@linxiraos/pi-ai 1.0.0

package/src/registry/oauth/xiaomi.ts

@@ -0,0 +1,211 @@
+/**
+ * Xiaomi MiMo login flow.
+ *
+ * Xiaomi MiMo provides OpenAI-compatible models via
+ * https://api.xiaomimimo.com/v1.
+ *
+ * Standard Xiaomi login opens the pay-as-you-go API key console. Token Plan
+ * login opens plan management so users copy the regional `tp-...` key.
+ */
+
+import * as AIError from "../../error";
+import type { FetchImpl } from "../../types";
+import type { OAuthController } from "./types";
+
+const PROVIDER_ID = "xiaomi";
+const PROVIDER_NAME = "Xiaomi MiMo";
+const STANDARD_AUTH_URL = "https://platform.xiaomimimo.com/#/console/api-keys";
+const TOKEN_PLAN_AUTH_URL = "https://platform.xiaomimimo.com/console/plan-manage";
+const STANDARD_API_BASE_URL = "https://api.xiaomimimo.com/v1";
+const TOKEN_PLAN_KEY_PREFIX = "tp-";
+const STANDARD_VALIDATION_MODEL = "mimo-v2.5";
+const TOKEN_PLAN_VALIDATION_MODEL = "mimo-v2.5";
+const TOKEN_PLAN_SGP_API_BASE_URL = "https://token-plan-sgp.xiaomimimo.com/v1";
+const TOKEN_PLAN_AMS_API_BASE_URL = "https://token-plan-ams.xiaomimimo.com/v1";
+const TOKEN_PLAN_CN_API_BASE_URL = "https://token-plan-cn.xiaomimimo.com/v1";
+
+/** Region codes accepted by the Xiaomi Token Plan login flow. */
+export type XiaomiTokenPlanRegion = "sgp" | "ams" | "cn";
+
+type XiaomiValidationEndpoint = {
+	baseUrl: string;
+	model: string;
+};
+
+const TOKEN_PLAN_VALIDATION_ENDPOINTS: Record<XiaomiTokenPlanRegion, XiaomiValidationEndpoint> = {
+	sgp: { baseUrl: TOKEN_PLAN_SGP_API_BASE_URL, model: TOKEN_PLAN_VALIDATION_MODEL },
+	ams: { baseUrl: TOKEN_PLAN_AMS_API_BASE_URL, model: TOKEN_PLAN_VALIDATION_MODEL },
+	cn: { baseUrl: TOKEN_PLAN_CN_API_BASE_URL, model: TOKEN_PLAN_VALIDATION_MODEL },
+};
+
+const TOKEN_PLAN_REGION_NAMES: Record<XiaomiTokenPlanRegion, string> = {
+	sgp: "Singapore",
+	ams: "Europe",
+	cn: "China",
+};
+
+function isTokenPlanKey(apiKey: string): boolean {
+	return apiKey.startsWith(TOKEN_PLAN_KEY_PREFIX);
+}
+
+const VALIDATION_TIMEOUT_MS = 15_000;
+
+async function validateXiaomiApiKey(
+	apiKey: string,
+	tokenPlanRegion: XiaomiTokenPlanRegion | undefined,
+	signal?: AbortSignal,
+	fetchOverride?: FetchImpl,
+): Promise<void> {
+	const fetchImpl = fetchOverride ?? fetch;
+	// Region-specific Token Plan logins must validate against the selected
+	// cluster. Generic Xiaomi login keeps the historical SGP → AMS → CN fallback.
+	const endpoints = tokenPlanRegion
+		? [TOKEN_PLAN_VALIDATION_ENDPOINTS[tokenPlanRegion]]
+		: isTokenPlanKey(apiKey)
+			? [
+					TOKEN_PLAN_VALIDATION_ENDPOINTS.sgp,
+					TOKEN_PLAN_VALIDATION_ENDPOINTS.ams,
+					TOKEN_PLAN_VALIDATION_ENDPOINTS.cn,
+				]
+			: [{ baseUrl: STANDARD_API_BASE_URL, model: STANDARD_VALIDATION_MODEL }];
+
+	let lastError: Error | null = null;
+
+	for (const ep of endpoints) {
+		// Fresh timeout per endpoint so SGP→AMS fallback works after a regional
+		// timeout: a shared AbortSignal.timeout would stay aborted and instantly
+		// abort the AMS fetch.
+		const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+		const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+		try {
+			const response = await fetchImpl(`${ep.baseUrl}/chat/completions`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${apiKey}`,
+				},
+				body: JSON.stringify({
+					model: ep.model,
+					max_tokens: 1,
+					messages: [{ role: "user", content: "ping" }],
+				}),
+				signal: requestSignal,
+			});
+
+			if (response.ok) {
+				return;
