@linxiraos/pi-ai 1.0.0

package/dist/types/registry/litellm.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/**
+ * Login to LiteLLM.
+ *
+ * Opens browser to LiteLLM setup docs, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginLiteLLM(options: OAuthController): Promise<string>;
+export declare const litellmProvider: {
+    readonly id: "litellm";
+    readonly name: "LiteLLM";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/llama-cpp.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare function loginLlamaCpp(options: OAuthController): Promise<string>;
+export declare const llamaCppProvider: {
+    readonly id: "llama.cpp";
+    readonly name: "llama.cpp (Local OpenAI-compatible)";
+    readonly envKeys: "LLAMA_CPP_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/lm-studio.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const DEFAULT_LOCAL_TOKEN = "lm-studio-local";
+export declare function loginLmStudio(options: OAuthController): Promise<string>;
+export declare const lmStudioProvider: {
+    readonly id: "lm-studio";
+    readonly name: "LM Studio (Local OpenAI-compatible)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/meta.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginMeta: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const metaProvider: {
+    readonly id: "meta";
+    readonly name: "Meta Model API";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/minimax-code-cn.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const minimaxCodeCnProvider: {
+    readonly id: "minimax-code-cn";
+    readonly name: "MiniMax Token Plan (China)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/minimax-code.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const minimaxCodeProvider: {
+    readonly id: "minimax-code";
+    readonly name: "MiniMax Token Plan (International)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/minimax.d.ts

@@ -0,0 +1,4 @@
+export declare const minimaxProvider: {
+    readonly id: "minimax";
+    readonly name: "MiniMax";
+};

package/dist/types/registry/mistral.d.ts

@@ -0,0 +1,4 @@
+export declare const mistralProvider: {
+    readonly id: "mistral";
+    readonly name: "Mistral";
+};

package/dist/types/registry/moonshot.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginMoonshot: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const moonshotProvider: {
+    readonly id: "moonshot";
+    readonly name: "Moonshot (Kimi API)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/nanogpt.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginNanoGPT: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const nanogptProvider: {
+    readonly id: "nanogpt";
+    readonly name: "NanoGPT";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/novita.d.ts

@@ -0,0 +1,6 @@
+export declare const loginNovita: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const novitaProvider: {
+    id: "novita";
+    name: string;
+    login: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+};

package/dist/types/registry/nvidia.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare function loginNvidia(options: OAuthController): Promise<string>;
+export declare const nvidiaProvider: {
+    readonly id: "nvidia";
+    readonly name: "NVIDIA";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/oauth/anthropic-constants.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Absolute lifetime of an Anthropic OAuth grant family, anchored at the
+ * interactive login. Refresh-token rotation does NOT extend it: ~30 days
+ * after authorization the token endpoint returns
+ * `invalid_grant: "Refresh token expired"` for the latest rotated token and
+ * only a fresh interactive login recovers the account. Observed against
+ * production (grants authorized 2026-06-20/06-25 died 30d later to the hour
+ * despite healthy 8h rotations); matches Claude Code's documented monthly
+ * re-login. Consumers use this to warn before the deadline — it is a display
+ * heuristic, not a wire contract.
+ */
+export declare const ANTHROPIC_OAUTH_GRANT_TTL_MS: number;

package/dist/types/registry/oauth/anthropic.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Anthropic OAuth flow (Claude Pro/Max)
+ */
+import type { FetchImpl } from "../../types.js";
+import { OAuthCallbackFlow } from "./callback-server.js";
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export { ANTHROPIC_OAUTH_GRANT_TTL_MS } from "./anthropic-constants.js";
+export declare class AnthropicOAuthFlow extends OAuthCallbackFlow {
+    #private;
+    constructor(ctrl: OAuthController);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+/**
+ * Login with Anthropic OAuth
+ */
+export declare function loginAnthropic(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Anthropic OAuth token
+ */
+export declare function refreshAnthropicToken(refreshToken: string, fetchOverride?: FetchImpl): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/callback-server.d.ts

