@oh-my-pi/pi-ai 18.1.3 → 18.1.5

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [18.1.5] - 2026-09-03
+
+### Added
+
+- Added `/login abliteration` with API key validation against `/v1/models`, supporting the `ABLITERATION_API_KEY` and `ABLIT_KEY` environment variables.
+
+### Changed
+
+- Modernized provider authentication and token refresh across the catalog, with shared support for API-key, authorization-code, and device-code sign-in flows and clearer sign-in progress messages for OpenRouter, Kimi, and xAI.
+
+### Fixed
+
+- GitHub Copilot now uses the official Copilot CLI identity and OAuth application for requests and new sign-ins, restoring access to client-gated models while preserving existing credentials.
+- GitHub Copilot now reports `model_not_supported` responses immediately instead of repeatedly retrying unsupported models.
+- Improved account recovery after Google rate limits are lifted earlier than the reported reset time.
+- Fixed unmetered autocomplete models being reported as exhausted when quota is limited.
+- Fixed Gemini 3 cross-model sessions in Cloud Code Assist when replaying tool calls without a thought signature.
+- Fixed Cursor models behind an authentication gateway incorrectly retrying valid client-declared tool calls.
+- Fixed reasoning from models that prefill `<think>` (including DeepSeek-R1 and hosted Qwen3-Thinking) being shown in the response instead of as a separate thinking block.
+
 ## [18.1.3] - 2026-09-02
 
 ### Fixed

package/README.md

@@ -1090,56 +1090,31 @@ For the current API-key onboarding flows, the library covers Together, Moonshot,
 
 ### Programmatic OAuth
 
-The library provides login and token refresh functions. Credential storage is the caller's responsibility.
+Provider login and refresh behavior is exposed through the registry. Credential storage is the caller's responsibility.
 
 ```typescript
 import {
-	// Login functions (return credentials, do not store)
-	loginAnthropic,
-	loginOpenAICodex,
-	loginGitHubCopilot,
-	loginGeminiCli,
-	loginAntigravity,
-	loginCloudflareAiGateway,
-	loginHuggingface,
-	loginLiteLLM,
-	loginMoonshot,
-	loginNvidia,
-	loginNanoGPT,
-	loginQianfan,
-	loginQwenPortal,
-	loginTogether,
-	loginVenice,
-	loginVllm,
-	loginXiaomi,
-
-	// Token management
+	getProviderDefinition,
 	refreshOAuthToken, // (provider, credentials) => new credentials
 	getOAuthApiKey, // (provider, credentialsMap) => { newCredentials, apiKey } | null
-
-	// Types
-	type OAuthProvider, // includes 'anthropic', 'openai-codex', 'github-copilot', 'google-gemini-cli', 'google-antigravity', 'together', 'moonshot', 'qianfan', 'nvidia', 'nanogpt', 'novita', 'huggingface', 'venice', 'xiaomi', 'vllm', 'litellm', 'cloudflare-ai-gateway', 'qwen-portal', ...
+	type OAuthProvider,
 	type OAuthCredentials,
 } from "@oh-my-pi/pi-ai";
-```
 
-`loginOpenAICodex` accepts an optional `originator` value used in the OAuth flow:
-
-```typescript
-await loginOpenAICodex({
+const provider = getProviderDefinition("openai-codex");
+const credentials = await provider?.login?.({
 	onAuth: ({ url }) => console.log(url),
-	originator: "my-cli",
 });
 ```
 
 ### Login Flow Example
 
 ```typescript
-import { loginGitHubCopilot } from "@oh-my-pi/pi-ai";
+import { getProviderDefinition } from "@oh-my-pi/pi-ai";
 import * as fs from "node:fs";
 
-const credentials = await loginGitHubCopilot({
-	onAuth: (url, instructions) => {
+const credentials = await getProviderDefinition("github-copilot")?.login?.({
+	onAuth: ({ url, instructions }) => {
 		console.log(`Open: ${url}`);
 		if (instructions) console.log(instructions);
 	},

package/dist/types/dialect/thinking.d.ts

@@ -1,6 +1,15 @@
 import type { InbandScanEvent, InbandScanner } from "./types.js";
+export interface ThinkingInbandScannerOptions {
+    /**
+     * Report a bare reasoning close tag (no open seen) as an `impliedThinkingEnd`
+     * event instead of passing it through as text. Off by default: only a
+     * consumer that owns the whole message can reclassify the text before it.
