@linxiraos/pi-ai 1.0.0

package/dist/types/registry/oauth/types.d.ts

@@ -0,0 +1,87 @@
+import type { FetchImpl } from "../../types.js";
+import type { OAuthProviderUnion } from "../registry.js";
+export type OAuthCredentials = {
+    refresh: string;
+    access: string;
+    expires: number;
+    enterpriseUrl?: string;
+    projectId?: string;
+    email?: string;
+    accountId?: string;
+    apiEndpoint?: string;
+    /**
+     * Organization/workspace the token is scoped to (e.g. an Anthropic org
+     * UUID or a ChatGPT workspace id). Captured once at login; token refreshes
+     * never rewrite it. Lets one account email hold credentials for multiple
+     * subscriptions.
+     */
+    orgId?: string;
+    /** Human-readable organization name for display (may embed the email). */
+    orgName?: string;
+    /**
+     * Epoch ms of the interactive login that minted this grant. Set by
+     * `AuthStorage.login`; token refreshes preserve it. Providers with an
+     * absolute grant lifetime (Anthropic expires the whole refresh-token
+     * family ~30 days after authorization regardless of rotation) use it to
+     * surface re-login deadlines before the grant dies.
+     */
+    authorizedAt?: number;
+};
+export type OAuthProvider = OAuthProviderUnion;
+export type OAuthProviderId = OAuthProvider | (string & {});
+export type OAuthPrompt = {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+};
+export type OAuthAuthInfo = {
+    /**
+     * Full authorization URL. Suitable for direct browser launch, OSC 8
+     * hyperlinks, and clipboard when the target UI can guarantee the full
+     * string reaches the user unmodified.
+     */
+    url: string;
+    /**
+     * Short loopback URL that 302-redirects to {@link url}. Provided by flows
+     * that host the redirect on the same callback server they already run
+     * ({@link OAuthCallbackFlow}). UIs SHOULD prefer this as the copy target
+     * so viewport truncation cannot corrupt OAuth query parameters. Undefined
+     * for flows without a loopback callback server (device code, paste-code
+     * providers with fixed non-loopback redirects, etc.).
+     */
+    launchUrl?: string;
+    instructions?: string;
+};
+export interface OAuthProviderInfo {
+    id: OAuthProviderId;
+    name: string;
+    available: boolean;
+    /**
+     * Provider id the login stores credentials under, when it differs from `id`
+     * (e.g. `openai-codex-device` ⇒ `openai-codex`). Lets callers map a login
+     * entry back to the model provider it authenticates.
+     */
+    storeCredentialsAs?: string;
+}
+export interface OAuthController {
+    onAuth?(info: OAuthAuthInfo): void;
+    onProgress?(message: string): void;
+    onManualCodeInput?(): Promise<string>;
+    onPrompt?(prompt: OAuthPrompt): Promise<string>;
+    signal?: AbortSignal;
+    fetch?: FetchImpl;
+}
+export interface OAuthLoginCallbacks extends OAuthController {
+    onAuth: (info: OAuthAuthInfo) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+}
+export interface OAuthProviderInterface {
+    readonly id: OAuthProviderId;
+    readonly name: string;
+    readonly sourceId?: string;
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials | string>;
+    refreshToken?(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    getApiKey?(credentials: OAuthCredentials): string;
+    /** Store resulting OAuth credentials under a different provider id. */
+    readonly storeCredentialsAs?: string;
+}

package/dist/types/registry/oauth/wafer.d.ts

@@ -0,0 +1 @@
+export declare const loginWaferServerless: (options: import("./types.js").OAuthController) => Promise<string>;

package/dist/types/registry/oauth/xai-oauth.d.ts

@@ -0,0 +1,46 @@
+import type { FetchImpl } from "../../types.js";
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare function validateXAIEndpoint(url: string, field: string): string;
+/**
+ * Pin SuperGrok billing URLs to HTTPS `grok.com` / `*.grok.com`.
+ * The CLI billing proxy is intentionally not on `*.x.ai`.
+ */
+export declare function validateXAIBillingEndpoint(url: string, field?: string): string;
+/** Decode an xAI access-token JWT payload without verifying its signature. */
+export declare function parseXAIAccessTokenPayload(jwt: string): Record<string, unknown> | null;
+/**
+ * Check whether a JWT access token is at or past its `exp` claim (with an
+ * optional refresh-skew margin).
+ *
+ * Returns `false` for malformed input because this is a refresh-trigger check,
+ * not token validation.
+ */
+export declare function isXAIAccessTokenExpiring(jwt: string, skewSeconds?: number): boolean;
+/** Extract the stable xAI subject UUID from an access token. */
+export declare function extractXAIAccessTokenSubject(jwt: string): string | undefined;
+export interface XAIOAuthIdentity {
+    accountId?: string;
+    email?: string;
+    name?: string;
+}
+/** Fetch optional OIDC userinfo for a valid xAI access token. */
+export declare function fetchXAIOAuthIdentity(accessToken: string, fetchOverride?: FetchImpl, signal?: AbortSignal): Promise<XAIOAuthIdentity | null>;
+/** Build the SuperGrok CLI billing URL. Pass `""` to omit `format` (unified monthly payload). */
+export declare function buildXAICliBillingUrl(format?: string): string;
+/**
+ * Headers for SuperGrok CLI billing (`cli-chat-proxy.grok.com`).
+ * Official Grok CLI also sends `X-XAI-Token-Auth: xai-grok-cli` on this host;
+ * include it so billing stays on the same product gate as chat inference.
+ */
+export declare function getXAICliBillingHeaders(options: {
+    accessToken: string;
+}): Record<string, string>;
+/** Log in to xAI Grok with the RFC 8628 device authorization grant. */
+export declare function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh an xAI OAuth access token using a stored refresh_token.
+ *
+ * Re-runs OIDC discovery and re-validates the token endpoint before sending
+ * the stored refresh token.
+ */
+export declare function refreshXAIOAuthToken(refreshToken: string, fetchOverride?: FetchImpl): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/xiaomi.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Xiaomi MiMo login flow.
+ *
+ * Xiaomi MiMo provides OpenAI-compatible models via
+ * https://api.xiaomimimo.com/v1.
+ *
+ * Standard Xiaomi login opens the pay-as-you-go API key console. Token Plan
+ * login opens plan management so users copy the regional `tp-...` key.
+ */
+import type { OAuthController } from "./types.js";
+/** Region codes accepted by the Xiaomi Token Plan login flow. */
+export type XiaomiTokenPlanRegion = "sgp" | "ams" | "cn";
+/**
+ * Login to Xiaomi MiMo.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginXiaomi(options: OAuthController): Promise<string>;
+/**
+ * Login to a regional Xiaomi Token Plan endpoint.
+ *
+ * Prompts for a token-plan API key and validates it against the selected region.
+ */
+export declare function loginXiaomiTokenPlan(options: OAuthController, region: XiaomiTokenPlanRegion): Promise<string>;

