@linxiraos/pi-ai 1.0.0

package/dist/types/providers/pi-native-server.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Pi-native wire format for the auth-gateway.
+ *
+ * Where the OpenAI / Anthropic / Responses route modules translate foreign
+ * wire shapes through pi-ai's canonical {@link Context}, this module accepts
+ * the canonical shape *directly* — for clients that already speak pi-ai
+ * (containerized omp, robomp's sidecar auth-gateway).
+ * Skipping the wire-format → Context → wire-format round-trip cuts
+ * per-request CPU but, more importantly, avoids the quantization that those
+ * translations impose on first-class pi-ai fields (service tier, cache
+ * markers, thinking budgets, tool-choice variants, …).
+ *
+ * The streaming wire is {@link AssistantMessageEvent} serialized verbatim and
+ * SSE-framed. Same type pi-ai already produces internally; the client feeds
+ * each parsed event straight into `AssistantMessageEventStream.push()` with
+ * no translation. Including `partial: AssistantMessage` on every delta is
+ * O(N²) in turn length on the wire — acceptable for the loopback / sidecar
+ * topology this transport is designed for; provider latency dominates the
+ * actual cost.
+ *
+ * Endpoint contract:
+ *   POST /v1/pi/stream
+ *   body:    { modelId, context, options?, stream? }   // `stream` defaults to true
+ *   200 SSE: stream of `AssistantMessageEvent` (terminated by `data: [DONE]`)
+ *   200 JSON (stream=false): { message: AssistantMessage }
+ *   4xx/5xx: { error: { type, message } }
+ */
+import type { AuthGatewayStreamControl } from "../auth-gateway/types.js";
+import type { AssistantMessageEventStream, Context, SimpleStreamOptions } from "../types.js";
+export interface PiNativeParsedRequest {
+    modelId: string;
+    context: Context;
+    options: SimpleStreamOptions;
+    stream: boolean;
+}
+/**
+ * Parse a pi-native request body. Validation is intentionally minimal — only
+ * the shape the gateway itself reads is checked (`modelId`, `context.messages`
+ * array, options is an object). Everything downstream is the canonical pi-ai
+ * type surface; mis-shaped values surface as a `502 upstream_error` from
+ * `streamSimple` rather than being re-validated here.
+ *
+ * Accepts both `{ modelId: string }` and `{ model: { id: string } }` so the
+ * existing `streamProxy` client (which sends the full Model object) can target
+ * the gateway with only a URL swap.
+ */
+export declare function parseRequest(body: unknown, _headers?: Headers): PiNativeParsedRequest;
+/**
+ * Ship every {@link AssistantMessageEvent} verbatim, SSE-framed.
+ *
+ * No per-event re-shaping: the pi-native client is pi-ai itself, so the
+ * canonical event type IS the wire type. Including the rolling
+ * `partial: AssistantMessage` on every delta is quadratic in turn length
+ * on the wire, but for the loopback / sidecar topology this transport
+ * targets (containerized omp → host gateway, robomp slot → omp-auth-gateway
+ * sidecar) the bandwidth cost is negligible compared to provider latency —
+ * and the client gets to feed the events straight into its existing
+ * `AssistantMessageEventStream.push()` plumbing with zero translation.
+ */
+export declare function encodeStream(events: AssistantMessageEventStream, _requestedModelId?: string, _options?: SimpleStreamOptions, control?: AuthGatewayStreamControl): ReadableStream<Uint8Array>;
+/**
+ * Pi-native error envelope:
+ *   `{ error: { type, message } }`
+ *
+ * Mirrors OpenAI's outer shape (which clients/SDKs already parse) without the
+ * provider-specific status taxonomy — pi-native callers consume `type`
+ * directly.
+ */
+export declare function formatError(status: number, type: string, message: string): Response;

