jeopi-ai 16.2.13

package/dist/types/registry/oauth/callback-server.d.ts

@@ -0,0 +1,72 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+export type CallbackResult = {
+    code: string;
+    state: string;
+};
+export interface OAuthCallbackFlowOptions {
+    preferredPort: number;
+    callbackPath?: string;
+    callbackHostname?: string;
+    /** Exact redirect URI advertised to the provider; disables port fallback. */
+    redirectUri?: string;
+    /**
+     * Whether the flow may bind to a random port when {@link preferredPort} is
+     * unavailable. Defaults to `true` so historical AI-provider flows (which
+     * pick uncommon ports and tolerate any loopback callback) keep working.
+     *
+     * Set to `false` for providers that validate the redirect URI against a
+     * registered callback — silently advertising a random-port URI would be
+     * rejected by the authorization server, leaving the browser on an opaque
+     * 500 page and the local callback waiting until the 5-minute timeout fires.
+     * With fallback disabled, {@link OAuthCallbackFlow.login} throws a
+     * {@link AIError.ConfigurationError} immediately so the caller can surface
+     * an actionable message before opening the browser.
+     */
+    allowPortFallback?: boolean;
+}
+/**
+ * Abstract base class for OAuth flows with local callback servers.
+ */
+export declare abstract class OAuthCallbackFlow {
+    #private;
+    ctrl: OAuthController;
+    preferredPort: number;
+    callbackPath: string;
+    callbackHostname: string;
+    redirectUri?: string;
+    allowPortFallback: boolean;
+    constructor(ctrl: OAuthController, preferredPortOrOptions: number | OAuthCallbackFlowOptions, callbackPath?: string);
+    /**
+     * Generate provider-specific authorization URL.
+     * @param state - CSRF state token
+     * @param redirectUri - The actual redirect URI to use (may differ from expected if port fallback occurred)
+     * @returns Authorization URL and optional instructions
+     */
+    abstract generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    /**
+     * Exchange authorization code for OAuth tokens.
+     * @param code - Authorization code from callback
+     * @param state - CSRF state token
+     * @param redirectUri - The actual redirect URI used (must match authorization request)
+     * @returns OAuth credentials
+     */
+    abstract exchangeToken(code: string, state: string, redirectUri: string): Promise<OAuthCredentials>;
+    /**
+     * Generate CSRF state token. Override if provider needs custom state generation.
+     */
+    generateState(): string;
+    /**
+     * Execute the OAuth login flow.
+     */
+    login(): Promise<OAuthCredentials>;
+}
+/**
+ * Parse a redirect URL or code string to extract code and state.
+ */
+export declare function parseCallbackInput(input: string): {
+    code?: string;
+    state?: string;
+};

package/dist/types/registry/oauth/cursor.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthCredentials } from "./types";
+export interface CursorAuthParams {
+    verifier: string;
+    challenge: string;
+    uuid: string;
+    loginUrl: string;
+}
+export declare function generateCursorAuthParams(): Promise<CursorAuthParams>;
+export declare function pollCursorAuth(uuid: string, verifier: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+}>;
+export declare function loginCursor(onAuthUrl: (url: string) => void, onPollStart?: () => void): Promise<OAuthCredentials>;
+export declare function refreshCursorToken(apiKeyOrRefreshToken: string): Promise<OAuthCredentials>;
+export declare function isCursorTokenExpiringSoon(token: string, thresholdSeconds?: number): boolean;

package/dist/types/registry/oauth/devin.d.ts

@@ -0,0 +1,5 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+type FetchFunction = NonNullable<OAuthController["fetch"]>;
+export declare function loginDevin(ctrl: OAuthController): Promise<OAuthCredentials>;
+export declare function exchangeDevinCliToken(authorizationCode: string, codeVerifier: string, fetchImpl?: FetchFunction): Promise<string>;
+export {};

