@mupt-ai/dari-gateway 0.2.1 → 0.3.1

package/src/providers/subscription_limits.ts

@@ -4,7 +4,7 @@ import { providerFailureMessage } from "../runtime/provider_stream_outcome.js";
 import type { ProviderKeySource } from "../types.js";
 import type { CapturedProviderResponse } from "./response_capture.js";
 
-export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex";
+export type SubscriptionOAuthProvider = "anthropic_claude_code" | "openai_codex" | "meta_muse";
 
 export type SubscriptionUsageLimit = {
   oauthProvider: SubscriptionOAuthProvider;
@@ -25,6 +25,7 @@ const FAILURE_MARKER = "subscription_usage_limit";
 const SUBSCRIPTION_LABEL: Record<SubscriptionOAuthProvider, string> = {
   anthropic_claude_code: "Claude Code",
   openai_codex: "ChatGPT",
+  meta_muse: "Muse Code",
 };
 
 export function subscriptionOAuthProviderFor(
@@ -34,13 +35,16 @@ export function subscriptionOAuthProviderFor(
   if (keySource !== "subscription") return null;
   if (provider === "anthropic") return "anthropic_claude_code";
   if (provider === "openai" || provider === "openai-codex") return "openai_codex";
+  if (provider === "meta") return "meta_muse";
   return null;
 }
 
 /**
  * Recognize a personal subscription that has run out of quota. Claude Code
  * answers 429 with the unified rate-limit headers; the ChatGPT backend answers
- * 429 with a structured `error.code` and `resets_at`. The Codex WebSocket
+ * 429 with a structured `error.code` and `resets_at`. Meta documents no
+ * usage-limit signature for Muse Code plans, so any 429 on one holds it until
+ * the reset Meta gives, if any. The Codex WebSocket
  * transport bypasses fetch, so its usage-limit error only survives as message
  * text and is matched there without a reset time.
  */
@@ -57,6 +61,7 @@ export function detectSubscriptionUsageLimit(args: {
   if (oauthProvider === "anthropic_claude_code") {
     return anthropicUsageLimit(args.captured, now);
   }
+  if (oauthProvider === "meta_muse") return museUsageLimit(args.captured, now);
   return codexUsageLimit(args.captured, providerFailureMessage(args.failure), now);
 }
 
@@ -109,6 +114,18 @@ function codexUsageLimit(
   };
 }
 
+function museUsageLimit(
+  captured: CapturedProviderResponse | undefined,
+  now: Date,
+): SubscriptionUsageLimit | null {
+  if (captured === undefined || captured.status !== 429) return null;
+  return {
+    oauthProvider: "meta_muse",
+    resetsAt: laterReset(codexErrorBody(captured.bodyText)?.resets_at, captured.headers, now),
+    reason: "Muse Code usage limit reached.",
+  };
+}
+
 function codexErrorBody(bodyText: string): Record<string, unknown> | null {
   try {
     const parsed: unknown = JSON.parse(bodyText);
@@ -178,13 +195,13 @@ export function subscriptionUsageLimitFromFailure(
   const oauthProvider = marker.oauth_provider;
   const resetsAt = typeof marker.resets_at === "string" ? new Date(marker.resets_at) : null;
   if (
-    (oauthProvider !== "anthropic_claude_code" && oauthProvider !== "openai_codex")
+    typeof oauthProvider !== "string" || !(oauthProvider in SUBSCRIPTION_LABEL)
     || resetsAt === null || Number.isNaN(resetsAt.getTime())
   ) {
     return null;
   }
   return {
-    oauthProvider,
+    oauthProvider: oauthProvider as SubscriptionOAuthProvider,
     resetsAt,
     reason: typeof marker.reason === "string" ? marker.reason : "Subscription usage limit reached.",
     ...(marker.switched === true ? { switched: true } : {}),

