@xiaoso/dsh-tool-plus 0.1.0-beta.3 → 0.1.0-beta.4

package/lib/xiaomi-D2qT5cAC.mjs

@@ -0,0 +1,157 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { _ as OnPromptRequiredError, c as OAuthError, h as LoginCancelledError, m as ApiKeyRequiredError } from "./error-Dd8DIqs-.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/xiaomi.ts
+/**
+* Xiaomi MiMo login flow.
+*
+* Xiaomi MiMo provides OpenAI-compatible models via
+* https://api.xiaomimimo.com/v1.
+*
+* Standard Xiaomi login opens the pay-as-you-go API key console. Token Plan
+* login opens plan management so users copy the regional `tp-...` key.
+*/
+const PROVIDER_ID = "xiaomi";
+const PROVIDER_NAME = "Xiaomi MiMo";
+const STANDARD_AUTH_URL = "https://platform.xiaomimimo.com/#/console/api-keys";
+const TOKEN_PLAN_AUTH_URL = "https://platform.xiaomimimo.com/console/plan-manage";
+const STANDARD_API_BASE_URL = "https://api.xiaomimimo.com/v1";
+const TOKEN_PLAN_KEY_PREFIX = "tp-";
+const STANDARD_VALIDATION_MODEL = "mimo-v2.5";
+const TOKEN_PLAN_VALIDATION_MODEL = "mimo-v2.5";
+const TOKEN_PLAN_VALIDATION_ENDPOINTS = {
+	sgp: {
+		baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1",
+		model: TOKEN_PLAN_VALIDATION_MODEL
+	},
+	ams: {
+		baseUrl: "https://token-plan-ams.xiaomimimo.com/v1",
+		model: TOKEN_PLAN_VALIDATION_MODEL
+	},
+	cn: {
+		baseUrl: "https://token-plan-cn.xiaomimimo.com/v1",
+		model: TOKEN_PLAN_VALIDATION_MODEL
+	}
+};
+const TOKEN_PLAN_REGION_NAMES = {
+	sgp: "Singapore",
+	ams: "Europe",
+	cn: "China"
+};
+function isTokenPlanKey(apiKey) {
+	return apiKey.startsWith(TOKEN_PLAN_KEY_PREFIX);
+}
+const VALIDATION_TIMEOUT_MS = 15e3;
+async function validateXiaomiApiKey(apiKey, tokenPlanRegion, signal, fetchOverride) {
+	const fetchImpl = fetchOverride ?? fetch;
+	const endpoints = tokenPlanRegion ? [TOKEN_PLAN_VALIDATION_ENDPOINTS[tokenPlanRegion]] : isTokenPlanKey(apiKey) ? [
+		TOKEN_PLAN_VALIDATION_ENDPOINTS.sgp,
+		TOKEN_PLAN_VALIDATION_ENDPOINTS.ams,
+		TOKEN_PLAN_VALIDATION_ENDPOINTS.cn
+	] : [{
+		baseUrl: STANDARD_API_BASE_URL,
+		model: STANDARD_VALIDATION_MODEL
+	}];
+	let lastError = null;
+	for (const ep of endpoints) {
+		const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+		const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+		try {
+			const response = await fetchImpl(`${ep.baseUrl}/chat/completions`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${apiKey}`
+				},
+				body: JSON.stringify({
+					model: ep.model,
+					max_tokens: 1,
+					messages: [{
+						role: "user",
+						content: "ping"
+					}]
+				}),
+				signal: requestSignal
+			});
+			if (response.ok) return;
+			if (response.status === 401) {
+				let details = "";
+				try {
+					details = (await response.text()).trim();
+				} catch {}
+				lastError = new OAuthError(details ? `${PROVIDER_NAME} API key validation failed (${response.status}): ${details}` : `${PROVIDER_NAME} API key validation failed (${response.status})`, {
+					kind: "validation",
+					provider: PROVIDER_ID,
+					status: response.status
+				});
+				continue;
+			}
+			let details = "";
+			try {
+				details = (await response.text()).trim();
+			} catch {}
+			const message = details ? `${PROVIDER_NAME} API key validation failed (${response.status}): ${details}` : `${PROVIDER_NAME} API key validation failed (${response.status})`;
+			throw new OAuthError(message, {
+				kind: "validation",
+				provider: PROVIDER_ID,
+				status: response.status
+			});
+		} catch (e) {
+			if (e instanceof DOMException && e.name === "AbortError" && signal?.aborted) throw e;
+			lastError = e instanceof Error ? e : new Error(String(e));
+		}
+	}
+	throw lastError ?? new OAuthError(`${PROVIDER_NAME} API key validation failed`, {
+		kind: "validation",
+		provider: PROVIDER_ID
+	});
+}
+/**
+* Login to Xiaomi MiMo.
