@columenlabs/lumen-ai 0.1.77 → 0.1.78

package/dist/assistant/models.js

@@ -3,6 +3,7 @@ export const CLAUDE_MODELS = [
     {
         id: 'claude-haiku-5-5',
         label: 'Claude Haiku 5.5',
+        provider: 'anthropic',
         group: 'Claude',
         in: 0.1,
         out: 0.5,
@@ -11,13 +12,53 @@ export const CLAUDE_MODELS = [
     {
         id: 'claude-sonnet-5-5',
         label: 'Claude Sonnet 5.5',
+        provider: 'anthropic',
         group: 'Claude',
         in: 2,
         out: 10,
         read: 0.2,
     },
-    { id: 'claude-opus-5-5', label: 'Claude Opus 5.5', group: 'Claude', in: 4, out: 20, read: 0.2 },
+    {
+        id: 'claude-opus-5-5',
+        label: 'Claude Opus 5.5',
+        provider: 'anthropic',
+        group: 'Claude',
+        in: 4,
+        out: 20,
+        read: 0.2,
+    },
 ];
+/** OpenAI models, smallest first (list prices from OpenAI's pricing page, October 2026). */
+export const OPENAI_MODELS = [
+    ['gpt-6-luna', 'GPT-6 Luna', 0.1, 0.5, 0.01],
+    ['gpt-6.1-terra', 'GPT-6.1 Terra', 1, 5, 0.05],
+    ['gpt-6.1-sol', 'GPT-6.1 Sol', 2, 10, 0.1],
+    ['gpt-6-astra', 'GPT-6 Astra', 10, 50, 1],
+].map(([id, label, i, o, r]) => ({
+    id: id,
+    label: label,
+    provider: 'openai',
+    group: 'OpenAI',
+    in: i,
+    out: o,
+    read: r,
+}));
+/** Every model the kit knows: what a tier may run unless the app lists its own. */
+export const ALL_MODELS = [...CLAUDE_MODELS, ...OPENAI_MODELS];
+/** How Settings names each provider, how its keys start and where a person makes one. */
+export const PROVIDERS = {
+    anthropic: {
+        label: 'Anthropic',
+        prefix: 'sk-ant-',
+        keysUrl: 'https://console.anthropic.com/settings/keys',
+    },
+    openai: {
+        label: 'OpenAI',
+        prefix: 'sk-',
+        keysUrl: 'https://platform.openai.com/api-keys',
+        signin: 'chatgpt',
+    },
+};
 /** Output tokens per model call when a tier sets none. */
 export const DEFAULT_OUT = 16_000;
 /** Tokens in (cache reads and writes included) and out of one reply, and its cost at list price. */
@@ -48,13 +89,15 @@ export class Meter {
         this.model = model;
         this.label = label;
     }
-    add(usage) {
+    /** `free`: the call ran on a plan sign-in, so it counts tokens and no dollars. */
+    add(usage, free = false) {
         const p = priced(this.model, usage);
         this.calls += 1;
         this.in += p.in;
         this.read += p.read;
         this.out += p.out;
-        this.usd += p.usd;
+        if (!free)
+            this.usd += p.usd;
     }
     part() {
         const { label, calls, read, out, usd } = this;

package/dist/assistant/routes.js

@@ -6,10 +6,14 @@
  *
  *   GET    /status                  what the panel and Settings show
  *   PUT    /settings                the person's tiers, tasks, hand off, advice, tool access, web, payer
- *   PUT    /app {cap_usd}           admin: what each person may spend a month on the app's key
- *   PUT    /key {api_key}           admin: the app's Claude key, tested before it is kept
- *   DELETE /key, POST /key/test     admin
- *   PUT    /my-key {api_key, cap_usd?}, PUT /my-key/cap {cap_usd}, DELETE /my-key, POST /my-key/test
+ *   PUT    /app {cap_usd}           admin: what each person may spend a month on the app's keys
+ *   PUT    /key {api_key}           admin: the app's key of `?provider=` (anthropic by default,
+ *                                   or openai), tested before it is kept
+ *   DELETE /key, POST /key/test     admin, `?provider=` the same
+ *   PUT    /my-key {api_key}, DELETE /my-key, POST /my-key/test   the person's own, `?provider=`
+ *   PUT    /my-key/cap {cap_usd}    what the person may spend a month on their own keys
+ *   POST   /my-signin               starts a ChatGPT plan sign-in (`?provider=openai`): {url, redirect}