+     */
+    readonly impliedOpen?: boolean;
+}
 export declare class ThinkingInbandScanner implements InbandScanner {
     #private;
+    constructor(options?: ThinkingInbandScannerOptions);
     feed(text: string): InbandScanEvent[];
     flush(): InbandScanEvent[];
 }

package/dist/types/dialect/types.d.ts

@@ -12,6 +12,16 @@ export type InbandScanEvent = {
 } | {
     type: "thinkingEnd";
     thinking: string;
+}
+/**
+ * A reasoning close tag with no open in this stream. Chat templates that
+ * prefill the opener into the prompt (DeepSeek-R1, Qwen3-Thinking) make the
+ * model stream only the close, so everything emitted as `text` before this
+ * event was reasoning. Only {@link ThinkingInbandScanner} with `impliedOpen`
+ * emits it.
+ */
+ | {
+    type: "impliedThinkingEnd";
 } | {
     type: "toolStart";
     id: string;

package/dist/types/error/flags.d.ts

@@ -87,13 +87,6 @@ export declare function isFastModeUnsupported(error: unknown): boolean;
  * fail identically) nor surface as an auth failure.
  */
 export declare function isClinePassSurfaceGateMessage(errorMessage: string | undefined): boolean;
-/**
- * GitHub Copilot 400 `model_not_supported` response for a model advertised by
- * `/models` — transient fleet skew, not a malformed request. Reads the
- * structural `code` through the SDK/body envelopes, then falls back to the
- * stringified body both SDK families put in `message`.
- */
-export declare function isCopilotTransientModelError(error: unknown): boolean;
 export declare function classifyMessage(message: {
     api?: Api;
     provider?: string;

package/dist/types/error/retryable.d.ts

@@ -7,13 +7,6 @@
  * may match more. Use this when you only have a `status: number`.
  */
 export declare function isTransientStatus(status: number | undefined): boolean;
-/** Hook for provider-specific transient detection that the error module must not import directly. */
-export interface ProviderRetryableHooks {
-    /** Provider id of the failing request, used to gate provider-specific checks. */
-    provider?: string;
-    /** Provider-specific transient predicate (e.g. Copilot model-availability 400s). */
-    isProviderTransient?: (error: Error) => boolean;
-}
 /**
  * Whether a provider stream error should be retried against the same credential.
  *
@@ -21,7 +14,7 @@ export interface ProviderRetryableHooks {
  * here — they are owned by the credential-rotation layer (auth-gateway /
  * `streamSimple` a/b/c policy), not this seconds-scale provider backoff.
  *
- * Provider-specific transient cases are injected via {@link ProviderRetryableHooks}
- * so this stays free of provider imports.
+ * Every 4xx other than 408/429 is terminal: a request the provider rejected
+ * as malformed, unauthorized, or unentitled fails identically on replay.
  */
-export declare function isProviderRetryableError(error: unknown, hooks?: ProviderRetryableHooks): boolean;
+export declare function isProviderRetryableError(error: unknown): boolean;

package/dist/types/index.d.ts

@@ -46,7 +46,6 @@ export * from "./utils/anthropic-auth.js";
 export * from "./utils/event-stream.js";
 export * from "./utils/glyph-codec.js";
 export * from "./utils/openrouter-headers.js";
-export * from "./utils/retry.js";
 export * from "./utils/schema/index.js";
 export * from "./utils/thinking-loop.js";
 export * from "./utils/tool-call-loop-guard.js";

package/dist/types/providers/anthropic.d.ts

@@ -188,13 +188,6 @@ export type AnthropicClientOptionsResult = {
  * omitted there.
  */
 export declare function resolveAnthropicCustomHeadersForBaseUrl(baseUrl: string | undefined): Record<string, string> | undefined;
-/**
- * Whether an Anthropic (or Copilot-over-Anthropic) stream error should be
- * retried. The classification lives in {@link AIError.isProviderRetryableError};
- * this wrapper injects the Copilot-specific model-availability transient check,
- * which the error module must not import directly.