+			}
+
+			// 401 means this endpoint didn't accept the key; try the next one
+			if (response.status === 401) {
+				let details = "";
+				try {
+					details = (await response.text()).trim();
+				} catch {
+					// ignore body parse errors, status is enough
+				}
+				lastError = new AIError.OAuthError(
+					details
+						? `${PROVIDER_NAME} API key validation failed (${response.status}): ${details}`
+						: `${PROVIDER_NAME} API key validation failed (${response.status})`,
+					{ kind: "validation", provider: PROVIDER_ID, status: response.status },
+				);
+				continue;
+			}
+
+			// Non-auth errors are real failures
+			let details = "";
+			try {
+				details = (await response.text()).trim();
+			} catch {
+				// ignore body parse errors, status is enough
+			}
+			const message = details
+				? `${PROVIDER_NAME} API key validation failed (${response.status}): ${details}`
+				: `${PROVIDER_NAME} API key validation failed (${response.status})`;
+			throw new AIError.OAuthError(message, {
+				kind: "validation",
+				provider: PROVIDER_ID,
+				status: response.status,
+			});
+		} catch (e) {
+			// Only re-throw AbortError when the caller explicitly cancelled.
+			// Timeout aborts (from AbortSignal.timeout) should fall through to
+			// the next endpoint so SGP→AMS fallback works during regional outages.
+			if (e instanceof DOMException && e.name === "AbortError" && signal?.aborted) {
+				throw e;
+			}
+			lastError = e instanceof Error ? e : new Error(String(e));
+		}
+	}
+	throw (
+		lastError ??
+		new AIError.OAuthError(`${PROVIDER_NAME} API key validation failed`, {
+			kind: "validation",
+			provider: PROVIDER_ID,
+		})
+	);
+}
+
+/**
+ * Login to Xiaomi MiMo.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export async function loginXiaomi(options: OAuthController): Promise<string> {
+	const fetchImpl = options.fetch ?? fetch;
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError(PROVIDER_NAME);
+	}
+	options.onAuth?.({
+		url: STANDARD_AUTH_URL,
+		instructions: "Copy your API key from the Xiaomi MiMo console",
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your Xiaomi API key (sk-... or token-plan tp-...)",
+		placeholder: "sk-... or tp-...",
+	});
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	options.onProgress?.(`Validating ${PROVIDER_ID} API key...`);
+	await validateXiaomiApiKey(trimmed, undefined, options.signal, fetchImpl);
+	return trimmed;
+}
+
+/**
+ * Login to a regional Xiaomi Token Plan endpoint.
+ *
+ * Prompts for a token-plan API key and validates it against the selected region.
+ */
+export async function loginXiaomiTokenPlan(options: OAuthController, region: XiaomiTokenPlanRegion): Promise<string> {
+	const fetchImpl = options.fetch ?? fetch;
+	if (!options.onPrompt) {
+		throw new AIError.OnPromptRequiredError(`Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]})`);
+	}
+	options.onAuth?.({
+		url: TOKEN_PLAN_AUTH_URL,
+		instructions: `Copy your token-plan API key for the ${TOKEN_PLAN_REGION_NAMES[region]} region`,
+	});
+	const apiKey = await options.onPrompt({
+		message: `Paste your Xiaomi Token Plan ${TOKEN_PLAN_REGION_NAMES[region]} API key (tp-...)`,
+		placeholder: "tp-...",
+	});
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError();
+	}
+
+	options.onProgress?.(`Validating Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]}) API key...`);
+	await validateXiaomiApiKey(trimmed, region, options.signal, fetchImpl);
+	return trimmed;
+}

