@mupt-ai/dari-gateway 0.2.1 → 0.3.1

package/dist/platform/platform.d.ts

@@ -23,7 +23,10 @@ export type GatewayPlatform = {
      * Optional. Supply the credential for one enabled model of this request,
      * consulted after `resolveRouter` and before its provider keys (for the
      * self-hosted gateway, its environment keys), so an embedder can serve
-     * per-tenant keys from its own store. Undefined keeps the resolved key.
+     * per-tenant keys from its own store. Undefined keeps the resolved key. A
+     * credential with `subscription` serves the model on that plan, even on a
+     * strict router; a plan that cannot serve the model for this client (see
+     * SubscriptionKind) is ignored.
      */
     resolveProviderCredential?(request: ProviderCredentialRequest): Promise<ProviderCredential | undefined>;
     /** Persist one completed turn's prefix entry and/or refresh a read entry. */
@@ -59,6 +62,7 @@ export type ProviderCredentialRequest = {
     routerId: string;
     organizationId: string;
     apiKey: string;
+    clientHarness?: ClientHarness;
 };
 export type PrefixStateWrite = {
     organization_id: string;

package/dist/protocol/input/chat_completions.js

@@ -54,7 +54,9 @@ export function internalChatCompletionsToInteraction(request) {
     const tools = chatTools(request.tools);
     toolsByWireName(tools);
     const responseFormat = toInteractionResponseFormat(request.response_format);
-    const reasoningEffort = request.reasoning_effort;
+    // OpenAI spells the non-reasoning effort "none"; Dari spells it "off".
+    const requestedEffort = request.reasoning_effort;
+    const reasoningEffort = requestedEffort === "none" ? "off" : request.reasoning_effort;
     return {
         sourceProtocol: request.source_protocol ?? "openai_chat",
         model: request.model,

package/dist/protocol/input/chat_completions_validation.js

@@ -184,7 +184,8 @@ function validateReasoning(request) {
     if (raw.reasoning !== undefined) {
         throw new HttpError(400, "reasoning is not supported; use reasoning_effort.", "invalid_request_error", "reasoning");
     }
-    if (request.reasoning_effort !== undefined && !isReasoningEffort(request.reasoning_effort)) {
+    const effort = request.reasoning_effort;
+    if (effort !== undefined && effort !== "none" && !isReasoningEffort(effort)) {
         throw new HttpError(400, "reasoning_effort is not supported.", "unsupported_reasoning_effort", "reasoning_effort");
     }
 }