- */
-export declare function isProviderRetryableError(error: unknown, provider?: string): boolean;
 export type AnthropicUsageLike = {
     cache_creation?: {
         ephemeral_5m_input_tokens?: number | null;

package/dist/types/providers/cursor.d.ts

@@ -12,6 +12,8 @@ export interface CursorOptions extends StreamOptions {
     conversationId?: string;
     execHandlers?: CursorExecHandlers;
     onToolResult?: CursorToolResultHandler;
+    /** Treat unhandled MCP calls as accepted handoffs to an external executor. */
+    externalToolExecutor?: boolean;
     /** Wire model id selected after thinking-effort routing (`resolveWireModelId`). */
     wireModelId?: string;
 }
@@ -104,7 +106,7 @@ export interface UsageState {
     sawTokenDelta: boolean;
 }
 /** Exported for tests: drives one Cursor server message through the stream (exec waits mark the stream busy). */
-export declare function handleServerMessage(msg: AgentServerMessage, output: AssistantMessage, stream: AssistantMessageEventStream, state: BlockState, blobStore: Map<string, Uint8Array>, h2Request: http2.ClientHttp2Stream, execHandlers: CursorExecHandlers | undefined, onToolResult: CursorToolResultHandler | undefined, usageState: UsageState, requestContextTools: McpToolDefinition[], requestContextRules?: CursorRule[], onConversationCheckpoint?: (checkpoint: ConversationStateStructure) => void): Promise<void>;
+export declare function handleServerMessage(msg: AgentServerMessage, output: AssistantMessage, stream: AssistantMessageEventStream, state: BlockState, blobStore: Map<string, Uint8Array>, h2Request: http2.ClientHttp2Stream, execHandlers: CursorExecHandlers | undefined, onToolResult: CursorToolResultHandler | undefined, usageState: UsageState, requestContextTools: McpToolDefinition[], requestContextRules?: CursorRule[], onConversationCheckpoint?: (checkpoint: ConversationStateStructure) => void, externalToolExecutor?: boolean): Promise<void>;
 /**
  * Exported for tests: verifies handler is invoked with correct `this` when passed as bound.
  *

package/dist/types/registry/amazon-bedrock.d.ts

@@ -1,10 +1,3 @@
-export declare const amazonBedrockProvider: {
-    readonly id: "amazon-bedrock";
-    readonly name: "Amazon Bedrock";
-    readonly envKeys: () => string | undefined;
-    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
-        region: string | undefined;
-        profile: string | undefined;
-        bearerToken: string | undefined;
-    };
-};
+import type { ProviderTransport } from "./build.js";
+/** Amazon Bedrock request shaping; auth policy lives in `rules/auth/amazon-bedrock.kdl`. */
+export declare const amazonBedrockTransport: ProviderTransport;

package/dist/types/registry/bedrock-mantle.d.ts

@@ -1,22 +1,3 @@
-import type { Model } from "../types.js";
-import { resolveAwsRegistryApiKey } from "./aws.js";
-export declare const bedrockMantleProvider: {
-    readonly id: "bedrock-mantle";
-    readonly name: "Amazon Bedrock Mantle";
-    readonly envKeys: typeof resolveAwsRegistryApiKey;
-    readonly allowsMissingApiKey: true;
-    readonly prepareRequest: (model: Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => import("../providers/bedrock-mantle.js").PreparedBedrockMantleRequest;
-    readonly mapSimpleOptions: (options: import("../index.js").SimpleStreamOptions) => {
-        providerOptions: Readonly<Record<string, unknown>> | undefined;
-    };
-    readonly prepareModelDiscovery: (config: import("./types.js").ProviderModelDiscoveryConfig) => {
-        baseUrl?: string;
-        fetch?: import("@oh-my-pi/pi-utils").FetchImpl;
-        apiKey: undefined;
-        authenticated: false;
-    } | {
-        authenticated: true;
-        baseUrl: string;
-        fetch: import("@oh-my-pi/pi-utils").FetchImpl;
-    };
-};
+import type { ProviderTransport } from "./build.js";
+/** Bedrock Mantle request/discovery shaping; auth policy lives in `rules/auth/bedrock-mantle.kdl`. */
+export declare const bedrockMantleTransport: ProviderTransport;

package/dist/types/registry/build.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Projects one compiled auth policy (`rules/auth/<id>.kdl`) plus the
+ * provider's optional TypeScript transport hooks into the
+ * {@link ProviderDefinition} the rest of `@oh-my-pi/pi-ai` consumes.
