@linxiraos/pi-ai 1.0.0

package/src/registry/baseten.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginBaseten = createApiKeyLogin({
+	providerLabel: "Baseten",
+	authUrl: "https://app.baseten.co/settings/api_keys",
+	instructions: "Copy your API key from the Baseten dashboard",
+	promptMessage: "Paste your Baseten API key",
+	placeholder: "bt_...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "Baseten",
+		modelsUrl: "https://inference.baseten.co/v1/models",
+	},
+});
+
+export const basetenProvider = {
+	id: "baseten",
+	name: "Baseten",
+	login: (cb: OAuthLoginCallbacks) => loginBaseten(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/bedrock-mantle.ts

@@ -0,0 +1,34 @@
+import {
+	type BedrockMantleOptions,
+	createBedrockMantleAuthenticatedFetch,
+	prepareBedrockMantleRequest,
+} from "../providers/bedrock-mantle";
+import type { Model } from "../types";
+import { resolveAwsRegion } from "../utils/aws-profile";
+import { resolveAwsBearerToken, resolveAwsRegistryApiKey } from "./aws";
+import type { ProviderDefinition } from "./types";
+
+export const bedrockMantleProvider = {
+	id: "bedrock-mantle",
+	name: "Amazon Bedrock Mantle",
+	envKeys: resolveAwsRegistryApiKey,
+	allowsMissingApiKey: true,
+	prepareRequest: (model, options) =>
+		prepareBedrockMantleRequest(model as Model<"openai-responses">, options as BedrockMantleOptions),
+	mapSimpleOptions: options => ({ providerOptions: options.providerOptions }),
+	prepareModelDiscovery: config => {
+		const bearerToken = resolveAwsBearerToken(config.apiKey);
+		if (!bearerToken) {
+			return { ...config, apiKey: undefined, authenticated: false };
+		}
+		const region = resolveAwsRegion();
+		return {
+			authenticated: true,
+			baseUrl: `https://bedrock-mantle.${encodeURIComponent(region)}.api.aws/openai/v1`,
+			fetch: createBedrockMantleAuthenticatedFetch({
+				fetch: config.fetch,
+				providerOptions: { bearerToken, region },
+			}),
+		};
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/cerebras.ts

@@ -0,0 +1,23 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginCerebras = createApiKeyLogin({
+	providerLabel: "Cerebras",
+	authUrl: "https://cloud.cerebras.ai/platform/",
+	instructions: "Copy your API key from the Cerebras dashboard",
+	promptMessage: "Paste your Cerebras API key",
+	placeholder: "csk-...",
+	validation: {
+		kind: "chat-completions",
+		provider: "Cerebras",
+		baseUrl: "https://api.cerebras.ai/v1",
+		model: "gpt-oss-120b",
+	},
+});
+
+export const cerebrasProvider = {
+	id: "cerebras",
+	name: "Cerebras",
+	login: (cb: OAuthLoginCallbacks) => loginCerebras(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/cloudflare-ai-gateway.ts

@@ -0,0 +1,45 @@
+import * as AIError from "../error";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const AUTH_URL = "https://developers.cloudflare.com/ai-gateway/configuration/authentication/";
+
+/**
+ * Login to Cloudflare AI Gateway.
+ *
+ * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginCloudflareAiGateway(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Cloudflare AI Gateway");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions:
+			"Copy your Cloudflare AI Gateway token/API key. Configure account/gateway base URL in models config.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Cloudflare AI Gateway token/API key",
+		placeholder: "cf-aig-...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	return trimmed;
+}
+
+export const cloudflareAiGatewayProvider = {
+	id: "cloudflare-ai-gateway",
+	name: "Cloudflare AI Gateway",
+	login: (cb: OAuthLoginCallbacks) => loginCloudflareAiGateway(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/coreweave.ts