package/dist/types/registry/oauth/github-copilot.d.ts

@@ -0,0 +1,30 @@
+import type { FetchImpl } from "../../types";
+import type { OAuthCredentials } from "./types";
+type GitHubCopilotLoginOptions = {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt: (prompt: {
+        message: string;
+        placeholder?: string;
+        allowEmpty?: boolean;
+    }) => Promise<string>;
+    onProgress?: (message: string) => void;
+    signal?: AbortSignal;
+    pollIntervalFloorMs?: number;
+    pollIntervalScaleMs?: number;
+    fetch?: FetchImpl;
+};
+/**
+ * Refresh GitHub Copilot token.
+ * With the opencode OAuth flow, the GitHub token is used directly — no JWT exchange needed.
+ */
+export declare function refreshGitHubCopilotToken(refreshToken: string, enterpriseDomain?: string, apiEndpoint?: string): OAuthCredentials;
+/**
+ * Login with GitHub Copilot OAuth (device code flow)
+ *
+ * @param options.onAuth - Callback with URL and optional instructions (user code)
+ * @param options.onPrompt - Callback to prompt user for input
+ * @param options.onProgress - Optional progress callback
+ * @param options.signal - Optional AbortSignal for cancellation
+ */
+export declare function loginGitHubCopilot(options: GitHubCopilotLoginOptions): Promise<OAuthCredentials>;
+export {};

package/dist/types/registry/oauth/gitlab-duo-workflow.d.ts

@@ -0,0 +1,6 @@
+import type { FetchImpl } from "../../types";
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+export declare const GITLAB_DUO_WORKFLOW_OAUTH_CLIENT_ID = "36f2a70cddeb5a0889d4fd8295c241b7e9848e89cf9e599d0eed2d8e5350fbf5";
+export declare const GITLAB_DUO_WORKFLOW_OAUTH_REDIRECT_URI = "vscode://gitlab.gitlab-workflow/authentication";
+export declare function loginGitLabDuoWorkflow(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshGitLabDuoWorkflowToken(credentials: OAuthCredentials, fetchImpl?: FetchImpl): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/gitlab-duo.d.ts

@@ -0,0 +1,3 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./types";
+export declare function loginGitLabDuo(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+export declare function refreshGitLabDuoToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/google-antigravity.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare const ANTIGRAVITY_LOAD_CODE_ASSIST_METADATA: Readonly<{
+    ideType: "ANTIGRAVITY";
+    platform: "PLATFORM_UNSPECIFIED";
+    pluginType: "GEMINI";
+}>;
+export declare function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Antigravity token
+ */
+export declare function refreshAntigravityToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/google-gemini-cli.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Gemini CLI OAuth flow (Google Cloud Code Assist)
+ * Standard Gemini models only (gemini-2.0-flash, gemini-2.5-*)
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare function loginGeminiCli(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Google Cloud Code Assist token
+ */
+export declare function refreshGoogleCloudToken(refreshToken: string, projectId: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/google-oauth-shared.d.ts

@@ -0,0 +1,22 @@
+import { OAuthCallbackFlow } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+export interface GoogleOAuthFlowConfig {
+    clientId: string;
+    clientSecret: string;
+    authUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    callbackPort: number;
+    callbackPath: string;
+    discoverProject: (accessToken: string, onProgress?: (message: string) => void) => Promise<string>;
+}
+export declare class GoogleOAuthFlow extends OAuthCallbackFlow {
+    private readonly config;
+    constructor(ctrl: OAuthController, config: GoogleOAuthFlowConfig);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+export declare function runGoogleOAuthLogin(ctrl: OAuthController, config: GoogleOAuthFlowConfig): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/index.d.ts