+ */
+import type { CompiledAuthProvider } from "@oh-my-pi/pi-catalog/compat/types";
+import type { ProviderDefinition } from "./types.js";
+/** Request/model shaping a provider implements in TypeScript beside its KDL auth policy. */
+export type ProviderTransport = Pick<ProviderDefinition, "prepareModel" | "prepareRequest" | "mapSimpleOptions" | "prepareModelDiscovery">;
+/** Materializes the registry definition for one compiled policy. */
+export declare function buildProviderDefinition(policy: CompiledAuthProvider, transport?: ProviderTransport): ProviderDefinition;

package/dist/types/registry/cloudflare-ai-gateway.d.ts

@@ -1,13 +1,3 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
-/** Collect the gateway credential used by CLI, setup-wizard, and TUI login callers. */
-export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;
-export declare const cloudflareAiGatewayProvider: {
-    readonly id: "cloudflare-ai-gateway";
-    readonly name: "Cloudflare AI Gateway";
-    readonly prepareModel: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>) => import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
-    readonly prepareRequest: (model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>, options: import("../index.js").StreamOptions) => {
-        model: import("@oh-my-pi/pi-catalog").Model<import("@oh-my-pi/pi-catalog").Api>;
-        options: import("../index.js").StreamOptions;
-    };
-    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
-};
+import type { ProviderTransport } from "./build.js";
+/** Cloudflare AI Gateway model/request shaping; login lives in `oauth/cloudflare-ai-gateway.ts` + its auth rule. */
+export declare const cloudflareAiGatewayTransport: ProviderTransport;

package/dist/types/registry/engine/api-key.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `login "api-key"` engine: open the provider's key page, prompt for a paste,
+ * optionally validate the key against a declared probe, return the key.
+ */
+import type { CompiledApiKeyLogin } from "@oh-my-pi/pi-catalog/compat/types";
+import type { OAuthController } from "../oauth/types.js";
+/** Builds the login function for one `login "api-key"` rule; `label` is the provider display name. */
+export declare function createApiKeyLogin(rule: CompiledApiKeyLogin, label: string): (options: OAuthController) => Promise<string>;

package/dist/types/registry/engine/common.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Shared machinery for the declarative login engines: resolving KDL values
+ * (env overrides, obfuscation, hooks), `{placeholder}` templating, token
+ * endpoint requests and token-response → `OAuthCredentials` projection.
+ */
+import type { CompiledAuthValue, CompiledCredentialMap, CompiledOAuthRequest, CompiledUserinfo } from "@oh-my-pi/pi-catalog/compat/types";
+import type { FetchImpl } from "../../types.js";
+import type { AfterExchangeHook, ExchangeContext, HeadersHook, LoginHook, RefreshHook } from "../hooks/types.js";
+import type { OAuthCredentials } from "../oauth/types.js";
+/** Far-future epoch ms: credentials that never expire (durable minted keys, session JWTs). */
+export declare const NEVER_EXPIRES = 8640000000000000;
+/** Substitution values available to `{placeholder}` templates in KDL params/URLs. */
+export type TemplateVars = Record<string, string | undefined>;
+export declare function loadLoginHook(name: string): Promise<LoginHook>;
+export declare function loadRefreshHook(name: string): Promise<RefreshHook>;
+export declare function loadAfterExchangeHook(name: string): Promise<AfterExchangeHook>;
+export declare function loadHeadersHook(name: string): Promise<HeadersHook>;
+/** Resolves a KDL value node: env overrides first, then the (possibly encoded) literal or hook. */
+export declare function resolveValue(value: CompiledAuthValue, signal?: AbortSignal): Promise<string>;
+/** Replaces `{name}` placeholders; unknown or undefined placeholders resolve to the empty string. */
+export declare function template(text: string, vars: TemplateVars): string;
+/** Reads a dot path (`data.user.email`) from a parsed JSON body. */
+export declare function jsonPath(body: unknown, path: string): unknown;
+/** Decodes a JWT payload without verification; `null` for malformed tokens. */
+export declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
+/** Epoch ms of a JWT `exp` claim minus `skewMs`, or undefined when absent. */
+export declare function jwtExpiryMs(token: string, skewMs: number): number | undefined;
+/**
+ * Projects a token response onto `OAuthCredentials` per the rule's
+ * `credential` map. A missing refresh token keeps `previous.refresh` (refresh
+ * grants that do not rotate) or falls back to the empty string.
