@benjamolina/pi-antigravity-guard 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jens
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,24 @@
+# Pi Antigravity Guard
+
+`@benjamolina/pi-antigravity-guard` is a Pi extension that registers the text-only `antigravity-guard` provider. It exposes exactly one selectable model, `antigravity-gemini-3.8-flash`, which is sent to Antigravity as `gemini-3.8-flash`.
+
+## Use
+
+Install the package in Pi, then run:
+
+```text
+/login antigravity-guard
+```
+
+Choose browser login, or choose manual login and paste the complete callback URL. The loopback callback uses fixed port `51121`; browser callback failures, remote shells, and port conflicts can use the manual callback-URL flow.
+
+Start a fresh text-only session with `--no-builtin-tools` and disable any active extension-provided tools. That flag does not disable extension tools by itself. Tools, tool history, images, and thinking content are unsupported and rejected rather than silently changed.
+
+## Limits and safety
+
+- This provider stores credentials through Pi's OAuth lifecycle and never reads or changes OpenCode account files; each is independent.
+- Costs are reported as zero because subscription usage is unpriced, not because access is free.
+- The documented public-to-wire model mapping is not proof that the model is live, available, or entitled. No authorized live OAuth or generation check has been run.
+- It has no account rotation, quota fallback, model substitution, or tool support.
+
+To remove it, disable or uninstall `@benjamolina/pi-antigravity-guard` and reload Pi. Removal does not delete Pi-managed credentials or revoke tokens.

package/dist/auth-http.d.ts

@@ -0,0 +1,17 @@
+import type { AuthHttpDependencies, PiCredentials } from "./types.ts";
+type AuthErrorKind = "aborted" | "authentication" | "response" | "transport";
+export declare class AuthHttpError extends Error {
+    readonly kind: AuthErrorKind;
+    readonly status?: number;
+    constructor(kind: AuthErrorKind, message: string, status?: number);
+}
+export interface ExchangeAuthorizationCodeOptions extends AuthHttpDependencies {
+    code: string;
+    verifier: string;
+}
+export interface RefreshCredentialsOptions extends AuthHttpDependencies {
+    credentials: PiCredentials;
+}
+export declare function exchangeAuthorizationCode(options: ExchangeAuthorizationCodeOptions): Promise<PiCredentials>;
+export declare function refreshCredentials(options: RefreshCredentialsOptions): Promise<PiCredentials>;
+export {};