@@ -0,0 +1,64 @@
+import type { OAuthCredentials, OAuthProvider, OAuthProviderId, OAuthProviderInfo, OAuthProviderInterface } from "./types";
+export type * from "./types";
+/** Result returned by one OAuth device-code polling attempt. */
+export type OAuthDeviceCodePollResult<T> = {
+    status: "complete";
+    value: T;
+} | {
+    status: "pending";
+} | {
+    status: "slow_down";
+} | {
+    status: "failed";
+    message: string;
+};
+/** Options for polling an RFC 8628-style OAuth device-code flow. */
+export interface OAuthDeviceCodeFlowOptions<T> {
+    /** Poll the provider once and classify the response. */
+    poll(): OAuthDeviceCodePollResult<T> | Promise<OAuthDeviceCodePollResult<T>>;
+    /** Provider-requested polling cadence; defaults to RFC 8628's five seconds. */
+    intervalSeconds?: number;
+    /** Provider-issued expiry window for the device code. */
+    expiresInSeconds?: number;
+    /** Cancels the flow with the legacy "Login cancelled" error. */
+    signal?: AbortSignal;
+}
+/** Poll an OAuth device-code flow until completion, provider failure, timeout, or cancellation. */
+export declare function pollOAuthDeviceCodeFlow<T>(options: OAuthDeviceCodeFlowOptions<T>): Promise<T>;
+/**
+ * Register a custom OAuth provider.
+ */
+export declare function registerOAuthProvider(provider: OAuthProviderInterface): void;
+/**
+ * Get a custom OAuth provider by ID.
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Remove all custom OAuth providers registered by a source.
+ */
+export declare function unregisterOAuthProviders(sourceId: string): void;
+/**
+ * Refresh token for any OAuth provider.
+ * Saves the new credentials and returns the new access token.
+ */
+export declare function refreshOAuthToken(provider: OAuthProvider, credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/**
+ * Build API-key bytes for a provider from an already-fresh OAuth credential.
+ *
+ * Refresh is owned by AuthStorage. This helper deliberately refuses expired
+ * credentials so it cannot POST broker redaction sentinels to upstream token
+ * endpoints as a side channel.
+ *
+ * For providers that need credential metadata at request time, returns
+ * JSON-encoded credentials plus expiry metadata for diagnostics/edge guards.
+ * @returns API key string, or null if no credentials
+ * @throws Error if the credential is expired and must be refreshed upstream
+ */
+export declare function getOAuthApiKey(provider: OAuthProvider, credentials: Record<string, OAuthCredentials>): Promise<{
+    newCredentials: OAuthCredentials;
+    apiKey: string;
+} | null>;
+/**
+ * Get list of OAuth providers.
+ */
+export declare function getOAuthProviders(): OAuthProviderInfo[];

package/dist/types/registry/oauth/kimi.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Kimi Code OAuth flow (device authorization grant)
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare let getKimiCommonHeaders: () => Readonly<{
+    "User-Agent": `KimiCLI/${string}`;
+    "X-Msh-Platform": "kimi_cli";
+    "X-Msh-Version": string;
+    "X-Msh-Device-Name": string;
+    "X-Msh-Device-Model": string;
+    "X-Msh-Os-Version": string;
+    "X-Msh-Device-Id": string;
+}>;
+/**
+ * Login with Kimi Code OAuth (device code flow).
+ */
+export declare function loginKimi(options: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh Kimi OAuth token.
+ */
+export declare function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/minimax-code.d.ts

