@vib-rato/ai 0.16.0

package/dist/types/utils/oauth/callback-server.d.ts

@@ -0,0 +1,80 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+export type CallbackResult = {
+    code: string;
+    state: string;
+};
+export interface OAuthCallbackFlowOptions {
+    preferredPort: number;
+    callbackPath?: string;
+    callbackHostname?: string;
+    /** Local listener hostname; defaults to callbackHostname when omitted. */
+    callbackBindHostname?: string;
+    /** Exact redirect URI advertised to the provider; disables port fallback. */
+    redirectUri?: string;
+    /**
+     * Do not bind a local listener at all. The provider redirects somewhere this
+     * process cannot observe (a hosted "copy this code" page, a custom protocol),
+     * so the code arrives by paste instead. Requires both `redirectUri` and an
+     * `onManualCodeInput` handler on the controller.
+     */
+    skipCallbackServer?: boolean;
+    /**
+     * Expected authorization-server issuer recorded from validated metadata
+     * (RFC 9207 / MCP 2026-07-28). When set, a present `iss` that differs
+     * rejects the response before any other parameter is acted on.
+     */
+    expectedIssuer?: string;
+    /**
+     * `authorization_response_iss_parameter_supported` from the same metadata.
+     * When true, a response WITHOUT `iss` is rejected.
+     */
+    issuerResponseIssSupported?: boolean;
+}
+/**
+ * Abstract base class for OAuth flows with local callback servers.
+ */
+export declare abstract class OAuthCallbackFlow {
+    #private;
+    ctrl: OAuthController;
+    preferredPort: number;
+    callbackPath: string;
+    callbackHostname: string;
+    callbackBindHostname: string;
+    redirectUri?: string;
+    expectedIssuer?: string;
+    issuerResponseIssSupported?: boolean;
+    constructor(ctrl: OAuthController, preferredPortOrOptions: number | OAuthCallbackFlowOptions, callbackPath?: string);
+    /**
+     * Generate provider-specific authorization URL.
+     * @param state - CSRF state token
+     * @param redirectUri - The actual redirect URI to use (may differ from expected if port fallback occurred)
+     * @returns Authorization URL and optional instructions
+     */
+    abstract generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    /**
+     * Exchange authorization code for OAuth tokens.
+     * @param code - Authorization code from callback
+     * @param state - CSRF state token
+     * @param redirectUri - The actual redirect URI used (must match authorization request)
+     * @returns OAuth credentials
+     */
+    abstract exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+    /**
+     * Generate CSRF state token. Override if provider needs custom state generation.
+     */
+    generateState(): string;
+    /**
+     * Execute the OAuth login flow.
+     */
+    login(): Promise<OAuthCredentials>;
+}
+/**
+ * Parse a redirect URL or code string to extract code and state.
+ */
+export declare function parseCallbackInput(input: string): {
+    code?: string;
+    state?: string;
+};

package/dist/types/utils/oauth/cerebras.d.ts

@@ -0,0 +1 @@
+export declare const loginCerebras: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/cloudflare-ai-gateway.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Cloudflare AI Gateway login flow.
+ *
+ * Cloudflare AI Gateway proxies upstream model providers.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open Cloudflare AI Gateway docs/dashboard
+ * 2. User copies their Cloudflare AI Gateway token/API key
+ * 3. User pastes the API key into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to Cloudflare AI Gateway.
+ *
+ * Opens browser to Cloudflare AI Gateway authentication docs and prompts for a gateway token/API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginCloudflareAiGateway(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/commandcode.d.ts

@@ -0,0 +1 @@
+export declare const loginCommandCode: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/cursor.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthCredentials } from "./types";
+export interface CursorAuthParams {
+    verifier: string;
+    challenge: string;
+    uuid: string;
+    loginUrl: string;
+}
+export declare function generateCursorAuthParams(): Promise<CursorAuthParams>;
+export declare function pollCursorAuth(uuid: string, verifier: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+}>;
+export declare function loginCursor(onAuthUrl: (url: string) => void, onPollStart?: () => void): Promise<OAuthCredentials>;
+export declare function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<OAuthCredentials>;
+export declare function isCursorTokenExpiringSoon(token: string, thresholdSeconds?: number): boolean;

package/dist/types/utils/oauth/deepinfra.d.ts

@@ -0,0 +1 @@
+export declare const loginDeepInfra: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/deepseek.d.ts