@@ -0,0 +1,40 @@
+import { coreWeaveProjectHeaders } from "@linxiraos/pi-catalog/wire/coreweave";
+import { $env } from "@linxiraos/pi-utils";
+import * as AIError from "../error";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const PROJECT_PERSIST_INSTRUCTIONS =
+	"add export COREWEAVE_PROJECT=<team>/<project> to your shell startup file (for example ~/.zshrc, ~/.bashrc, or your shell's profile/rc file)";
+const PROJECT_SETUP_INSTRUCTIONS = `Create or select a CoreWeave Serverless Inference project, ${PROJECT_PERSIST_INSTRUCTIONS} for the OpenAI-Project header, then copy your API key from account settings`;
+
+function requireCoreWeaveProjectHeaders(): Record<string, string> {
+	const headers = coreWeaveProjectHeaders($env);
+	if (!headers) {
+		throw new AIError.ConfigurationError(
+			`CoreWeave Serverless Inference requires OpenAI-Project. Set COREWEAVE_PROJECT=<team>/<project> before running /login coreweave. To persist it, ${PROJECT_PERSIST_INSTRUCTIONS}.`,
+		);
+	}
+	return headers;
+}
+
+export const loginCoreWeave = createApiKeyLogin({
+	providerLabel: "CoreWeave Serverless Inference",
+	authUrl: "https://wandb.ai/settings",
+	instructions: PROJECT_SETUP_INSTRUCTIONS,
+	promptMessage: "Paste your CoreWeave Serverless Inference API key",
+	placeholder: "api-key",
+	validation: {
+		kind: "models-endpoint",
+		provider: "CoreWeave Serverless Inference",
+		modelsUrl: "https://api.inference.wandb.ai/v1/models",
+		headers: requireCoreWeaveProjectHeaders,
+	},
+});
+
+export const coreWeaveProvider = {
+	id: "coreweave",
+	name: "CoreWeave Serverless Inference",
+	login: (cb: OAuthLoginCallbacks) => loginCoreWeave(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/cursor.ts

@@ -0,0 +1,20 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const cursorProvider = {
+	id: "cursor",
+	name: "Cursor (Claude, GPT, etc.)",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginCursor } = await import("./oauth/cursor");
+		return loginCursor(
+			url => cb.onAuth({ url }),
+			cb.onProgress ? () => cb.onProgress?.("Waiting for browser authentication...") : undefined,
+		);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshCursorToken } = await import("./oauth/cursor");
+		return refreshCursorToken(credentials.refresh);
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/deepseek.ts

@@ -0,0 +1,46 @@
+import * as AIError from "../error";
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthController, OAuthLoginCallbacks, OAuthPrompt } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const innerLogin = createApiKeyLogin({
+	providerLabel: "DeepSeek",
+	authUrl: "https://platform.deepseek.com/api_keys",
+	instructions: "Create or copy your API key from the DeepSeek dashboard",
+	promptMessage: "Paste your DeepSeek API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "deepseek",
+		modelsUrl: "https://api.deepseek.com/v1/models",
+	},
+});
+
+export function normalizeDeepSeekApiKey(raw: string): string {
+	const trimmed = raw.trim();
+	if (!trimmed) {
+		return trimmed;
+	}
+	const stripped = trimmed.replace(/^bearer\b\s*/i, "");
+	if (!stripped) {
+		throw new AIError.ApiKeyRequiredError("DeepSeek API key is empty after stripping Bearer prefix");
+	}
+	return stripped;
+}
+
+export const loginDeepSeek = async (options: OAuthController): Promise<string> => {
+	const userOnPrompt = options.onPrompt;
+	const wrapped: OAuthController = userOnPrompt
+		? {
+				...options,
+				onPrompt: async (prompt: OAuthPrompt) => normalizeDeepSeekApiKey(await userOnPrompt(prompt)),
+			}
+		: options;
+	return innerLogin(wrapped);
+};
+
+export const deepseekProvider = {
+	id: "deepseek",
+	name: "DeepSeek",
+	login: (cb: OAuthLoginCallbacks) => loginDeepSeek(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/derived.ts