@@ -0,0 +1,74 @@
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export type CallbackResult = {
+    code: string;
+    state: string;
+};
+export interface OAuthCallbackFlowOptions {
+    preferredPort: number;
+    callbackPath?: string;
+    callbackHostname?: string;
+    /** Exact redirect URI advertised to the provider; disables port fallback. */
+    redirectUri?: string;
+    /**
+     * Whether the flow may bind to a random port when {@link preferredPort} is
+     * unavailable. Defaults to `true` so historical AI-provider flows (which
+     * pick uncommon ports and tolerate any loopback callback) keep working.
+     *
+     * Set to `false` for providers that validate the redirect URI against a
+     * registered callback — silently advertising a random-port URI would be
+     * rejected by the authorization server, leaving the browser on an opaque
+     * 500 page and the local callback waiting until the 5-minute timeout fires.
+     * With fallback disabled, {@link OAuthCallbackFlow.login} throws a
+     * {@link AIError.ConfigurationError} immediately so the caller can surface
+     * an actionable message before opening the browser.
+     */
+    allowPortFallback?: boolean;
+    /** Skip the local callback server entirely; the user pastes the code or redirect URL back. */
+    manualInputOnly?: boolean;
+}
+/**
+ * Abstract base class for OAuth flows with local callback servers.
+ */
+export declare abstract class OAuthCallbackFlow {
+    #private;
+    ctrl: OAuthController;
+    preferredPort: number;
+    callbackPath: string;
+    callbackHostname: string;
+    redirectUri?: string;
+    allowPortFallback: boolean;
+    constructor(ctrl: OAuthController, preferredPortOrOptions: number | OAuthCallbackFlowOptions, callbackPath?: string);
+    /**
+     * Generate provider-specific authorization URL.
+     * @param state - CSRF state token
+     * @param redirectUri - The actual redirect URI to use (may differ from expected if port fallback occurred)
+     * @returns Authorization URL and optional instructions
+     */
+    abstract generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    /**
+     * Exchange authorization code for OAuth tokens.
+     * @param code - Authorization code from callback
+     * @param state - CSRF state token
+     * @param redirectUri - The actual redirect URI used (must match authorization request)
+     * @returns OAuth credentials
+     */
+    abstract exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+    /**
+     * Generate CSRF state token. Override if provider needs custom state generation.
+     */
+    generateState(): string;
+    /**
+     * Execute the OAuth login flow.
+     */
+    login(): Promise<OAuthCredentials>;
+}
+/**
+ * Parse a redirect URL or code string to extract code and state.
+ */
+export declare function parseCallbackInput(input: string): {
+    code?: string;
+    state?: string;
+};

package/dist/types/registry/oauth/cursor.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthCredentials } from "./types.js";
+export interface CursorAuthParams {
+    verifier: string;
+    challenge: string;
+    uuid: string;
+    loginUrl: string;
+}
+export declare function generateCursorAuthParams(): Promise<CursorAuthParams>;
+export declare function pollCursorAuth(uuid: string, verifier: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+}>;
+export declare function loginCursor(onAuthUrl: (url: string) => void, onPollStart?: () => void): Promise<OAuthCredentials>;
+export declare function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<OAuthCredentials>;
+export declare function extractCursorAccessTokenUserId(accessToken: string): string | undefined;
+export declare function isCursorTokenExpiringSoon(token: string, thresholdSeconds?: number): boolean;

package/dist/types/registry/oauth/device-code.d.ts

@@ -0,0 +1,25 @@
+/** Result returned by one OAuth device-code polling attempt. */
+export type OAuthDeviceCodePollResult<T> = {
+    status: "complete";
+    value: T;
+} | {
+    status: "pending";
+} | {
+    status: "slow_down";
+} | {
+    status: "failed";
+    message: string;
+};
+/** Options for polling an RFC 8628-style OAuth device-code flow. */
+export interface OAuthDeviceCodeFlowOptions<T> {
+    /** Poll the provider once and classify the response. */
+    poll(): OAuthDeviceCodePollResult<T> | Promise<OAuthDeviceCodePollResult<T>>;
+    /** Provider-requested polling cadence; defaults to RFC 8628's five seconds. */
+    intervalSeconds?: number;
+    /** Provider-issued expiry window for the device code. */
+    expiresInSeconds?: number;
+    /** Cancels the flow with the legacy "Login cancelled" error. */
+    signal?: AbortSignal;
+}
+/** Poll an OAuth device-code flow until completion, provider failure, timeout, or cancellation. */
+export declare function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOptions<T>): Promise<T>;