package/dist/types/providers/register-builtins.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Lazy provider module loading.
+ *
+ * Each provider module is loaded only when its stream function is first called.
+ * This avoids eagerly importing heavy SDK dependencies (e.g., openai) at
+ * startup. The loaded module promise is cached so subsequent calls
+ * reuse the same import.
+ *
+ * NOTE: stream.ts currently imports providers directly, so this file is not yet
+ * wired into the main streaming path. It provides the infrastructure for lazy
+ * loading that can be integrated when stream.ts is refactored.
+ */
+import type { AssistantMessageEventStream, Context, Model, OptionsForApi } from "../types.js";
+import { AssistantMessageEventStream as EventStreamImpl } from "../utils/event-stream.js";
+import type { BedrockOptions } from "./amazon-bedrock.js";
+import type { CursorOptions } from "./cursor.js";
+interface CursorProviderModule {
+    streamCursor: (model: Model<"cursor-agent">, context: Context, options: CursorOptions) => AssistantMessageEventStream;
+}
+interface BedrockProviderModule {
+    streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: BedrockOptions) => AssistantMessageEventStream;
+}
+export declare function setBedrockProviderModule(module: BedrockProviderModule): void;
+export declare function setCursorProviderModule(module: CursorProviderModule): void;
+export declare const streamAnthropic: (model: Model<"anthropic-messages">, context: Context, options: OptionsForApi<"anthropic-messages">) => EventStreamImpl;
+export declare const streamAzureOpenAIResponses: (model: Model<"azure-openai-responses">, context: Context, options: OptionsForApi<"azure-openai-responses">) => EventStreamImpl;
+export declare const streamGoogle: (model: Model<"google-generative-ai">, context: Context, options: OptionsForApi<"google-generative-ai">) => EventStreamImpl;
+export declare const streamGoogleGeminiCli: (model: Model<"google-gemini-cli">, context: Context, options: OptionsForApi<"google-gemini-cli">) => EventStreamImpl;
+export declare const streamGoogleVertex: (model: Model<"google-vertex">, context: Context, options: OptionsForApi<"google-vertex">) => EventStreamImpl;
+export declare const streamOpenAICodexResponses: (model: Model<"openai-codex-responses">, context: Context, options: OptionsForApi<"openai-codex-responses">) => EventStreamImpl;
+export declare const streamOpenAICompletions: (model: Model<"openai-completions">, context: Context, options: OptionsForApi<"openai-completions">) => EventStreamImpl;
+export declare const streamOpenAIResponses: (model: Model<"openai-responses">, context: Context, options: OptionsForApi<"openai-responses">) => EventStreamImpl;
+export declare const streamCursor: (model: Model<"cursor-agent">, context: Context, options: OptionsForApi<"cursor-agent">) => EventStreamImpl;
+export declare const streamDevin: (model: Model<"devin-agent">, context: Context, options: OptionsForApi<"devin-agent">) => EventStreamImpl;
+export declare const streamOllama: (model: Model<"ollama-chat">, context: Context, options: OptionsForApi<"ollama-chat">) => EventStreamImpl;
+export declare const streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: OptionsForApi<"bedrock-converse-stream">) => EventStreamImpl;
+export {};

package/dist/types/providers/synthetic.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Synthetic provider - wraps OpenAI or Anthropic API based on format setting.
+ *
+ * Synthetic offers both OpenAI-compatible and Anthropic-compatible APIs:
+ * - OpenAI: https://api.synthetic.new/openai/v1/chat/completions
+ * - Anthropic: https://api.synthetic.new/anthropic/v1/messages
+ *
+ * @see https://dev.synthetic.new/docs/api/overview
+ */
+import type { Api, Context, Model } from "../types.js";
+import type { AssistantMessageEventStream } from "../utils/event-stream.js";
+import { type OpenAIAnthropicApiFormat, type OpenAIAnthropicShimOptions } from "./openai-anthropic-shim.js";
+export type SyntheticApiFormat = OpenAIAnthropicApiFormat;
+export interface SyntheticOptions extends OpenAIAnthropicShimOptions {
+    /** API format: "openai" or "anthropic". Default: "openai" */
+    format?: SyntheticApiFormat;
+}
+/**
+ * Stream from Synthetic, routing to either OpenAI or Anthropic API based on format.
+ * Returns synchronously like other providers - async processing happens internally.
+ */
+export declare function streamSynthetic(model: Model<"openai-completions">, context: Context, options?: SyntheticOptions): AssistantMessageEventStream;
+/**
+ * Check if a model is a Synthetic model.
+ */
+export declare function isSyntheticModel(model: Model<Api>): boolean;