package/src/registry/oauth/zai.ts

@@ -0,0 +1,285 @@
+/**
+ * Z.ai / GLM OAuth flow (GLM Coding Plan · Sign in)
+ *
+ * Mirrors ZCode's desktop "Individual Plan" browser sign-in: an
+ * authorization-code flow (no PKCE) against chat.z.ai, a JSON token exchange
+ * that yields a short-lived OAuth access token, and a business-API sequence
+ * that provisions a durable `id.secret` API key. The minted key is placed in
+ * {@link OAuthCredentials.access}; `getOAuthApiKey` returns it verbatim as the
+ * request bearer for the `zai` provider, so no dialect change is needed.
+ */
+
+import * as AIError from "../../error";
+import type { FetchImpl } from "../../types";
+import { OAuthCallbackFlow } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const env = (key: string): string | undefined => {
+	const value = process.env[key];
+	return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+
+const CLIENT_ID = env("ZAI_OAUTH_CLIENT_ID") ?? "client_P8X5CMWmlaRO9gyO-KSqtg";
+const AUTHORIZE_URL = env("ZAI_OAUTH_AUTHORIZE_URL") ?? "https://chat.z.ai/api/oauth/authorize";
+const TOKEN_URL = env("ZAI_OAUTH_TOKEN_URL") ?? "https://zcode.z.ai/api/v1/oauth/token";
+const BIZ_BASE = env("ZAI_BIZ_BASE") ?? "https://api.z.ai";
+/** Business-login endpoint: exchanges the OAuth access token for a biz token. */
+const BUSINESS_LOGIN_URL = env("ZAI_BUSINESS_LOGIN_URL") ?? "https://api.z.ai/api/auth/z/login";
+/** OMP's own key name so sign-in never mutates ZCode's `zcode-api-key`. */
+const KEY_NAME = "oh-my-pi";
+const CALLBACK_PORT = 54548;
+const CALLBACK_PATH = "/callback";
+/** Durable minted key never expires; matches the perplexity NEVER_EXPIRES sentinel. */
+const NEVER_EXPIRES = 8.64e15;
+
+function formatErrorDetails(error: unknown): string {
+	if (error instanceof Error) {
+		return error.message;
+	}
+	return String(error);
+}
+
+/**
+ * Z.ai's `{ code, msg, data, success }` envelope. The OAuth token endpoint
+ * signals success with `code: 0`; the biz endpoints (`api.z.ai`) use
+ * `code: 200` / `success: true`. Accept both; throw `msg` on failure. Bodies
+ * without a status wrapper pass through unchanged.
+ */
+function isSuccessCode(code: unknown): boolean {
+	if (code == null) return true;
+	if (typeof code === "number") return code === 0 || code === 200;
+	if (typeof code === "string") return code === "0" || code === "200";
+	return false;
+}
+
+function unwrapEnvelope(body: unknown, operation: string): unknown {
+	if (body && typeof body === "object" && ("code" in body || "success" in body)) {
+		const envelope = body as { code?: unknown; msg?: string; data?: unknown; success?: unknown };
+		if (envelope.success === false || !isSuccessCode(envelope.code)) {
+			throw new AIError.OAuthError(`Z.ai ${operation} failed: ${envelope.msg ?? `code ${String(envelope.code)}`}`, {
+				kind: "token-exchange",
+				provider: "zai",
+			});
+		}
+		return "data" in envelope ? envelope.data : envelope;
+	}
+	return body;
+}
+
+async function getJson(url: string, headers: Record<string, string>, fetchImpl: FetchImpl): Promise<unknown> {
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers,
+		signal: AbortSignal.timeout(30_000),
+	});
+	const responseBody = await response.text();
+	if (!response.ok) {
+		throw new AIError.ProviderHttpError(
+			`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`,
+			response.status,
+		);
+	}
+	return responseBody.length > 0 ? JSON.parse(responseBody) : undefined;
+}
+
+async function postJson(