+*
+* Opens browser to API keys page, prompts user to paste their API key.
+* Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+*/
+async function loginXiaomi(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	if (!options.onPrompt) throw new OnPromptRequiredError(PROVIDER_NAME);
+	options.onAuth?.({
+		url: STANDARD_AUTH_URL,
+		instructions: "Copy your API key from the Xiaomi MiMo console"
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your Xiaomi API key (sk-... or token-plan tp-...)",
+		placeholder: "sk-... or tp-..."
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = apiKey.trim();
+	if (!trimmed) throw new ApiKeyRequiredError();
+	options.onProgress?.(`Validating ${PROVIDER_ID} API key...`);
+	await validateXiaomiApiKey(trimmed, void 0, options.signal, fetchImpl);
+	return trimmed;
+}
+/**
+* Login to a regional Xiaomi Token Plan endpoint.
+*
+* Prompts for a token-plan API key and validates it against the selected region.
+*/
+async function loginXiaomiTokenPlan(options, region) {
+	const fetchImpl = options.fetch ?? fetch;
+	if (!options.onPrompt) throw new OnPromptRequiredError(`Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]})`);
+	options.onAuth?.({
+		url: TOKEN_PLAN_AUTH_URL,
+		instructions: `Copy your token-plan API key for the ${TOKEN_PLAN_REGION_NAMES[region]} region`
+	});
+	const apiKey = await options.onPrompt({
+		message: `Paste your Xiaomi Token Plan ${TOKEN_PLAN_REGION_NAMES[region]} API key (tp-...)`,
+		placeholder: "tp-..."
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = apiKey.trim();
+	if (!trimmed) throw new ApiKeyRequiredError();
+	options.onProgress?.(`Validating Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]}) API key...`);
+	await validateXiaomiApiKey(trimmed, region, options.signal, fetchImpl);
+	return trimmed;
+}
+//#endregion
+export { loginXiaomi, loginXiaomiTokenPlan };

package/lib/zai-7DWMkEqM.mjs

@@ -0,0 +1,203 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-yCSG0mGC.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-DDSrZ6l_.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/zai.ts
+/**
+* Z.ai / GLM OAuth flow (GLM Coding Plan · Sign in)
+*
+* Mirrors ZCode's desktop "Individual Plan" browser sign-in: an
+* authorization-code flow (no PKCE) against chat.z.ai, a JSON token exchange
+* that yields a short-lived OAuth access token, and a business-API sequence
+* that provisions a durable `id.secret` API key. The minted key is placed in
+* {@link OAuthCredentials.access}; `getOAuthApiKey` returns it verbatim as the
+* request bearer for the `zai` provider, so no dialect change is needed.