package/dist/types/providers/transform-messages.d.ts

@@ -0,0 +1,32 @@
+import type { Api, AssistantMessage, Message, Model } from "../types.js";
+/**
+ * Normalize tool call ID for cross-provider compatibility.
+ * OpenAI Responses API generates IDs that are 450+ chars with special characters like `|`.
+ * Anthropic APIs require IDs matching ^[a-zA-Z0-9_-]+$ (max 64 chars).
+ *
+ * For aborted/errored turns, this function:
+ * - Preserves tool call structure (unlike converting to text summaries)
+ * - Injects synthetic "aborted" tool results
+ */
+/**
+ * Credential-shaped token patterns scrubbed from outbound provider traffic when
+ * credential redaction is enabled. Exported so hosts can route the same shapes
+ * through reversible obfuscation (keyed placeholders restored before local tool
+ * execution) instead of the irreversible `[*_token_redacted]` rewrite below —
+ * an irreversible placeholder echoed back in edit-tool `old_string` can never
+ * match the real bytes on disk.
+ */
+export declare const SENSITIVE_TOKEN_RE: RegExp;
+/**
+ * Toggle outbound credential-pattern redaction. When disabled (the default),
+ * {@link redactSensitiveCredentials} and {@link redactSensitiveInObject} are
+ * pass-throughs and outbound messages/system prompts leave the process
+ * unmodified.
+ */
+export declare function configureCredentialRedaction(enabled: boolean): void;
+export declare function redactSensitiveCredentials(text: string): string;
+export declare function redactSensitiveInObject(val: unknown): {
+    result: unknown;
+    changed: boolean;
+};
+export declare function transformMessages<TApi extends Api>(messages: Message[], model: Model<TApi>, normalizeToolCallId?: (id: string, model: Model<TApi>, source: AssistantMessage) => string, maxNormalizedToolCallIdLength?: number, duplicateToolCallIdSuffixPrefix?: string, targetCompat?: Model<TApi>["compat"]): Message[];

package/dist/types/providers/vision-guard.d.ts

@@ -0,0 +1,20 @@
+import type { ImageContent, Model, TextContent } from "../types.js";
+export declare const NON_VISION_IMAGE_PLACEHOLDER = "[image omitted: model does not support vision]";
+export declare function partitionVisionContent(content: ReadonlyArray<TextContent | ImageContent>, supportsImages: boolean): {
+    textBlocks: TextContent[];
+    imageBlocks: ImageContent[];
+    omittedImages: boolean;
+};
+export declare function joinTextWithImagePlaceholder(text: string, omittedImages: boolean): string;
+/**
+ * Detect known text-only Qwen models served via Alibaba DashScope's consumer
+ * `compatible-mode` endpoint that the upstream chat-completions API rejects
+ * multimodal content arrays for. The compatible-mode endpoint also serves
+ * multimodal Qwen SKUs without `vl` in the id (e.g. `qwen3.7-plus`), so this
+ * guard only covers families verified to be text-only for issue #1859:
+ * `qwen*-max` and `qwen*-coder*`.
+ *
+ * Used as a defensive override in `convertMessages` so a misconfigured custom
+ * provider (issue #1859) can't drive the request into an unrecoverable 400.
+ */
+export declare function isDashscopeCompatibleModeTextOnlyQwen(model: Model<"openai-completions">): boolean;

package/dist/types/registry/aiand.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginAiand: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const aiandProvider: {
+    readonly id: "aiand";
+    readonly name: "ai&";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/aimlapi.d.ts