package/dist/providers/pi.js

@@ -13,7 +13,7 @@ import { REASONING_EFFORTS, isRecord, nativeModelId, providerForModel, } from "@
 import { HttpError } from "../http/errors.js";
 import { effectiveContextWindow } from "../models/context_limits.js";
 import { defaultBaseUrl } from "../models/provider_defaults.js";
-import { contextWindowOverride, inputModalitiesOverride, runtimeCompat } from "../models/runtime_overrides.js";
+import { contextWindowOverride, inputModalitiesOverride, providerThinkingLevelOverrides, runtimeCompat, withThinkingLevelOverrides, } from "../models/runtime_overrides.js";
 import { BEDROCK_API } from "./model_capabilities.js";
 import { buildContext } from "./pi_context.js";
 import { providerIdentityFromModel } from "../interaction/provider_continuation_state.js";
@@ -175,15 +175,20 @@ export function buildModel(pi, modelId, pricing, config) {
     // A null catalog value delegates to Pi's registry when it knows the model.
     // Custom OpenAI-compatible models are not necessarily registered, so keep
     // the public effort set permissive and let the provider validate the wire
-    // value instead of silently treating an unknown model as off-only.
-    const fallbackThinkingLevels = config !== undefined && configuredThinkingLevels == null && registered === undefined
+    // value instead of silently treating an unknown model as off-only. A
+    // built-in provider with its own thinking levels (Meta) serves ids newer
+    // than the registry the same way, with only its key configured.
+    const providerThinking = providerThinkingLevelOverrides(provider);
+    const fallbackThinkingLevels = (config !== undefined || providerThinking !== undefined) &&
+        configuredThinkingLevels == null &&
+        registered === undefined
         ? REASONING_EFFORTS
         : undefined;
     const effectiveThinkingLevels = Array.isArray(configuredThinkingLevels)
         ? configuredThinkingLevels
         : fallbackThinkingLevels;
     const configuredThinking = effectiveThinkingLevels
-        ? thinkingMetadata(effectiveThinkingLevels, registered)
+        ? thinkingMetadata(effectiveThinkingLevels, registered ?? { thinkingLevelMap: providerThinking })
         : null;
     const defaultThinkingLevel = config?.default_thinking_level ?? undefined;
     const api = config?.api ?? registered?.api ?? defaultApi(provider);
@@ -243,7 +248,7 @@ function thinkingMetadata(supportedLevels, registered) {
 }
 function resolveModelMetadata(pi, provider, modelId, nativeId) {
     const registry = registryProvider(provider, modelId);
-    return pi.getModel?.(registry, nativeId) ?? pi.getModel?.(registry, modelId);
+    return withThinkingLevelOverrides(provider, pi.getModel?.(registry, nativeId) ?? pi.getModel?.(registry, modelId));
 }
 // Dari's "azure" provider has no Pi registry of its own. One Foundry resource
 // serves OpenAI deployments through Pi's Azure OpenAI Responses registry and
@@ -307,7 +312,8 @@ function executionPricing(pricing, config) {
     return pricing ?? modelPricingFromConfig(config);
 }
 function defaultApi(provider) {
-    if (provider === "openai" || provider === "xai")
+    // Meta recommends Responses: its Chat Completions drops reasoning between turns.
+    if (provider === "openai" || provider === "xai" || provider === "meta")
         return "openai-responses";
     if (provider === "anthropic")
         return "anthropic-messages";

package/dist/providers/pi_options.js

@@ -23,8 +23,11 @@ export function buildOptions(request, auth, selectedModel, model, pi, sessionId,
     const providerAuth = typeof auth === "string" ? { type: "bearer", apiKey: auth } : auth;
     const { generation, toolChoice, parallelToolCalls, responseFormat } = request;
     const headers = {};
+    const bearerHeader = sendsBearerToMessages(providerAuth, model);
+    if (bearerHeader)
+        headers.authorization = `Bearer ${providerAuth.apiKey}`;
     const options = {
-        ...authenticationOptions(providerAuth, api),
+        ...(bearerHeader ? {} : authenticationOptions(providerAuth, api)),
         maxRetries: 0,
         timeoutMs,
         signal,
@@ -38,6 +41,9 @@ export function buildOptions(request, auth, selectedModel, model, pi, sessionId,
     if (isClaudeCodeOAuth(providerAuth, api)) {
         headers["user-agent"] = request.claudeCodeUserAgent ?? CLAUDE_CODE_USER_AGENT;
     }
+    if (model.provider === "meta" && request.museCodeClientId !== undefined) {
+        headers["x-client-id"] = request.museCodeClientId;
+    }
     // Pi's Anthropic transport honors compat.supportsTemperature; the OpenAI
     // transports forward temperature regardless, so drop it here for models
     // that reject it instead of failing the whole request.
@@ -173,6 +179,12 @@ function authenticationOptions(auth, api) {
         },
     };
 }
+// Anthropic Messages endpoints outside Anthropic that take the key as a bearer
+// token (Claude Code's ANTHROPIC_AUTH_TOKEN) and reject x-api-key.
+const BEARER_MESSAGES_PROVIDERS = new Set(["meta"]);
+function sendsBearerToMessages(auth, model) {
+    return auth.type === "bearer" && isAnthropic(model.api) && BEARER_MESSAGES_PROVIDERS.has(model.provider);
+}
 function isClaudeCodeOAuth(auth, api) {
     return auth.type === "bearer" && isAnthropic(api) && auth.apiKey.includes("sk-ant-oat");
 }

