@xiaoso/dsh-tool-plus 0.1.0-beta.3 → 0.1.0-beta.4

package/lib/xai-oauth-CMal8l1O.mjs

@@ -0,0 +1,446 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { r as __exportAll } from "./fs-promises-shim-B-9cMxz5.mjs";
+import { c as OAuthError, h as LoginCancelledError } from "./error-yCSG0mGC.mjs";
+import { t as pollOAuthDeviceCodeFlow } from "./device-code-DIb0FU-H.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/xai-oauth.ts
+/**
+* xAI Grok OAuth device authorization flow.
+*
+* Requests an RFC 8628 device code, opens xAI's verification page, and polls
+* the discovered token endpoint until the user approves the login.
+*/
+var xai_oauth_exports = /* @__PURE__ */ __exportAll({
+	buildXAICliBillingUrl: () => buildXAICliBillingUrl,
+	extractXAIAccessTokenSubject: () => extractXAIAccessTokenSubject,
+	fetchXAIOAuthIdentity: () => fetchXAIOAuthIdentity,
+	getXAICliBillingHeaders: () => getXAICliBillingHeaders,
+	loginXAIOAuth: () => loginXAIOAuth,
+	parseXAIAccessTokenPayload: () => parseXAIAccessTokenPayload,
+	refreshXAIOAuthToken: () => refreshXAIOAuthToken,
+	validateXAIBillingEndpoint: () => validateXAIBillingEndpoint,
+	validateXAIEndpoint: () => validateXAIEndpoint
+});
+const XAI_OAUTH_ISSUER = "https://auth.x.ai";
+const XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
+const XAI_OAUTH_DEVICE_CODE_URL = `${XAI_OAUTH_ISSUER}/oauth2/device/code`;
+const XAI_OAUTH_USERINFO_URL = `${XAI_OAUTH_ISSUER}/oauth2/userinfo`;
+const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const XAI_CLI_BILLING_BASE_URL = "https://cli-chat-proxy.grok.com";
+const XAI_CLI_BILLING_PATH = "/v1/billing";
+const XAI_CLI_BILLING_FORMAT = "credits";
+const ACCESS_TOKEN_CLIENT_SKEW_MS = 3e5;
+const DISCOVERY_TIMEOUT_MS = 15e3;
+const TOKEN_REQUEST_TIMEOUT_MS = 2e4;
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* Validate an xAI OIDC endpoint against its scheme and host.
+*
+* The discovery response is long-lived and its token endpoint receives every
+* future refresh token. Rejecting non-HTTPS or non-`x.ai` / `*.x.ai` hosts
+* pins that endpoint to the xAI auth origin.
+*
+* @throws Error with message `Invalid xAI <field>: <url>` when the URL fails
+*         either scheme or host validation.
+*/
+function isXaiAuthHostname(host) {
+	return host === "x.ai" || host.endsWith(".x.ai");
+}
+/** SuperGrok CLI billing proxy host (`cli-chat-proxy.grok.com`), not the OIDC issuer. */
+function isXaiBillingHostname(host) {
+	return host === "grok.com" || host.endsWith(".grok.com");
+}
+function validateXAIEndpoint(url, field) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+			kind: "validation",
+			provider: "xai"
+		});
+	}
+	if (parsed.protocol !== "https:") throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	const host = parsed.hostname.toLowerCase();
+	if (!host || !isXaiAuthHostname(host)) throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	return url;
+}
+/**
+* Pin SuperGrok billing URLs to HTTPS `grok.com` / `*.grok.com`.
+* The CLI billing proxy is intentionally not on `*.x.ai`.
