@fudrouter/fsrouter 0.6.77 → 0.6.78

package/dist/lib/oauth/constants/oauth.js

@@ -118,6 +118,8 @@ export const KIMCHI_CONFIG = { ...PROVIDER_OAUTH["kimchi"] };
 // Endpoint: cli-chat-proxy.grok.com — same client_id as xai, different flow + scopes
 export const GROK_CLI_CONFIG = { ...PROVIDER_OAUTH["grok-cli"] };
 
+export const NOUS_CONFIG = { ...PROVIDER_OAUTH["nous-research"] };
+
 // OAuth timeout (5 minutes)
 export const OAUTH_TIMEOUT = 300000;
 

package/dist/lib/oauth/providers.js

@@ -28,6 +28,7 @@ import {
   CODEBUDDY_CONFIG,
   KIMCHI_CONFIG,
   GROK_CLI_CONFIG,
+  NOUS_CONFIG,
   getOAuthClientMetadata,
 } from "./constants/oauth.js";
 import { XAI_CONFIG, XAI_PKCE_VERIFIER_BYTES } from "./constants/xai.js";
@@ -372,6 +373,77 @@ const PROVIDERS = {
     },
   },
 
+  // Nous Research (Nous Portal) — OAuth device code flow.
+  // Portal has no manual API-key page; auth is device-code only (client_id hermes-cli).
+  "nous-research": {
+    config: NOUS_CONFIG,
+    flowType: "device_code",
+    requestDeviceCode: async (config) => {
+      const body = new URLSearchParams({ client_id: config.clientId });
+      if (config.scope) body.set("scope", config.scope);
+      const response = await fetch(config.deviceCodeUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body,
+      });
+      if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Nous device code request failed: ${error}`);
+      }
+      return await response.json();
+    },
+    pollToken: async (config, deviceCode) => {
+      const response = await fetch(config.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json",
+        },
+        body: new URLSearchParams({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: deviceCode,
+          client_id: config.clientId,
+        }),
+      });
+      let data;
+      try {
+        data = await response.json();
+      } catch {
+        const text = await response.text();
+        data = { error: "invalid_response", error_description: text };
+      }
+      const pending =
+        data?.error === "authorization_pending" || data?.error === "slow_down";
+      return { ok: response.ok || pending, data };
+    },
+    mapTokens: (tokens) => {
+      let email = null;
+      try {
+        const parts = String(tokens.access_token || "").split(".");
+        if (parts.length >= 2) {
+          const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+          const padded = b64 + "=".repeat((4 - (b64.length % 4)) % 4);
+          const claims = JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+          email = claims.email || claims.sub || null;
+        }
+      } catch { /* ignore */ }
+      return {
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token || null,
+        expiresIn: tokens.expires_in,
+        scope: tokens.scope,
+        email: email || undefined,
+        providerSpecificData: {
+          authMethod: "device_code",
+          email: email || null,
+        },
+      };
+    },
+  },
+
   "gemini-cli": {
     config: GEMINI_CONFIG,
     flowType: "authorization_code",

package/dist/open-sse/providers/index.js

@@ -6,7 +6,7 @@ import { buildTtsProviderModels } from "../config/ttsModels.js";
 
 // oauth block is canonical for these fields; inject into transport so executors reading
 // this.config.{clientId,clientSecret,tokenUrl} keep working without duplicating in transport
-const OAUTH_INJECT_FIELDS = ["clientId", "clientSecret", "tokenUrl"];
+const OAUTH_INJECT_FIELDS = ["clientId", "clientSecret", "tokenUrl", "refreshUrl"];
 
 // transport: re-apply shared default (format:"openai") + inject oauth-canonical fields
 function buildTransport(transport, oauth) {

package/dist/open-sse/providers/registry/nous-research.js

@@ -14,8 +14,16 @@ export default {
       apiKeyUrl: "https://portal.nousresearch.com",
     },
   },
-  category: "apikey",
-  authModes: ["apikey"],
+  category: "oauth",
+  authModes: ["oauth"],
+  oauth: {
+    clientId: "hermes-cli",
+    deviceCodeUrl: "https://portal.nousresearch.com/api/oauth/device/code",
+    tokenUrl: "https://portal.nousresearch.com/api/oauth/token",
+    refreshUrl: "https://portal.nousresearch.com/api/oauth/token",
+    scope: "inference:invoke",
+    refreshLeadMs: 5 * 60 * 1000,
+  },
   transport: {
     baseUrl: "https://inference-api.nousresearch.com/v1/chat/completions",
     format: "openai",