+ *   POST   /my-signin/finish {url}  finishes it from the 127.0.0.1 address the sign-in ended on
  *   PUT    /web/scrapeql {client_id, client_secret}, DELETE /web/scrapeql, POST /web/test   admin
  *   POST   /chat                    one answer as server-sent events; closing the request stops it
  *   GET    /chats, GET|DELETE /chats/:id
@@ -21,6 +25,8 @@
  */
 import { ASSISTANT_ACCESS, ASSISTANT_EFFORTS, ASSISTANT_PAYERS, HAND_OFF_POLICIES, } from '@columenlabs/lumen-ui-types/assistant';
 import { AssistantError } from './engine.js';
+import { PROVIDERS } from './models.js';
+import { keyDocName } from './state.js';
 import { APP_SCOPE } from './store.js';
 const MUTATING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 const MAX_MESSAGE = 20_000;
@@ -137,6 +143,13 @@ export function assistantRoutes(a, o) {
             return fail('Sign in first.', 403, 'forbidden');
         const admin = () => (caller.admin ? null : fail('Admins only.', 403, 'forbidden'));
         const status = async () => json(await a.status(caller));
+        const asked = url.searchParams.get('provider') ?? 'anthropic';
+        const provider = a.providers.find((p) => p === asked);
+        const keyRoute = /^(PUT|DELETE|POST) \/(my-)?(key|signin)(\/test|\/finish)?$/.test(route);
+        if (keyRoute && !provider)
+            return fail(`This app runs no ${asked} models.`, 404);
+        const prov = provider ?? 'anthropic';
+        const docName = keyDocName(prov);
         try {
             switch (route) {
                 case 'GET /status':
@@ -169,31 +182,21 @@ export function assistantRoutes(a, o) {
                     }
                     const b = await body(req);
                     const key = str(b.api_key, 400);
-                    if (!key)
-                        return fail('Paste the key (sk-ant-…).');
-                    const c = b.cap_usd === undefined ? undefined : cap(b.cap_usd);
-                    if (c === null)
-                        return fail(`cap_usd is a number of dollars, 0 to ${MAX_CAP}.`);
-                    const test = await a.testKey(key);
+                    const { prefix, label } = PROVIDERS[prov];
+                    if (!key?.startsWith(prefix))
+                        return fail(`Paste the ${label} key (${prefix}…).`);
+                    const test = await a.testKey(prov, key);
                     if (!test.ok)
                         return fail(test.detail, 400, 'key_refused');
                     const scope = mine ? caller.id : APP_SCOPE;
-                    await docs.update(scope, 'key', (d) => ({
-                        api_key: key,
-                        saved_at: Date.now(),
-                        test,
-                        ...(mine ? { cap_usd: c ?? d?.cap_usd ?? a.state.defaultCap } : {}),
-                    }));
+                    await docs.write(scope, docName, { api_key: key, saved_at: Date.now(), test });
                     return status();
                 }
                 case 'PUT /my-key/cap': {
                     const c = cap((await body(req)).cap_usd);
                     if (c === null)
                         return fail(`cap_usd is a number of dollars, 0 to ${MAX_CAP}.`);
-                    const d = await a.state.ownKey(caller.id);
-                    if (!d)
-                        return fail('Add your key first.', 404);
-                    await docs.write(caller.id, 'key', { ...d, cap_usd: c });
+                    await a.state.setPerson(caller.id, (d) => ({ ...d, own_cap: c }));
                     return status();
                 }
                 case 'DELETE /key':
@@ -204,25 +207,36 @@ export function assistantRoutes(a, o) {
                         if (no)
                             return no;
                     }
-                    await docs.remove(mine ? caller.id : APP_SCOPE, 'key');
+                    await docs.remove(mine ? caller.id : APP_SCOPE, docName);