package/dist/types/registry/oauth/devin.d.ts

@@ -0,0 +1,5 @@
+import type { OAuthController, OAuthCredentials } from "./types.js";
+type FetchFunction = NonNullable<OAuthController["fetch"]>;
+export declare function loginDevin(ctrl: OAuthController): Promise<OAuthCredentials>;
+export declare function exchangeDevinCliToken(authorizationCode: string, codeVerifier: string, fetchImpl?: FetchFunction): Promise<string>;
+export {};

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -0,0 +1,30 @@
+import type { FetchImpl } from "../../types.js";
+import type { OAuthCredentials } from "./types.js";
+type GitHubCopilotLoginOptions = {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    pollIntervalFloorMs?: number;
+    pollIntervalScaleMs?: number;
+    fetch?: FetchImpl;
+};
+/**
+ * Refresh GitHub Copilot token.
+ * With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+ */
+export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, apiEndpoint?: string): OAuthCredentials;
+/**
+ * Login with GitHub Copilot OAuth (device code flow)
+ *
+ * @param options.onAuth - Callback with URL and optional instructions (user code)
+ * @param options.onPrompt - Callback to prompt user for input
+ * @param options.onProgress - Optional progress callback
+ * @param options.signal - Optional AbortSignal for cancellation
+ */
+export declare function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Promise<OAuthCredentials>;
+export {};

package/dist/types/registry/oauth/gitlab-duo-workflow.d.ts

@@ -0,0 +1,6 @@
+import type { FetchImpl } from "../../types.js";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types.js";
+export declare const GITLAB_DUO_WORKFLOW_OAUTH_CLIENT_ID = "36f2a70cddeb5a0889d4fd8295c241b7e9848e89cf9e599d0eed2d8e5350fbf5";
+export declare const GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI = "vscode://gitlab.gitlab-workflow/authentication";
+export declare function loginGitLabDuoWorkflow(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshGitLabDuoWorkflowToken(credentials: OAuthCredentials, fetchImpl?: FetchImpl): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/gitlab-duo.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types.js";
+export declare function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/google-antigravity.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA: Readonly<{
+    ideType: "ANTIGRAVITY";
+    platform: "PLATFORM_UNSPECIFIED";
+    pluginType: "GEMINI";
+}>;
+export declare function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Antigravity token
+ */
+export declare function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/google-gemini-cli.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Gemini CLI OAuth flow (Google Cloud Code Assist)
+ * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)
+ */
+import type { OAuthController, OAuthCredentials } from "./types.js";
+interface LongRunningOperationResponse {
+    name?: string;
+    done?: boolean;
+    response?: {
+        cloudaicompanionProject?: {
+            id?: string;
+        };
+    };
+}
+export declare const POLL_MAX_ATTEMPTS = 24;
+export declare function pollOperation(operationName: string, headers: Record<string, string>, signal: AbortSignal | undefined, onProgress?: (message: string) => void): Promise<LongRunningOperationResponse>;
+export declare function loginGeminiCli(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Google Cloud Code Assist token
+ */
+export declare function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;
+export {};