@@ -0,0 +1,4 @@
+export declare const aimlApiProvider: {
+    readonly id: "aimlapi";
+    readonly name: "AIML API";
+};

package/dist/types/registry/alibaba-coding-plan.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthController, OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare function loginAlibabaCodingPlan(options: OAuthController): Promise<OAuthCredentials>;
+export declare const alibabaCodingPlanProvider: {
+    readonly id: "alibaba-coding-plan";
+    readonly name: "Alibaba Coding Plan";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly getApiKey: (credentials: OAuthCredentials) => string;
+};

package/dist/types/registry/alibaba-token-plan.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/**
+ * Log in to the QwenCloud Token Plan provider.
+ *
+ * The Token Plan ships as two regionally separate products with
+ * non-interchangeable keys — International (Singapore) and China (Beijing) —
+ * so login first selects the region (or a custom base URL) before pasting the
+ * key, mirroring {@link loginAlibabaCodingPlan}. The chosen region is validated
+ * against its own `/models` endpoint and, when it diverges from the default
+ * international endpoint, stored in the credential so inference and discovery
+ * both target it (#6682).
+ */
+export declare function loginAlibabaTokenPlan(options: OAuthController): Promise<string>;
+export declare const alibabaTokenPlanProvider: {
+    readonly id: "alibaba-token-plan";
+    readonly name: "QwenCloud Token Plan";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/amazon-bedrock.d.ts

@@ -0,0 +1,5 @@
+export declare const amazonBedrockProvider: {
+    readonly id: "amazon-bedrock";
+    readonly name: "Amazon Bedrock";
+    readonly envKeys: () => "<authenticated>" | undefined;
+};

package/dist/types/registry/anthropic.d.ts

@@ -0,0 +1,10 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const anthropicProvider: {
+    readonly id: "anthropic";
+    readonly name: "Anthropic (Claude Pro/Max)";
+    readonly envKeys: () => string | undefined;
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 54545;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/api-key-login.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared factory for API-key-paste "login" flows.
+ *
+ * Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
+ * don't actually implement OAuth — they just ask the user to paste an API key,
+ * optionally validate it, and return the trimmed key.
+ */
+import type { OAuthController } from "./oauth/types.js";
+type ChatCompletionsValidation = {
+    kind: "chat-completions";
+    provider: string;
+    baseUrl: string;
+    model: string;
+};
+type AnthropicMessagesValidation = {
+    kind: "anthropic-messages";
+    provider: string;
+    baseUrl: string;
+    model: string;
+};
+type ModelsEndpointValidation = {
+    kind: "models-endpoint";
+    provider: string;
+    modelsUrl: string | (() => string);
+    headers?: Record<string, string> | (() => Record<string, string> | undefined);
+};
+export type ApiKeyLoginConfig = {
+    /** Display name used in error messages, e.g. "Cerebras", "NanoGPT". */
+    providerLabel: string;
+    /** URL opened in browser for the user to grab their key. */
+    authUrl: string;
+    /** Instructions shown with the onAuth callback. */
+    instructions: string;
+    /** Prompt message shown when asking for the key paste. */
+    promptMessage: string;
+    /** Placeholder string for the prompt (e.g. "sk-...", "csk-..."). */
+    placeholder: string;
+    /** Validation strategy, or `null` to skip validation. */
+    validation: ChatCompletionsValidation | AnthropicMessagesValidation | ModelsEndpointValidation | null;
+};
+export declare function createApiKeyLogin(config: ApiKeyLoginConfig): (options: OAuthController) => Promise<string>;
+export {};

package/dist/types/registry/api-key-validation.d.ts

@@ -0,0 +1,43 @@
+import type { FetchImpl } from "../types.js";
+type OpenAICompatibleValidationOptions = {
+    provider: string;
+    apiKey: string;
+    baseUrl: string;
+    model: string;
+    signal?: AbortSignal;
+    fetch?: FetchImpl;
+};
+type AnthropicCompatibleValidationOptions = {
+    provider: string;
+    apiKey: string;
+    baseUrl: string;
+    model: string;
+    signal?: AbortSignal;
+    fetch?: FetchImpl;
+};
+type ModelListValidationOptions = {
+    provider: string;
+    apiKey: string;
+    modelsUrl: string;
+    headers?: Record<string, string> | (() => Record<string, string> | undefined);
+    signal?: AbortSignal;
+    fetch?: FetchImpl;
+};
+/**
+ * Validate an API key against an OpenAI-compatible chat completions endpoint.
+ *
+ * Performs a minimal request to verify credentials and endpoint access.
+ */
+export declare function validateOpenAICompatibleApiKey(options: OpenAICompatibleValidationOptions): Promise<void>;
+/**
+ * Validate an API key against an Anthropic-compatible messages endpoint.
+ */
+export declare function validateAnthropicCompatibleApiKey(options: AnthropicCompatibleValidationOptions): Promise<void>;
+/**
+ * Validate an API key against a provider models endpoint.
+ *
+ * Useful for providers where access to specific models may vary by plan and
+ * should not block key validation.
+ */
+export declare function validateApiKeyAgainstModelsEndpoint(options: ModelListValidationOptions): Promise<void>;
+export {};