@@ -0,0 +1,27 @@
+/**
+ * MiniMax Token Plan login flow.
+ *
+ * MiniMax Token Plan is a subscription service that provides access to
+ * MiniMax models (M2 and newer) through an OpenAI-compatible API.
+ *
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to the matching regional MiniMax subscription page
+ * 2. User subscribes and copies their API key
+ * 3. User pastes the API key back into the CLI
+ *
+ * International: https://api.minimax.io/v1
+ * China: https://api.minimaxi.com/v1
+ */
+/**
+ * Login to MiniMax Token Plan (international).
+ *
+ * Opens browser to subscription page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare const loginMiniMaxCode: (options: import("./types").OAuthController) => Promise<string>;
+/**
+ * Login to MiniMax Token Plan (China).
+ *
+ * Same flow as international but uses China endpoint.
+ */
+export declare const loginMiniMaxCodeCn: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/registry/oauth/openai-codex.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow — browser and device-code flows.
+ */
+import type { OAuthController, OAuthCredentials } from "./types";
+export declare function decodeJwt<T = Record<string, unknown>>(token: string): T | null;
+/** Formats OpenAI Codex OAuth token endpoint errors for login and refresh failures. */
+export declare function formatOpenAICodexTokenEndpointError(status: number, bodyText: string): string;
+/** Builds the Codex browser OAuth URL used by browser login; exported for auth regression tests. */
+export declare function createOpenAICodexAuthorizationUrl(args: {
+    state: string;
+    redirectUri: string;
+    challenge: string;
+    originator?: string;
+}): string;
+/**
+ * Login with OpenAI Codex OAuth
+ */
+export type OpenAICodexLoginOptions = OAuthController & {
+    /** Optional originator value for OpenAI Codex OAuth. Default matches OMP Codex request headers. */
+    originator?: string;
+};
+export declare function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials>;
+/**
+ * Login with OpenAI Codex using the device-code (headless) flow.
+ *
+ * Avoids a local callback server entirely — useful when port 1455 is unavailable
+ * or when the browser callback flow fails with 403 (e.g. network/proxy issues).
+ */
+export declare function loginOpenAICodexDevice(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh OpenAI Codex OAuth token
+ */
+export declare function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/opencode.d.ts

@@ -0,0 +1,18 @@
+/**
+ * OpenCode Zen login flow.
+ *
+ * OpenCode Zen is a subscription service that provides access to various AI models
+ * (GPT-5.x, Claude 4.x, Gemini 3, etc.) through a unified API at opencode.ai/zen.
+ * This is not OAuth - it's a simple API key flow:
+ * 1. Open browser to https://opencode.ai/auth
+ * 2. User logs in and copies their API key
+ * 3. User pastes the API key back into the CLI
+ */
+import type { OAuthController } from "./types";
+/**
+ * Login to OpenCode Zen.
+ *
+ * Opens browser to auth page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginOpenCode(options: OAuthController): Promise<string>;

package/dist/types/registry/oauth/perplexity.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthController, OAuthCredentials } from "./types";
+/**
+ * Login to Perplexity.
+ *
+ * Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
+ *
+ * No browser/manual token paste fallback is used.
+ */
+export declare function loginPerplexity(ctrl: OAuthController): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/pkce.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;

package/dist/types/registry/oauth/types.d.ts

@@ -0,0 +1,56 @@
+import type { FetchImpl } from "../../types";
+import type { OAuthProviderUnion } from "../registry";
+export type OAuthCredentials = {
+    refresh: string;
+    access: string;
+    expires: number;
+    enterpriseUrl?: string;
+    projectId?: string;
+    email?: string;
+    accountId?: string;
+    apiEndpoint?: string;
+};
+export type OAuthProvider = OAuthProviderUnion;
+export type OAuthProviderId = OAuthProvider | (string & {});
+export type OAuthPrompt = {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+};
+export type OAuthAuthInfo = {
+    url: string;
+    instructions?: string;
+};
+export interface OAuthProviderInfo {
+    id: OAuthProviderId;
+    name: string;
+    available: boolean;
+    /**
+     * Provider id the login stores credentials under, when it differs from `id`
+     * (e.g. `openai-codex-device` ⇒ `openai-codex`). Lets callers map a login
+     * entry back to the model provider it authenticates.
+     */
+    storeCredentialsAs?: string;
+}
+export interface OAuthController {
+    onAuth?(info: OAuthAuthInfo): void;
+    onProgress?(message: string): void;
+    onManualCodeInput?(): Promise<string>;
+    onPrompt?(prompt: OAuthPrompt): Promise<string>;
+    signal?: AbortSignal;
+    fetch?: FetchImpl;
+}
+export interface OAuthLoginCallbacks extends OAuthController {
+    onAuth: (info: OAuthAuthInfo) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+}
+export interface OAuthProviderInterface {
+    readonly id: OAuthProviderId;
+    readonly name: string;
+    readonly sourceId?: string;
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials | string>;
+    refreshToken?(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    getApiKey?(credentials: OAuthCredentials): string;
+    /** Store resulting OAuth credentials under a different provider id. */
+    readonly storeCredentialsAs?: string;
+}

package/dist/types/registry/oauth/wafer.d.ts

@@ -0,0 +1 @@
+export declare const loginWaferServerless: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/registry/oauth/xai-oauth.d.ts