package/src/runtime/explicit_model.ts

@@ -14,14 +14,7 @@ export function explicitModelDecision(
 ): RoutedDecision | null {
   const modelId = explicitModelId(prepared.interaction.model);
   if (modelId === null) return null;
-  if (!prepared.credentials.enabled_models.includes(modelId)) {
-    throw new HttpError(
-      400,
-      `Model '${modelId}' is not enabled on this router.`,
-      "model_not_enabled",
-      "model",
-    );
-  }
+  if (!prepared.credentials.enabled_models.includes(modelId)) throw modelNotEnabled(modelId);
   const candidates = prepared.routing.candidateResolution.candidates.filter(
     (candidate) => candidate.model === modelId,
   );
@@ -63,14 +56,7 @@ function pickCandidate(
    refuses everything else instead of substituting. */
 export function strictModelDecision(prepared: PreparedRoutedCompletion): RoutedDecision {
   const modelId = explicitModelId(prepared.interaction.model);
-  if (modelId === null) {
-    throw new HttpError(
-      400,
-      "This router is strict: request a pinned model as 'dari/model/<id>'.",
-      "strict_model_required",
-      "model",
-    );
-  }
+  if (modelId === null) throw strictModelRequired();
   const { decision } = explicitModelDecision(prepared)!;
   const requested = prepared.interaction.reasoning?.effort
     ?? prepared.credentials.model_configs?.[modelId]?.default_thinking_level;
@@ -84,3 +70,16 @@ export function strictModelDecision(prepared: PreparedRoutedCompletion): RoutedD
   }
   return { decision };
 }
+
+export function modelNotEnabled(modelId: string): HttpError {
+  return new HttpError(400, `Model '${modelId}' is not enabled on this router.`, "model_not_enabled", "model");
+}
+
+export function strictModelRequired(): HttpError {
+  return new HttpError(
+    400,
+    "This router is strict: request a pinned model as 'dari/model/<id>'.",
+    "strict_model_required",
+    "model",
+  );
+}

package/src/runtime/prepare_routed_completion.ts

@@ -9,12 +9,14 @@ import {
 } from "../context/routing_context.js";
 import { isBackgroundRequest, type InteractionRequest } from "../interaction/types.js";
 import { executionProviderForModel } from "../models/execution_provider.js";
+import { codexModelConfig, subscriptionServes } from "../models/subscriptions.js";
 import { gatewayPlatform, type RequestTags } from "../platform/platform.js";
 import { resolveRouter } from "../strategies/routing.js";
 import { RequestReporter, type ReportedCandidatePruning } from "../telemetry/report.js";
 import { RoutingBillingFinalization } from "../telemetry/billing_finalization.js";
 import type { ClientHarness, ProviderCredential, ResolvedRouter } from "../types.js";
 import { requestTags } from "./request_tags.js";
+import { strictProviderAccess } from "./strict_provider_access.js";
 import type { RoutedRuntimeReporter } from "./runtime_reporter.js";
 import type { RoutedProtocol } from "./routed_protocol.js";
 import {
@@ -125,7 +127,10 @@ export async function prepareRoutedCompletion(args: {
     }
     credentials = conversationCredentials;
   }
-  credentials = await withProviderCredentials(credentials, args.apiKey);
+  const access = strictProviderAccess(credentials, args.interaction);
+  credentials = access.credentials;
+  args = { ...args, interaction: access.interaction };
+  credentials = await withProviderCredentials(credentials, args.apiKey, args.clientHarness);
   const billable = true;
   const routing = await buildRoutingContext({
     routerId: prefixFingerprintRouterId,
@@ -188,6 +193,7 @@ export async function prepareRoutedCompletion(args: {
 async function withProviderCredentials(
   credentials: ResolvedRouter,
   apiKey: string,
+  clientHarness: ClientHarness | undefined,
 ): Promise<ResolvedRouter> {
   const platform = gatewayPlatform();
   if (platform.resolveProviderCredential === undefined) return credentials;
@@ -200,14 +206,27 @@ async function withProviderCredentials(
         routerId: credentials.router_id,
         organizationId: credentials.organization_id,
         apiKey,
+        ...(clientHarness ? { clientHarness } : {}),
       }),
     ] as const),
   );
   const provider_credentials: Record<string, ProviderCredential> = {};
+  const model_configs = { ...credentials.model_configs };
   for (const [model, credential] of resolved) {
-    if (credential?.apiKey.trim()) provider_credentials[model] = credential;
+    if (!credential?.apiKey.trim()) continue;
+    const plan = credential.subscription;
+    if (plan !== undefined && !subscriptionServes(plan, model, clientHarness)) continue;
+    provider_credentials[model] = credential;
+    if (plan === "openai_codex") {
+      // Keep the catalog's limits and thinking levels; only the serving
+      // endpoint changes.
+      model_configs[model] = {
+        ...model_configs[model],
+        ...codexModelConfig(model, credentials.model_prices?.[model] ?? null),
+      };
+    }
   }
-  return { ...credentials, provider_credentials };
+  return { ...credentials, provider_credentials, model_configs };
 }
 