package/dist/types/registry/aws.d.ts

@@ -0,0 +1,13 @@
+export interface AwsBedrockProviderOptions extends Readonly<Record<string, unknown>> {
+    /** AWS region used in the service endpoint and SigV4 credential scope. */
+    region?: string;
+    /** Named AWS shared-credentials/config profile. */
+    profile?: string;
+    /** Amazon Bedrock API key sent as a bearer token, ahead of SigV4 credential resolution. */
+    bearerToken?: string;
+}
+export declare function hasAwsCredentialSource(): boolean;
+/** Registry key marker for AWS transports that resolve their own bearer/IAM credentials. */
+export declare function resolveAwsRegistryApiKey(): string | undefined;
+/** Resolve a real AWS bearer token while filtering the registry's auth marker. */
+export declare function resolveAwsBearerToken(apiKey?: string, bearerToken?: string): string | undefined;

package/dist/types/registry/azure.d.ts

@@ -0,0 +1,4 @@
+export declare const azureProvider: {
+    readonly id: "azure";
+    readonly name: "Azure OpenAI";
+};

package/dist/types/registry/baseten.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginBaseten: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const basetenProvider: {
+    readonly id: "baseten";
+    readonly name: "Baseten";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/bedrock-mantle.d.ts

@@ -0,0 +1,22 @@
+import type { Model } from "../types.js";
+import { resolveAwsRegistryApiKey } from "./aws.js";
+export declare const bedrockMantleProvider: {
+    readonly id: "bedrock-mantle";
+    readonly name: "Amazon Bedrock Mantle";
+    readonly envKeys: typeof resolveAwsRegistryApiKey;
+    readonly allowsMissingApiKey: true;
+    readonly prepareRequest: (model: Model<import("@linxiraos/pi-catalog").Api>, options: import("../index.js").StreamOptions) => import("../providers/bedrock-mantle.js").PreparedBedrockMantleRequest;
+    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
+        providerOptions: Readonly<Record<string, unknown>> | undefined;
+    };
+    readonly prepareModelDiscovery: (config: import("./types.js").ProviderModelDiscoveryConfig) => {
+        baseUrl?: string;
+        fetch?: import("@linxiraos/pi-utils").FetchImpl;
+        apiKey: undefined;
+        authenticated: false;
+    } | {
+        authenticated: true;
+        baseUrl: string;
+        fetch: import("@linxiraos/pi-utils").FetchImpl;
+    };
+};

package/dist/types/registry/cerebras.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginCerebras: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const cerebrasProvider: {
+    readonly id: "cerebras";
+    readonly name: "Cerebras";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/cloudflare-ai-gateway.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/**
+ * Login to Cloudflare AI Gateway.
+ *
+ * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;
+export declare const cloudflareAiGatewayProvider: {
+    readonly id: "cloudflare-ai-gateway";
+    readonly name: "Cloudflare AI Gateway";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/coreweave.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginCoreWeave: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const coreWeaveProvider: {
+    readonly id: "coreweave";
+    readonly name: "CoreWeave Serverless Inference";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/cursor.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const cursorProvider: {
+    readonly id: "cursor";
+    readonly name: "Cursor (Claude, GPT, etc.)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+};

package/dist/types/registry/deepseek.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare function normalizeDeepSeekApiKey(raw: string): string;
+export declare const loginDeepSeek: (options: OAuthController) => Promise<string>;
+export declare const deepseekProvider: {
+    readonly id: "deepseek";
+    readonly name: "DeepSeek";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/derived.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Providers whose OAuth flow needs a pasted code/redirect URL rather than a
+ * local callback server. Consumed by the coding-agent login UX.
+ */
+export declare const PASTE_CODE_LOGIN_PROVIDERS: ReadonlySet<string>;