+	url: string,
+	body: Record<string, string | number>,
+	headers: Record<string, string>,
+	fetchImpl: FetchImpl,
+): Promise<unknown> {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: { ...headers, "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(30_000),
+	});
+	const responseBody = await response.text();
+	if (!response.ok) {
+		throw new AIError.ProviderHttpError(
+			`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`,
+			response.status,
+		);
+	}
+	return responseBody.length > 0 ? JSON.parse(responseBody) : undefined;
+}
+
+/** Coerce an api_keys list response (bare array or common wrapper shapes) to an array. */
+function asKeyArray(value: unknown): Array<Record<string, unknown>> {
+	if (Array.isArray(value)) return value as Array<Record<string, unknown>>;
+	if (value && typeof value === "object") {
+		const record = value as Record<string, unknown>;
+		for (const field of ["list", "keys", "apiKeys", "records"]) {
+			if (Array.isArray(record[field])) return record[field] as Array<Record<string, unknown>>;
+		}
+	}
+	return [];
+}
+
+function trimmedString(value: unknown): string | undefined {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+
+/**
+ * Exchange the short-lived OAuth access token for a durable biz token via
+ * ZCode's business-login endpoint. The biz APIs reject the raw OAuth token;
+ * they require this token.
+ */
+async function businessLogin(oauthAccessToken: string, fetchImpl: FetchImpl): Promise<string> {
+	const data = unwrapEnvelope(
+		await postJson(BUSINESS_LOGIN_URL, { token: oauthAccessToken }, {}, fetchImpl),
+		"business login",
+	) as { access_token?: unknown; accessToken?: unknown } | undefined;
+	const bizToken = trimmedString(data?.access_token) ?? trimmedString(data?.accessToken);
+	if (!bizToken) {
+		throw new AIError.OAuthError("Z.ai business login returned no access token", {
+			kind: "token-exchange",
+			provider: "zai",
+		});
+	}
+	return bizToken;
+}
+
+interface ZaiProject {
+	projectId?: unknown;
+	isDefault?: unknown;
+}
+interface ZaiOrganization {
+	organizationId?: unknown;
+	isDefault?: unknown;
+	projects?: ZaiProject[];
+}
+
+/**
+ * Provision the durable Z.ai API key from a short-lived OAuth access token,
+ * mirroring ZCode: business-login → resolve default org/project from
+ * `getCustomerInfo` → find/create the OMP-named key → obtain its secret →
+ * return `${apiKey}.${secretKey}` (the 49-char durable key).
+ */
+async function mintZaiApiKey(oauthAccessToken: string, fetchImpl: FetchImpl): Promise<string> {
+	const bizToken = await businessLogin(oauthAccessToken, fetchImpl);
+	const auth = { Authorization: `Bearer ${bizToken}` };
+
+	const customer = unwrapEnvelope(
+		await getJson(`${BIZ_BASE}/api/biz/customer/getCustomerInfo`, auth, fetchImpl),
+		"customer lookup",
+	) as { organizations?: ZaiOrganization[] } | undefined;
+	const orgs = Array.isArray(customer?.organizations) ? customer.organizations : [];
+	const org = orgs.find(o => o?.isDefault) ?? orgs[0];
+	const projects = Array.isArray(org?.projects) ? org.projects : [];
+	const project = projects.find(p => p?.isDefault) ?? projects[0];
+	const organizationId = trimmedString(org?.organizationId);
+	const projectId = trimmedString(project?.projectId);
+	if (!organizationId || !projectId) {
+		throw new AIError.OAuthError("Z.ai key provisioning failed: no organization/project on account", {
+			kind: "token-exchange",
+			provider: "zai",
+		});
+	}
+