package/dist/routes/headroom/extras/route.js

@@ -16,7 +16,7 @@ export async function GET(req, res) {
 }
 export async function POST(req, res) {
     try {
-        const body = await req.json().catch(() => ({}));
+        const body = req.body || {};
         const extras = Array.isArray(body.extras) ? body.extras : [];
         if (extras.length === 0) {
             return res.status(400).json({ error: "No extras requested" });
@@ -37,7 +37,7 @@ export async function POST(req, res) {
 }
 export async function DELETE(req, res) {
     try {
-        const body = await req.json().catch(() => ({}));
+        const body = req.body || {};
         const extras = Array.isArray(body.extras) ? body.extras : [];
         if (extras.length === 0) {
             return res.status(400).json({ error: "No extras requested" });

package/dist/shared/constants/providers.js

@@ -147,7 +147,7 @@ export const APIKEY_PROVIDERS = {
   // nscale: { id: "nscale", alias: "nscale", name: "nScale", icon: "token", color: "#0891B2", textIcon: "NS", website: "https://nscale.com", notice: { text: "$5 free credits on signup.", apiKeyUrl: "https://console.nscale.com/api-keys" }, serviceKinds: ["llm"] },
   // baseten: { id: "baseten", alias: "baseten", name: "Baseten", icon: "deployed_code", color: "#111827", textIcon: "BT", website: "https://baseten.co", notice: { text: "$30 free trial credits for GPU inference.", apiKeyUrl: "https://app.baseten.co/settings/api_keys" }, serviceKinds: ["llm"] },
   // publicai: { id: "publicai", alias: "publicai", name: "PublicAI", icon: "public", color: "#059669", textIcon: "PA", website: "https://publicai.co", notice: { text: "Free community inference tier.", apiKeyUrl: "https://publicai.co" }, serviceKinds: ["llm"] },
-  "nous-research": { id: "nous-research", alias: "nous", name: "Nous Research", icon: "hub", color: "#2563EB", textIcon: "NO", website: "https://portal.nousresearch.com", notice: { text: "Free tier: 50 RPM, 500K TPM — no credit card.", apiKeyUrl: "https://portal.nousresearch.com" }, serviceKinds: ["llm"] },
+  "nous-research": { id: "nous-research", alias: "nous", name: "Nous Research", icon: "hub", color: "#2563EB", textIcon: "NO", website: "https://portal.nousresearch.com", notice: { text: "Free tier: 50 RPM, 500K TPM — no credit card. Sign in with your Nous Portal account (device login, no API key needed).", signupUrl: "https://portal.nousresearch.com" }, serviceKinds: ["llm"], authModes: ["oauth"], hasOAuth: true },
   // glhf: { id: "glhf", alias: "glhf", name: "GLHF Chat", icon: "hub", color: "#10B981", textIcon: "GH", website: "https://glhf.chat", notice: { text: "Free tier for open-source model inference.", apiKeyUrl: "https://glhf.chat/users/settings/api" }, passthroughModels: true, serviceKinds: ["llm"] },
   "ollama-local": { id: "ollama-local", alias: "ollama-local", name: "Ollama Local", icon: "cloud", color: "#ffffffff", textIcon: "OL", website: "https://ollama.com" },
   "vertex-partner": { id: "vertex-partner", alias: "vxp", name: "Vertex Partner", icon: "cloud", color: "#34A853", textIcon: "VP", website: "https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-partner-models", notice: { apiKeyUrl: "https://console.cloud.google.com/iam-admin/serviceaccounts" } },

package/open-sse/providers/index.js

@@ -6,7 +6,7 @@ import { buildTtsProviderModels } from "../config/ttsModels.js";
 
 // oauth block is canonical for these fields; inject into transport so executors reading
 // this.config.{clientId,clientSecret,tokenUrl} keep working without duplicating in transport
-const OAUTH_INJECT_FIELDS = ["clientId", "clientSecret", "tokenUrl"];
+const OAUTH_INJECT_FIELDS = ["clientId", "clientSecret", "tokenUrl", "refreshUrl"];
 
 // transport: re-apply shared default (format:"openai") + inject oauth-canonical fields
 function buildTransport(transport, oauth) {

package/open-sse/providers/registry/nous-research.js

@@ -14,8 +14,16 @@ export default {
       apiKeyUrl: "https://portal.nousresearch.com",
     },
   },
-  category: "apikey",
-  authModes: ["apikey"],
+  category: "oauth",
+  authModes: ["oauth"],
+  oauth: {
+    clientId: "hermes-cli",
+    deviceCodeUrl: "https://portal.nousresearch.com/api/oauth/device/code",
+    tokenUrl: "https://portal.nousresearch.com/api/oauth/token",
+    refreshUrl: "https://portal.nousresearch.com/api/oauth/token",
+    scope: "inference:invoke",
+    refreshLeadMs: 5 * 60 * 1000,
+  },
   transport: {
     baseUrl: "https://inference-api.nousresearch.com/v1/chat/completions",
     format: "openai",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fudrouter/fsrouter",
-  "version": "0.6.77",
+  "version": "0.6.78",
   "private": false,
   "type": "module",
   "description": "9Router v2 — Express Backend (API, SSE, DB, Auth, MITM)",