+*/
+function validateXAIBillingEndpoint(url, field = "billing_url") {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+			kind: "validation",
+			provider: "xai"
+		});
+	}
+	if (parsed.protocol !== "https:") throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	const host = parsed.hostname.toLowerCase();
+	if (!host || !isXaiBillingHostname(host)) throw new OAuthError(`Invalid xAI ${field}: ${url}`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	return url;
+}
+/** Fetch xAI's OIDC discovery document and validate the token endpoint. */
+async function xaiOAuthDiscovery(timeoutMs = DISCOVERY_TIMEOUT_MS, fetchOverride) {
+	const fetchImpl = fetchOverride ?? fetch;
+	let response;
+	try {
+		response = await fetchImpl(XAI_OAUTH_DISCOVERY_URL, {
+			method: "GET",
+			headers: { Accept: "application/json" },
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+	} catch (error) {
+		throw new OAuthError(`xAI OIDC discovery failed: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "discovery",
+			provider: "xai",
+			cause: error
+		});
+	}
+	if (response.status !== 200) throw new OAuthError(`xAI OIDC discovery returned status ${response.status}.`, {
+		kind: "discovery",
+		provider: "xai",
+		status: response.status
+	});
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		throw new OAuthError(`xAI OIDC discovery returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "validation",
+			provider: "xai",
+			cause: error
+		});
+	}
+	if (!isRecord(payload)) throw new OAuthError("xAI OIDC discovery response was not a JSON object.", {
+		kind: "validation",
+		provider: "xai"
+	});
+	const tokenEndpoint = typeof payload.token_endpoint === "string" ? payload.token_endpoint.trim() : "";
+	if (!tokenEndpoint) throw new OAuthError("xAI OIDC discovery response was missing token_endpoint.", {
+		kind: "validation",
+		provider: "xai"
+	});
+	validateXAIEndpoint(tokenEndpoint, "token_endpoint");
+	return { token_endpoint: tokenEndpoint };
+}
+/** Decode an xAI access-token JWT payload without verifying its signature. */
+function parseXAIAccessTokenPayload(jwt) {
+	try {
+		if (typeof jwt !== "string" || !jwt.includes(".")) return null;
+		const parts = jwt.split(".");
+		if (parts.length < 2) return null;
+		const payloadPart = parts[1];
+		if (!payloadPart) return null;
+		const decoded = Buffer.from(payloadPart, "base64url").toString("utf8");
+		const payload = JSON.parse(decoded);
+		return isRecord(payload) && !Array.isArray(payload) ? payload : null;
+	} catch {
+		return null;
+	}
+}
+/** Extract the stable xAI subject UUID from an access token. */
+function extractXAIAccessTokenSubject(jwt) {
+	const sub = parseXAIAccessTokenPayload(jwt)?.sub;
+	return typeof sub === "string" && sub.trim() ? sub.trim() : void 0;
+}
+/** Fetch optional OIDC userinfo for a valid xAI access token. */
+async function fetchXAIOAuthIdentity(accessToken, fetchOverride, signal) {
+	const token = accessToken.trim();
+	if (!token) return null;
+	const fetchImpl = fetchOverride ?? fetch;
+	try {
+		const response = await fetchImpl(XAI_OAUTH_USERINFO_URL, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/json"
+			},
+			redirect: "error",
+			signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(DISCOVERY_TIMEOUT_MS)]) : AbortSignal.timeout(DISCOVERY_TIMEOUT_MS)
+		});
+		if (!response.ok) return null;
+		const payload = await response.json();
+		if (!isRecord(payload) || Array.isArray(payload)) return null;
+		const sub = typeof payload.sub === "string" && payload.sub.trim() ? payload.sub.trim() : void 0;
+		const email = typeof payload.email === "string" && payload.email.trim() ? payload.email.trim() : void 0;
+		const name = typeof payload.name === "string" && payload.name.trim() ? payload.name.trim() : void 0;
+		if (!sub && !email && !name) return null;
+		return {
+			...sub ? { accountId: sub } : {},
+			...email ? { email: email.toLowerCase() } : {},
+			...name ? { name } : {}
+		};
+	} catch {
+		return null;
+	}
+}
+async function withXAIOAuthIdentity(credentials, fetchOverride, signal) {
+	const identity = await fetchXAIOAuthIdentity(credentials.access, fetchOverride, signal);
+	const accountId = identity?.accountId ?? credentials.accountId ?? extractXAIAccessTokenSubject(credentials.access);
+	const email = identity?.email ?? credentials.email;
+	return {
+		...credentials,
+		...accountId ? { accountId } : {},
+		...email ? { email } : {}
+	};
+}
+/** Build the SuperGrok CLI billing URL. Pass `""` to omit `format` (unified monthly payload). */
+function buildXAICliBillingUrl(format = XAI_CLI_BILLING_FORMAT) {
+	const url = new URL(XAI_CLI_BILLING_PATH, XAI_CLI_BILLING_BASE_URL);
+	if (format) url.searchParams.set("format", format);
+	return validateXAIBillingEndpoint(url.toString());
+}
+/**
+* Headers for SuperGrok CLI billing (`cli-chat-proxy.grok.com`).