+*/
+const env = (key) => {
+	const value = process.env[key];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+};
+const CLIENT_ID = env("ZAI_OAUTH_CLIENT_ID") ?? "client_P8X5CMWmlaRO9gyO-KSqtg";
+const AUTHORIZE_URL = env("ZAI_OAUTH_AUTHORIZE_URL") ?? "https://chat.z.ai/api/oauth/authorize";
+const TOKEN_URL = env("ZAI_OAUTH_TOKEN_URL") ?? "https://zcode.z.ai/api/v1/oauth/token";
+const BIZ_BASE = env("ZAI_BIZ_BASE") ?? "https://api.z.ai";
+/** Business-login endpoint: exchanges the OAuth access token for a biz token. */
+const BUSINESS_LOGIN_URL = env("ZAI_BUSINESS_LOGIN_URL") ?? "https://api.z.ai/api/auth/z/login";
+/** OMP's own key name so sign-in never mutates ZCode's `zcode-api-key`. */
+const KEY_NAME = "oh-my-pi";
+const CALLBACK_PORT = 54548;
+const CALLBACK_PATH = "/callback";
+/** Durable minted key never expires; matches the perplexity NEVER_EXPIRES sentinel. */
+const NEVER_EXPIRES = 864e13;
+function formatErrorDetails(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+/**
+* Z.ai's `{ code, msg, data, success }` envelope. The OAuth token endpoint
+* signals success with `code: 0`; the biz endpoints (`api.z.ai`) use
+* `code: 200` / `success: true`. Accept both; throw `msg` on failure. Bodies
+* without a status wrapper pass through unchanged.
+*/
+function isSuccessCode(code) {
+	if (code == null) return true;
+	if (typeof code === "number") return code === 0 || code === 200;
+	if (typeof code === "string") return code === "0" || code === "200";
+	return false;
+}
+function unwrapEnvelope(body, operation) {
+	if (body && typeof body === "object" && ("code" in body || "success" in body)) {
+		const envelope = body;
+		if (envelope.success === false || !isSuccessCode(envelope.code)) throw new OAuthError(`Z.ai ${operation} failed: ${envelope.msg ?? `code ${String(envelope.code)}`}`, {
+			kind: "token-exchange",
+			provider: "zai"
+		});
+		return "data" in envelope ? envelope.data : envelope;
+	}
+	return body;
+}
+async function getJson(url, headers, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers,
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	return responseBody.length > 0 ? JSON.parse(responseBody) : void 0;
+}
+async function postJson(url, body, headers, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: {
+			...headers,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	return responseBody.length > 0 ? JSON.parse(responseBody) : void 0;
+}
+/** Coerce an api_keys list response (bare array or common wrapper shapes) to an array. */
+function asKeyArray(value) {
+	if (Array.isArray(value)) return value;
+	if (value && typeof value === "object") {
+		const record = value;
+		for (const field of [
+			"list",
+			"keys",
+			"apiKeys",
+			"records"
+		]) if (Array.isArray(record[field])) return record[field];
+	}
+	return [];
+}
+function trimmedString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/**
+* Exchange the short-lived OAuth access token for a durable biz token via
+* ZCode's business-login endpoint. The biz APIs reject the raw OAuth token;
+* they require this token.
+*/
+async function businessLogin(oauthAccessToken, fetchImpl) {
+	const data = unwrapEnvelope(await postJson(BUSINESS_LOGIN_URL, { token: oauthAccessToken }, {}, fetchImpl), "business login");
+	const bizToken = trimmedString(data?.access_token) ?? trimmedString(data?.accessToken);
+	if (!bizToken) throw new OAuthError("Z.ai business login returned no access token", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	return bizToken;
+}
+/**
+* Provision the durable Z.ai API key from a short-lived OAuth access token,
+* mirroring ZCode: business-login → resolve default org/project from
+* `getCustomerInfo` → find/create the OMP-named key → obtain its secret →
+* return `${apiKey}.${secretKey}` (the 49-char durable key).
