@kenkaiiii/gg-core 5.94.0 → 5.95.1

package/dist/index.d.cts

@@ -200,13 +200,21 @@ interface OAuthCredentials {
      *  scale the proactive-refresh threshold: short-lived tokens (e.g. Kimi's
      *  15-min access token) must refresh well before expiry, not 60s prior. */
     expiresIn?: number;
+    /** ChatGPT plan: the validated ID-token subject. Its presence routes OpenAI to the plan transport. */
     accountId?: string;
+    /** Retired Gemini Code Assist project ID; only read to recognise an old sign-in. */
     projectId?: string;
     baseUrl?: string;
+    /** ChatGPT plan: the client ID OpenAI issued at first sign-in (never `dynamic_agent_client`). */
+    clientId?: string;
+    /** ChatGPT plan: the last validated ID token, sent back as `id_token_hint`. */
+    idToken?: string;
+    /** ChatGPT plan: scopes the token response granted. */
+    scopes?: string[];
     /** ms timestamp until which this credential's usage window is exhausted.
      *  Set by AuthStorage.markUsageExhausted() when the provider rejects with a
      *  usage/quota stop; while in the future, resolution may skip this credential
-     *  in favor of a configured fallback (e.g. Kimi OAuth → Moonshot API key). */
+     *  in favor of a configured fallback (e.g. ChatGPT plan → OpenAI API key). */
     usageExhaustedUntil?: number;
 }
 interface OAuthLoginCallbacks {
@@ -318,21 +326,41 @@ declare function claudeCodeCallbackUrl(manualUrl: string, captured: string): str
 declare function loginClaudeCode(callbacks: OAuthLoginCallbacks, opts?: ClaudeCodeRunOptions): Promise<void>;
 