+                    return status();
+                }
+                case 'POST /my-signin':
+                    return json(await a.startSignin(caller, prov));
+                case 'POST /my-signin/finish': {
+                    const pasted = str((await body(req)).url, 4000);
+                    if (!pasted)
+                        return fail('Paste the address the sign-in ended on.');
+                    await a.finishSignin(caller, prov, pasted);
                     return status();
                 }
-                case 'POST /key/test':
                 case 'POST /my-key/test': {
-                    const mine = route === 'POST /my-key/test';
-                    if (!mine) {
-                        const no = admin();
-                        if (no)
-                            return no;
-                    }
-                    const scope = mine ? caller.id : APP_SCOPE;
-                    const d = await docs.read(scope, 'key');
-                    const key = d?.api_key ?? (mine ? null : (await a.state.appApiKey())?.key);
+                    const test = await a.testOwn(caller, prov);
+                    if (!test)
+                        return fail('No key is set.', 404);
+                    await docs.update(caller.id, docName, (d) => (d ? { ...d, test } : null));
+                    return json(test);
+                }
+                case 'POST /key/test': {
+                    const no = admin();
+                    if (no)
+                        return no;
+                    const d = await docs.read(APP_SCOPE, docName);
+                    const key = d?.api_key ?? (await a.state.appApiKey(prov))?.key;
                     if (!key)
                         return fail('No key is set.', 404);
-                    const test = await a.testKey(key);
+                    const test = await a.testKey(prov, key);
                     if (d)
-                        await docs.write(scope, 'key', { ...d, test });
+                        await docs.write(APP_SCOPE, docName, { ...d, test });
                     return json(test);
                 }
                 case 'PUT /web/scrapeql': {

package/dist/assistant/state.d.ts

@@ -1,17 +1,23 @@
 /**
  * The assistant's settings, keys and spend, as stored documents.
  *
- *   app      (the app's scope)   the cap per person on the app's key
+ *   app      (the app's scope)   the cap per person on the app's keys
  *   key      (the app's scope)   the app's Anthropic key, tested before it is kept, sealed
+ *   key:<p>  (the app's scope)   the app's key of another provider (`key:openai`), the same
  *   scrapeql (the app's scope)   ScrapeQL's Access service token, tested before it is kept, sealed
- *   settings (a person's scope)  their tiers, start tiers, hand off, advice, tool access, web, payer
- *   key      (a person's scope)  their own Anthropic key and its monthly cap, sealed
+ *   settings (a person's scope)  their tiers, start tiers, hand off, advice, tool access, web, payer,
+ *                                and the monthly cap on their own keys
+ *   key, key:<p> (a person's)    their own key of each provider, sealed; OpenAI's may be a ChatGPT
+ *                                plan sign-in, refreshed before it runs out
+ *   signin:<p>   (a person's)    the app's sign-in registration for them, kept across sign-outs
  *   spend:YYYY-MM                what each tier cost them this month, by payer
  *
- * Who pays: the person's pick (the app's key by default) while it has money left this month, else
- * the other; with neither the assistant waits and says why.
+ * Who pays: the person's pick (the app's keys by default) while it has a key for the provider the
+ * tier runs on and money left this month, else the other; with neither the assistant waits and says
+ * why. A cap covers every provider of its payer.