package/dist/providers/provider_call.js

@@ -19,8 +19,10 @@ export function prepareProviderExecution(args) {
     }
     const provider = executionProviderForModel(args.credentials, model);
     const supplied = args.credentials.provider_credentials?.[model];
-    const providerKeySource = supplied ? "user" : keySourceForModel(args.credentials, model);
-    if (args.credentials.strict === true && providerKeySource === "subscription") {
+    const providerKeySource = keySourceForModel(args.credentials, model);
+    // A strict router serves a plan only when the platform supplied it for this
+    // request, never a pooled or personal one it resolved.
+    if (args.credentials.strict === true && providerKeySource === "subscription" && !supplied) {
         throw new HttpError(400, `Strict routers do not serve '${model}' from a personal subscription.`, "strict_subscription_refused", "model");
     }
     const auth = supplied
@@ -47,7 +49,9 @@ export function prepareProviderExecution(args) {
             : {}),
         provider,
         providerKeySource,
-        ...(providerKeySource === "subscription" && args.credentials.attributed_user_id
+        // Only resolved personal subscriptions are held at their usage limit;
+        // the platform manages the plans it supplies.
+        ...(providerKeySource === "subscription" && !supplied && args.credentials.attributed_user_id
             ? {
                 subscriptionUserId: args.credentials.attributed_user_id,
                 subscriptionCredentialId: args.credentials.subscription_credential_ids?.[provider],

package/dist/providers/provider_reported_cost.js

@@ -2,7 +2,8 @@ import { isRecord } from "@mupt-ai/dari-router/policy-engine";
 import { gatewayFor } from "../models/gateways.js";
 import { providerFailureFromCaught } from "../runtime/provider_stream_outcome.js";
 // Gateways bill per call and say what they billed: OpenRouter as `usage.cost`
-// on the final chunk, Vercel AI Gateway as `providerMetadata.gateway.cost`.
+// on the final chunk (plus the provider's charge on a BYOK call), Vercel AI
+// Gateway as `providerMetadata.gateway.cost`.
 // Pi prices usage from model rates and drops both, so the amount is read off
 // the raw response bytes and replaces the priced total.
 export function reportsProviderCost(model) {
@@ -63,7 +64,21 @@ export function reportedCost(body) {
     const gateway = isRecord(body.providerMetadata) && isRecord(body.providerMetadata.gateway)
         ? body.providerMetadata.gateway
         : undefined;
-    return usd(isRecord(body.usage) ? body.usage.cost : undefined) ?? usd(gateway?.cost);
+    return openRouterCost(body.usage) ?? usd(gateway?.cost);
+}
+// On a BYOK call OpenRouter bills the provider's charge to the org's own key:
+// `usage.cost` is only its fee (often 0), and the charge is in
+// `cost_details.upstream_inference_cost`.
+function openRouterCost(usage) {
+    if (!isRecord(usage))
+        return undefined;
+    const cost = usd(usage.cost);
+    if (cost === undefined || usage.is_byok !== true)
+        return cost;
+    const upstream = isRecord(usage.cost_details)
+        ? usd(usage.cost_details.upstream_inference_cost)
+        : undefined;
+    return cost + (upstream ?? 0);
 }
 function usd(value) {
     const amount = typeof value === "string" && value.trim() !== "" ? Number(value) : value;

package/dist/providers/subscription_limits.d.ts

@@ -1,6 +1,6 @@
 import type { ProviderKeySource } from "../types.js";
 import type { CapturedProviderResponse } from "./response_capture.js";
-export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex";
+export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex" | "meta_muse";
 export type SubscriptionUsageLimit = {
     oauthProvider: SubscriptionOAuthProvider;
     resetsAt: Date;
@@ -12,7 +12,9 @@ export declare function subscriptionOAuthProviderFor(provider: string, keySource
 /**
  * Recognize a personal subscription that has run out of quota. Claude Code
  * answers 429 with the unified rate-limit headers; the ChatGPT backend answers
- * 429 with a structured `error.code` and `resets_at`. The Codex WebSocket
+ * 429 with a structured `error.code` and `resets_at`. Meta documents no
+ * usage-limit signature for Muse Code plans, so any 429 on one holds it until
+ * the reset Meta gives, if any. The Codex WebSocket
  * transport bypasses fetch, so its usage-limit error only survives as message
  * text and is matched there without a reset time.
  */