@@ -0,0 +1,10 @@
+import type { OAuthController } from "./types";
+/**
+ * Normalize a pasted DeepSeek API key.
+ *
+ * Users frequently copy keys out of `curl` snippets that include the
+ * `Authorization: Bearer …` prefix. Strip it so validation does not fail
+ * with a confusing 401, and reject obviously empty input early.
+ */
+export declare function normalizeDeepSeekApiKey(raw: string): string;
+export declare const loginDeepSeek: (options: OAuthController) => Promise<string>;

package/dist/types/utils/oauth/firepass.d.ts

@@ -0,0 +1 @@
+export declare const loginFirepass: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/fireworks.d.ts

@@ -0,0 +1 @@
+export declare const loginFireworks: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/fugu.d.ts

@@ -0,0 +1 @@
+export declare const loginFugu: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/github-copilot.d.ts

@@ -0,0 +1,38 @@
+import type { OAuthCredentials } from "./types";
+export declare const COPILOT_USER_AGENT: "opencode/1.3.15";
+export declare const OPENCODE_HEADERS: {
+    readonly "User-Agent": "opencode/1.3.15";
+};
+export type ParsedGitHubCopilotApiKey = {
+    accessToken: string;
+    enterpriseUrl?: string;
+};
+export declare function normalizeGitHubCopilotEnterpriseDomain(input: string | undefined): string | undefined;
+export declare function parseGitHubCopilotApiKey(apiKeyRaw: string): ParsedGitHubCopilotApiKey;
+export declare function normalizeDomain(input: string): string | null;
+export declare function getGitHubCopilotBaseUrl(enterpriseDomain?: string): string;
+/**
+ * Refresh GitHub Copilot token.
+ * With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+ */
+export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string): OAuthCredentials;
+/**
+ * Login with GitHub Copilot OAuth (device code flow)
+ *
+ * @param options.onAuth - Callback with URL and optional instructions (user code)
+ * @param options.onPrompt - Callback to prompt user for input
+ * @param options.onProgress - Optional progress callback
+ * @param options.signal - Optional AbortSignal for cancellation
+ */
+export declare function loginGitHubCopilot(options: {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    pollIntervalFloorMs?: number;
+    pollIntervalScaleMs?: number;
+}): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/gitlab-duo.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+export declare function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/glm-zcode.d.ts

@@ -0,0 +1,71 @@
+/**
+ * GLM ZCode OAuth flow (UNOFFICIAL, opt-in).
+ *
+ * Replicates how the ZCode desktop app turns a Z.AI login into usable GLM model
+ * access. This is NOT an official Z.AI OAuth client: it reuses ZCode's authorize
+ * page, broker, and a custom-protocol redirect. It may break at any time and may
+ * violate ZCode/Z.AI Terms of Service. Endpoints/client id are overridable via
+ * `ZCODE_OAUTH_*` environment variables.
+ *
+ * Verified end-to-end against the ZCode host bundle (`resolveZaiApiKey` /
+ * `resolveBizApiKey`) and live traffic:
+ *   1. Authorize: GET {authorize}?redirect_uri=zcode://oauth/callback&response_type=code&client_id=...&state=...
+ *      (custom-protocol redirect → a CLI cannot catch it, so the user pastes the code/redirect URL)
+ *   2. Broker:    POST {broker} { provider:"zai", code, redirect_uri, state }
+ *                  → { data: { token: <ZCode JWT>, zai: { access_token: <upstream Z.AI token> } } }
+ *   3. Business:  POST {z/login} { token: <upstream Z.AI token> } → { data: { access_token: <business token> } }
+ *   4. Provision: with the business token, GET getCustomerInfo → default org/project,
+ *      GET/POST .../api_keys (find/create a key named "zcode-api-key"),
+ *      GET .../api_keys/copy/{id} → secretKey ⇒ a real Z.AI API key "{id}.{secret}".
+ *
+ * Credential mapping:
+ *   - `access`  = the provisioned **Z.AI API key** ("{id}.{secret}"). Model requests go to
+ *                 `https://api.z.ai/api/anthropic/v1/messages` with `Authorization: Bearer <key>`
+ *                 (exactly like a dashboard key) — NO zcode.z.ai gateway, NO captcha.
+ *   - `refresh` = the upstream Z.AI OAuth access token (used to re-provision the key).
+ * The API key is long-lived, so `expires` is set far in the future.
+ *
+ * This provider must NEVER force `isOAuth=true`: the key is a plain Z.AI API key, and
+ * api.z.ai is not api.anthropic.com, so the Anthropic path already emits a plain bearer.
+ */
+import { OAuthCallbackFlow } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare const GLM_ZCODE_REFRESH_SKEW_MS: number;
+/** Default endpoints / client id. Override via the matching `ZCODE_OAUTH_*` env vars. */
+export declare const GLM_ZCODE_OAUTH_AUTHORIZE_URL = "https://chat.z.ai/api/oauth/authorize";
+export declare const GLM_ZCODE_OAUTH_CLIENT_ID = "client_P8X5CMWmlaRO9gyO-KSqtg";
+export declare const GLM_ZCODE_OAUTH_REDIRECT_URI = "zcode://oauth/callback";
+export declare const GLM_ZCODE_OAUTH_BROKER_TOKEN_URL = "https://zcode.z.ai/api/v1/oauth/token";
+export declare const GLM_ZCODE_ZAI_LOGIN_URL = "https://api.z.ai/api/auth/z/login";
+export declare const GLM_ZCODE_USERINFO_URL = "https://chat.z.ai/api/oauth/userinfo";
+/** Z.AI business API base (customer/org/project/api-key management). */
+export declare const GLM_ZCODE_ZAI_API_BASE = "https://api.z.ai";
+/** Model API base — the provisioned key is used here, exactly like a dashboard key. */
+export declare const GLM_ZCODE_ANTHROPIC_BASE_URL = "https://api.z.ai/api/anthropic";
+type FetchImpl = typeof globalThis.fetch;
+/** Configured whenever a client id is available; the real ZCode client id ships as default. */
+export declare function isGlmZcodeOAuthConfigured(): boolean;
+export interface GlmZcodeOAuthFlowOptions {
+    fetch?: FetchImpl;
+}
+export declare class GlmZcodeOAuthFlow extends OAuthCallbackFlow {
+    #private;
+    constructor(ctrl: OAuthController, options?: GlmZcodeOAuthFlowOptions);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+export declare function loginGlmZcode(ctrl: OAuthController, options?: GlmZcodeOAuthFlowOptions): Promise<OAuthCredentials>;
+export interface GlmZcodeRefreshOptions {
+    signal?: AbortSignal;
+    fetch?: FetchImpl;
+}
+/**
+ * Re-provision the Z.AI API key from the stored upstream token. The key itself is
+ * long-lived, so this is rarely needed; if the upstream token has expired it fails
+ * loudly and the user must re-login.
+ */
+export declare function refreshGlmZcodeToken(credentials: OAuthCredentials, options?: AbortSignal | GlmZcodeRefreshOptions): Promise<OAuthCredentials>;
+export {};