+* Official Grok CLI also sends `X-XAI-Token-Auth: xai-grok-cli` on this host;
+* include it so billing stays on the same product gate as chat inference.
+*/
+function getXAICliBillingHeaders(options) {
+	return {
+		Authorization: `Bearer ${options.accessToken}`,
+		Accept: "application/json",
+		"X-XAI-Token-Auth": "xai-grok-cli"
+	};
+}
+function parseXAIDeviceAuthorization(payload) {
+	if (!isRecord(payload)) throw new OAuthError("xAI device-code response was not a JSON object.", {
+		kind: "validation",
+		provider: "xai"
+	});
+	const deviceCode = typeof payload.device_code === "string" ? payload.device_code.trim() : "";
+	const userCode = typeof payload.user_code === "string" ? payload.user_code.trim() : "";
+	const verificationUri = typeof payload.verification_uri === "string" ? payload.verification_uri.trim() : "";
+	const verificationUriComplete = typeof payload.verification_uri_complete === "string" ? payload.verification_uri_complete.trim() : "";
+	const expiresInSeconds = payload.expires_in;
+	const intervalSeconds = payload.interval;
+	if (!deviceCode || !userCode || !verificationUri || !verificationUriComplete || typeof expiresInSeconds !== "number" || !Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0 || typeof intervalSeconds !== "number" || !Number.isFinite(intervalSeconds) || intervalSeconds <= 0) throw new OAuthError("xAI device-code response missing or invalid required fields.", {
+		kind: "validation",
+		provider: "xai"
+	});
+	validateXAIEndpoint(verificationUri, "verification_uri");
+	validateXAIEndpoint(verificationUriComplete, "verification_uri_complete");
+	return {
+		deviceCode,
+		userCode,
+		verificationUriComplete,
+		expiresInSeconds,
+		intervalSeconds
+	};
+}
+function parseXAITokenResponse(payload, label, refreshTokenFallback) {
+	if (!isRecord(payload)) throw new OAuthError(`${label} was not a JSON object`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	const accessToken = typeof payload.access_token === "string" ? payload.access_token : "";
+	const refreshToken = (typeof payload.refresh_token === "string" ? payload.refresh_token : "") || refreshTokenFallback || "";
+	const expiresInSeconds = payload.expires_in;
+	if (!accessToken) throw new OAuthError(`${label} missing access_token`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	if (!refreshToken) throw new OAuthError(`${label} missing refresh_token`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	if (typeof expiresInSeconds !== "number" || !Number.isFinite(expiresInSeconds)) throw new OAuthError(`${label} missing expires_in`, {
+		kind: "validation",
+		provider: "xai"
+	});
+	return {
+		access: accessToken,
+		refresh: refreshToken,
+		expires: Date.now() + expiresInSeconds * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS
+	};
+}
+async function requestXAIDeviceAuthorization(fetchImpl, signal) {
+	let response;
+	try {
+		const timeoutSignal = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+		response = await fetchImpl(XAI_OAUTH_DEVICE_CODE_URL, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body: new URLSearchParams({
+				client_id: XAI_OAUTH_CLIENT_ID,
+				scope: XAI_OAUTH_SCOPE
+			}),
+			signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
+		});
+	} catch (error) {
+		if (signal?.aborted) throw new LoginCancelledError();
+		throw new OAuthError(`xAI device-code request failed: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "device-auth",
+			provider: "xai",
