auth "zai-coding-plan" {
	name "Z.AI (GLM Coding Plan · Sign in)"
	login "oauth-code" {
		client-id "client_P8X5CMWmlaRO9gyO-KSqtg" env="ZAI_OAUTH_CLIENT_ID"
		authorize-url "https://chat.z.ai/api/oauth/authorize" env="ZAI_OAUTH_AUTHORIZE_URL"
		// No PKCE: matches ZCode's authorize request verbatim.
		// Z.AI's server-side allowlist now rejects every loopback redirect_uri for
		// this client (#10745); only ZCode's desktop scheme still validates. On a
		// supported local desktop, temporarily receive that scheme and restore its
		// previous handler. Remote and unsupported sessions retain manual input.
		// `redirect-uri-env` lets users adapt to further allowlist shifts without a release.
		callback port=0 redirect-uri="zcode://zai-auth/callback" redirect-uri-env="ZAI_OAUTH_REDIRECT_URI" manual-only=#true native-scheme=#true
		instructions "Complete Z.ai login in your browser. On supported local desktops, omp captures the zcode:// callback and restores its previous handler automatically. You can also paste the final redirect URL or authorization code when prompted."
		token url="https://zcode.z.ai/api/v1/oauth/token" url-env="ZAI_OAUTH_TOKEN_URL" body="json" standard=#false {
			params {
				provider "zai"
				code "{code}"
				redirect_uri "{redirect_uri}"
				state "{state}"
			}
		}
		credential {
			access "data.zai.access_token"
			expires "never"
			email "data.user.email"
			account-id "data.user.id"
		}
		// Business login then provisions/reuses OMP's durable id.secret API key.
		after-exchange hook="zai-mint-key"
	}
	store-as "zai"
	refresh "none"
}