package/dist/types/utils/oauth/google-antigravity.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA: Readonly<{
+    ideType: "ANTIGRAVITY";
+    platform: "PLATFORM_UNSPECIFIED";
+    pluginType: "GEMINI";
+}>;
+export declare function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Antigravity token
+ */
+export declare function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/google-gemini-cli.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Gemini CLI OAuth flow (Google Cloud Code Assist)
+ * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare function loginGeminiCli(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Google Cloud Code Assist token
+ */
+export declare function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/google-oauth-shared.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Shared OAuth flow for Google-style providers (Gemini CLI, Antigravity).
+ *
+ * Both providers use the same authorization-code flow shape; only the client
+ * credentials, scopes, endpoint constants, and project-discovery logic differ.
+ */
+import { OAuthCallbackFlow } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+export interface GoogleOAuthFlowConfig {
+    clientId: string;
+    clientSecret: string;
+    authUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    callbackPort: number;
+    callbackPath: string;
+    discoverProject: (accessToken: string, onProgress?: (message: string) => void) => Promise<string>;
+}
+export declare class GoogleOAuthFlow extends OAuthCallbackFlow {
+    private readonly config;
+    constructor(ctrl: OAuthController, config: GoogleOAuthFlowConfig);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+export declare function runGoogleOAuthLogin(ctrl: OAuthController, config: GoogleOAuthFlowConfig): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/huggingface.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Hugging Face Inference login flow.
+ *
+ * Hugging Face Inference Providers expose an OpenAI-compatible endpoint via
+ * https://router.huggingface.co/v1.
+ *
+ * This is an API key flow:
+ * 1. Open browser to Hugging Face token settings
+ * 2. User creates/copies a token with Inference Providers permission
+ * 3. User pastes the token into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to Hugging Face Inference Providers.
+ *
+ * Opens browser to token settings, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginHuggingface(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/index.d.ts