package/dist/providers/subscription_limits.js

@@ -8,6 +8,7 @@ const FAILURE_MARKER = "subscription_usage_limit";
 const SUBSCRIPTION_LABEL = {
     anthropic_claude_code: "Claude Code",
     openai_codex: "ChatGPT",
+    meta_muse: "Muse Code",
 };
 export function subscriptionOAuthProviderFor(provider, keySource) {
     if (keySource !== "subscription")
@@ -16,12 +17,16 @@ export function subscriptionOAuthProviderFor(provider, keySource) {
         return "anthropic_claude_code";
     if (provider === "openai" || provider === "openai-codex")
         return "openai_codex";
+    if (provider === "meta")
+        return "meta_muse";
     return null;
 }
 /**
  * Recognize a personal subscription that has run out of quota. Claude Code
  * answers 429 with the unified rate-limit headers; the ChatGPT backend answers
- * 429 with a structured `error.code` and `resets_at`. The Codex WebSocket
+ * 429 with a structured `error.code` and `resets_at`. Meta documents no
+ * usage-limit signature for Muse Code plans, so any 429 on one holds it until
+ * the reset Meta gives, if any. The Codex WebSocket
  * transport bypasses fetch, so its usage-limit error only survives as message
  * text and is matched there without a reset time.
  */
@@ -33,6 +38,8 @@ export function detectSubscriptionUsageLimit(args) {
     if (oauthProvider === "anthropic_claude_code") {
         return anthropicUsageLimit(args.captured, now);
     }
+    if (oauthProvider === "meta_muse")
+        return museUsageLimit(args.captured, now);
     return codexUsageLimit(args.captured, providerFailureMessage(args.failure), now);
 }
 function anthropicUsageLimit(captured, now) {
@@ -76,6 +83,15 @@ function codexUsageLimit(captured, failureMessage, now) {
         reason: "ChatGPT usage limit reached.",
     };
 }
+function museUsageLimit(captured, now) {
+    if (captured === undefined || captured.status !== 429)
+        return null;
+    return {
+        oauthProvider: "meta_muse",
+        resetsAt: laterReset(codexErrorBody(captured.bodyText)?.resets_at, captured.headers, now),
+        reason: "Muse Code usage limit reached.",
+    };
+}
 function codexErrorBody(bodyText) {
     try {
         const parsed = JSON.parse(bodyText);
@@ -137,12 +153,12 @@ export function subscriptionUsageLimitFromFailure(failure) {
         return null;
     const oauthProvider = marker.oauth_provider;
     const resetsAt = typeof marker.resets_at === "string" ? new Date(marker.resets_at) : null;
-    if ((oauthProvider !== "anthropic_claude_code" && oauthProvider !== "openai_codex")
+    if (typeof oauthProvider !== "string" || !(oauthProvider in SUBSCRIPTION_LABEL)
         || resetsAt === null || Number.isNaN(resetsAt.getTime())) {
         return null;
     }
     return {
-        oauthProvider,
+        oauthProvider: oauthProvider,
         resetsAt,
         reason: typeof marker.reason === "string" ? marker.reason : "Subscription usage limit reached.",
         ...(marker.switched === true ? { switched: true } : {}),

package/dist/runtime/explicit_model.d.ts

@@ -1,4 +1,7 @@
+import { HttpError } from "../http/errors.js";
 import type { RoutedDecision } from "../strategies/route_decision.js";
 import type { PreparedRoutedCompletion } from "./prepare_routed_completion.js";
 export declare function explicitModelDecision(prepared: PreparedRoutedCompletion): RoutedDecision | null;
 export declare function strictModelDecision(prepared: PreparedRoutedCompletion): RoutedDecision;
+export declare function modelNotEnabled(modelId: string): HttpError;
+export declare function strictModelRequired(): HttpError;