+	const keysUrl = `${BIZ_BASE}/api/biz/v1/organization/${organizationId}/projects/${projectId}/api_keys`;
+	const existing = asKeyArray(unwrapEnvelope(await getJson(keysUrl, auth, fetchImpl), "api key list")).find(
+		key => key.name === KEY_NAME,
+	);
+	const keyRecord =
+		existing ??
+		(unwrapEnvelope(await postJson(keysUrl, { name: KEY_NAME }, auth, fetchImpl), "api key create") as
+			| Record<string, unknown>
+			| undefined);
+
+	const apiKey = trimmedString(keyRecord?.apiKey);
+	if (!apiKey) {
+		throw new AIError.OAuthError("Z.ai key provisioning returned no apiKey", {
+			kind: "token-exchange",
+			provider: "zai",
+		});
+	}
+
+	// Always fetch the secret via the copy endpoint: list entries mask it
+	// (`*****abcd`) and the create response's inline secret is not reliable
+	// across account states, whereas copy always returns the full secret.
+	const copied = unwrapEnvelope(
+		await getJson(`${keysUrl}/copy/${encodeURIComponent(apiKey)}`, auth, fetchImpl),
+		"api key copy",
+	) as { secretKey?: unknown } | undefined;
+	const secretKey = trimmedString(copied?.secretKey);
+	if (!secretKey) {
+		throw new AIError.OAuthError("Z.ai key provisioning returned no secretKey", {
+			kind: "token-exchange",
+			provider: "zai",
+		});
+	}
+
+	return `${apiKey}.${secretKey}`;
+}
+
+export class ZaiOAuthFlow extends OAuthCallbackFlow {
+	#fetch: FetchImpl;
+
+	constructor(ctrl: OAuthController) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		// No PKCE: matches ZCode's authorize request verbatim.
+		const authParams = new URLSearchParams({
+			redirect_uri: redirectUri,
+			response_type: "code",
+			client_id: CLIENT_ID,
+			state,
+		});
+		return {
+			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+			instructions:
+				"Complete Z.ai login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.",
+		};
+	}
+
+	async exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials> {
+		if (this.ctrl.signal?.aborted) {
+			throw new AIError.LoginCancelledError(`OAuth callback cancelled: ${this.ctrl.signal.reason}`);
+		}
+
+		let body: unknown;
+		try {
+			// Non-standard token body (no grant_type/code_verifier): matches ZCode.
+			body = await postJson(TOKEN_URL, { provider: "zai", code, redirect_uri: redirectUri, state }, {}, this.#fetch);
+		} catch (error) {
+			throw new AIError.OAuthError(
+				`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; details=${formatErrorDetails(error)}`,
+				{ kind: "token-exchange", provider: "zai", cause: error },
+			);
+		}
+
+		const data = unwrapEnvelope(body, "token exchange") as
+			| { zai?: { access_token?: unknown }; user?: { email?: unknown; id?: unknown } }
+			| undefined;
+		const oauthAccessToken = trimmedString(data?.zai?.access_token);
+		if (!oauthAccessToken) {
+			throw new AIError.OAuthError("Z.ai token response missing access token", {
+				kind: "validation",
+				provider: "zai",
+			});
+		}
+
+		const mintedKey = await mintZaiApiKey(oauthAccessToken, this.#fetch);
+
+		return {
+			access: mintedKey,
+			refresh: "",
+			expires: NEVER_EXPIRES,
+			email: typeof data?.user?.email === "string" ? data.user.email : undefined,
+			accountId:
+				typeof data?.user?.id === "string" || typeof data?.user?.id === "number" ? String(data.user.id) : undefined,
+		};
+	}
+}
+
+/**
+ * Login with Z.ai OAuth (GLM Coding Plan).
+ */
+export async function loginZaiOAuth(ctrl: OAuthController): Promise<OAuthCredentials> {
+	const flow = new ZaiOAuthFlow(ctrl);
+	return flow.login();
+}