@@ -0,0 +1,52 @@
+import type { FetchImpl } from "../../types";
+import { OAuthCallbackFlow } from "./callback-server";
+import type { OAuthController, OAuthCredentials } from "./types";
+/**
+ * Validate an xAI OIDC discovery endpoint against scheme + host.
+ *
+ * Hermes `_xai_validate_oauth_endpoint` L2997-3035. The discovery response is
+ * long-lived and cached in {@link OAuthCredentials}; a single MITM during
+ * initial login could substitute a malicious `token_endpoint` that would then
+ * receive every future refresh_token. Rejecting non-HTTPS or non-`x.ai` /
+ * `*.x.ai` hosts pins the cached endpoint to the xAI auth origin.
+ *
+ * @throws Error with message `Invalid xAI <field>: <url>` when the URL fails
+ *         either scheme or host validation.
+ */
+export declare function validateXAIEndpoint(url: string, field: string): string;
+/**
+ * Check whether a JWT access token is at or past its `exp` claim (with an
+ * optional refresh-skew margin).
+ *
+ * Hermes `_xai_access_token_is_expiring` L2979-2994. Returns `false` for any
+ * malformed input — this is a refresh-trigger check, not a validation, so
+ * non-JWTs ("no token in cache") must NOT trigger a spurious refresh.
+ */
+export declare function isXAIAccessTokenExpiring(jwt: string, skewSeconds?: number): boolean;
+/**
+ * xAI Grok OAuth loopback flow (Hermes `_xai_oauth_loopback_login` L5315-5469).
+ *
+ * Uses a fixed redirect URI so the callback server fails fast instead of
+ * falling back to a random port that xAI's redirect_uri allowlist rejects.
+ */
+export declare class XAIOAuthFlow extends OAuthCallbackFlow {
+    #private;
+    constructor(ctrl: OAuthController);
+    generateAuthUrl(state: string, redirectUri: string): Promise<{
+        url: string;
+        instructions?: string;
+    }>;
+    exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials>;
+}
+/**
+ * Login with xAI Grok OAuth (SuperGrok Subscription).
+ */
+export declare function loginXAIOAuth(ctrl: OAuthController): Promise<OAuthCredentials>;
+/**
+ * Refresh an xAI OAuth access token using a stored refresh_token.
+ *
+ * Hermes `refresh_xai_oauth_pure` L3087-3160. Re-runs OIDC discovery and
+ * re-validates the cached `token_endpoint` on the refresh hot path so a
+ * cached-but-poisoned endpoint cannot silently leak a refresh_token.
+ */
+export declare function refreshXAIOAuthToken(refreshToken: string, fetchOverride?: FetchImpl): Promise<OAuthCredentials>;

package/dist/types/registry/oauth/xiaomi.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Xiaomi MiMo login flow.
+ *
+ * Xiaomi MiMo provides OpenAI-compatible models via
+ * https://api.xiaomimimo.com/v1.
+ *
+ * Standard Xiaomi login opens the pay-as-you-go API key console. Token Plan
+ * login opens plan management so users copy the regional `tp-...` key.
+ */
+import type { OAuthController } from "./types";
+/** Region codes accepted by the Xiaomi Token Plan login flow. */
+export type XiaomiTokenPlanRegion = "sgp" | "ams" | "cn";
+/**
+ * Login to Xiaomi MiMo.
+ *
+ * Opens browser to API keys page, prompts user to paste their API key.
+ * Returns the API key directly (not OAuthCredentials - this isn't OAuth).
+ */
+export declare function loginXiaomi(options: OAuthController): Promise<string>;
+/**
+ * Login to a regional Xiaomi Token Plan endpoint.
+ *
+ * Prompts for a token-plan API key and validates it against the selected region.
+ */
+export declare function loginXiaomiTokenPlan(options: OAuthController, region: XiaomiTokenPlanRegion): Promise<string>;