@@ -0,0 +1,39 @@
+import type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types";
+/**
+ * Register a custom OAuth provider.
+ */
+export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
+/**
+ * Get a custom OAuth provider by ID.
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Remove all custom OAuth providers registered by a source.
+ */
+export declare function unregisterOAuthProviders(sourceId: string): void;
+/**
+ * Refresh token for any OAuth provider.
+ * Saves the new credentials and returns the new access token.
+ */
+export declare function refreshOAuthToken(provider: OAuthProvider, credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/**
+ * Build API-key bytes for a provider from an already-fresh OAuth credential.
+ *
+ * Refresh is owned by AuthStorage. This helper deliberately refuses expired
+ * credentials so it cannot POST broker redaction sentinels to upstream token
+ * endpoints as a side channel.
+ *
+ * For providers that need credential metadata at request time, returns
+ * JSON-encoded credentials plus expiry metadata for diagnostics/edge guards.
+ * @returns API key string, or null if no credentials
+ * @throws Error if the credential is expired and must be refreshed upstream
+ */
+export declare function getOAuthApiKey(provider: OAuthProvider, credentials: Record<string, OAuthCredentials>): Promise<{
+    newCredentials: OAuthCredentials;
+    apiKey: string;
+} | null>;
+export declare function resolveOAuthStorageProvider(provider: OAuthProviderId): OAuthProviderId;
+/**
+ * Get list of OAuth providers.
+ */
+export declare function getOAuthProviders(): OAuthProviderInfo[];

package/dist/types/utils/oauth/kagi.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Kagi login flow.
+ *
+ * Kagi web search uses an API key from the account settings page.
+ * This is an API key flow:
+ * 1. Open browser to Kagi API settings
+ * 2. User copies API key
+ * 3. User pastes key into CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to Kagi.
+ *
+ * Opens browser to API settings and prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginKagi(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/kilo.d.ts

@@ -0,0 +1,5 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+/**
+ * Login with Kilo Gateway OAuth (device code flow).
+ */
+export declare function loginKilo(callbacks: OAuthController): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/kimi.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Kimi Code OAuth flow (device authorization grant)
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+/** Test seam: the OAuth host as resolved from trusted env. */
+export declare function resolveKimiOAuthHostForTest(): string;
+/** @internal Exported for tests. Builds unsanitized-input-safe Kimi common headers. */
+export declare function buildKimiCommonHeaders(): Readonly<Record<string, string>>;
+export declare const getKimiCommonHeaders: () => Readonly<Record<string, string>>;
+/**
+ * Login with Kimi Code OAuth (device code flow).
+ */
+export declare function loginKimi(options: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Kimi OAuth token.
+ */
+export declare function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials>;

package/dist/types/utils/oauth/kiro.d.ts

@@ -0,0 +1,71 @@
+import type { OAuthCredentials } from "./types";
+interface StartDeviceAuthorizationResponse {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    interval: number;
+    expiresIn: number;
+}
+interface CreateTokenSuccess {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken?: string;
+}
+interface ClientRegistration {
+    clientId: string;
+    clientSecret: string;
+    expiresAt: number;
+}
+/**
+ * Register a public SSO OIDC client. Registration responses include an expiry
+ * timestamp (`clientSecretExpiresAt`); we cache until then to avoid re-registering
+ * on every login attempt.
+ *
+ * The SSO OIDC `RegisterClient` endpoint is public (no authentication required).
+ */
+export declare function registerClient(region: string, startUrl: string, signal?: AbortSignal): Promise<ClientRegistration>;
+/** Drop cached client registration — used by tests. */
+export declare function clearClientRegistrationCache(): void;
+/**
+ * Start device authorization. The SSO OIDC `StartDeviceAuthorization` endpoint
+ * is public (requires registered clientId/clientSecret, not SigV4).
+ */
+export declare function startDeviceAuthorization(region: string, startUrl: string, registration: ClientRegistration, signal?: AbortSignal): Promise<StartDeviceAuthorizationResponse>;
+/**
+ * Poll `CreateToken` until the user completes authorization or the device code
+ * expires. Handles `authorization_pending` (continue polling) and `slow_down`
+ * (increase interval) per the published SSO OIDC model.
+ */
+export declare function pollForToken(region: string, registration: ClientRegistration, deviceCode: string, intervalSeconds: number, expiresInSeconds: number, signal?: AbortSignal): Promise<CreateTokenSuccess>;
+/**
+ * Refresh an expired access token using the stored refresh token via
+ * `CreateToken` with `grantType: "refresh_token"`.
+ *
+ * Rotation is published behavior: the response includes a new `refreshToken`.
+ * If the server does not return a new one, the old refresh token is retained.
+ */
+export declare function refreshKiroToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+export interface KiroLoginOptions {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    /** Override for tests. */
+    fetchImpl?: typeof globalThis.fetch;
+}
+export declare function loginKiro(options: KiroLoginOptions): Promise<OAuthCredentials>;
+/**
+ * Attempt to import a cached SSO access token from `~/.aws/sso/cache/`.
+ * Returns the token if a valid (non-expired) one exists, otherwise undefined.
+ *
+ * This reuses the documented AWS CLI SSO cache location, not any third-party
+ * credential store.
+ */
+export declare function importSsoCacheToken(): OAuthCredentials | undefined;
+export {};