 // Core's cache-aware pruning audit, extended with the context layer's image

package/src/runtime/strict_provider_access.ts

@@ -0,0 +1,42 @@
+import { getBuiltinModels, getBuiltinProviders } from "@mupt-ai/pi-ai/providers/all";
+import { HttpError } from "../http/errors.js";
+import type { InteractionRequest } from "../interaction/types.js";
+import { explicitModelId } from "../protocol/input/router_model.js";
+import type { ResolvedRouter } from "../types.js";
+import { modelNotEnabled, strictModelRequired } from "./explicit_model.js";
+
+// Resolve only the requested catalog model, never turn a provider grant into
+// selector candidates. Unknown IDs fail closed; a grant-only router has no
+// candidates to route among, so it refuses them here with the strict errors.
+export function strictProviderAccess(
+  credentials: ResolvedRouter,
+  interaction: InteractionRequest,
+): { credentials: ResolvedRouter; interaction: InteractionRequest } {
+  const providers = credentials.strict_providers;
+  if (credentials.strict !== true || !providers?.length) return { credentials, interaction };
+  const requested = explicitModelId(interaction.model);
+  const grantOnly = credentials.enabled_models.length === 0;
+  if (requested === null) {
+    if (grantOnly) throw strictModelRequired();
+    return { credentials, interaction };
+  }
+  const matches = new Set<string>();
+  for (const provider of providers) {
+    if (!(getBuiltinProviders() as readonly string[]).includes(provider)) {
+      throw new HttpError(400, `Unknown strict provider '${provider}'.`, "unknown_provider");
+    }
+    for (const model of getBuiltinModels(provider as never)) {
+      const id = `${provider}/${model.id}`;
+      if (requested === id) matches.add(id);
+    }
+  }
+  const model = [...matches][0];
+  if (model === undefined) {
+    if (grantOnly) throw modelNotEnabled(requested);
+    return { credentials, interaction };
+  }
+  return {
+    credentials: { ...credentials, enabled_models: [...new Set([...credentials.enabled_models, model])] },
+    interaction: { ...interaction, model: `dari/model/${model}` },
+  };
+}

package/src/self_host/resolve.ts

@@ -4,17 +4,13 @@ import {
   nativeModelId,
   providerForModel,
   type ReasoningEffort,
-  type RouterModelPrice,
   type RouterPrefixHit,
 } from "@mupt-ai/dari-router/policy-engine";
 import { HttpError } from "../http/errors.js";
 import type { ResolveRouterRequest } from "../platform/platform.js";
+import { codexModelConfig } from "../models/subscriptions.js";
 import { registeredModelPrice } from "../providers/pi.js";
-import type {
-  ProviderKeySource,
-  ResolvedRouter,
-  ResolvedRouterModelConfig,
-} from "../types.js";
+import type { ProviderKeySource, ResolvedRouter } from "../types.js";
 import type { GatewayConfig, RouterConfig } from "./config.js";
 import {
   freshAccessToken,
@@ -29,8 +25,6 @@ import {
 export const SELF_HOSTED_ORGANIZATION_ID = "self-hosted";
 export const SELF_HOSTED_USER_ID = "self-hosted";
 