@@ -0,0 +1,9 @@
+import { PROVIDER_REGISTRY } from "./registry";
+
+/**
+ * Providers whose OAuth flow needs a pasted code/redirect URL rather than a
+ * local callback server. Consumed by the coding-agent login UX.
+ */
+export const PASTE_CODE_LOGIN_PROVIDERS: ReadonlySet<string> = new Set(
+	PROVIDER_REGISTRY.filter(p => p.pasteCodeFlow).map(p => p.id),
+);

package/src/registry/devin.ts

@@ -0,0 +1,15 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const devinProvider = {
+	id: "devin",
+	name: "Devin",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep OAuth flow modules out of the eager registry graph.
+		const { loginDevin } = await import("./oauth/devin");
+		const credentials = await loginDevin(cb);
+		return credentials.access;
+	},
+	callbackPort: 59653,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/exa.ts

@@ -0,0 +1,19 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginExa = createApiKeyLogin({
+	providerLabel: "Exa",
+	authUrl: "https://dashboard.exa.ai/api-keys",
+	instructions: "Create or copy your API key from the Exa dashboard.",
+	promptMessage: "Paste your Exa API key",
+	placeholder: "API key",
+	validation: null,
+});
+
+export const exaProvider = {
+	id: "exa",
+	name: "Exa",
+	envKeys: "EXA_API_KEY",
+	login: (cb: OAuthLoginCallbacks) => loginExa(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/firepass.ts

@@ -0,0 +1,32 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+/**
+ * Fire Pass login flow.
+ *
+ * Fire Pass is a Fireworks subscription product whose dedicated `fpk_…` API
+ * keys are scoped to the `accounts/fireworks/routers/kimi-k2p6-turbo` router
+ * (Kimi K2.6 Turbo). The key does NOT authorize `/v1/models`, so validation
+ * pings the chat completions endpoint with the router id directly.
+ * See https://docs.fireworks.ai/firepass.
+ */
+export const loginFirepass = createApiKeyLogin({
+	providerLabel: "Fire Pass",
+	authUrl: "https://app.fireworks.ai/settings/users/api-keys",
+	instructions: "Create a dedicated Fire Pass API key in the Fireworks dashboard",
+	promptMessage: "Paste your Fire Pass API key",
+	placeholder: "fpk_...",
+	validation: {
+		kind: "chat-completions",
+		provider: "Fire Pass",
+		baseUrl: "https://api.fireworks.ai/inference/v1",
+		model: "accounts/fireworks/routers/kimi-k2p6-turbo",
+	},
+});
+
+export const firepassProvider = {
+	id: "firepass",
+	name: "Fire Pass (Fireworks Kimi K2.6 Turbo subscription)",
+	login: (cb: OAuthLoginCallbacks) => loginFirepass(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/fireworks.ts

@@ -0,0 +1,28 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginFireworks = createApiKeyLogin({
+	providerLabel: "Fireworks",
+	authUrl: "https://app.fireworks.ai/settings/users/api-keys",
+	instructions: "Create or copy your Fireworks API key",
+	promptMessage: "Paste your Fireworks API key",
+	placeholder: "fw_...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "Fireworks",
+		// The OpenAI-compatible inference listing (`/inference/v1/models`) enumerates
+		// the caller's *deployed* models and returns `500 Error listing deployed models`
+		// for accounts without active deployments, which rejected valid `fw_…` keys
+		// during `/login`. The control-plane `List Models` API hits the static
+		// `fireworks` serverless catalog (same endpoint discovery uses) and only
+		// requires the key to authenticate, not to own any deployments.
+		modelsUrl: "https://api.fireworks.ai/v1/accounts/fireworks/models?filter=supports_serverless%3Dtrue&pageSize=1",
+	},
+});
+
+export const fireworksProvider = {
+	id: "fireworks",
+	name: "Fireworks",
+	login: (cb: OAuthLoginCallbacks) => loginFireworks(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/github-copilot.ts