package/dist/auth-http.js

@@ -0,0 +1,143 @@
+import { ANTIGRAVITY_OAUTH_CLIENT, buildCodeExchangeForm, buildRefreshForm, calculateTokenExpiry, } from "@benjamolina/antigravity-guard-core";
+const MAX_BODY_BYTES = 64 * 1024;
+const REQUEST_TIMEOUT_MS = 10_000;
+export class AuthHttpError extends Error {
+    kind;
+    status;
+    constructor(kind, message, status) {
+        super(message);
+        this.kind = kind;
+        this.status = status;
+    }
+}
+export async function exchangeAuthorizationCode(options) {
+    return requestTokens(buildCodeExchangeForm(ANTIGRAVITY_OAUTH_CLIENT, options), options, undefined);
+}
+export async function refreshCredentials(options) {
+    return requestTokens(buildRefreshForm(ANTIGRAVITY_OAUTH_CLIENT, options.credentials.refresh), options, options.credentials.refresh);
+}
+async function requestTokens(form, options, priorRefresh) {
+    const signal = requestSignal(options);
+    const requestTime = options.now();
+    let response;
+    try {
+        response = await abortable(options.fetch(ANTIGRAVITY_OAUTH_CLIENT.tokenEndpoint, {
+            method: "POST",
+            redirect: "error",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: form.toString(),
+            signal,
+        }), signal);
+    }
+    catch {
+        if (signal.aborted)
+            throw safeAbortError(signal);
+        throw new AuthHttpError("transport", "Authentication request failed.");
+    }
+    const body = await readBoundedBody(response, signal);
+    if (!response.ok)
+        throw responseError(response.status, tryParseJson(body));
+    return credentialsFrom(parseJson(body), requestTime, priorRefresh);
+}
+function requestSignal(options) {
+    const remaining = options.deadlineMs === undefined
+        ? REQUEST_TIMEOUT_MS
+        : Math.min(REQUEST_TIMEOUT_MS, options.deadlineMs - options.now());
+    if (remaining <= 0 || options.signal?.aborted)
+        throw safeAbortError(options.signal);
+    return options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(remaining)]) : AbortSignal.timeout(remaining);
+}
+async function readBoundedBody(response, signal) {
+    if (!response.body)
+        return "";
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const next = await abortable(reader.read(), signal);
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > MAX_BODY_BYTES)
+                throw new AuthHttpError("response", "Authentication response was too large.");
+            chunks.push(next.value);
+        }
+    }
+    catch (error) {
+        void reader.cancel().catch(() => undefined);
+        if (error instanceof AuthHttpError)
+            throw error;
+        if (signal.aborted)
+            throw safeAbortError(signal);
+        throw new AuthHttpError("transport", "Authentication request failed.");
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return new TextDecoder().decode(concat(chunks, size));
+}
+function abortable(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(safeAbortError(signal));
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(safeAbortError(signal));
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function concat(chunks, size) {
+    const output = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+function parseJson(body) {
+    const value = tryParseJson(body);
+    if (value === undefined)
+        throw new AuthHttpError("response", "Authentication service returned an invalid response.");
+    return value;
+}
+function tryParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+}
+function credentialsFrom(value, requestTime, priorRefresh) {
+    if (!isRecord(value) || !nonempty(value.access_token) || !finitePositive(value.expires_in)) {
+        throw new AuthHttpError("response", "Authentication service returned invalid credentials.");
+    }
+    if (Object.hasOwn(value, "refresh_token") && !nonempty(value.refresh_token)) {
+        throw new AuthHttpError("response", "Authentication service returned invalid credentials.");
+    }
+    const refresh = nonempty(value.refresh_token) ? value.refresh_token : priorRefresh;
+    const expires = calculateTokenExpiry(requestTime, value.expires_in);
+    if (!refresh || !Number.isFinite(expires)) {
+        throw new AuthHttpError("response", "Authentication service returned invalid credentials.");
+    }
+    return { access: value.access_token, refresh, expires };
+}
+function responseError(status, value) {
+    if (isRecord(value) && (value.error === "invalid_grant" || (isRecord(value.error) && value.error.error === "invalid_grant"))) {
+        return new AuthHttpError("authentication", "Authentication expired. Run /login antigravity-guard.", status);
+    }
+    return new AuthHttpError("authentication", status >= 500 ? "Authentication service is unavailable." : "Authentication request was rejected.", status);
+}
+function safeAbortError(signal) {
+    return new AuthHttpError("aborted", signal?.aborted ? "Authentication request was cancelled." : "Authentication request failed.");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function nonempty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function finitePositive(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0;
+}

package/dist/context.d.ts

@@ -0,0 +1,41 @@
+import type { Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
+declare const WIRE_MODEL = "gemini-3.8-flash-tiered";
+interface Part {
+    text: string;
+}
+interface Content {
+    role: "user" | "model";
+    parts: Part[];
+}
+export interface GenerationRequest {
+    project: string;
+    model: typeof WIRE_MODEL;
+    request: {
+        contents: Content[];
+        systemInstruction?: {
+            parts: Part[];
+        };
+        generationConfig: {
+            temperature: number;
+            maxOutputTokens: number;
+            thinkingConfig: {
+                thinkingLevel: "low";
+                includeThoughts: false;
+            };
+        };
+    };
+    requestType: "agent";
+    userAgent: "antigravity";
+    requestId: string;
+}
+export interface SerializeTextContextInput {
+    context: Context;
+    model: Model<string>;
+    options?: SimpleStreamOptions;
+    project: string;
+    requestId: string;
+}
+export declare class ContextSerializationError extends Error {
+}
+export declare function serializeTextContext(input: SerializeTextContextInput): GenerationRequest;
+export {};