package/dist/types/utils/oauth/litellm.d.ts

@@ -0,0 +1,18 @@
+/**
+ * LiteLLM login flow.
+ *
+ * LiteLLM is an OpenAI-compatible proxy that routes requests to many upstream providers.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to LiteLLM docs/dashboard
+ * 2. User copies their LiteLLM API key
+ * 3. User pastes the API key into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to LiteLLM.
+ *
+ * Opens browser to LiteLLM setup docs, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginLiteLLM(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/lm-studio.d.ts

@@ -0,0 +1,17 @@
+/**
+ * LM Studio login flow.
+ *
+ * LM Studio provides an OpenAI-compatible API at a local base URL.
+ * It usually runs unauthenticated but can be configured to require a bearer token.
+ *
+ * This flow stores an API-key-style credential used by `/login` and auth storage.
+ */
+import type { OAuthController } from "./types";
+export declare const DEFAULT_LOCAL_TOKEN = "lm-studio-local";
+/**
+ * Login to LM Studio.
+ *
+ * Opens LM Studio API docs, prompts for an optional token,
+ * and returns a stored key value.
+ */
+export declare function loginLmStudio(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/mara.d.ts

@@ -0,0 +1 @@
+export declare const loginMara: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/minimax-code.d.ts

@@ -0,0 +1,28 @@
+/**
+ * MiniMax Coding Plan login flow.
+ *
+ * MiniMax Coding Plan is a subscription service that provides access to
+ * MiniMax models (M2, M2.1) through an OpenAI-compatible API.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to https://platform.minimax.io/subscribe/coding-plan
+ * 2. User subscribes and copies their API key
+ * 3. User pastes the API key back into the CLI
+ *
+ * International: https://api.minimax.io/v1
+ * China: https://api.minimaxi.com/v1
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to MiniMax Coding Plan (international).
+ *
+ * Opens browser to subscription page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginMiniMaxCode(options: OAuthController): Promise<string>;
+/**
+ * Login to MiniMax Coding Plan (China).
+ *
+ * Same flow as international but uses China endpoint.
+ */
+export declare function loginMiniMaxCodeCn(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/moonshot.d.ts

@@ -0,0 +1 @@
+export declare const loginMoonshot: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/nanogpt.d.ts

@@ -0,0 +1 @@
+export declare const loginNanoGPT: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/nvidia.d.ts

@@ -0,0 +1,18 @@
+/**
+ * NVIDIA login flow.
+ *
+ * NVIDIA provides OpenAI-compatible models via https://integrate.api.nvidia.com/v1.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to NVIDIA NGC catalog
+ * 2. User copies their API key
+ * 3. User pastes the API key into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to NVIDIA.
+ *
+ * Opens browser to NVIDIA dashboard, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginNvidia(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/ollama-cloud.d.ts

@@ -0,0 +1,2 @@
+import type { OAuthController } from "./types";
+export declare function loginOllamaCloud(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/ollama.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Ollama login flow.
+ *
+ * Ollama is typically used locally without authentication, but some hosted
+ * deployments require a bearer token/API key.
+ *
+ * This flow is API-key based (not OAuth):
+ * 1. Optionally open Ollama docs
+ * 2. Prompt user for API key/token (optional)
+ * 3. Persist key only when provided
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to Ollama.
+ *
+ * Returns a trimmed API key/token string. Empty string means local no-auth mode.
+ */
+export declare function loginOllama(options: OAuthController): Promise<string>;

package/dist/types/utils/oauth/openai-codex.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare function decodeJwt<T = Record<string, unknown>>(token: string): T | null;
+/**
+ * Login with OpenAI code provider OAuth
+ */
+export type OpenAICodexLoginOptions = OAuthController & {
+    /** Optional originator value for OpenAI code provider OAuth. Default: "opencode". */
+    originator?: string;
+};
+export declare function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials>;
+/**
+ * Login with OpenAI code provider using the device-code (headless) flow.
+ *
+ * Avoids a local callback server entirely — useful when port 1455 is unavailable
+ * or when the browser callback flow fails with 403 (e.g. network/proxy issues).
+ */
+export declare function loginOpenAICodexDevice(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh OpenAI code provider OAuth token
+ */
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;