package/dist/types/registry/oauth/zai.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Z.ai / GLM OAuth flow (GLM Coding Plan · Sign in)
+ *
+ * Mirrors ZCode's desktop "Individual Plan" browser sign-in: an
+ * authorization-code flow (no PKCE) against chat.z.ai, a JSON token exchange
+ * that yields a short-lived OAuth access token, and a business-API sequence
+ * that provisions a durable `id.secret` API key. The minted key is placed in
+ * {@link OAuthCredentials.access}; `getOAuthApiKey` returns it verbatim as the
+ * request bearer for the `zai` provider, so no dialect change is needed.
+ */
+import { OAuthCallbackFlow } from "./callback-server.js";
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare class ZaiOAuthFlow extends OAuthCallbackFlow {
+    #private;
+    constructor(ctrl: OAuthController);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+/**
+ * Login with Z.ai OAuth (GLM Coding Plan).
+ */
+export declare function loginZaiOAuth(ctrl: OAuthController): Promise<OAuthCredentials>;

package/dist/types/registry/ollama-cloud.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare function loginOllamaCloud(options: OAuthController): Promise<string>;
+export declare const ollamaCloudProvider: {
+    readonly id: "ollama-cloud";
+    readonly name: "Ollama Cloud";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/ollama.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthController } from "./oauth/types.js";
+/**
+ * Login to Ollama.
+ *
+ * Returns a trimmed API key/token string. Empty string means local no-auth mode.
+ */
+export declare function loginOllama(options: OAuthController): Promise<string>;
+export declare const ollamaProvider: {
+    readonly id: "ollama";
+    readonly name: "Ollama (Local OpenAI-compatible)";
+    readonly login: typeof loginOllama;
+};

package/dist/types/registry/openai-codex-device.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const openaiCodexDeviceProvider: {
+    readonly id: "openai-codex-device";
+    readonly name: "ChatGPT Plus/Pro (Codex, headless/device)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly storeCredentialsAs: "openai-codex";
+};

package/dist/types/registry/openai-codex.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const openaiCodexProvider: {
+    readonly id: "openai-codex";
+    readonly name: "ChatGPT Plus/Pro (Codex Subscription)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 1455;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/openai.d.ts

@@ -0,0 +1,4 @@
+export declare const openaiProvider: {
+    readonly id: "openai";
+    readonly name: "OpenAI";
+};

package/dist/types/registry/opencode-go.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const opencodeGoProvider: {
+    readonly id: "opencode-go";
+    readonly name: "OpenCode Go";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/opencode-zen.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const opencodeZenProvider: {
+    readonly id: "opencode-zen";
+    readonly name: "OpenCode Zen";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/openrouter.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+/** OpenRouter login flow (API key paste, validated via /auth/key).
+ *
+ * `/api/v1/models` is public and returns 200 for any bearer (including bogus),
+ * so it cannot validate auth. `/api/v1/auth/key` is the canonical "who am I"
+ * endpoint — 200 for valid keys, 401 otherwise.
+ */
+export declare const loginOpenRouter: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const openrouterProvider: {
+    readonly id: "openrouter";
+    readonly name: "OpenRouter";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/parallel.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+/**
+ * Login to Parallel.
+ *
+ * Opens browser to the API keys page, prompts the user to paste their API key,
+ * and returns the API key directly.
+ */
+export declare function loginParallel(options: OAuthController): Promise<string>;
+export declare const parallelProvider: {
+    readonly id: "parallel";
+    readonly name: "Parallel";
+    readonly envKeys: "PARALLEL_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/perplexity.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const perplexityProvider: {
+    readonly id: "perplexity";
+    readonly name: "Perplexity (Pro/Max)";
+    readonly envKeys: "PERPLEXITY_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<import("./oauth/index.js").OAuthCredentials>;
+};

package/dist/types/registry/qianfan.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginQianfan: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const qianfanProvider: {
+    readonly id: "qianfan";
+    readonly name: "Qianfan";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/qwen-portal.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+export declare function loginQwenPortal(options: OAuthController): Promise<string>;
+export declare const qwenPortalProvider: {
+    readonly id: "qwen-portal";
+    readonly name: "Qwen Portal";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};