+*/
+async function mintZaiApiKey(oauthAccessToken, fetchImpl) {
+	const auth = { Authorization: `Bearer ${await businessLogin(oauthAccessToken, fetchImpl)}` };
+	const customer = unwrapEnvelope(await getJson(`${BIZ_BASE}/api/biz/customer/getCustomerInfo`, auth, fetchImpl), "customer lookup");
+	const orgs = Array.isArray(customer?.organizations) ? customer.organizations : [];
+	const org = orgs.find((o) => o?.isDefault) ?? orgs[0];
+	const projects = Array.isArray(org?.projects) ? org.projects : [];
+	const project = projects.find((p) => p?.isDefault) ?? projects[0];
+	const organizationId = trimmedString(org?.organizationId);
+	const projectId = trimmedString(project?.projectId);
+	if (!organizationId || !projectId) throw new OAuthError("Z.ai key provisioning failed: no organization/project on account", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	const keysUrl = `${BIZ_BASE}/api/biz/v1/organization/${organizationId}/projects/${projectId}/api_keys`;
+	const apiKey = trimmedString((asKeyArray(unwrapEnvelope(await getJson(keysUrl, auth, fetchImpl), "api key list")).find((key) => key.name === KEY_NAME) ?? unwrapEnvelope(await postJson(keysUrl, { name: KEY_NAME }, auth, fetchImpl), "api key create"))?.apiKey);
+	if (!apiKey) throw new OAuthError("Z.ai key provisioning returned no apiKey", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	const secretKey = trimmedString(unwrapEnvelope(await getJson(`${keysUrl}/copy/${encodeURIComponent(apiKey)}`, auth, fetchImpl), "api key copy")?.secretKey);
+	if (!secretKey) throw new OAuthError("Z.ai key provisioning returned no secretKey", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	return `${apiKey}.${secretKey}`;
+}
+var ZaiOAuthFlow = class extends OAuthCallbackFlow {
+	#fetch;
+	constructor(ctrl) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const authParams = new URLSearchParams({
+			redirect_uri: redirectUri,
+			response_type: "code",
+			client_id: CLIENT_ID,
+			state
+		});
+		return {
+			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+			instructions: "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		};
+	}
+	async exchangeToken(code, state, redirectUri) {
+		if (this.ctrl.signal?.aborted) throw new LoginCancelledError(`OAuth callback cancelled: ${this.ctrl.signal.reason}`);
+		let body;
+		try {
+			body = await postJson(TOKEN_URL, {
+				provider: "zai",
+				code,
+				redirect_uri: redirectUri,
+				state
+			}, {}, this.#fetch);
+		} catch (error) {
+			throw new OAuthError(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; details=${formatErrorDetails(error)}`, {
+				kind: "token-exchange",
+				provider: "zai",
+				cause: error
+			});
+		}
+		const data = unwrapEnvelope(body, "token exchange");
+		const oauthAccessToken = trimmedString(data?.zai?.access_token);
+		if (!oauthAccessToken) throw new OAuthError("Z.ai token response missing access token", {
+			kind: "validation",
+			provider: "zai"
+		});
+		return {
+			access: await mintZaiApiKey(oauthAccessToken, this.#fetch),
+			refresh: "",
+			expires: NEVER_EXPIRES,
+			email: typeof data?.user?.email === "string" ? data.user.email : void 0,
+			accountId: typeof data?.user?.id === "string" || typeof data?.user?.id === "number" ? String(data.user.id) : void 0
+		};
+	}
+};
+/**
+* Login with Z.ai OAuth (GLM Coding Plan).
+*/
+async function loginZaiOAuth(ctrl) {
+	return new ZaiOAuthFlow(ctrl).login();
+}
+//#endregion
+export { loginZaiOAuth };

package/lib/zai-C59YnomG.mjs

@@ -0,0 +1,203 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { V as ProviderHttpError, c as OAuthError, h as LoginCancelledError } from "./error-Dd8DIqs-.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-CQ5Jo8F-.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/zai.ts
+/**
+* Z.ai / GLM OAuth flow (GLM Coding Plan · Sign in)
+*
+* Mirrors ZCode's desktop "Individual Plan" browser sign-in: an
+* authorization-code flow (no PKCE) against chat.z.ai, a JSON token exchange
+* that yields a short-lived OAuth access token, and a business-API sequence
+* that provisions a durable `id.secret` API key. The minted key is placed in
+* {@link OAuthCredentials.access}; `getOAuthApiKey` returns it verbatim as the
+* request bearer for the `zai` provider, so no dialect change is needed.