+ */
+export declare function mapCredentials(map: CompiledCredentialMap, body: unknown, provider: string, previous?: OAuthCredentials): OAuthCredentials;
+export interface RequestContext {
+    provider: string;
+    fetch: FetchImpl;
+    signal?: AbortSignal;
+    /** Extra headers merged under the rule's declared headers. */
+    headers?: Record<string, string>;
+}
+/**
+ * Performs one declared token-style POST. `standardParams` are the grant's
+ * baseline (included when the rule keeps `standard=#true`), `params` the
+ * rule's declared extras; both are templated with `vars`.
+ */
+export declare function postTokenRequest(request: CompiledOAuthRequest, standardParams: Record<string, string | undefined>, vars: TemplateVars, context: RequestContext, errorKind: "token-exchange" | "token-refresh" | "device-auth"): Promise<{
+    body: unknown;
+    response: Response;
+}>;
+/** Bearer GET declared by `userinfo`; failures leave identity fields unset. */
+export declare function applyUserinfo(userinfo: CompiledUserinfo | undefined, credentials: OAuthCredentials, context: RequestContext): Promise<OAuthCredentials>;
+/** Runs the rule's after-exchange / after-refresh hook, if declared. */
+export declare function applyAfterExchange(hook: string | undefined, credentials: OAuthCredentials, context: ExchangeContext): Promise<OAuthCredentials>;
+export declare function describeError(error: unknown): string;
+export declare function throwIfCancelled(signal: AbortSignal | undefined): void;

package/dist/types/registry/engine/device-code.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `login "device-code"` engine: RFC 8628 device authorization — request a
+ * user code, show the verification URL, poll the token endpoint until the
+ * grant completes, then project / enrich the credentials.
+ */
+import type { CompiledDeviceCodeLogin } from "@oh-my-pi/pi-catalog/compat/types";
+import type { OAuthController, OAuthCredentials } from "../oauth/types.js";
+/** Builds the login function for one `login "device-code"` rule. */
+export declare function createDeviceCodeLogin(rule: CompiledDeviceCodeLogin, provider: string): (ctrl: OAuthController) => Promise<OAuthCredentials>;

package/dist/types/registry/engine/oauth-code.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `login "oauth-code"` engine: authorization-code grant (optionally PKCE)
+ * through the loopback callback server, followed by the declared token
+ * exchange, credential projection, userinfo enrichment and after-exchange hook.
+ */
+import type { CompiledAuthProvider, CompiledCallback, CompiledOAuthCodeLogin } from "@oh-my-pi/pi-catalog/compat/types";
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "../oauth/callback-server.js";
+import type { OAuthController, OAuthCredentials } from "../oauth/types.js";
+/**
+ * Callback-server options for a rule. A `redirect-uri-env` override is
+ * advertised verbatim with random-port fallback disabled; HTTP loopback
+ * overrides also bind the listener to the URI's host/port/path.
+ */
+export declare function resolveCallbackOptions(callback: CompiledCallback, provider: string, signal?: AbortSignal): Promise<OAuthCallbackFlowOptions>;
+/** Generic authorization-code flow driven by one compiled rule. */
+export declare class DeclarativeOAuthCodeFlow extends OAuthCallbackFlow {
+    #private;
+    constructor(ctrl: OAuthController, rule: CompiledOAuthCodeLogin, policy: CompiledAuthProvider, options: OAuthCallbackFlowOptions);
+    generateState(): string;
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+/** Builds the login function for one `login "oauth-code"` rule. */
+export declare function createOAuthCodeLogin(rule: CompiledOAuthCodeLogin, policy: CompiledAuthProvider): (ctrl: OAuthController) => Promise<OAuthCredentials>;

package/dist/types/registry/engine/refresh.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `refresh { … }` engine: refresh-token grant against the declared token
+ * endpoint. Unrotated refresh tokens are preserved; identity fields the
+ * response omits are left for the caller to merge from the stored row.