  */
-import type { AssistantAccess, AssistantEffort, AssistantPayer, AssistantWait, HandOffPolicy, UsagePart } from '@columenlabs/lumen-ui-types/assistant';
+import type { AssistantAccess, AssistantEffort, AssistantPayer, AssistantProvider, AssistantWait, HandOffPolicy, UsagePart } from '@columenlabs/lumen-ui-types/assistant';
+import { type ChatgptTokens } from './chatgpt.js';
 import { type Docs } from './store.js';
 export interface KeyTest {
     at: number;
@@ -22,9 +28,13 @@ export interface KeyDoc {
     api_key: string;
     saved_at: number;
     test: KeyTest | null;
-    /** USD a month: the person's own key only. */
+    /** USD a month: a person's own Anthropic key before the cap moved to their settings. */
     cap_usd?: number;
+    /** A ChatGPT plan sign-in in place of an API key (`api_key` is then its access token). */
+    chatgpt?: ChatgptTokens;
 }
+/** Where a provider's key is kept: `key` for Anthropic, `key:<provider>` for the rest. */
+export declare const keyDocName: (provider: AssistantProvider) => string;
 export interface TokenDoc {
     client_id: string;
     client_secret: string;
@@ -47,6 +57,8 @@ export interface PersonDoc {
     access?: Record<string, AssistantAccess>;
     web?: boolean;
     pay?: AssistantPayer;
+    /** USD a month on their own keys. */
+    own_cap?: number;
 }
 export type SpendRow = UsagePart & {
     payer: AssistantPayer;
@@ -63,12 +75,18 @@ export declare function keyState(d: KeyDoc | TokenDoc | null, secret: (d: KeyDoc
 } | {
     set: true;
     hint: string;
+    via?: "chatgpt" | undefined;
     saved_at: number;
     test?: KeyTest | undefined;
 };
 export interface Paying {
     payer: AssistantPayer;
+    /** The key of the provider asked for. */
     apiKey: string;
+    /** The payer's key of every provider it has one for (a hand-off may run on another). */
+    keys: Partial<Record<AssistantProvider, string>>;
+    /** Providers whose key is a plan sign-in: their use costs the payer nothing. */
+    plans: Partial<Record<AssistantProvider, boolean>>;
     /** USD left this month under the payer's cap. */
     left: number;
     cap: number;
@@ -79,7 +97,8 @@ export declare class State {
     constructor(docs: Docs, o: {
         timeZone: string;
         defaultCap: number;
-        appKey?: () => Promise<string | null | undefined>;
+        appKey?: (provider: AssistantProvider) => Promise<string | null | undefined>;
+        fetch?: typeof fetch;
     });
     /** USD a month when nobody set a cap. */
     get defaultCap(): number;
@@ -88,22 +107,34 @@ export declare class State {
     setPerson(id: string, change: (d: PersonDoc) => PersonDoc): Promise<PersonDoc | null>;
     app(): Promise<AppDoc>;
     setApp(change: (d: AppDoc) => AppDoc): Promise<AppDoc | null>;
-    appKey(): Promise<KeyDoc | null>;
+    appKey(provider: AssistantProvider): Promise<KeyDoc | null>;
     /** The app's key: the stored one, else the app's fallback (a Worker secret). */
-    appApiKey(): Promise<{
+    appApiKey(provider: AssistantProvider): Promise<{
         key: string;
         fromEnv: boolean;
     } | null>;
-    ownKey(id: string): Promise<KeyDoc | null>;
+    ownKey(id: string, provider: AssistantProvider): Promise<KeyDoc | null>;
+    /** The person's own key, a plan sign-in refreshed first when it is about to run out. */
+    ownApiKey(id: string, provider: AssistantProvider): Promise<{
+        key: string;
+        plan: boolean;
+    } | null>;
+    /** USD a month on the person's own keys. */
+    ownCap(id: string): Promise<number>;
     scrapeql(): Promise<TokenDoc | null>;
     appCap(): Promise<number>;
     spend(id: string, month?: string): Promise<SpendDoc>;
     /** Adds an answer's use to this month's spend, by label and payer. */
     addSpend(id: string, payer: AssistantPayer, parts: UsagePart[]): Promise<void>;
-    /** Who pays the person's next answer, or why nobody can. */
-    paying(id: string): Promise<{
+    /** The payer's key of each provider, those set, and which are plan sign-ins. */