package/dist/context.js

@@ -0,0 +1,128 @@
+const MAX_TEXT_BYTES = 8 * 1024 * 1024;
+const MAX_OUTPUT_TOKENS = 65_536;
+const PUBLIC_MODEL = "antigravity-gemini-3.8-flash";
+const WIRE_MODEL = "gemini-3.8-flash-tiered";
+const RESERVED_HEADERS = new Set(["authorization", "host", "content-type", "content-length"]);
+export class ContextSerializationError extends Error {
+}
+export function serializeTextContext(input) {
+    try {
+        if (!isRecord(input))
+            fail("Invalid text context.");
+        const context = field(input, "context", true);
+        const model = field(input, "model", true);
+        const options = field(input, "options");
+        const project = field(input, "project", true);
+        const requestId = field(input, "requestId", true);
+        if (!isRecord(context) || !isRecord(model) || field(model, "id", true) !== PUBLIC_MODEL || typeof project !== "string" || typeof requestId !== "string")
+            fail("Invalid text context.");
+        const systemPrompt = field(context, "systemPrompt");
+        const tools = field(context, "tools");
+        if (systemPrompt !== undefined && typeof systemPrompt !== "string")
+            fail("Text-only context is required.");
+        if (tools !== undefined) {
+            if (isDenseArray(tools).length)
+                fail("Tools are not supported by this text-only provider.");
+        }
+        validateOptions(options);
+        let textBytes = byteLength(systemPrompt ?? "");
+        const contents = [];
+        for (const message of isDenseArray(field(context, "messages", true))) {
+            if (!isRecord(message))
+                fail("Invalid text context.");
+            const role = field(message, "role", true);
+            if (role === "toolResult")
+                fail("Tool history is not supported by this text-only provider.");
+            if (role !== "user" && role !== "assistant")
+                fail("Unsupported context role for this text-only provider.");
+            const text = textParts(field(message, "content", true));
+            textBytes += text.reduce((total, part) => total + byteLength(part.text), 0);
+            if (textBytes > MAX_TEXT_BYTES)
+                fail("Text context is too large.");
+            contents.push({ role: role === "assistant" ? "model" : "user", parts: text });
+        }
+        if (!contents.length)
+            fail("A text conversation is required.");
+        const systemInstruction = systemPrompt === undefined ? undefined : { parts: [{ text: systemPrompt }] };
+        const temperature = option(options, "temperature");
+        const maxTokens = option(options, "maxTokens");
+        return { project, model: WIRE_MODEL, request: { contents, ...(systemInstruction ? { systemInstruction } : {}), generationConfig: {
+                    temperature: typeof temperature === "number" ? temperature : 1,
+                    maxOutputTokens: typeof maxTokens === "number" ? maxTokens : 4096,
+                    thinkingConfig: { thinkingLevel: "low", includeThoughts: false },
+                } }, requestType: "agent", userAgent: "antigravity", requestId };
+    }
+    catch (error) {
+        if (error instanceof ContextSerializationError)
+            throw error;
+        fail("Invalid text context.");
+    }
+}
+function textParts(content) {
+    if (typeof content === "string")
+        return content ? [{ text: content }] : fail("A text conversation is required.");
+    const parts = isDenseArray(content);
+    if (!parts.length)
+        fail("A text conversation is required.");
+    return parts.map((part) => {
+        if (!isRecord(part) || field(part, "type", true) !== "text")
+            fail("Only text context is supported by this provider.");
+        const text = field(part, "text", true);
+        if (typeof text !== "string" || !text)
+            fail("Only text context is supported by this provider.");
+        return { text };
+    });
+}
+function validateOptions(options) {
+    if (options === undefined)
+        return;
+    if (!isRecord(options))
+        fail("Invalid generation options.");
+    const reasoning = option(options, "reasoning"), budgets = option(options, "thinkingBudgets"), deferred = option(options, "deferred"), toolChoice = option(options, "toolChoice"), sampling = option(options, "samplingParams"), temperature = option(options, "temperature"), maxTokens = option(options, "maxTokens"), headers = option(options, "headers");
+    if (reasoning !== undefined || budgets !== undefined || deferred)
+        fail("Reasoning and deferred requests are not supported.");
+    if (toolChoice !== undefined && toolChoice !== "none")
+        fail("Tools are not supported by this text-only provider.");
+    if (sampling !== undefined)
+        fail("Custom generation options are not supported.");
+    if (temperature !== undefined && (typeof temperature !== "number" || !Number.isFinite(temperature) || temperature < 0 || temperature > 2))
+        fail("Temperature must be finite and between 0 and 2.");
+    if (maxTokens !== undefined && (typeof maxTokens !== "number" || !Number.isInteger(maxTokens) || maxTokens <= 0 || maxTokens > MAX_OUTPUT_TOKENS))
+        fail("maxTokens must be a positive integer no greater than 65536.");
+    if (headers !== undefined && !isRecord(headers))
+        fail("Invalid generation options.");
+    for (const name of headers ? Object.keys(headers) : [])
+        if (RESERVED_HEADERS.has(name.toLowerCase()))
+            fail("Custom headers cannot replace protected request headers.");
+}
+function byteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function isRecord(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function field(record, name, required = false) {
+    const descriptor = Object.getOwnPropertyDescriptor(record, name);
+    if (!descriptor)
+        return required ? fail("Invalid text context.") : undefined;
+    return "value" in descriptor ? descriptor.value : fail("Invalid text context.");
+}
+function option(options, name) {
+    return isRecord(options) ? field(options, name) : undefined;
+}
+function isDenseArray(value) {
+    if (!Array.isArray(value))
+        fail("Invalid text context.");
+    for (let index = 0; index < value.length; index++) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (!descriptor || !("value" in descriptor))
+            fail("Invalid text context.");
+    }
+    return value;
+}
+function fail(message) {
+    throw new ContextSerializationError(message);
+}