+			cause: error
+		});
+	}
+	if (!response.ok) {
+		let detail = "";
+		try {
+			detail = (await response.text()).trim();
+		} catch {}
+		throw new OAuthError(`xAI device-code request failed: ${response.status}${detail ? ` ${detail}` : ""}`, {
+			kind: "device-auth",
+			provider: "xai",
+			status: response.status
+		});
+	}
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		throw new OAuthError(`xAI device-code response returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "validation",
+			provider: "xai",
+			cause: error
+		});
+	}
+	return parseXAIDeviceAuthorization(payload);
+}
+async function pollXAIDeviceToken(tokenEndpoint, deviceCode, fetchImpl, signal) {
+	let response;
+	try {
+		const timeoutSignal = AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS);
+		response = await fetchImpl(tokenEndpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body: new URLSearchParams({
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				client_id: XAI_OAUTH_CLIENT_ID,
+				device_code: deviceCode
+			}),
+			redirect: "error",
+			signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
+		});
+	} catch (error) {
+		if (signal?.aborted) throw new LoginCancelledError();
+		throw new OAuthError(`xAI device-code token polling failed: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "polling",
+			provider: "xai",
+			cause: error
+		});
+	}
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		throw new OAuthError(`xAI device-code token polling returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "polling",
+			provider: "xai",
+			status: response.status,
+			cause: error
+		});
+	}
+	if (response.ok) return {
+		status: "complete",
+		value: parseXAITokenResponse(payload, "xAI device-code token response")
+	};
+	if (!isRecord(payload)) throw new OAuthError(`xAI device-code token polling failed: ${response.status}`, {
+		kind: "polling",
+		provider: "xai",
+		status: response.status
+	});
+	const errorCode = typeof payload.error === "string" ? payload.error : "";
+	if (errorCode === "authorization_pending") return { status: "pending" };
+	if (errorCode === "slow_down") return { status: "slow_down" };
+	const detail = (typeof payload.error_description === "string" ? payload.error_description : "") || errorCode || String(response.status);
+	throw new OAuthError(`xAI device-code token polling failed: ${detail}`, {
+		kind: "polling",
+		provider: "xai",
+		status: response.status
+	});
+}
+/** Log in to xAI Grok with the RFC 8628 device authorization grant. */
+async function loginXAIOAuth(ctrl) {
+	const fetchImpl = ctrl.fetch ?? fetch;
+	const discovery = await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, fetchImpl);
+	const device = await requestXAIDeviceAuthorization(fetchImpl, ctrl.signal);
+	ctrl.onAuth?.({
+		url: device.verificationUriComplete,
+		instructions: `Enter code: ${device.userCode}`
+	});
+	ctrl.onProgress?.("Waiting for xAI device authorization...");
+	return withXAIOAuthIdentity(await pollOAuthDeviceCodeFlow({
+		poll: () => pollXAIDeviceToken(discovery.token_endpoint, device.deviceCode, fetchImpl, ctrl.signal),
+		intervalSeconds: device.intervalSeconds,
+		expiresInSeconds: device.expiresInSeconds,
+		signal: ctrl.signal
+	}), fetchImpl, ctrl.signal);
+}
+/**
+* Refresh an xAI OAuth access token using a stored refresh_token.
+*
+* Re-runs OIDC discovery and re-validates the token endpoint before sending
+* the stored refresh token.