+    keysOf(id: string, payer: AssistantPayer): Promise<{
+        keys: Partial<Record<"anthropic" | "openai", string>>;
+        plans: Partial<Record<"anthropic" | "openai", boolean>>;
+    }>;
+    /** Who pays the person's next answer on `provider`'s model, or why nobody can. */
+    paying(id: string, provider: AssistantProvider): Promise<{
         paying: Paying | null;
         wait: AssistantWait | null;
     }>;
 }
-export declare const WAIT_TEXT: Record<AssistantWait, string>;
+export declare function waitText(wait: AssistantWait, provider: AssistantProvider): string;

package/dist/assistant/state.js

@@ -1,5 +1,8 @@
-import { keyHint } from './models.js';
+import { refreshChatgpt, staleChatgpt } from './chatgpt.js';
+import { PROVIDERS, keyHint } from './models.js';
 import { APP_SCOPE } from './store.js';
+/** Where a provider's key is kept: `key` for Anthropic, `key:<provider>` for the rest. */
+export const keyDocName = (provider) => provider === 'anthropic' ? 'key' : `key:${provider}`;
 /** USD a month when nobody set a cap. */
 export const DEFAULT_CAP = 10;
 /** `2026-10` in the app's time zone. */
@@ -11,9 +14,11 @@ export function monthIn(timeZone, at = new Date()) {
 export function keyState(d, secret) {
     if (!d)
         return { set: false };
+    const plan = 'chatgpt' in d ? d.chatgpt : undefined;
     return {
         set: true,
-        hint: keyHint(secret(d)),
+        hint: plan ? (plan.email ?? 'ChatGPT plan') : keyHint(secret(d)),
+        ...(plan ? { via: 'chatgpt' } : {}),
         saved_at: d.saved_at,
         ...(d.test ? { test: d.test } : {}),
     };
@@ -44,19 +49,52 @@ export class State {
     setApp(change) {
         return this.docs.update(APP_SCOPE, 'app', (d) => change(d ?? {}));
     }
-    appKey() {
-        return this.docs.read(APP_SCOPE, 'key');
+    appKey(provider) {
+        return this.docs.read(APP_SCOPE, keyDocName(provider));
     }
     /** The app's key: the stored one, else the app's fallback (a Worker secret). */
-    async appApiKey() {
-        const d = await this.appKey();
+    async appApiKey(provider) {
+        const d = await this.appKey(provider);
         if (d)
             return { key: d.api_key, fromEnv: false };
-        const env = await this.o.appKey?.();
+        const env = await this.o.appKey?.(provider);
         return env ? { key: env, fromEnv: true } : null;
     }
-    ownKey(id) {
-        return this.docs.read(id, 'key');
+    ownKey(id, provider) {
+        return this.docs.read(id, keyDocName(provider));
+    }
+    /** The person's own key, a plan sign-in refreshed first when it is about to run out. */
+    async ownApiKey(id, provider) {
+        const d = await this.ownKey(id, provider);
+        if (!d)
+            return null;
+        if (!d.chatgpt)
+            return { key: d.api_key, plan: false };
+        if (!staleChatgpt(d.chatgpt))
+            return { key: d.chatgpt.access_token, plan: true };
+        try {
+            const t = await refreshChatgpt(d.chatgpt, this.o.fetch ?? fetch);
+            await this.docs.write(id, keyDocName(provider), {
+                ...d,
+                api_key: t.access_token,
+                chatgpt: t,
+            });
+            return { key: t.access_token, plan: true };
+        }
+        catch (err) {
+            await this.docs.write(id, keyDocName(provider), {
+                ...d,
+                test: { at: Date.now(), ok: false, detail: err.message },
+            });
+            return null;
+        }
+    }
+    /** USD a month on the person's own keys. */
+    async ownCap(id) {
+        const p = await this.person(id);
+        if (p.own_cap !== undefined)
+            return p.own_cap;
+        return (await this.ownKey(id, 'anthropic'))?.cap_usd ?? this.o.defaultCap;
     }
     scrapeql() {
         return this.docs.read(APP_SCOPE, 'scrapeql');
@@ -96,24 +134,53 @@ export class State {
             return { rows };
         });
     }
-    /** Who pays the person's next answer, or why nobody can. */