-const CODEX_BACKEND_URL = "https://chatgpt.com/backend-api";
-
 export type SelfHostedResolverDeps = {
   config: GatewayConfig;
   gatewayKeys: readonly string[];
@@ -176,8 +170,8 @@ export function gatewayKeyIndex(keys: readonly string[], presented: string): num
   return null;
 }
 
-// Claude Code plans serve only Claude Code itself; ChatGPT plans serve any
-// client through the Codex backend.
+// Claude Code plans serve only Claude Code itself and Muse Code plans only
+// Muse Code; ChatGPT plans serve any client through the Codex backend.
 function subscriptionProviderFor(
   provider: string,
   clientHarness: ResolveRouterRequest["clientHarness"],
@@ -185,6 +179,7 @@ function subscriptionProviderFor(
   if (provider === "anthropic") {
     return clientHarness === "claude_code" ? "anthropic_claude_code" : null;
   }
+  if (provider === "meta") return clientHarness === "muse_code" ? "meta_muse" : null;
   if (provider === "openai") return "openai_codex";
   return null;
 }
@@ -197,34 +192,25 @@ function servingProviders(provider: string, credential: ProviderCredential): str
     : [provider];
 }
 
-function codexModelConfig(
-  modelId: string,
-  price: RouterModelPrice | null,
-): ResolvedRouterModelConfig {
-  return {
-    provider: "openai-codex",
-    native_model_id: nativeModelId(modelId),
-    api: "openai-codex-responses",
-    base_url: CODEX_BACKEND_URL,
-    // A plan bills no tokens; the catalog price only feeds cost estimates.
-    cost: price ?? { input: 0, output: 0 },
-    fast_mode: false,
-  };
-}
-
 function thinkingLevels(router: RouterConfig): Record<string, ReasoningEffort[]> {
   return Object.fromEntries(
     router.models.flatMap((model) => model.thinking ? [[model.id, model.thinking]] : []),
   );
 }
 
+const SUBSCRIPTION_PLAN_NAMES: Record<SubscriptionProvider, string> = {
+  anthropic_claude_code: "Claude Code",
+  openai_codex: "ChatGPT",
+  meta_muse: "Muse Code",
+};
+
 function unavailableRouterError(
   routerId: string,
   exhausted: ReadonlySet<SubscriptionProvider>,
 ): HttpError {
   if (exhausted.size > 0) {
     const plans = [...exhausted]
-      .map((provider) => provider === "anthropic_claude_code" ? "Claude Code" : "ChatGPT")
+      .map((provider) => SUBSCRIPTION_PLAN_NAMES[provider])
       .join(" and ");
     return new HttpError(
       424,

package/src/self_host/subscriptions/oauth.ts

@@ -2,16 +2,18 @@ import { createHash, randomBytes } from "node:crypto";
 
 /**
  * OAuth protocols for personal subscriptions: Claude Code (PKCE, the user
- * pastes back the `code#state` Anthropic shows) and ChatGPT/Codex (device
- * code, the gateway polls for approval). Every network call goes through the
- * injected `fetch`.
+ * pastes back the `code#state` Anthropic shows), ChatGPT/Codex (device code,
+ * the gateway polls for approval), and Muse Code (Meta's device code, then the
+ * subscription's Model API key minted from the sign-in token). Every network
+ * call goes through the injected `fetch`.
  */
 
-export type SubscriptionProvider = "anthropic_claude_code" | "openai_codex";
+export type SubscriptionProvider = "anthropic_claude_code" | "openai_codex" | "meta_muse";
 
 export const SUBSCRIPTION_PROVIDERS: readonly SubscriptionProvider[] = [
   "anthropic_claude_code",
   "openai_codex",
+  "meta_muse",
 ];
 
 export type OAuthFetch = (url: string, init: RequestInit) => Promise<Response>;
@@ -20,7 +22,8 @@ export type OAuthOptions = { fetch: OAuthFetch; now?: Date };
 