+ */
+import type { CompiledAuthProvider } from "@oh-my-pi/pi-catalog/compat/types";
+import type { OAuthCredentials } from "../oauth/types.js";
+type Refresher = (credentials: OAuthCredentials, signal?: AbortSignal) => Promise<OAuthCredentials>;
+/** The refresh function for a provider policy, or undefined when it never refreshes. */
+export declare function createRefresh(policy: CompiledAuthProvider): Refresher | undefined;
+export {};

package/dist/types/registry/hooks/api-key.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Hooks referenced by API-key style rules: `headers-hook` resolvers for
+ * `validate "models-endpoint"` probes needing computed headers, and
+ * `login "custom"` flows that paste keys but need region/endpoint prompts.
+ */
+import type { HeadersHook, Lazy, LoginHook } from "./types.js";
+export declare const API_KEY_HEADERS_HOOKS: Record<string, Lazy<HeadersHook>>;
+export declare const API_KEY_LOGIN_HOOKS: Record<string, Lazy<LoginHook>>;

package/dist/types/registry/hooks/custom.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Whole-flow hooks: `login "custom" hook=…` and `refresh hook=…` for providers
+ * whose flow is not expressible in the declarative grammar.
+ */
+import type { Lazy, LoginHook, RefreshHook } from "./types.js";
+export declare const CUSTOM_LOGIN_HOOKS: Record<string, Lazy<LoginHook>>;
+export declare const CUSTOM_REFRESH_HOOKS: Record<string, Lazy<RefreshHook>>;

package/dist/types/registry/hooks/device-code.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Hooks referenced by `login "device-code"` rules: fingerprint headers,
+ * discovered endpoints and post-exchange identity steps.
+ */
+import type { AfterExchangeHook, HeadersHook, Lazy, ValueHook } from "./types.js";
+export declare const DEVICE_CODE_HEADERS_HOOKS: Record<string, Lazy<HeadersHook>>;
+export declare const DEVICE_CODE_VALUE_HOOKS: Record<string, Lazy<ValueHook>>;
+export declare const DEVICE_CODE_AFTER_EXCHANGE_HOOKS: Record<string, Lazy<AfterExchangeHook>>;

package/dist/types/registry/hooks/env.d.ts

@@ -0,0 +1,2 @@
+import type { EnvHook } from "./types.js";
+export declare const ENV_HOOKS: Record<string, EnvHook>;

package/dist/types/registry/hooks/index.d.ts

@@ -0,0 +1,3 @@
+import type { HookTables } from "./types.js";
+export declare const HOOKS: HookTables;
+export type * from "./types.js";

package/dist/types/registry/hooks/oauth-code.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Hooks referenced by `login "oauth-code"` rules: post-exchange identity /
+ * provisioning steps and runtime-resolved values.
+ */
+import type { AfterExchangeHook, Lazy, LoginHook, ValueHook } from "./types.js";
+export declare const OAUTH_CODE_AFTER_EXCHANGE_HOOKS: Record<string, Lazy<AfterExchangeHook>>;
+export declare const OAUTH_CODE_VALUE_HOOKS: Record<string, Lazy<ValueHook>>;
+export declare const OAUTH_CODE_LOGIN_HOOKS: Record<string, Lazy<LoginHook>>;

package/dist/types/registry/hooks/types.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Hook contracts referenced by name from `rules/auth/*.kdl`. A hook is the
+ * escape hatch for the part of a login flow that is not declarative
+ * (identity lookups, project provisioning, key minting, bespoke polling).
+ * Names are validated against the compiled rule tree by
+ * `test/auth-hooks-registry.test.ts`.