package/dist/runtime/explicit_model.js

@@ -8,9 +8,8 @@ export function explicitModelDecision(prepared) {
     const modelId = explicitModelId(prepared.interaction.model);
     if (modelId === null)
         return null;
-    if (!prepared.credentials.enabled_models.includes(modelId)) {
-        throw new HttpError(400, `Model '${modelId}' is not enabled on this router.`, "model_not_enabled", "model");
-    }
+    if (!prepared.credentials.enabled_models.includes(modelId))
+        throw modelNotEnabled(modelId);
     const candidates = prepared.routing.candidateResolution.candidates.filter((candidate) => candidate.model === modelId);
     if (candidates.length === 0) {
         throw new HttpError(400, `Model '${modelId}' cannot serve this request.`, "model_unavailable", "model");
@@ -40,9 +39,8 @@ function pickCandidate(prepared, modelId, candidates) {
    refuses everything else instead of substituting. */
 export function strictModelDecision(prepared) {
     const modelId = explicitModelId(prepared.interaction.model);
-    if (modelId === null) {
-        throw new HttpError(400, "This router is strict: request a pinned model as 'dari/model/<id>'.", "strict_model_required", "model");
-    }
+    if (modelId === null)
+        throw strictModelRequired();
     const { decision } = explicitModelDecision(prepared);
     const requested = prepared.interaction.reasoning?.effort
         ?? prepared.credentials.model_configs?.[modelId]?.default_thinking_level;
@@ -51,3 +49,9 @@ export function strictModelDecision(prepared) {
     }
     return { decision };
 }
+export function modelNotEnabled(modelId) {
+    return new HttpError(400, `Model '${modelId}' is not enabled on this router.`, "model_not_enabled", "model");
+}
+export function strictModelRequired() {
+    return new HttpError(400, "This router is strict: request a pinned model as 'dari/model/<id>'.", "strict_model_required", "model");
+}

package/dist/runtime/prepare_routed_completion.js

@@ -2,11 +2,13 @@ import { interactionConversationPrefix } from "../context/interaction_fingerprin
 import { buildRoutingContext, derivePrefixLookupHashes, } from "../context/routing_context.js";
 import { isBackgroundRequest } from "../interaction/types.js";
 import { executionProviderForModel } from "../models/execution_provider.js";
+import { codexModelConfig, subscriptionServes } from "../models/subscriptions.js";
 import { gatewayPlatform } from "../platform/platform.js";
 import { resolveRouter } from "../strategies/routing.js";
 import { RequestReporter } from "../telemetry/report.js";
 import { RoutingBillingFinalization } from "../telemetry/billing_finalization.js";
 import { requestTags } from "./request_tags.js";
+import { strictProviderAccess } from "./strict_provider_access.js";
 import { scopedHarnessConversationId, scopedHarnessSessionId, } from "./harness_identity/index.js";
 export async function prepareRoutedCompletion(args) {
     const tags = requestTags(args.tagsHeader);
@@ -79,7 +81,10 @@ export async function prepareRoutedCompletion(args) {
         }
         credentials = conversationCredentials;
     }
-    credentials = await withProviderCredentials(credentials, args.apiKey);
+    const access = strictProviderAccess(credentials, args.interaction);
+    credentials = access.credentials;
+    args = { ...args, interaction: access.interaction };
+    credentials = await withProviderCredentials(credentials, args.apiKey, args.clientHarness);
     const billable = true;
     const routing = await buildRoutingContext({
         routerId: prefixFingerprintRouterId,
@@ -134,7 +139,7 @@ export async function prepareRoutedCompletion(args) {
 }
 // Ask the platform for each enabled model's credential up front, so provider
 // execution and fallback stay synchronous.
-async function withProviderCredentials(credentials, apiKey) {
+async function withProviderCredentials(credentials, apiKey, clientHarness) {
     const platform = gatewayPlatform();
     if (platform.resolveProviderCredential === undefined)
         return credentials;
@@ -146,14 +151,28 @@ async function withProviderCredentials(credentials, apiKey) {
             routerId: credentials.router_id,
             organizationId: credentials.organization_id,
             apiKey,
+            ...(clientHarness ? { clientHarness } : {}),
         }),
     ]));
     const provider_credentials = {};
+    const model_configs = { ...credentials.model_configs };
     for (const [model, credential] of resolved) {
-        if (credential?.apiKey.trim())
-            provider_credentials[model] = credential;
+        if (!credential?.apiKey.trim())
+            continue;
+        const plan = credential.subscription;
+        if (plan !== undefined && !subscriptionServes(plan, model, clientHarness))
+            continue;
+        provider_credentials[model] = credential;
+        if (plan === "openai_codex") {
+            // Keep the catalog's limits and thinking levels; only the serving
+            // endpoint changes.
+            model_configs[model] = {
+                ...model_configs[model],
+                ...codexModelConfig(model, credentials.model_prices?.[model] ?? null),
+            };
+        }
     }
-    return { ...credentials, provider_credentials };
+    return { ...credentials, provider_credentials, model_configs };
 }
 // Core's cache-aware pruning audit, extended with the context layer's image
 // capability exclusions. The exclusions survive on their own when custom