 /** The provider refused or could not be reached (HTTP 502 at the edge). */
 export class SubscriptionOAuthProviderError extends Error {
-  constructor(message: string, readonly status?: number) {
+  // `errorCode` is the provider's OAuth `error` code, such as `authorization_pending`.
+  constructor(message: string, readonly status?: number, readonly errorCode?: string) {
     super(message);
     this.name = "SubscriptionOAuthProviderError";
   }
@@ -43,6 +46,8 @@ export type OAuthAuthorization = {
   flow: Record<string, string>;
 };
 
+// A Muse Code plan's access token is the Model API key minted for it, and its
+// refresh token the Meta sign-in token the key is minted from.
 export type OAuthTokens = {
   provider: SubscriptionProvider;
   accessToken: string;
@@ -76,6 +81,23 @@ const CODEX_ACCOUNT_CLAIM = "https://api.openai.com/auth";
 export const CODEX_APPROVAL_PENDING =
   "OpenAI approval is still pending. Enter the code at OpenAI, finish approval, then try again.";
 
+// Muse Code's own device sign-in (`muse login`), as its public launcher runs it.
+export const MUSE_CODE_CLIENT_ID = "1031625952748946";
+const META_AUTH_BASE_URL = "https://auth.meta.com";
+const META_DEVICE_AUTHORIZATION_URL = `${META_AUTH_BASE_URL}/oidc/device/authorization/`;
+const META_TOKEN_URL = `${META_AUTH_BASE_URL}/oidc/device/token/`;
+// Muse Code mints its subscription's Model API key from the sign-in token here.
+const MUSE_MINT_URL = "https://api.meta.ai/muse-code/key";
+// Meta states no lifetime for a minted key, and Muse Code mints a fresh one at
+// every start, so the key is minted again on this cadence.
+const MUSE_KEY_LIFETIME_MS = 12 * 60 * 60_000;
+// Marks a stored sign-in refresh token, which is exchanged for a fresh sign-in
+// token before each mint. Without it the stored value is the sign-in token.
+const MUSE_SIGN_IN_REFRESH_PREFIX = "refresh:";
+
+export const META_APPROVAL_PENDING =
+  "Meta approval is still pending. Enter the code at Meta, finish approval, then try again.";
+
 export async function startOAuth(
   provider: SubscriptionProvider,
   options: OAuthOptions,
@@ -103,6 +125,23 @@ export async function startOAuth(
       flow: { code_verifier: verifier, state },
     };
   }
+  if (provider === "meta_muse") {
+    const payload = await postForm(
+      options.fetch,
+      META_DEVICE_AUTHORIZATION_URL,
+      { client_id: MUSE_CODE_CLIENT_ID },
+      "Meta device code request",
+    );
+    const complete = payload.verification_uri_complete;
+    return {
+      authorizationUrl: typeof complete === "string" && complete.startsWith("https://")
+        ? complete
+        : requiredString(payload, "verification_uri"),
+      expiresAt,
+      userCode: requiredString(payload, "user_code"),
+      flow: { device_code: requiredString(payload, "device_code") },
+    };
+  }
   const payload = await postJson(
     options.fetch,
     `${CODEX_DEVICE_AUTH_URL}/usercode`,
@@ -120,7 +159,7 @@ export async function startOAuth(
 