+*/
+const env = (key) => {
+	const value = process.env[key];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+};
+const CLIENT_ID = env("ZAI_OAUTH_CLIENT_ID") ?? "client_P8X5CMWmlaRO9gyO-KSqtg";
+const AUTHORIZE_URL = env("ZAI_OAUTH_AUTHORIZE_URL") ?? "https://chat.z.ai/api/oauth/authorize";
+const TOKEN_URL = env("ZAI_OAUTH_TOKEN_URL") ?? "https://zcode.z.ai/api/v1/oauth/token";
+const BIZ_BASE = env("ZAI_BIZ_BASE") ?? "https://api.z.ai";
+/** Business-login endpoint: exchanges the OAuth access token for a biz token. */
+const BUSINESS_LOGIN_URL = env("ZAI_BUSINESS_LOGIN_URL") ?? "https://api.z.ai/api/auth/z/login";
+/** OMP's own key name so sign-in never mutates ZCode's `zcode-api-key`. */
+const KEY_NAME = "oh-my-pi";
+const CALLBACK_PORT = 54548;
+const CALLBACK_PATH = "/callback";
+/** Durable minted key never expires; matches the perplexity NEVER_EXPIRES sentinel. */
+const NEVER_EXPIRES = 864e13;
+function formatErrorDetails(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+/**
+* Z.ai's `{ code, msg, data, success }` envelope. The OAuth token endpoint
+* signals success with `code: 0`; the biz endpoints (`api.z.ai`) use
+* `code: 200` / `success: true`. Accept both; throw `msg` on failure. Bodies
+* without a status wrapper pass through unchanged.
+*/
+function isSuccessCode(code) {
+	if (code == null) return true;
+	if (typeof code === "number") return code === 0 || code === 200;
+	if (typeof code === "string") return code === "0" || code === "200";
+	return false;
+}
+function unwrapEnvelope(body, operation) {
+	if (body && typeof body === "object" && ("code" in body || "success" in body)) {
+		const envelope = body;
+		if (envelope.success === false || !isSuccessCode(envelope.code)) throw new OAuthError(`Z.ai ${operation} failed: ${envelope.msg ?? `code ${String(envelope.code)}`}`, {
+			kind: "token-exchange",
+			provider: "zai"
+		});
+		return "data" in envelope ? envelope.data : envelope;
+	}
+	return body;
+}
+async function getJson(url, headers, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers,
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	return responseBody.length > 0 ? JSON.parse(responseBody) : void 0;
+}
+async function postJson(url, body, headers, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: {
+			...headers,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	return responseBody.length > 0 ? JSON.parse(responseBody) : void 0;
+}
+/** Coerce an api_keys list response (bare array or common wrapper shapes) to an array. */
+function asKeyArray(value) {
+	if (Array.isArray(value)) return value;
+	if (value && typeof value === "object") {
+		const record = value;
+		for (const field of [
+			"list",
+			"keys",
+			"apiKeys",
+			"records"
+		]) if (Array.isArray(record[field])) return record[field];
+	}
+	return [];
+}
+function trimmedString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/**
+* Exchange the short-lived OAuth access token for a durable biz token via
+* ZCode's business-login endpoint. The biz APIs reject the raw OAuth token;
+* they require this token.
+*/
+async function businessLogin(oauthAccessToken, fetchImpl) {
+	const data = unwrapEnvelope(await postJson(BUSINESS_LOGIN_URL, { token: oauthAccessToken }, {}, fetchImpl), "business login");
+	const bizToken = trimmedString(data?.access_token) ?? trimmedString(data?.accessToken);
+	if (!bizToken) throw new OAuthError("Z.ai business login returned no access token", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	return bizToken;
+}
+/**
+* Provision the durable Z.ai API key from a short-lived OAuth access token,
+* mirroring ZCode: business-login → resolve default org/project from
+* `getCustomerInfo` → find/create the OMP-named key → obtain its secret →
+* return `${apiKey}.${secretKey}` (the 49-char durable key).