@@ -0,0 +1,22 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const githubCopilotProvider = {
+	id: "github-copilot",
+	name: "GitHub Copilot",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginGitHubCopilot } = await import("./oauth/github-copilot");
+		return loginGitHubCopilot({
+			onAuth: (url, instructions) => cb.onAuth({ url, instructions }),
+			onPrompt: cb.onPrompt,
+			onProgress: cb.onProgress,
+			signal: cb.signal,
+		});
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshGitHubCopilotToken } = await import("./oauth/github-copilot");
+		return refreshGitHubCopilotToken(credentials.refresh, credentials.enterpriseUrl, credentials.apiEndpoint);
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/gitlab-duo-workflow.ts

@@ -0,0 +1,20 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const gitLabDuoWorkflowProvider = {
+	id: "gitlab-duo-agent",
+	name: "GitLab Duo Agent",
+	envKeys: "GITLAB_TOKEN",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginGitLabDuoWorkflow } = await import("./oauth/gitlab-duo-workflow");
+		return loginGitLabDuoWorkflow(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshGitLabDuoWorkflowToken } = await import("./oauth/gitlab-duo-workflow");
+		return refreshGitLabDuoWorkflowToken(credentials);
+	},
+	callbackPort: 8080,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/gitlab-duo.ts

@@ -0,0 +1,19 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const gitlabDuoProvider = {
+	id: "gitlab-duo",
+	name: "GitLab Duo Non-Agentic",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginGitLabDuo } = await import("./oauth/gitlab-duo");
+		return loginGitLabDuo(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshGitLabDuoToken } = await import("./oauth/gitlab-duo");
+		return refreshGitLabDuoToken(credentials);
+	},
+	callbackPort: 8080,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/gmi-cloud.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginGmiCloud = createApiKeyLogin({
+	providerLabel: "GMI Cloud",
+	authUrl: "https://console.gmicloud.ai",
+	instructions: "Create or copy your GMI Cloud API key",
+	promptMessage: "Paste your GMI Cloud API key",
+	placeholder: "eyJ...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "GMI Cloud",
+		modelsUrl: "https://api.gmi-serving.com/v1/models",
+	},
+});
+
+export const gmiCloudProvider = {
+	id: "gmi-cloud",
+	name: "GMI Cloud",
+	login: (cb: OAuthLoginCallbacks) => loginGmiCloud(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/google-antigravity.ts

@@ -0,0 +1,22 @@
+import * as AIError from "../error";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const googleAntigravityProvider = {
+	id: "google-antigravity",
+	name: "Antigravity (Gemini 3, Claude, GPT-OSS)",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginAntigravity } = await import("./oauth/google-antigravity");
+		return loginAntigravity(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		if (!credentials.projectId) {
+			throw new AIError.ConfigurationError("Antigravity credentials missing projectId");
+		}
+		const { refreshAntigravityToken } = await import("./oauth/google-antigravity");
+		return refreshAntigravityToken(credentials.refresh, credentials.projectId);
+	},
+	callbackPort: 51121,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/google-gemini-cli.ts

@@ -0,0 +1,22 @@
+import * as AIError from "../error";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const googleGeminiCliProvider = {
+	id: "google-gemini-cli",
+	name: "Google Cloud Code Assist (Gemini CLI)",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginGeminiCli } = await import("./oauth/google-gemini-cli");
+		return loginGeminiCli(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		if (!credentials.projectId) {
+			throw new AIError.ConfigurationError("Google Cloud credentials missing projectId");
+		}
+		const { refreshGoogleCloudToken } = await import("./oauth/google-gemini-cli");
+		return refreshGoogleCloudToken(credentials.refresh, credentials.projectId);
+	},
+	callbackPort: 8085,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/google-vertex.ts