package/src/registry/ollama-cloud.ts

@@ -0,0 +1,36 @@
+import * as AIError from "../error";
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const OLLAMA_CLOUD_KEYS_URL = "https://ollama.com/settings/keys";
+
+export async function loginOllamaCloud(options: OAuthController): Promise<string> {
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	if (!options.onPrompt) {
+		throw new AIError.ConfigurationError("Interactive prompt is required for Ollama Cloud login");
+	}
+	options.onAuth?.({
+		url: OLLAMA_CLOUD_KEYS_URL,
+		instructions: "Create an Ollama Cloud API key, then paste it here.",
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your Ollama Cloud API key",
+		placeholder: "ollama-cloud-api-key",
+	});
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	const trimmed = apiKey.trim();
+	if (!trimmed) {
+		throw new AIError.ApiKeyRequiredError("Ollama Cloud API key is required");
+	}
+	return trimmed;
+}
+
+export const ollamaCloudProvider = {
+	id: "ollama-cloud",
+	name: "Ollama Cloud",
+	login: (cb: OAuthLoginCallbacks) => loginOllamaCloud(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/ollama.ts

@@ -0,0 +1,43 @@
+import * as AIError from "../error";
+import type { OAuthController } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+const OLLAMA_DOCS_URL = "https://github.com/ollama/ollama/blob/main/docs/api.md";
+
+/**
+ * Login to Ollama.
+ *
+ * Returns a trimmed API key/token string. Empty string means local no-auth mode.
+ */
+export async function loginOllama(options: OAuthController): Promise<string> {
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+	if (!options.onPrompt) {
+		return "";
+	}
+
+	options.onAuth?.({
+		url: OLLAMA_DOCS_URL,
+		instructions:
+			"Optional: paste an Ollama API key/token for authenticated hosts. Leave empty for local no-auth mode.",
+	});
+
+	const apiKey = await options.onPrompt({
+		message: "Paste your Ollama API key/token (optional)",
+		placeholder: "ollama-local",
+		allowEmpty: true,
+	});
+
+	if (options.signal?.aborted) {
+		throw new AIError.LoginCancelledError();
+	}
+
+	return apiKey.trim();
+}
+
+export const ollamaProvider = {
+	id: "ollama",
+	name: "Ollama (Local OpenAI-compatible)",
+	login: loginOllama,
+} as const satisfies ProviderDefinition;

package/src/registry/openai-codex-device.ts

@@ -0,0 +1,18 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const openaiCodexDeviceProvider = {
+	id: "openai-codex-device",
+	name: "ChatGPT Plus/Pro (Codex, headless/device)",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginOpenAICodexDevice } = await import("./oauth/openai-codex");
+		return loginOpenAICodexDevice(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshOpenAICodexToken } = await import("./oauth/openai-codex");
+		return refreshOpenAICodexToken(credentials.refresh);
+	},
+	storeCredentialsAs: "openai-codex",
+} as const satisfies ProviderDefinition;

package/src/registry/openai-codex.ts

@@ -0,0 +1,19 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const openaiCodexProvider = {
+	id: "openai-codex",
+	name: "ChatGPT Plus/Pro (Codex Subscription)",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginOpenAICodex } = await import("./oauth/openai-codex");
+		return loginOpenAICodex(cb);
+	},
+	refreshToken: async (credentials: OAuthCredentials) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { refreshOpenAICodexToken } = await import("./oauth/openai-codex");
+		return refreshOpenAICodexToken(credentials.refresh);
+	},
+	callbackPort: 1455,
+	pasteCodeFlow: true,
+} as const satisfies ProviderDefinition;

package/src/registry/openai.ts

@@ -0,0 +1,6 @@
+import type { ProviderDefinition } from "./types";
+
+export const openaiProvider = {
+	id: "openai",
+	name: "OpenAI",
+} as const satisfies ProviderDefinition;

package/src/registry/opencode-go.ts

@@ -0,0 +1,12 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const opencodeGoProvider = {
+	id: "opencode-go",
+	name: "OpenCode Go",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginOpenCode } = await import("./oauth/opencode");
+		return loginOpenCode(cb);
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/opencode-zen.ts

@@ -0,0 +1,12 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const opencodeZenProvider = {
+	id: "opencode-zen",
+	name: "OpenCode Zen",
+	login: async (cb: OAuthLoginCallbacks) => {
+		// Lazy import: keep heavy OAuth flow modules out of the eager registry graph.
+		const { loginOpenCode } = await import("./oauth/opencode");
+		return loginOpenCode(cb);
+	},
+} as const satisfies ProviderDefinition;

package/src/registry/openrouter.ts

@@ -0,0 +1,28 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+/** OpenRouter login flow (API key paste, validated via /auth/key).
+ *
+ * `/api/v1/models` is public and returns 200 for any bearer (including bogus),
+ * so it cannot validate auth. `/api/v1/auth/key` is the canonical "who am I"
+ * endpoint — 200 for valid keys, 401 otherwise.
+ */
+export const loginOpenRouter = createApiKeyLogin({
+	providerLabel: "OpenRouter",
+	authUrl: "https://openrouter.ai/keys",
+	instructions: "Create or copy your OpenRouter API key",
+	promptMessage: "Paste your OpenRouter API key",
+	placeholder: "sk-or-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "OpenRouter",
+		modelsUrl: "https://openrouter.ai/api/v1/auth/key",
+	},
+});
+
+export const openrouterProvider = {
+	id: "openrouter",
+	name: "OpenRouter",
+	login: (cb: OAuthLoginCallbacks) => loginOpenRouter(cb),
+} as const satisfies ProviderDefinition;