 /**
  * Finish a flow. Claude Code needs the pasted authorization response; the
- * device-code flow ignores it and asks OpenAI whether the user approved.
+ * device-code flows ignore it and ask the provider whether the user approved.
  */
 export async function completeOAuth(
   provider: SubscriptionProvider,
@@ -154,6 +193,35 @@ export async function completeOAuth(
     );
     return claudeTokens(token, now, null);
   }
+  if (provider === "meta_muse") {
+    let token: Record<string, unknown>;
+    try {
+      token = await postForm(
+        options.fetch,
+        META_TOKEN_URL,
+        {
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: requiredString(flow, "device_code"),
+          client_id: MUSE_CODE_CLIENT_ID,
+        },
+        "Meta device approval check",
+      );
+    } catch (error) {
+      if (error instanceof SubscriptionOAuthProviderError) {
+        if (error.errorCode === "authorization_pending" || error.errorCode === "slow_down") {
+          throw new SubscriptionOAuthInputError(META_APPROVAL_PENDING);
+        }
+        if (error.errorCode === "access_denied") {
+          throw new SubscriptionOAuthInputError("The sign-in was declined on Meta. Start again to retry.");
+        }
+        if (error.errorCode === "expired_token") {
+          throw new SubscriptionOAuthInputError("The Meta sign-in code expired. Start again.");
+        }
+      }
+      throw error;
+    }
+    return await museTokens(requiredString(token, "access_token"), museRefreshToken(token), options.fetch, now);
+  }
 
   // The provider, not user-supplied input, supplies the authorization code.
   let approval: Record<string, unknown>;
@@ -207,6 +275,28 @@ export async function refreshOAuth(
     );
     return claudeTokens(token, now, credential.refreshToken);
   }
+  if (credential.provider === "meta_muse") {
+    let stored = credential.refreshToken;
+    let signInToken = stored;
+    if (stored.startsWith(MUSE_SIGN_IN_REFRESH_PREFIX)) {
+      const token = await postForm(
+        options.fetch,
+        META_TOKEN_URL,
+        {
+          grant_type: "refresh_token",
+          refresh_token: stored.slice(MUSE_SIGN_IN_REFRESH_PREFIX.length),
+          client_id: MUSE_CODE_CLIENT_ID,
+        },
+        "Meta sign-in refresh",
+      );
+      signInToken = requiredString(token, "access_token");
+      stored = museRefreshToken(token) ?? stored;
+    }
+    // A lapsed plan fails routing like any other refresh failure.
+    return await museTokens(signInToken, stored, options.fetch, now).catch((error: unknown) => {
+      throw error instanceof SubscriptionOAuthInputError ? new SubscriptionOAuthProviderError(error.message) : error;
+    });
+  }
   const token = await postJson(
     options.fetch,
     CODEX_TOKEN_URL,
@@ -258,6 +348,43 @@ function claudeTokens(
   };
 }
 
+function museRefreshToken(token: Record<string, unknown>): string | null {
+  const value = token.refresh_token;
+  return typeof value === "string" && value ? MUSE_SIGN_IN_REFRESH_PREFIX + value : null;
+}
+
+// Mints the plan's Model API key from the Meta sign-in token.
+async function museTokens(
+  signInToken: string,
+  refreshToken: string | null,
+  fetch: OAuthFetch,
+  now: Date,
+): Promise<OAuthTokens> {
+  const minted = await requestJson(
+    fetch,
+    MUSE_MINT_URL,
+    "{}",
+    "application/json",
+    "Muse Code subscription key mint",
+    { Authorization: `Bearer ${signInToken}`, "x-api-version": "1.0.0" },
+  );
+  // A key minted without an active plan bills Model API pay-as-you-go.
+  if (minted.is_subs_active !== true) {
+    throw new SubscriptionOAuthInputError(
+      "This Meta account has no active Muse Code subscription. Subscribe at https://accountscenter.meta.com/muse_code/, then connect again.",
+    );
+  }
+  const email = minted.user_email;
+  return {
+    provider: "meta_muse",
+    accessToken: requiredString(minted, "api_key"),
+    refreshToken: refreshToken ?? signInToken,
+    expiresAt: new Date(now.getTime() + MUSE_KEY_LIFETIME_MS),
+    accountId: null,
+    accountEmail: typeof email === "string" && email ? email : null,
+  };
+}
+
 function codexTokens(
   payload: Record<string, unknown>,
   now: Date,
@@ -353,12 +480,13 @@ async function requestJson(
   body: string,
   contentType: string,
   operation: string,
+  headers: Record<string, string> = {},
 ): Promise<Record<string, unknown>> {
   let response: Response;
   try {
     response = await fetch(url, {
       method: "POST",
-      headers: { Accept: "application/json", "Content-Type": contentType, "User-Agent": "Dari/1.0" },
+      headers: { Accept: "application/json", "Content-Type": contentType, "User-Agent": "Dari/1.0", ...headers },
       body,
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     });
@@ -366,10 +494,13 @@ async function requestJson(
     throw new SubscriptionOAuthProviderError(`${operation} could not reach the provider.`);
   }
   if (!response.ok) {
-    await response.body?.cancel();
+    // Only the RFC 6749 `error` code is kept; the rest may carry provider detail.
+    const failure: unknown = await response.json().catch(() => undefined);
+    const errorCode = isRecord(failure) && typeof failure.error === "string" ? failure.error : undefined;
     throw new SubscriptionOAuthProviderError(
       `${operation} failed with provider status ${response.status}.`,
       response.status,
+      errorCode,
     );
   }
   let decoded: unknown;

