {
+						type: "failed",
+						error:
+							token.description ||
+							token.error ||
+							`D.AI 换取令牌失败（HTTP ${token.status ?? "?"}）`,
+					};
+				}
+				const who = await fetchJson(`${base}/api/oauth/userinfo`, {
+					apiKey: token.access_token,
+					oauth: true,
+				}).catch(() => null);
+				const accountId =
+					textOf(who?.email) || textOf(who?.preferred_username) || textOf(who?.sub);
+				return {
+					type: "success",
+					access: token.access_token,
+					refresh: token.refresh_token ?? "",
+					expires: Date.now() + numberOr(token.expires_in, 3600) * 1000,
+					...(accountId ? { accountId } : {}),
+					...(textOf(who?.sub) ? { uid: textOf(who.sub) } : {}),
+				};
+			} catch (error) {
+				return { type: "failed", error: String(error?.message ?? error) };
+			} finally {
+				callback.close();
+			}
+		},
+	};
+}
+
+async function refreshOAuth(base, auth, clientId = OAUTH_CLIENT_ID) {
+	if (!isOAuthAuth(auth)) return;
+	const refresh = textOf(auth?.refresh);
+	if (!refresh) throw Object.assign(new Error("D.AI 登录已失效"), { signIn: "expired" });
+	const token = await tokenRequest(base, {
+		grant_type: "refresh_token",
+		client_id: clientId,
+		refresh_token: refresh,
+	});
+	if (!token.access_token) {
+		const expired =
+			token.status === 400 ||
+			token.error === "invalid_grant" ||
+			token.error === "invalid_refresh_token";
+		throw Object.assign(
+			new Error(token.description || token.error || "D.AI 刷新登录失败"),
+			expired ? { signIn: "expired" } : {},
+		);
+	}
+	return {
+		access: token.access_token,
+		refresh: token.refresh_token ?? refresh,
+		expires: Date.now() + numberOr(token.expires_in, 3600) * 1000,
+	};
+}
+
 /**
  * Every chat model D.AI publishes, keyed by model id. With a key the catalog is
  * narrowed to the models that key may call; a `/v1/models` failure leaves the
@@ -294,7 +582,11 @@ async function fetchCatalog(base, { key, signal } = {}) {
 	const models = chatModelsFromDocs(docs, base);
 	if (!key || !Object.keys(models).length) return models;
 	try {
-		const listed = await fetchJson(`${apiBase(base)}/models`, { apiKey: key, signal });
+		const listed = await fetchJson(`${apiBase(base)}/models`, {
+			apiKey: key,
+			oauth: key.startsWith("ddoa_"),
+			signal,
+		});
 		const allowed = new Set(
 			(listed?.data ?? []).map((model) => textOf(model?.id)).filter(Boolean),
 		);
@@ -304,7 +596,7 @@ async function fetchCatalog(base, { key, signal } = {}) {
 		// A refused key must reach Magpie as a sign-in failure. A network or
 		// server failure keeps the last good catalog instead.
 		if (error?.status === 401 || error?.status === 403) {
-			throw Object.assign(new Error("D.AI 拒绝了该 API 密钥，请重新登录"), {
+			throw Object.assign(new Error("D.AI 登录已失效，请重新登录"), {
 				status: error.status,
 				signIn: "expired",
 			});
@@ -378,7 +670,7 @@ function balanceCard(account, key) {
 		parts.push(`今日 ${calls} 次调用`);
 	}
 	return {
-		plan: tierLabel(tier.code) || keyLabel(key),
+		plan: tierLabel(tier.code) || key || "D.AI 账号",
 		balance: total === undefined ? "" : `$${usd(total)}`,
 		windows: [{ name: "D.AI 余额", display: parts.join(" · ") }],
 	};
@@ -566,6 +858,7 @@ async function mediaCatalog(base, input, signal) {
 
 const DaiPlugin = async (_input, options = {}) => {
 	const base = normalizeBase(options?.baseUrl ?? process.env.DAI_BASE_URL) ?? DEFAULT_BASE;
+	const oauthClientId = textOf(options?.oauthClientId) || OAUTH_CLIENT_ID;
 	const offline = fallbackCatalog(base);
 
 	// One catalog read per account, reused until it goes stale. Keyed by the
@@ -599,43 +892,70 @@ const DaiPlugin = async (_input, options = {}) => {
 		auth: {
 			provider: PROVIDER,
 