+ */
+import type { FetchImpl } from "../../types.js";
+import type { OAuthController, OAuthCredentials, OAuthPrompt } from "../oauth/types.js";
+/** Whole-flow login implementation (`login "custom" hook=…`); rejects a bare controller at runtime when it needs prompts. */
+export type LoginHook = (callbacks: OAuthController) => Promise<OAuthCredentials | string>;
+/** Whole-flow refresh implementation (`refresh hook=…`). */
+export type RefreshHook = (credentials: OAuthCredentials, signal?: AbortSignal) => Promise<OAuthCredentials>;
+/** Runtime context handed to `after-exchange` / `after-refresh` hooks. */
+export interface ExchangeContext {
+    provider: string;
+    phase: "login" | "refresh";
+    /** Parsed JSON body of the token response. */
+    raw: unknown;
+    fetch: FetchImpl;
+    signal?: AbortSignal;
+    onProgress?: (message: string) => void;
+    onPrompt?: (prompt: OAuthPrompt) => Promise<string>;
+    /** Credential being refreshed (refresh phase only). */
+    stored?: OAuthCredentials;
+}
+/** Enrich or replace the engine-mapped credentials after a token exchange. */
+export type AfterExchangeHook = (credentials: OAuthCredentials, context: ExchangeContext) => Promise<OAuthCredentials>;
+/** Extra request headers (`headers-hook`); may throw a configuration error. */
+export type HeadersHook = () => Record<string, string> | undefined;
+/** Computed env-var fallback (`env hook=…`); must stay synchronous. */
+export type EnvHook = () => string | undefined;
+/** Runtime-resolved string setting (`url-hook=` / `hook=` on a value node). */
+export type ValueHook = (signal?: AbortSignal) => Promise<string>;
+/** Lazily loaded hook: keeps heavy flow modules out of the eager registry graph. */
+export type Lazy<T> = () => Promise<T>;
+export interface HookTables {
+    env: Record<string, EnvHook>;
+    headers: Record<string, Lazy<HeadersHook>>;
+    value: Record<string, Lazy<ValueHook>>;
+    login: Record<string, Lazy<LoginHook>>;
+    refresh: Record<string, Lazy<RefreshHook>>;
+    afterExchange: Record<string, Lazy<AfterExchangeHook>>;
+}

package/dist/types/registry/oauth/alibaba-coding-plan.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthController, OAuthCredentials } from "./types.js";
+export declare function loginAlibabaCodingPlan(options: OAuthController): Promise<OAuthCredentials>;

package/dist/types/registry/{alibaba-token-plan.d.ts → oauth/alibaba-token-plan.d.ts}

@@ -1,4 +1,4 @@
-import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
+import type { OAuthController } from "./types.js";
 /**
  * Log in to the QwenCloud Token Plan provider.
  *
@@ -11,8 +11,3 @@ import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types.js";
  * both target it (#6682).
  */
 export declare function loginAlibabaTokenPlan(options: OAuthController): Promise<string>;
-export declare const alibabaTokenPlanProvider: {
-    readonly id: "alibaba-token-plan";
-    readonly name: "QwenCloud Token Plan";
-    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
-};

package/dist/types/registry/oauth/anthropic.d.ts

@@ -1,24 +1,32 @@
 /**
- * Anthropic OAuth flow (Claude Pro/Max)
+ * Anthropic (Claude Pro/Max) sign-in residue. The OAuth flow itself is
+ * declared in `rules/auth/anthropic.kdl`; this module supplies the
+ * `anthropic-identity` after-exchange hook that recovers account /
+ * organization identity from `/api/claude_cli/bootstrap` when the token
+ * response omits it.
  */
 import type { FetchImpl } from "../../types.js";
-import { OAuthCallbackFlow } from "./callback-server.js";
-import type { OAuthController, OAuthCredentials } from "./types.js";
+import type { AfterExchangeHook } from "../hooks/types.js";
 export { ANTHROPIC_OAUTH_GRANT_TTL_MS } from "./anthropic-constants.js";
-export declare class AnthropicOAuthFlow extends OAuthCallbackFlow {
-    #private;
-    constructor(ctrl: OAuthController);
-    generateAuthUrl(state: string, redirectUri: string): Promise<{
-        url: string;
-        instructions?: string;
-    }>;
-    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
-}
 /**
- * Login with Anthropic OAuth
+ * Account + organization identity slice resolved from the
+ * `/api/claude_cli/bootstrap` endpoint. The organization is the subscription
+ * workspace the token draws limits from — one account email can hold several
+ * (e.g. a Team seat plus a personal Max plan).