package/src/self_host/subscriptions/store.ts

@@ -47,6 +47,7 @@ export type PendingOAuthSession = {
 const BASE_NAMES: Record<SubscriptionProvider, string> = {
   anthropic_claude_code: "ANTHROPIC_CLAUDE_CODE_OAUTH_TOKEN",
   openai_codex: "OPENAI_CODEX_OAUTH_TOKEN",
+  meta_muse: "META_MUSE_OAUTH_TOKEN",
 };
 
 type CredentialRow = {

package/src/types.ts

@@ -42,12 +42,25 @@ export type AwsAssumeRoleProviderAuth = {
 // Authentication a provider call can use directly.
 export type ResolvedProviderAuth = BearerProviderAuth | AwsSigV4ProviderAuth;
 
+// A personal plan whose access token serves its provider's models in place of
+// an API key:
+// - "openai_codex": a ChatGPT plan; the token is Codex's auth.json
+//   `tokens.access_token`, served through the Codex backend.
+// - "anthropic_claude_code": a Claude Code plan; the token is the OAuth token
+//   `claude setup-token` prints. It serves Claude Code clients only.
+// - "meta_muse": a Meta (Muse) sign-in; the token is the Model API key the
+//   sign-in mints (Pi's Meta OAuth `access`).
+export type SubscriptionKind = "openai_codex" | "anthropic_claude_code" | "meta_muse";
+
 // A bearer credential an embedding platform supplies for one request through
 // GatewayPlatform.resolveProviderCredential, optionally with its own endpoint.
+// With `subscription`, `apiKey` is that plan's access token; the platform keeps
+// it fresh.
 export type ProviderCredential = {
   apiKey: string;
   baseUrl?: string;
   headers?: Record<string, string>;
+  subscription?: SubscriptionKind;
 };
 
 export type ProviderAuth = ResolvedProviderAuth | AwsAssumeRoleProviderAuth;
@@ -70,7 +83,7 @@ export type PublicEvalCatalogCard = Omit<RouterEval, "scores"> & {
   scores: PublicEvalCatalogScore[];
 };
 
-export type ClientHarness = "claude_code";
+export type ClientHarness = "claude_code" | "muse_code";
 
 export type ResolvedRouterModelConfig = {
   provider: string;
@@ -111,9 +124,13 @@ export type ResolvedRouter = {
   speculative_routing?: boolean;
   primary_retries?: number;
   // Serve only the requested `dari/model/<id>` at the requested thinking
-  // level: no selector, lease, fallback, or personal subscription, and an
-  // error for anything else, whatever the client sends.
+  // level: no selector, lease, fallback, or personal subscription the
+  // platform did not supply through resolveProviderCredential, and an error
+  // for anything else, whatever the client sends.
   strict?: boolean;
+  // On strict routers only, allow requested catalog models of these providers.
+  // Requires dari/model/<provider>/<id>; never enables fallback.
+  strict_providers?: string[];
   model_fallback_enabled?: boolean;
   fallback_requires_different_provider?: boolean;
   evals?: RouterEval[];