auth

type DeviceCodeResponse struct {
	DeviceCode      string `json:"device_code"`
	UserCode        string `json:"user_code"`
	VerificationURI string `json:"verification_uri"`
	ExpiresIn       int    `json:"expires_in"`
	Interval        int    `json:"interval"`
}

type Provider struct {
	Name          string
	EnvVar        string
	AuthURL       string // OAuth authorization endpoint
	TokenURL      string // OAuth token endpoint
	ClientID      string // OAuth client ID (public client)
	Scopes        []string
	ExtraParams   map[string]string // additional auth URL params
	TokenToKey    func(tok *TokenResponse) string
	KeyPageURL    string // fallback manual key page
	DeviceURL     string // device authorization endpoint (optional)
	UseDeviceFlow bool   // prefer device code flow over PKCE
	TLSPreflight  bool   // run TLS preflight before OAuth (OpenAI Codex)
	CodexOAuth    bool   // use Codex OAuth callback + token-exchange semantics
}

type Result struct {
	Provider string
	APIKey   string
	EnvVar   string
	Err      error
}

type TLSPreflightResult struct {
	OK      bool
	Kind    string // "tls-cert" or "network"
	Code    string
	Message string
}

type TokenResponse struct {
	AccessToken  string `json:"access_token"`
	TokenType    string `json:"token_type"`
	ExpiresIn    int    `json:"expires_in"`
	RefreshToken string `json:"refresh_token"`
	Scope        string `json:"scope"`
	IDToken      string `json:"id_token"`
	APIKey       string `json:"api_key"`        // some providers return key directly
	APIKeyCamel  string `json:"apiKey"`         // alternate camelCase response key
	OpenAIAPIKey string `json:"openai_api_key"` // alternate token-exchange response key
}