+*/
+async function refreshXAIOAuthToken(refreshToken, fetchOverride) {
+	const fetchImpl = fetchOverride ?? fetch;
+	if (typeof refreshToken !== "string" || !refreshToken.trim()) throw new OAuthError("missing refresh_token", {
+		kind: "validation",
+		provider: "xai"
+	});
+	const response = await fetchImpl(validateXAIEndpoint((await xaiOAuthDiscovery(DISCOVERY_TIMEOUT_MS, fetchImpl)).token_endpoint, "token_endpoint"), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json"
+		},
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			client_id: XAI_OAUTH_CLIENT_ID,
+			refresh_token: refreshToken
+		}),
+		redirect: "error",
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+	});
+	if (!response.ok) {
+		let detail = "";
+		try {
+			detail = (await response.text()).trim();
+		} catch {}
+		throw new OAuthError(`xAI token refresh failed: ${response.status}${detail ? ` ${detail}` : ""}`, {
+			kind: "token-refresh",
+			provider: "xai",
+			status: response.status
+		});
+	}
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		throw new OAuthError(`xAI token refresh returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`, {
+			kind: "validation",
+			provider: "xai",
+			cause: error
+		});
+	}
+	return withXAIOAuthIdentity(parseXAITokenResponse(payload, "xAI token refresh response", refreshToken), fetchImpl);
+}
+//#endregion
+export { xai_oauth_exports as a, getXAICliBillingHeaders as i, extractXAIAccessTokenSubject as n, fetchXAIOAuthIdentity as r, buildXAICliBillingUrl as t };

package/lib/xiaomi-CZgwvX2G.mjs

@@ -0,0 +1,157 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { _ as OnPromptRequiredError, c as OAuthError, h as LoginCancelledError, m as ApiKeyRequiredError } from "./error-yCSG0mGC.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/xiaomi.ts
+/**
+* Xiaomi MiMo login flow.
+*
+* Xiaomi MiMo provides OpenAI-compatible models via
+* https://api.xiaomimimo.com/v1.
+*
+* Standard Xiaomi login opens the pay-as-you-go API key console. Token Plan
+* login opens plan management so users copy the regional `tp-...` key.
+*/
+const PROVIDER_ID = "xiaomi";
+const PROVIDER_NAME = "Xiaomi MiMo";
+const STANDARD_AUTH_URL = "https://platform.xiaomimimo.com/#/console/api-keys";
+const TOKEN_PLAN_AUTH_URL = "https://platform.xiaomimimo.com/console/plan-manage";
+const STANDARD_API_BASE_URL = "https://api.xiaomimimo.com/v1";
+const TOKEN_PLAN_KEY_PREFIX = "tp-";
+const STANDARD_VALIDATION_MODEL = "mimo-v2.5";
+const TOKEN_PLAN_VALIDATION_MODEL = "mimo-v2.5";
+const TOKEN_PLAN_VALIDATION_ENDPOINTS = {
+	sgp: {
+		baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1",
+		model: TOKEN_PLAN_VALIDATION_MODEL
+	},
+	ams: {
+		baseUrl: "https://token-plan-ams.xiaomimimo.com/v1",
+		model: TOKEN_PLAN_VALIDATION_MODEL
+	},
+	cn: {
+		baseUrl: "https://token-plan-cn.xiaomimimo.com/v1",
+		model: TOKEN_PLAN_VALIDATION_MODEL
+	}
+};
+const TOKEN_PLAN_REGION_NAMES = {
+	sgp: "Singapore",
+	ams: "Europe",
+	cn: "China"
+};
+function isTokenPlanKey(apiKey) {
+	return apiKey.startsWith(TOKEN_PLAN_KEY_PREFIX);
+}
+const VALIDATION_TIMEOUT_MS = 15e3;
+async function validateXiaomiApiKey(apiKey, tokenPlanRegion, signal, fetchOverride) {
+	const fetchImpl = fetchOverride ?? fetch;
+	const endpoints = tokenPlanRegion ? [TOKEN_PLAN_VALIDATION_ENDPOINTS[tokenPlanRegion]] : isTokenPlanKey(apiKey) ? [
+		TOKEN_PLAN_VALIDATION_ENDPOINTS.sgp,
+		TOKEN_PLAN_VALIDATION_ENDPOINTS.ams,
+		TOKEN_PLAN_VALIDATION_ENDPOINTS.cn
+	] : [{
+		baseUrl: STANDARD_API_BASE_URL,
+		model: STANDARD_VALIDATION_MODEL
+	}];
+	let lastError = null;
+	for (const ep of endpoints) {