package/dist/extension.d.ts

@@ -0,0 +1,2 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export default function extension(pi: Pick<ExtensionAPI, "registerProvider">): void;

package/dist/extension.js

@@ -0,0 +1,4 @@
+import { registerAntigravityProvider } from "./provider.js";
+export default function extension(pi) {
+    registerAntigravityProvider(pi);
+}

package/dist/loopback.d.ts

@@ -0,0 +1,45 @@
+export type LoopbackOutcome = {
+    kind: "callback";
+    code: string;
+} | {
+    kind: "denied";
+} | {
+    kind: "rejected";
+    reason: "invalid-callback";
+} | {
+    kind: "manual";
+    reason: "manual" | "listener-failure" | "timeout";
+} | {
+    kind: "cancelled";
+};
+export interface LoopbackRequest {
+    method?: string;
+    host?: string;
+    remoteAddress?: string;
+    url?: string;
+}
+export type CallbackValidation = {
+    kind: "callback";
+    code: string;
+} | {
+    kind: "denied";
+} | {
+    kind: "reject";
+} | {
+    kind: "ignore";
+    status: 404 | 405;
+};
+export interface LoopbackReceiver {
+    ready: Promise<void>;
+    result: Promise<LoopbackOutcome>;
+    cancel(): void;
+}
+export interface LoopbackOptions {
+    state: string;
+    mode?: "loopback" | "manual";
+    signal?: AbortSignal;
+    loopbackWindowMs?: number;
+    totalDeadlineMs?: number;
+}
+export declare function validateLoopbackCallback(request: LoopbackRequest, state: string): CallbackValidation;
+export declare function openLoopbackReceiver(options: LoopbackOptions): LoopbackReceiver;