  */
-export declare function loginAnthropic(ctrl: OAuthController): Promise<OAuthCredentials>;
+interface AnthropicIdentity {
+    accountId?: string;
+    email?: string;
+    orgId?: string;
+    orgName?: string;
+}
+/** Fetches the signed-in account/org identity Claude Code's CLI bootstrap reports. */
+export declare function fetchAnthropicBootstrapIdentity(accessToken: string, fetchImpl: FetchImpl): Promise<AnthropicIdentity>;
 /**
- * Refresh Anthropic OAuth token
+ * `anthropic-identity` hook: fills account (and, at login only, organization)
+ * identity from the bootstrap endpoint when the token response left it
+ * unset. The org an access token is scoped to is captured once at login and
+ * deliberately never refreshed — rewriting identity during background
+ * refreshes could silently re-key stored credentials.
  */
-export declare function refreshAnthropicToken(refreshToken: string, fetchOverride?: FetchImpl): Promise<OAuthCredentials>;
+export declare const anthropicIdentityHook: AfterExchangeHook;

package/dist/types/registry/oauth/cloudflare-ai-gateway.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthController } from "./types.js";
+/** Collect the gateway credential used by CLI, setup-wizard, and TUI login callers. */
+export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;

package/dist/types/registry/oauth/coreweave.d.ts

@@ -0,0 +1 @@
+export declare function requireCoreWeaveProjectHeaders(): Record<string, string>;

package/dist/types/registry/oauth/cursor.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthCredentials } from "./types.js";
+import type { OAuthController, OAuthCredentials } from "./types.js";
 export interface CursorAuthParams {
     verifier: string;
     challenge: string;
@@ -11,6 +11,8 @@ export declare function pollCursorAuth(uuid: string, verifier: string): Promise<
     refreshToken: string;
 }>;
 export declare function loginCursor(onAuthUrl: (url: string) => void, onPollStart?: () => void): Promise<OAuthCredentials>;
+export declare function loginCursorHook(callbacks: OAuthController): Promise<OAuthCredentials>;
 export declare function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<OAuthCredentials>;
+export declare function refreshCursorHook(credentials: OAuthCredentials): Promise<OAuthCredentials>;
 export declare function extractCursorAccessTokenUserId(accessToken: string): string | undefined;
 export declare function isCursorTokenExpiringSoon(token: string, thresholdSeconds?: number): boolean;

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -1,5 +1,5 @@
 import type { FetchImpl } from "../../types.js";
-import type { OAuthCredentials } from "./types.js";
+import type { OAuthController, OAuthCredentials } from "./types.js";
 type GitHubCopilotLoginOptions = {
     onAuth: (url: string, instructions?: string) => void;
     onPrompt: (prompt: {
@@ -15,9 +15,11 @@ type GitHubCopilotLoginOptions = {
 };
 /**
  * Refresh GitHub Copilot token.
- * With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+ * GitHub OAuth tokens from both the former OpenCode app and the Copilot CLI app
+ * remain directly usable, so existing logins need no token exchange or migration.
  */
 export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, apiEndpoint?: string): OAuthCredentials;
+export declare function refreshGitHubCopilotHook(credentials: OAuthCredentials): Promise<OAuthCredentials>;
 /**
  * Login with GitHub Copilot OAuth (device code flow)
  *
@@ -27,4 +29,5 @@ export declare function refreshGitHubCopilotToken(refreshToken: string, enterpri
  * @param options.signal - Optional AbortSignal for cancellation
  */
 export declare function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Promise<OAuthCredentials>;
+export declare function loginGitHubCopilotHook(callbacks: OAuthController): Promise<OAuthCredentials>;
 export {};

package/dist/types/registry/oauth/gitlab-duo.d.ts

@@ -1,3 +1,3 @@
-import type { OAuthCredentials, OAuthLoginCallbacks } from "./types.js";
-export declare function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
-export declare function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/** GitLab Duo OAuth residue: invalidate direct-access credentials after token rotation. */
+import type { AfterExchangeHook } from "../hooks/types.js";
+export declare const gitLabDuoClearCacheHook: AfterExchangeHook;