package/dist/types/registry/devin.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const devinProvider: {
+    readonly id: "devin";
+    readonly name: "Devin";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+    readonly callbackPort: 59653;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/exa.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginExa: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const exaProvider: {
+    readonly id: "exa";
+    readonly name: "Exa";
+    readonly envKeys: "EXA_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/firepass.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+/**
+ * Fire Pass login flow.
+ *
+ * Fire Pass is a Fireworks subscription product whose dedicated `fpk_…` API
+ * keys are scoped to the `accounts/fireworks/routers/kimi-k2p6-turbo` router
+ * (Kimi K2.6 Turbo). The key does NOT authorize `/v1/models`, so validation
+ * pings the chat completions endpoint with the router id directly.
+ * See https://docs.fireworks.ai/firepass.
+ */
+export declare const loginFirepass: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const firepassProvider: {
+    readonly id: "firepass";
+    readonly name: "Fire Pass (Fireworks Kimi K2.6 Turbo subscription)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/fireworks.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginFireworks: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const fireworksProvider: {
+    readonly id: "fireworks";
+    readonly name: "Fireworks";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/github-copilot.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const githubCopilotProvider: {
+    readonly id: "github-copilot";
+    readonly name: "GitHub Copilot";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+};

package/dist/types/registry/gitlab-duo-workflow.d.ts

@@ -0,0 +1,10 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const gitLabDuoWorkflowProvider: {
+    readonly id: "gitlab-duo-agent";
+    readonly name: "GitLab Duo Agent";
+    readonly envKeys: "GITLAB_TOKEN";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 8080;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/gitlab-duo.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const gitlabDuoProvider: {
+    readonly id: "gitlab-duo";
+    readonly name: "GitLab Duo Non-Agentic";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 8080;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/gmi-cloud.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginGmiCloud: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const gmiCloudProvider: {
+    readonly id: "gmi-cloud";
+    readonly name: "GMI Cloud";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/google-antigravity.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const googleAntigravityProvider: {
+    readonly id: "google-antigravity";
+    readonly name: "Antigravity (Gemini 3, Claude, GPT-OSS)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 51121;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/google-gemini-cli.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const googleGeminiCliProvider: {
+    readonly id: "google-gemini-cli";
+    readonly name: "Google Cloud Code Assist (Gemini CLI)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 8085;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/google-vertex.d.ts

@@ -0,0 +1,5 @@
+export declare const googleVertexProvider: {
+    readonly id: "google-vertex";
+    readonly name: "Google Vertex AI";
+    readonly envKeys: () => string | undefined;
+};

package/dist/types/registry/google.d.ts

@@ -0,0 +1,4 @@
+export declare const googleProvider: {
+    readonly id: "google";
+    readonly name: "Google Gemini";
+};

package/dist/types/registry/groq.d.ts

@@ -0,0 +1,4 @@
+export declare const groqProvider: {
+    readonly id: "groq";
+    readonly name: "Groq";
+};

package/dist/types/registry/huggingface.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginHuggingface: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const huggingfaceProvider: {
+    readonly id: "huggingface";
+    readonly name: "Hugging Face Inference";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./derived.js";
+export * from "./oauth/index.js";
+export * from "./registry.js";
+export * from "./types.js";

package/dist/types/registry/kagi.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/**
+ * Login to Kagi.
+ *
+ * Opens browser to API settings and prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginKagi(options: OAuthController): Promise<string>;
+export declare const kagiProvider: {
+    readonly id: "kagi";
+    readonly name: "Kagi";
+    readonly envKeys: "KAGI_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/kilo.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthController, OAuthCredentials } from "./oauth/types.js";
+export declare function loginKilo(callbacks: OAuthController): Promise<OAuthCredentials>;
+export declare const kiloProvider: {
+    readonly id: "kilo";
+    readonly name: "Kilo Gateway";
+    readonly login: typeof loginKilo;
+};

package/dist/types/registry/kimi-code.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const kimiCodeProvider: {
+    readonly id: "kimi-code";
+    readonly name: "Kimi Code";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+};