+		const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+		const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+		try {
+			const response = await fetchImpl(`${ep.baseUrl}/chat/completions`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${apiKey}`
+				},
+				body: JSON.stringify({
+					model: ep.model,
+					max_tokens: 1,
+					messages: [{
+						role: "user",
+						content: "ping"
+					}]
+				}),
+				signal: requestSignal
+			});
+			if (response.ok) return;
+			if (response.status === 401) {
+				let details = "";
+				try {
+					details = (await response.text()).trim();
+				} catch {}
+				lastError = new OAuthError(details ? `${PROVIDER_NAME} API key validation failed (${response.status}): ${details}` : `${PROVIDER_NAME} API key validation failed (${response.status})`, {
+					kind: "validation",
+					provider: PROVIDER_ID,
+					status: response.status
+				});
+				continue;
+			}
+			let details = "";
+			try {
+				details = (await response.text()).trim();
+			} catch {}
+			const message = details ? `${PROVIDER_NAME} API key validation failed (${response.status}): ${details}` : `${PROVIDER_NAME} API key validation failed (${response.status})`;
+			throw new OAuthError(message, {
+				kind: "validation",
+				provider: PROVIDER_ID,
+				status: response.status
+			});
+		} catch (e) {
+			if (e instanceof DOMException && e.name === "AbortError" && signal?.aborted) throw e;
+			lastError = e instanceof Error ? e : new Error(String(e));
+		}
+	}
+	throw lastError ?? new OAuthError(`${PROVIDER_NAME} API key validation failed`, {
+		kind: "validation",
+		provider: PROVIDER_ID
+	});
+}
+/**
+* Login to Xiaomi MiMo.
+*
+* Opens browser to API keys page, prompts user to paste their API key.
+* Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+*/
+async function loginXiaomi(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	if (!options.onPrompt) throw new OnPromptRequiredError(PROVIDER_NAME);
+	options.onAuth?.({
+		url: STANDARD_AUTH_URL,
+		instructions: "Copy your API key from the Xiaomi MiMo console"
+	});
+	const apiKey = await options.onPrompt({
+		message: "Paste your Xiaomi API key (sk-... or token-plan tp-...)",
+		placeholder: "sk-... or tp-..."
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = apiKey.trim();
+	if (!trimmed) throw new ApiKeyRequiredError();
+	options.onProgress?.(`Validating ${PROVIDER_ID} API key...`);
+	await validateXiaomiApiKey(trimmed, void 0, options.signal, fetchImpl);
+	return trimmed;
+}
+/**
+* Login to a regional Xiaomi Token Plan endpoint.
+*
+* Prompts for a token-plan API key and validates it against the selected region.
+*/
+async function loginXiaomiTokenPlan(options, region) {
+	const fetchImpl = options.fetch ?? fetch;
+	if (!options.onPrompt) throw new OnPromptRequiredError(`Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]})`);
+	options.onAuth?.({
+		url: TOKEN_PLAN_AUTH_URL,
+		instructions: `Copy your token-plan API key for the ${TOKEN_PLAN_REGION_NAMES[region]} region`
+	});
+	const apiKey = await options.onPrompt({
+		message: `Paste your Xiaomi Token Plan ${TOKEN_PLAN_REGION_NAMES[region]} API key (tp-...)`,
+		placeholder: "tp-..."
+	});
+	if (options.signal?.aborted) throw new LoginCancelledError();
+	const trimmed = apiKey.trim();
+	if (!trimmed) throw new ApiKeyRequiredError();
+	options.onProgress?.(`Validating Xiaomi Token Plan (${TOKEN_PLAN_REGION_NAMES[region]}) API key...`);
+	await validateXiaomiApiKey(trimmed, region, options.signal, fetchImpl);
+	return trimmed;
+}
+//#endregion
+export { loginXiaomi, loginXiaomiTokenPlan };