feat(cli): support OAuth login in setup

packages/cli/src/onboarding-catalog.ts

@@ -42,6 +42,7 @@ export function listApiKeyOnboardableProviders(): OnboardableProvider[] {
       providerType,
       label: definition.label,
       requiresBaseUrl: !definition.baseUrl,
+      setupMethod: 'api_key' as const,
     };
   });
 }

packages/cli/src/pi-tui-contracts.ts

@@ -25,6 +25,8 @@ import type {
   ConnectionEffectFailureClass,
   ConnectionOnboardingSaveResult as RuntimeHostOnboardingSaveResult,
   ConnectionOnboardingVerifyResult as RuntimeHostOnboardingVerifyResult,
+  OAuthConnectionIdentity,
+  OAuthLoginFailureCode,
 } from '@maka/runtime-host/protocol';
 import type { MakaPiTuiTurnActivity } from './pi-tui-turn.js';
 
@@ -62,6 +64,7 @@ export interface OnboardableProvider {
   providerType: ProviderType;
   label: string;
   requiresBaseUrl: boolean;
+  setupMethod: 'api_key' | 'oauth';
 }
 
 export type OnboardingIdentityChoice = {
@@ -154,8 +157,33 @@ export type OnboardingSaveResult =
     }
   | OnboardingFailure;
 
+export interface OnboardingOAuthPresentation {
+  readonly url: string;
+  readonly stateHint?: string;
+}
+
+export interface OnboardingOAuthInput {
+  readonly target: ConnectionOnboardingTarget;
+  readonly signal: AbortSignal;
+  readonly onPresentation: (presentation: OnboardingOAuthPresentation) => void;
+}
+
+export type OnboardingOAuthFailureReason =
+  | OAuthLoginFailureCode
+  | 'connection_not_found'
+  | 'operation_conflict'
+  | 'unavailable';
+
+export type OnboardingOAuthResult =
+  | { readonly kind: 'authenticated'; readonly connection: OAuthConnectionIdentity }
+  | { readonly kind: 'cancelled' }
+  | { readonly kind: 'failed'; readonly reason: OnboardingOAuthFailureReason };
+
 export interface MakaOnboardingSurface {
   listProviders(): Promise<OnboardingProviderEntry[]>;
+  /** One complete Host-owned OAuth attempt. Polling, cancellation convergence,
+   * and presentation transport stay behind this interface. */
+  loginOAuth?(input: OnboardingOAuthInput): Promise<OnboardingOAuthResult>;
   verify(input: OnboardingVerifyInput): Promise<OnboardingVerifyResult>;
   save(input: OnboardingSaveInput): Promise<OnboardingSaveResult>;
 }