package/dist/types/registry/oauth/google-oauth-shared.d.ts

@@ -0,0 +1,56 @@
+import { OAuthCallbackFlow } from "./callback-server.js";
+import type { OAuthController, OAuthCredentials } from "./types.js";
+/**
+ * Per-request timeout for the post-callback provisioning phase (token exchange,
+ * user-info, project discovery/onboarding, LRO polling). These Cloud Code
+ * Assist calls normally settle in well under this window; a longer stall means
+ * a hung endpoint that must surface a login error instead of hanging forever.
+ * The callback server's own 300s deadline covers only the browser-callback wait
+ * ({@link OAuthCallbackFlow}) and does not gate this phase.
+ */
+export declare const OAUTH_REQUEST_TIMEOUT_MS = 30000;
+/** Options for {@link oauthFetch}. */
+export interface OAuthFetchOptions {
+    /** Provider id recorded on any {@link AIError.OAuthError} raised. */
+    provider: string;
+    /** Controller signal; when it aborts, the in-flight request is cancelled. */
+    signal?: AbortSignal;
+    /** Override the per-request timeout (defaults to {@link OAUTH_REQUEST_TIMEOUT_MS}). */
+    timeoutMs?: number;
+}
+/**
+ * Throw {@link AIError.LoginCancelledError} when the controller signal has
+ * already aborted. Gates each provisioning round-trip, which the callback-wait
+ * cancellation checks in {@link OAuthCallbackFlow} do not reach.
+ */
+export declare function throwIfLoginCancelled(signal: AbortSignal | undefined): void;
+/**
+ * `fetch` for the provisioning phase: composes the controller signal with a
+ * per-request timeout so a stalled endpoint aborts instead of hanging login,
+ * and user cancellation aborts the in-flight request. Cancellation surfaces as
+ * {@link AIError.LoginCancelledError}; a timeout surfaces as an
+ * {@link AIError.OAuthError} with `kind: "timeout"`.
+ */
+export declare function oauthFetch(url: string, init: RequestInit, { provider, signal, timeoutMs }: OAuthFetchOptions): Promise<Response>;
+export interface GoogleOAuthFlowConfig {
+    /** Provider id used in progress/error reporting and per-request fetches. */
+    provider: string;
+    clientId: string;
+    clientSecret: string;
+    authUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    callbackPort: number;
+    callbackPath: string;
+    discoverProject: (accessToken: string, onProgress?: (message: string) => void, signal?: AbortSignal) => Promise<string>;
+}
+export declare class GoogleOAuthFlow extends OAuthCallbackFlow {
+    private readonly config;
+    constructor(ctrl: OAuthController, config: GoogleOAuthFlowConfig);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+export declare function runGoogleOAuthLogin(ctrl: OAuthController, config: GoogleOAuthFlowConfig): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/index.d.ts

@@ -0,0 +1,45 @@
+import type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types.js";
+export * from "./anthropic.js";
+export * from "./device-code.js";
+export type * from "./types.js";
+/**
+ * Register a custom OAuth provider.
+ */
+export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
+/**
+ * Remove a custom OAuth provider by ID.
+ */
+export declare function unregisterOAuthProvider(id: string): void;
+/**
+ * Get a custom OAuth provider by ID.
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Remove all custom OAuth providers registered by a source.
+ */
+export declare function unregisterOAuthProviders(sourceId: string): void;
+/**
+ * Refresh token for any OAuth provider.
+ * Saves the new credentials and returns the new access token.
+ */
+export declare function refreshOAuthToken(provider: OAuthProvider, credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/**
+ * Build API-key bytes for a provider from an already-fresh OAuth credential.
+ *
+ * Refresh is owned by AuthStorage. This helper deliberately refuses expired
+ * credentials so it cannot POST broker redaction sentinels to upstream token
+ * endpoints as a side channel.
+ *
+ * For providers that need credential metadata at request time, returns
+ * JSON-encoded credentials plus expiry metadata for diagnostics/edge guards.
+ * @returns API key string, or null if no credentials
+ * @throws Error if the credential is expired and must be refreshed upstream
+ */
+export declare function getOAuthApiKey(provider: OAuthProvider, credentials: Record<string, OAuthCredentials>): Promise<{
+    newCredentials: OAuthCredentials;
+    apiKey: string;
+} | null>;
+/**
+ * Get list of OAuth providers.
+ */
+export declare function getOAuthProviders(): OAuthProviderInfo[];