package/dist/runtime/strict_provider_access.d.ts

@@ -0,0 +1,6 @@
+import type { InteractionRequest } from "../interaction/types.js";
+import type { ResolvedRouter } from "../types.js";
+export declare function strictProviderAccess(credentials: ResolvedRouter, interaction: InteractionRequest): {
+    credentials: ResolvedRouter;
+    interaction: InteractionRequest;
+};

package/dist/runtime/strict_provider_access.js

@@ -0,0 +1,40 @@
+import { getBuiltinModels, getBuiltinProviders } from "@mupt-ai/pi-ai/providers/all";
+import { HttpError } from "../http/errors.js";
+import { explicitModelId } from "../protocol/input/router_model.js";
+import { modelNotEnabled, strictModelRequired } from "./explicit_model.js";
+// Resolve only the requested catalog model, never turn a provider grant into
+// selector candidates. Unknown IDs fail closed; a grant-only router has no
+// candidates to route among, so it refuses them here with the strict errors.
+export function strictProviderAccess(credentials, interaction) {
+    const providers = credentials.strict_providers;
+    if (credentials.strict !== true || !providers?.length)
+        return { credentials, interaction };
+    const requested = explicitModelId(interaction.model);
+    const grantOnly = credentials.enabled_models.length === 0;
+    if (requested === null) {
+        if (grantOnly)
+            throw strictModelRequired();
+        return { credentials, interaction };
+    }
+    const matches = new Set();
+    for (const provider of providers) {
+        if (!getBuiltinProviders().includes(provider)) {
+            throw new HttpError(400, `Unknown strict provider '${provider}'.`, "unknown_provider");
+        }
+        for (const model of getBuiltinModels(provider)) {
+            const id = `${provider}/${model.id}`;
+            if (requested === id)
+                matches.add(id);
+        }
+    }
+    const model = [...matches][0];
+    if (model === undefined) {
+        if (grantOnly)
+            throw modelNotEnabled(requested);
+        return { credentials, interaction };
+    }
+    return {
+        credentials: { ...credentials, enabled_models: [...new Set([...credentials.enabled_models, model])] },
+        interaction: { ...interaction, model: `dari/model/${model}` },
+    };
+}