-			methods: [{ type: "api", label: "D.AI API 密钥", placeholder: "ddsk_…" }],
+			refreshLead: 5 * 60 * 1000,
+
+			async refresh(auth) {
+				return refreshOAuth(base, auth, oauthClientId);
+			},
+
+			methods: [
+				{
+					type: "oauth",
+					label: "使用 D.AI 账号登录",
+					authorize: () => browserSignIn(base, oauthClientId),
+				},
+				{ type: "api", label: "D.AI API 密钥", placeholder: "ddsk_…" },
+			],
 
 			async loader(getAuth) {
 				const auth = await getAuth();
-				const key = textOf(auth?.key);
-				if (auth?.type !== "api" || !key) return {};
+				const credential = credentialOf(auth);
+				if (!credential) return {};
+				if (isOAuthAuth(auth)) {
+					return {
+						baseURL: apiBase(base),
+						apiKey: credential,
+						headers: { "x-dai-client": CLIENT },
+						fetch(input, init) {
+							const headers = new Headers(init?.headers);
+							headers.delete("x-api-key");
+							headers.set("authorization", `Bearer ${credential}`);
+							return fetch(input, { ...init, headers });
+						},
+					};
+				}
 				return {
 					baseURL: apiBase(base),
-					apiKey: key,
+					apiKey: credential,
 					headers: { "x-dai-client": CLIENT },
 				};
 			},
 
-			// The account behind the key: wallet balance, tier and token totals,
-			// from D.AI's own endpoint (`GET /api/ai/account`). A `ddsk_` key may
-			// call it, which is the point: the plugin can show what a D.AI key
-			// cannot otherwise read. The card says the balance as the wallet's
-			// total, then how much of it this key may spend and what it has used.
+			// The account behind either sign-in: wallet balance, tier and token
+			// totals from `GET /api/ai/account`. The card says the balance as the
+			// wallet's total, then what this key may spend and what it has used.
 			async usage(getAuth) {
 				const auth = await getAuth();
-				const key = textOf(auth?.key);
-				if (auth?.type !== "api" || !key) {
-					return { windows: [], error: "D.AI：请使用 API 密钥登录" };
+				const credential = credentialOf(auth);
+				if (!credential) {
+					return { windows: [], error: "D.AI：请先登录" };
 				}
 				try {
-					const account = await fetchJson(`${base}/api/ai/account`, { apiKey: key });
-					return balanceCard(account, key);
+					const account = await fetchJson(`${base}/api/ai/account`, {
+						apiKey: credential,
+						oauth: isOAuthAuth(auth),
+					});
+					return balanceCard(account, authLabel(auth));
 				} catch (error) {
 					const status = error?.status;
 					if (status === 401 || status === 403) {
-						return { windows: [], error: "D.AI 拒绝了该 API 密钥", signIn: "expired" };
+						return { windows: [], error: "D.AI 登录已失效", signIn: "expired" };
 					}
 					// A deployment older than the endpoint answers 404. Its call log
 					// is still there, and counting calls beats showing an error.
-					if (status === 404) {
+					if (status === 404 && !isOAuthAuth(auth)) {
 						try {
-							return await callLogCard(base, key);
+							return await callLogCard(base, credential);
 						} catch (fallbackError) {
 							return { windows: [], error: String(fallbackError?.message ?? fallbackError) };
 						}
@@ -651,10 +971,10 @@ const DaiPlugin = async (_input, options = {}) => {
 			// The account's own list when D.AI answers, else the catalog the
 			// config hook declared, so a failed fetch never empties the provider.
 			async models(provider, { auth } = {}) {
-				const key = textOf(auth?.key);
-				if (!key) return provider.models;
+				const credential = credentialOf(auth);
+				if (!credential) return provider.models;
 				try {
-					const models = await catalogFor(key, undefined);
+					const models = await catalogFor(credential, undefined);
 					return models ?? provider.models;
 				} catch (error) {
 					if (error?.signIn === "expired") throw error;
@@ -721,8 +1041,10 @@ export default { id: PROVIDER, server: DaiPlugin };
 
 /** For tests and manual probing: the pure pieces, never called as a plugin. */
 export const _internal = {
+	authLabel,
 	balanceCard,
 	buildModel,
+	browserSignIn,
 	fallbackCatalog,
 	fetchCatalog,
 	fetchGatewayModels,
@@ -733,4 +1055,7 @@ export const _internal = {
 	mediaModel,
 	mediaRows,
 	normalizeBase,
+	pkcePair,
+	refreshOAuth,
+	tokenRequest,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@d-ai/magpie",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "D.AI (dai.itbug.shop) chat models in magpie and OpenCode, plus a read-only image/video/audio model catalog",
   "type": "module",
   "main": "./index.mjs",