package/dist/types/registry/ollama-cloud.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+export declare function loginOllamaCloud(options: OAuthController): Promise<string>;
+export declare const ollamaCloudProvider: {
+    readonly id: "ollama-cloud";
+    readonly name: "Ollama Cloud";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/ollama.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthController } from "./oauth/types";
+/**
+ * Login to Ollama.
+ *
+ * Returns a trimmed API key/token string. Empty string means local no-auth mode.
+ */
+export declare function loginOllama(options: OAuthController): Promise<string>;
+export declare const ollamaProvider: {
+    readonly id: "ollama";
+    readonly name: "Ollama (Local OpenAI-compatible)";
+    readonly login: typeof loginOllama;
+};

package/dist/types/registry/openai-codex-device.d.ts

@@ -0,0 +1,8 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+export declare const openaiCodexDeviceProvider: {
+    readonly id: "openai-codex-device";
+    readonly name: "ChatGPT Plus/Pro (Codex, headless/device)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly storeCredentialsAs: "openai-codex";
+};

package/dist/types/registry/openai-codex.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./oauth/types";
+export declare const openaiCodexProvider: {
+    readonly id: "openai-codex";
+    readonly name: "ChatGPT Plus/Pro (Codex Subscription)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<OAuthCredentials>;
+    readonly refreshToken: (credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+    readonly callbackPort: 1455;
+    readonly pasteCodeFlow: true;
+};

package/dist/types/registry/openai.d.ts

@@ -0,0 +1,4 @@
+export declare const openaiProvider: {
+    readonly id: "openai";
+    readonly name: "OpenAI";
+};

package/dist/types/registry/opencode-go.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const opencodeGoProvider: {
+    readonly id: "opencode-go";
+    readonly name: "OpenCode Go";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/opencode-zen.d.ts

@@ -0,0 +1,6 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const opencodeZenProvider: {
+    readonly id: "opencode-zen";
+    readonly name: "OpenCode Zen";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/openrouter.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+/** OpenRouter login flow (API key paste, validated via /auth/key).
+ *
+ * `/api/v1/models` is public and returns 200 for any bearer (including bogus),
+ * so it cannot validate auth. `/api/v1/auth/key` is the canonical "who am I"
+ * endpoint — 200 for valid keys, 401 otherwise.
+ */
+export declare const loginOpenRouter: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const openrouterProvider: {
+    readonly id: "openrouter";
+    readonly name: "OpenRouter";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/parallel.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+/**
+ * Login to Parallel.
+ *
+ * Opens browser to the API keys page, prompts the user to paste their API key,
+ * and returns the API key directly.
+ */
+export declare function loginParallel(options: OAuthController): Promise<string>;
+export declare const parallelProvider: {
+    readonly id: "parallel";
+    readonly name: "Parallel";
+    readonly envKeys: "PARALLEL_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/perplexity.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const perplexityProvider: {
+    readonly id: "perplexity";
+    readonly name: "Perplexity (Pro/Max)";
+    readonly envKeys: "PERPLEXITY_API_KEY";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<import("./oauth").OAuthCredentials>;
+};

package/dist/types/registry/qianfan.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types";
+export declare const loginQianfan: (options: import("./oauth").OAuthController) => Promise<string>;
+export declare const qianfanProvider: {
+    readonly id: "qianfan";
+    readonly name: "Qianfan";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/qwen-portal.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthController, OAuthLoginCallbacks } from "./oauth/types";
+export declare function loginQwenPortal(options: OAuthController): Promise<string>;
+export declare const qwenPortalProvider: {
+    readonly id: "qwen-portal";
+    readonly name: "Qwen Portal";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};