package/dist/self_host/resolve.js

@@ -1,13 +1,13 @@
 import { timingSafeEqual } from "node:crypto";
 import { nativeModelId, providerForModel, } from "@mupt-ai/dari-router/policy-engine";
 import { HttpError } from "../http/errors.js";
+import { codexModelConfig } from "../models/subscriptions.js";
 import { registeredModelPrice } from "../providers/pi.js";
 import { freshAccessToken, } from "./subscriptions/index.js";
 // A self-hosted gateway is one tenant; these stand in for the hosted
 // organization and the user a personal subscription belongs to.
 export const SELF_HOSTED_ORGANIZATION_ID = "self-hosted";
 export const SELF_HOSTED_USER_ID = "self-hosted";
-const CODEX_BACKEND_URL = "https://chatgpt.com/backend-api";
 /**
  * Resolve a configured router for one request. Each provider is served by a
  * connected personal subscription when the router allows it and one is
@@ -129,12 +129,14 @@ export function gatewayKeyIndex(keys, presented) {
     }
     return null;
 }
-// Claude Code plans serve only Claude Code itself; ChatGPT plans serve any
-// client through the Codex backend.
+// Claude Code plans serve only Claude Code itself and Muse Code plans only
+// Muse Code; ChatGPT plans serve any client through the Codex backend.
 function subscriptionProviderFor(provider, clientHarness) {
     if (provider === "anthropic") {
         return clientHarness === "claude_code" ? "anthropic_claude_code" : null;
     }
+    if (provider === "meta")
+        return clientHarness === "muse_code" ? "meta_muse" : null;
     if (provider === "openai")
         return "openai_codex";
     return null;
@@ -146,24 +148,18 @@ function servingProviders(provider, credential) {
         ? [provider, "openai-codex"]
         : [provider];
 }
-function codexModelConfig(modelId, price) {
-    return {
-        provider: "openai-codex",
-        native_model_id: nativeModelId(modelId),
-        api: "openai-codex-responses",
-        base_url: CODEX_BACKEND_URL,
-        // A plan bills no tokens; the catalog price only feeds cost estimates.
-        cost: price ?? { input: 0, output: 0 },
-        fast_mode: false,
-    };
-}
 function thinkingLevels(router) {
     return Object.fromEntries(router.models.flatMap((model) => model.thinking ? [[model.id, model.thinking]] : []));
 }
+const SUBSCRIPTION_PLAN_NAMES = {
+    anthropic_claude_code: "Claude Code",
+    openai_codex: "ChatGPT",
+    meta_muse: "Muse Code",
+};
 function unavailableRouterError(routerId, exhausted) {
     if (exhausted.size > 0) {
         const plans = [...exhausted]
-            .map((provider) => provider === "anthropic_claude_code" ? "Claude Code" : "ChatGPT")
+            .map((provider) => SUBSCRIPTION_PLAN_NAMES[provider])
             .join(" and ");
         return new HttpError(424, `Every connected ${plans} subscription is at its usage limit, and no API key can serve router ${routerId} instead.`, "personal_subscription_unavailable");
     }

package/dist/self_host/subscriptions/oauth.d.ts

@@ -1,10 +1,11 @@
 /**
  * OAuth protocols for personal subscriptions: Claude Code (PKCE, the user
- * pastes back the `code#state` Anthropic shows) and ChatGPT/Codex (device
- * code, the gateway polls for approval). Every network call goes through the
- * injected `fetch`.
+ * pastes back the `code#state` Anthropic shows), ChatGPT/Codex (device code,
+ * the gateway polls for approval), and Muse Code (Meta's device code, then the
+ * subscription's Model API key minted from the sign-in token). Every network
+ * call goes through the injected `fetch`.
  */
-export type SubscriptionProvider = "anthropic_claude_code" | "openai_codex";
+export type SubscriptionProvider = "anthropic_claude_code" | "openai_codex" | "meta_muse";
 export declare const SUBSCRIPTION_PROVIDERS: readonly SubscriptionProvider[];
 export type OAuthFetch = (url: string, init: RequestInit) => Promise<Response>;
 export type OAuthOptions = {
@@ -14,7 +15,8 @@ export type OAuthOptions = {
 /** The provider refused or could not be reached (HTTP 502 at the edge). */
 export declare class SubscriptionOAuthProviderError extends Error {
     readonly status?: number | undefined;
-    constructor(message: string, status?: number | undefined);
+    readonly errorCode?: string | undefined;
+    constructor(message: string, status?: number | undefined, errorCode?: string | undefined);
 }
 /** The user's input or flow state is wrong (HTTP 400 at the edge). */
 export declare class SubscriptionOAuthInputError extends Error {
@@ -37,10 +39,12 @@ export type OAuthTokens = {
 export declare const CLAUDE_CODE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_APPROVAL_PENDING = "OpenAI approval is still pending. Enter the code at OpenAI, finish approval, then try again.";
+export declare const MUSE_CODE_CLIENT_ID = "1031625952748946";
+export declare const META_APPROVAL_PENDING = "Meta approval is still pending. Enter the code at Meta, finish approval, then try again.";
 export declare function startOAuth(provider: SubscriptionProvider, options: OAuthOptions): Promise<OAuthAuthorization>;
 /**
  * Finish a flow. Claude Code needs the pasted authorization response; the
- * device-code flow ignores it and asks OpenAI whether the user approved.
+ * device-code flows ignore it and ask the provider whether the user approved.
  */
 export declare function completeOAuth(provider: SubscriptionProvider, flow: Record<string, string>, authorizationResponse: string, options: OAuthOptions): Promise<OAuthTokens>;
 export declare function refreshOAuth(credential: {