package/dist/loopback.js

@@ -0,0 +1,171 @@
+import { createServer } from "node:http";
+import { timingSafeEqual } from "node:crypto";
+const ADDRESS = "127.0.0.1";
+const PORT = 51121;
+const HOST = "localhost:51121";
+const PATH = "/oauth-callback";
+const MAX_URL_BYTES = 8 * 1024;
+const LOOPBACK_WINDOW_MS = 30_000;
+const TOTAL_DEADLINE_MS = 5 * 60_000;
+const RESPONSE = "<!doctype html><title>Authorization complete</title><p>You may close this window.</p>";
+function hasOne(values) {
+    return values.length === 1 && values[0].length > 0;
+}
+function isWellFormed(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            if (++index === value.length || value.charCodeAt(index) < 0xdc00 || value.charCodeAt(index) > 0xdfff)
+                return false;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff)
+            return false;
+    }
+    return true;
+}
+function stateMatches(expected, actual) {
+    if (!isWellFormed(expected) || !isWellFormed(actual))
+        return false;
+    const expectedBytes = Buffer.from(expected, "utf8");
+    const actualBytes = Buffer.from(actual, "utf8");
+    return expectedBytes.length === actualBytes.length && timingSafeEqual(expectedBytes, actualBytes);
+}
+export function validateLoopbackCallback(request, state) {
+    try {
+        const target = request.url;
+        if (!target?.startsWith("/") || Buffer.byteLength(target, "utf8") > MAX_URL_BYTES)
+            return { kind: "reject" };
+        if (target.includes("#"))
+            return { kind: "reject" };
+        const queryAt = target.indexOf("?");
+        const rawPath = target.slice(0, queryAt === -1 ? target.length : queryAt);
+        if (rawPath !== PATH) {
+            if (rawPath.startsWith("//") || rawPath.includes("..") || rawPath.includes("%"))
+                return { kind: "reject" };
+            return { kind: "ignore", status: 404 };
+        }
+        const rawQuery = queryAt === -1 ? "" : target.slice(queryAt + 1);
+        if (/%(?![0-9a-f]{2})/i.test(rawQuery))
+            return { kind: "reject" };
+        try {
+            decodeURIComponent(rawQuery.replace(/\+/g, "%20"));
+        }
+        catch {
+            return { kind: "reject" };
+        }
+        if (request.method !== "GET")
+            return { kind: "ignore", status: 405 };
+        if (request.host !== HOST || request.remoteAddress !== ADDRESS)
+            return { kind: "reject" };
+        const parameters = new URLSearchParams(rawQuery);
+        const codes = parameters.getAll("code");
+        const states = parameters.getAll("state");
+        const errors = parameters.getAll("error");
+        if (!hasOne(states) || !stateMatches(state, states[0]))
+            return { kind: "reject" };
+        if (hasOne(codes) === hasOne(errors))
+            return { kind: "reject" };
+        return hasOne(codes) ? { kind: "callback", code: codes[0] } : { kind: "denied" };
+    }
+    catch {
+        return { kind: "reject" };
+    }
+}
+export function openLoopbackReceiver(options) {
+    let server;
+    let timer;
+    let settled = false;
+    let readyResolve;
+    let resolve;
+    const ready = new Promise((done) => { readyResolve = done; });
+    const result = new Promise((done) => { resolve = done; });
+    const sockets = new Set();
+    const cleanup = () => new Promise((done) => {
+        if (timer)
+            clearTimeout(timer);
+        options.signal?.removeEventListener("abort", cancel);
+        for (const socket of sockets)
+            socket.destroy();
+        sockets.clear();
+        if (!server)
+            return done();
+        server.close(() => done());
+    });
+    const claim = () => {
+        if (settled)
+            return false;
+        settled = true;
+        return true;
+    };
+    const settle = (outcome) => {
+        if (!claim())
+            return;
+        void cleanup().finally(() => resolve(outcome));
+    };
+    const cancel = () => settle({ kind: "cancelled" });
+    const fallback = (reason) => settle({ kind: "manual", reason });
+    if (options.signal?.aborted) {
+        readyResolve();
+        cancel();
+    }
+    else if (options.mode === "manual") {
+        readyResolve();
+        settle({ kind: "manual", reason: "manual" });
+    }
+    else if (options.totalDeadlineMs !== undefined && options.totalDeadlineMs <= 0) {
+        readyResolve();
+        fallback("timeout");
+    }
+    else {
+        server = createServer((request, response) => {
+            let validation;
+            try {
+                validation = validateLoopbackCallback({
+                    method: request.method,
+                    host: request.headers.host,
+                    remoteAddress: request.socket.remoteAddress,
+                    url: request.url,
+                }, options.state);
+            }
+            catch {
+                validation = { kind: "reject" };
+            }
+            if (validation.kind === "ignore") {
+                response.writeHead(validation.status).end();
+                return;
+            }
+            const outcome = validation.kind === "callback"
+                ? validation
+                : validation.kind === "denied"
+                    ? validation
+                    : { kind: "rejected", reason: "invalid-callback" };
+            if (!claim()) {
+                response.writeHead(409).end();
+                return;
+            }
+            response.writeHead(validation.kind === "callback" ? 200 : 400, {
+                "cache-control": "no-store",
+                "content-security-policy": "default-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+                "content-type": "text/html; charset=utf-8",
+            }).end(RESPONSE, () => {
+                setImmediate(() => void cleanup().finally(() => resolve(outcome)));
+            });
+        });
+        server.on("connection", (socket) => {
+            sockets.add(socket);
+            socket.once("close", () => sockets.delete(socket));
+        });
+        server.once("error", () => {
+            readyResolve();
+            fallback("listener-failure");
+        });
+        server.listen(PORT, ADDRESS, () => {
+            readyResolve();
+            const total = Math.min(options.totalDeadlineMs ?? TOTAL_DEADLINE_MS, TOTAL_DEADLINE_MS);
+            const window = Math.min(options.loopbackWindowMs ?? LOOPBACK_WINDOW_MS, total);
+            timer = setTimeout(() => fallback("timeout"), Math.max(0, window));
+        });
+        options.signal?.addEventListener("abort", cancel, { once: true });
+    }
+    return { ready, result, cancel };
+}

package/dist/oauth.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai/oauth";
+import { exchangeAuthorizationCode, refreshCredentials } from "./auth-http.ts";
+import { openLoopbackReceiver } from "./loopback.ts";
+import type { LoopbackReceiver } from "./loopback.ts";
+import { resolveLoginProject } from "./project.ts";
+import type { LoginProject } from "./project.ts";
+export interface PiOAuthDependencies {
+    fetch: typeof globalThis.fetch;
+    now: () => number;
+    randomBytes?: (size: number) => Uint8Array;
+    exchange?: typeof exchangeAuthorizationCode;
+    refresh?: typeof refreshCredentials;
+    project?: (options: Parameters<typeof resolveLoginProject>[0]) => Promise<LoginProject>;
+    openLoopback?: (options: Parameters<typeof openLoopbackReceiver>[0]) => LoopbackReceiver;
+}
+export interface PiOAuthLifecycle {
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+    refreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;
+    getApiKey(credentials: OAuthCredentials): string;
+}
+export declare function createPiOAuthLifecycle(dependencies: PiOAuthDependencies): PiOAuthLifecycle;