+*/
+async function mintZaiApiKey(oauthAccessToken, fetchImpl) {
+	const auth = { Authorization: `Bearer ${await businessLogin(oauthAccessToken, fetchImpl)}` };
+	const customer = unwrapEnvelope(await getJson(`${BIZ_BASE}/api/biz/customer/getCustomerInfo`, auth, fetchImpl), "customer lookup");
+	const orgs = Array.isArray(customer?.organizations) ? customer.organizations : [];
+	const org = orgs.find((o) => o?.isDefault) ?? orgs[0];
+	const projects = Array.isArray(org?.projects) ? org.projects : [];
+	const project = projects.find((p) => p?.isDefault) ?? projects[0];
+	const organizationId = trimmedString(org?.organizationId);
+	const projectId = trimmedString(project?.projectId);
+	if (!organizationId || !projectId) throw new OAuthError("Z.ai key provisioning failed: no organization/project on account", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	const keysUrl = `${BIZ_BASE}/api/biz/v1/organization/${organizationId}/projects/${projectId}/api_keys`;
+	const apiKey = trimmedString((asKeyArray(unwrapEnvelope(await getJson(keysUrl, auth, fetchImpl), "api key list")).find((key) => key.name === KEY_NAME) ?? unwrapEnvelope(await postJson(keysUrl, { name: KEY_NAME }, auth, fetchImpl), "api key create"))?.apiKey);
+	if (!apiKey) throw new OAuthError("Z.ai key provisioning returned no apiKey", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	const secretKey = trimmedString(unwrapEnvelope(await getJson(`${keysUrl}/copy/${encodeURIComponent(apiKey)}`, auth, fetchImpl), "api key copy")?.secretKey);
+	if (!secretKey) throw new OAuthError("Z.ai key provisioning returned no secretKey", {
+		kind: "token-exchange",
+		provider: "zai"
+	});
+	return `${apiKey}.${secretKey}`;
+}
+var ZaiOAuthFlow = class extends OAuthCallbackFlow {
+	#fetch;
+	constructor(ctrl) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const authParams = new URLSearchParams({
+			redirect_uri: redirectUri,
+			response_type: "code",
+			client_id: CLIENT_ID,
+			state
+		});
+		return {
+			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+			instructions: "Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		};
+	}
+	async exchangeToken(code, state, redirectUri) {
+		if (this.ctrl.signal?.aborted) throw new LoginCancelledError(`OAuth callback cancelled: ${this.ctrl.signal.reason}`);
+		let body;
+		try {
+			body = await postJson(TOKEN_URL, {
+				provider: "zai",
+				code,
+				redirect_uri: redirectUri,
+				state
+			}, {}, this.#fetch);
+		} catch (error) {
+			throw new OAuthError(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; details=${formatErrorDetails(error)}`, {
+				kind: "token-exchange",
+				provider: "zai",
+				cause: error
+			});
+		}
+		const data = unwrapEnvelope(body, "token exchange");
+		const oauthAccessToken = trimmedString(data?.zai?.access_token);
+		if (!oauthAccessToken) throw new OAuthError("Z.ai token response missing access token", {
+			kind: "validation",
+			provider: "zai"
+		});
+		return {
+			access: await mintZaiApiKey(oauthAccessToken, this.#fetch),
+			refresh: "",
+			expires: NEVER_EXPIRES,
+			email: typeof data?.user?.email === "string" ? data.user.email : void 0,
+			accountId: typeof data?.user?.id === "string" || typeof data?.user?.id === "number" ? String(data.user.id) : void 0
+		};
+	}
+};
+/**
+* Login with Z.ai OAuth (GLM Coding Plan).
+*/
+async function loginZaiOAuth(ctrl) {
+	return new ZaiOAuthFlow(ctrl).login();
+}
+//#endregion
+export { loginZaiOAuth };