package/dist/types/registry/oauth/kimi.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Kimi Code OAuth flow (device authorization grant)
+ */
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare let getKimiCommonHeaders: () => Readonly<{
+    "User-Agent": `KimiCLI/${string}`;
+    "X-Msh-Platform": "kimi_cli";
+    "X-Msh-Version": string;
+    "X-Msh-Device-Name": string;
+    "X-Msh-Device-Model": string;
+    "X-Msh-Os-Version": string;
+    "X-Msh-Device-Id": string;
+}>;
+/**
+ * Login with Kimi Code OAuth (device code flow).
+ */
+export declare function loginKimi(options: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Kimi OAuth token.
+ */
+export declare function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/minimax-code.d.ts

@@ -0,0 +1,27 @@
+/**
+ * MiniMax Token Plan login flow.
+ *
+ * MiniMax Token Plan is a subscription service that provides access to
+ * MiniMax models (M2 and newer) through an OpenAI-compatible API.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to the matching regional MiniMax subscription page
+ * 2. User subscribes and copies their API key
+ * 3. User pastes the API key back into the CLI
+ *
+ * International: https://api.minimax.io/v1
+ * China: https://api.minimaxi.com/v1
+ */
+/**
+ * Login to MiniMax Token Plan (international).
+ *
+ * Opens browser to subscription page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare const loginMiniMaxCode: (options: import("./types.js").OAuthController) => Promise<string>;
+/**
+ * Login to MiniMax Token Plan (China).
+ *
+ * Same flow as international but uses China endpoint.
+ */
+export declare const loginMiniMaxCodeCn: (options: import("./types.js").OAuthController) => Promise<string>;

package/dist/types/registry/oauth/openai-codex.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow — browser and device-code flows.
+ */
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare function decodeJwt<T = Record<string, unknown>>(token: string): T | null;
+/** Formats OpenAI Codex OAuth token endpoint errors for login and refresh failures. */
+export declare function formatOpenAICodexTokenEndpointError(status: number, bodyText: string): string;
+/** Builds the Codex browser OAuth URL used by browser login; exported for auth regression tests. */
+export declare function createOpenAICodexAuthorizationUrl(args: {
+    state: string;
+    redirectUri: string;
+    challenge: string;
+    originator?: string;
+}): string;
+/**
+ * Login with OpenAI Codex OAuth
+ */
+export type OpenAICodexLoginOptions = OAuthController & {
+    /** Optional originator value for OpenAI Codex OAuth. Default matches OMP Codex request headers. */
+    originator?: string;
+};
+export declare function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials>;
+/**
+ * Login with OpenAI Codex using the device-code (headless) flow.
+ *
+ * Avoids a local callback server entirely — useful when port 1455 is unavailable
+ * or when the browser callback flow fails with 403 (e.g. network/proxy issues).
+ */
+export declare function loginOpenAICodexDevice(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh OpenAI Codex OAuth token
+ */
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/opencode.d.ts

@@ -0,0 +1,18 @@
+/**
+ * OpenCode Zen login flow.
+ *
+ * OpenCode Zen is a subscription service that provides access to various AI models
+ * (GPT-5.x, Claude 4.x, Gemini 3, etc.) through a unified API at opencode.ai/zen.
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to https://opencode.ai/auth
+ * 2. User logs in and copies their API key
+ * 3. User pastes the API key back into the CLI
+ */
+import type { OAuthController } from "./types.js";
+/**
+ * Login to OpenCode Zen.
+ *
+ * Opens browser to auth page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginOpenCode(options: OAuthController): Promise<string>;

package/dist/types/registry/oauth/perplexity.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthController, OAuthCredentials } from "./types.js";
+/**
+ * Login to Perplexity.
+ *
+ * Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
+ *
+ * No browser/manual token paste fallback is used.
+ */
+export declare function loginPerplexity(ctrl: OAuthController): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/pkce.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;