@@ -0,0 +1,38 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { $env } from "@linxiraos/pi-utils";
+import type { ProviderDefinition } from "./types";
+
+let cachedVertexAdcCredentialsExists: boolean | null = null;
+
+function hasVertexAdcCredentials(): boolean {
+	if (cachedVertexAdcCredentialsExists === null) {
+		const gacPath = $env.GOOGLE_APPLICATION_CREDENTIALS;
+		if (gacPath) {
+			cachedVertexAdcCredentialsExists = fs.existsSync(gacPath);
+		} else {
+			cachedVertexAdcCredentialsExists = fs.existsSync(
+				path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json"),
+			);
+		}
+	}
+	return cachedVertexAdcCredentialsExists;
+}
+
+export const googleVertexProvider = {
+	id: "google-vertex",
+	name: "Google Vertex AI",
+	// Vertex AI supports either GOOGLE_CLOUD_API_KEY or Application Default Credentials.
+	envKeys: () => {
+		if ($env.GOOGLE_CLOUD_API_KEY) {
+			return $env.GOOGLE_CLOUD_API_KEY;
+		}
+		const hasCredentials = hasVertexAdcCredentials();
+		const hasProject = !!($env.GOOGLE_CLOUD_PROJECT || $env.GCP_PROJECT || $env.GCLOUD_PROJECT);
+		const hasLocation = !!($env.GOOGLE_VERTEX_LOCATION || $env.GOOGLE_CLOUD_LOCATION || $env.VERTEX_LOCATION);
+		if (hasCredentials && hasProject && hasLocation) {
+			return "<authenticated>";
+		}
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/google.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const googleProvider = {
+	id: "google",
+	name: "Google Gemini",
+} as const satisfies ProviderDefinition;

package/src/registry/groq.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const groqProvider = {
+	id: "groq",
+	name: "Groq",
+} as const satisfies ProviderDefinition;

package/src/registry/huggingface.ts

@@ -0,0 +1,29 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const AUTH_URL =
+	"https://huggingface.co/settings/tokens/new?ownUserPermissions=inference.serverless.write&tokenType=fineGrained";
+const API_BASE_URL = "https://router.huggingface.co/v1";
+const VALIDATION_MODEL = "openai/gpt-oss-120b";
+
+export const loginHuggingface = createApiKeyLogin({
+	providerLabel: "Hugging Face",
+	authUrl: AUTH_URL,
+	instructions:
+		"Create/copy a token with Make calls to Inference Providers permission (usable as HUGGINGFACE_HUB_TOKEN or HF_TOKEN)",
+	promptMessage: "Paste your Hugging Face token (HUGGINGFACE_HUB_TOKEN / HF_TOKEN)",
+	placeholder: "hf_...",
+	validation: {
+		kind: "chat-completions",
+		provider: "Hugging Face",
+		baseUrl: API_BASE_URL,
+		model: VALIDATION_MODEL,
+	},
+});
+
+export const huggingfaceProvider = {
+	id: "huggingface",
+	name: "Hugging Face Inference",
+	login: (cb: OAuthLoginCallbacks) => loginHuggingface(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/index.ts

@@ -0,0 +1,4 @@
+export * from "./derived";
+export * from "./oauth";
+export * from "./registry";
+export * from "./types";

package/src/registry/kagi.ts

@@ -0,0 +1,46 @@
+import * as AIError from "../error";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const AUTH_URL = "https://kagi.com/settings/api";
+
+/**
+ * Login to Kagi.
+ *
+ * Opens browser to API settings and prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginKagi(options: OAuthController): Promise<string> {
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError("Kagi");
+	}
+
+	options.onAuth?.({
+		url: AUTH_URL,
+		instructions:
+			"Copy your Kagi Search API key from Kagi API settings. Search API access is beta-only; if unavailable, email support@kagi.com.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Kagi API key",
+		placeholder: "KG_...",
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	return trimmed;
+}
+
+export const kagiProvider = {
+	id: "kagi",
+	name: "Kagi",
+	envKeys: "KAGI_API_KEY",
+	login: (cb: OAuthLoginCallbacks) => loginKagi(cb),
+} as const satisfies ProviderDefinition;