-    async paying(id) {
-        const [person, app, own, spend, appCap] = await Promise.all([
+    /** The payer's key of each provider, those set, and which are plan sign-ins. */
+    async keysOf(id, payer) {
+        const ids = Object.keys(PROVIDERS);
+        const found = await Promise.all(ids.map((p) => payer === 'app'
+            ? this.appApiKey(p).then((k) => (k ? { key: k.key, plan: false } : null))
+            : this.ownApiKey(id, p)));
+        const keys = {};
+        const plans = {};
+        ids.forEach((p, i) => {
+            const k = found[i];
+            if (k)
+                keys[p] = k.key;
+            if (k?.plan)
+                plans[p] = true;
+        });
+        return { keys, plans };
+    }
+    /** Who pays the person's next answer on `provider`'s model, or why nobody can. */
+    async paying(id, provider) {
+        const [person, appKeys, ownKeys, spend, appCap, ownCap] = await Promise.all([
             this.person(id),
-            this.appApiKey(),
-            this.ownKey(id),
+            this.keysOf(id, 'app'),
+            this.keysOf(id, 'own'),
             this.spend(id),
             this.appCap(),
+            this.ownCap(id),
         ]);
         const spent = (p) => spend.rows.filter((r) => r.payer === p).reduce((a, r) => a + r.usd, 0);
+        const app = appKeys.keys[provider];
+        const own = ownKeys.keys[provider];
         const sources = {
-            app: app ? { payer: 'app', apiKey: app.key, cap: appCap, left: appCap - spent('app') } : null,
+            app: app
+                ? {
+                    payer: 'app',
+                    apiKey: app,
+                    ...appKeys,
+                    cap: appCap,
+                    left: appCap - spent('app'),
+                }
+                : null,
             own: own
                 ? {
                     payer: 'own',
-                    apiKey: own.api_key,
-                    cap: own.cap_usd ?? this.o.defaultCap,
-                    left: (own.cap_usd ?? this.o.defaultCap) - spent('own'),
+                    apiKey: own,
+                    ...ownKeys,
+                    cap: ownCap,
+                    left: ownCap - spent('own'),
                 }
                 : null,
         };
@@ -131,8 +198,11 @@ export class State {
         return { paying: null, wait: capped === 'own' ? 'own_cap' : 'app_cap' };
     }
 }
-export const WAIT_TEXT = {
-    not_connected: 'No Claude key is set: an admin adds one in Settings ▸ Model providers.',
-    app_cap: "You reached this month's cap on the app's key. Add your own key, or wait for next month.",
-    own_cap: 'Your own key reached its monthly cap: raise it in Settings ▸ Spend.',
-};
+export function waitText(wait, provider) {
+    const label = PROVIDERS[provider].label;
+    if (wait === 'not_connected')
+        return `No ${label} key is set: add one in Settings ▸ Model providers, or pick another model in Settings ▸ Models.`;
+    if (wait === 'app_cap')
+        return "You reached this month's cap on the shared keys. Add your own key, or wait for next month.";
+    return 'Your own keys reached their monthly cap: raise it in Settings ▸ Model providers.';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@columenlabs/lumen-ai",
-  "version": "0.1.77",
+  "version": "0.1.78",
   "description": "Lumen's assistant and agent parts: a chat assistant's server (Claude tiers, tools over MCP, the web, hand off, spend caps), serving an MCP server from a Worker, read-only tool sets and metered tool calls.",
   "license": "MIT",
   "type": "module",
@@ -40,10 +40,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@columenlabs/lumen-ops": "0.1.77",
-    "@columenlabs/lumen-ui-types": "0.1.77",
-    "zod": "^4.3.6",
-    "@anthropic-ai/sdk": "0.133.0"
+    "@anthropic-ai/sdk": "0.133.0",
+    "@columenlabs/lumen-ops": "0.1.78",
+    "@columenlabs/lumen-ui-types": "0.1.78",
+    "openai": "7.32.0",
+    "zod": "^4.3.6"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0"