 /**
- * Storage key for Kimi Code OAuth credentials. Kept distinct from the
- * `moonshot` API-key entry so a user can configure BOTH and we always
- * prefer OAuth for the logical `moonshot` provider.
+ * Storage key for the ChatGPT plan sign-in (Continue with ChatGPT). Kept
+ * distinct from the `openai` entry, which holds an OpenAI API key, so a user can
+ * hold both: the plan serves first and the key covers while its usage is out.
  */
-declare const MOONSHOT_OAUTH_KEY = "moonshot-oauth";
+declare const OPENAI_CHATGPT_KEY = "openai-chatgpt";
 /**
- * Storage key for Grok (xAI) subscription OAuth credentials. Kept distinct from
- * the `xai` API-key entry for the same reason as Kimi's: a user may configure
- * BOTH — a SuperGrok/X Premium subscription plus a metered console key — and we
- * always prefer OAuth for the logical `xai` provider.
+ * Storage key for a Kimi Code plan key (Kimi Code Console), served by
+ * `api.kimi.com/coding/v1` or `api.kimi.ai/coding/v1`. Kept distinct from the
+ * `moonshot` entry, which holds a pay-per-token Moonshot platform key.
  */
-declare const XAI_OAUTH_KEY = "xai-oauth";
+declare const KIMI_CODE_KEY = "kimi-code";
 /**
- * A provider that can hold two credentials at once: a refreshable subscription
- * OAuth token and a static API key. One policy governs all of them — see
+ * A sign-in GG Coder no longer uses, because it posed as another vendor's app
+ * (Codex CLI, Kimi Code CLI, Grok CLI, Gemini CLI) or its token stopped
+ * working. The entry is never served; the user is asked once to reconnect.
+ */
+interface RetiredSignIn {
+    /** Logical provider the credential belonged to. */
+    provider: string;
+    /** auth.json key holding the retired credential. */
+    storageKey: string;
+    /** What to tell the user, without CLI/app-specific instructions. */
+    message: string;
+}
+declare const RETIRED_SIGN_INS: readonly RetiredSignIn[];
+/** Logical provider for a storage key (`kimi-code` → `moonshot`). */
+declare function storageKeyProvider(storageKey: string): string;
+/**
+ * API-key storage keys for a provider whose keys split into a plan key and a
+ * pay-per-token key, plan first. Single-key providers yield just their own key.
+ */
+declare function apiKeyStorageKeys(provider: string): string[];
+/**
+ * A provider that can hold two credentials at once: a refreshable plan sign-in
+ * and a static API key. One policy governs all of them — see
  * {@link DUAL_AUTH_PROVIDERS} — so adding a provider here is enough to give it
  * OAuth-first resolution, usage-exhaustion fallback, per-method logout and the
  * matching UI affordances.
@@ -372,9 +400,7 @@ declare const XIAOMI_CREDITS_KEY = "xiaomi-credits";
 /**
  * Storage key for a Gemini API key (Google AI Studio, billed per token), served
  * by the public Gemini API at {@link GEMINI_API_KEY_BASE_URL}. Kept distinct from
- * the `gemini` entry, which holds the Code Assist OAuth login: Google stopped
- * serving Code Assist to personal accounts on 2026-06-18, so an API key is how
- * those accounts reach Gemini at all, and a licensed account may hold both.
+ * the `gemini` entry, which held the retired Google sign-in.
  */
 declare const GEMINI_API_KEY = "gemini-api";
 /** Public Gemini API (AI Studio key). The transport routes on this base URL. */
@@ -415,9 +441,11 @@ declare class AuthStorage {
     private refreshLocks;
     private readonly detectMiniMaxRegion;
     private readonly detectXiaomiCluster;
+    private readonly detectKimiRegion;
     constructor(filePath?: string, options?: {
         detectMiniMaxBaseUrl?: (apiKey: string) => Promise<string | undefined>;
         detectXiaomiTokenPlanBaseUrl?: (apiKey: string) => Promise<string | undefined>;
+        detectKimiCodeBaseUrl?: (apiKey: string) => Promise<string | undefined>;
     });
     /** Path to the on-disk auth file. Useful for status output. */
     get path(): string;
@@ -434,20 +462,28 @@ declare class AuthStorage {
      */
     pickStorageKey(keys: string[]): Promise<string | undefined>;
     /**
-     * True if the user has any usable auth for the logical provider. For a
-     * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
-     * satisfies it.
+     * True if the user has any usable auth for the logical provider: the plan
+     * sign-in or any of its API keys. A retired sign-in doesn't count.
      */
     hasProviderAuth(provider: string): Promise<boolean>;
+    /** True if any of `provider`'s API keys is stored. A retired sign-in in a key slot doesn't count. */
+    hasApiKey(provider: string): Promise<boolean>;
+    /**
+     * `provider`'s first stored API key, never its plan sign-in. For calls that
+     * only an API key may make (OpenAI's Images API isn't on the ChatGPT plan).
+     */
+    resolveApiKey(provider: string): Promise<OAuthCredentials>;
     /** True when the user signed in with Claude through Claude Code (marker only, no token). */
     hasClaudeCodeLogin(): Promise<boolean>;
     /** Record a Claude Code sign-in. Claude Code keeps the token; auth.json gets only the marker. */
     setClaudeCodeLogin(): Promise<void>;
+    /** Retired sign-ins still on disk, so the UI can ask the user to reconnect. */
+    legacySignIns(): Promise<RetiredSignIn[]>;
     /**
-     * Remove an old GG Claude sign-in token (`sk-ant-oat…`), if any. True when one
-     * was removed, so the caller can tell the user once to sign in with Claude again.
+     * Remove `provider`'s retired sign-in, if any. True when one was removed, so
+     * the caller can tell the user once to reconnect.
      */
-    takeLegacyClaudeSignIn(): Promise<boolean>;
+    takeLegacySignIn(provider: string): Promise<boolean>;
     clearClaudeCodeLogin(): Promise<void>;
     /** Endpoint ids that currently have a `local:<id>` credential stored. */
     listLocalEndpointIds(): Promise<string[]>;
@@ -468,10 +504,10 @@ declare class AuthStorage {
     /**
      * The base URL on the credential that is active right now, if any.
      * Synchronous — call only after load()/resolveCredentials() populated the
-     * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
-     * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
-     * resolveCredentials would serve (i.e. not currently usage-exhausted with an
-     * API key configured).
+     * snapshot. For a dual-auth provider this is the plan endpoint whenever the
+     * sign-in is the one resolveCredentials would serve (i.e. not currently
+     * usage-exhausted with an API key configured); for a plan/pay-per-token key
+     * split it is the plan key's endpoint when one is stored.
      */
     getStoredBaseUrl(provider: string): string | undefined;
     load(): Promise<void>;
@@ -510,7 +546,16 @@ declare class AuthStorage {
      * and was deleted as invalid.
      */
     private withMiniMaxRegion;
-    setCredentials(provider: string, creds: OAuthCredentials): Promise<void>;
+    /**
+     * A Kimi Code key saved without an endpoint gets the host that issued it
+     * (`api.kimi.com` or `api.kimi.ai`), saved so the check runs once.
+     */
+    private withKimiRegion;
+    /**
+     * Store `creds` under `storageKey`. Connecting a provider again also removes
+     * its retired sign-in, which is what the reconnect notice asked for.
+     */
+    setCredentials(storageKey: string, creds: OAuthCredentials): Promise<void>;
     /**
      * After a 401, move a regional key to the cluster that issued it instead of
      * treating it as invalid. Only the Xiaomi Token Plan is regional: every key
@@ -524,9 +569,9 @@ declare class AuthStorage {
      * Mark the credential stored under `storageKey` as usage-exhausted until
      * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
      * 15-minute default when no reset time is known. While the mark is in the
-     * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-     * instead of the subscription OAuth credential (when both are configured) — OAuth
-     * stays the preferred credential and is retried automatically once the mark
+     * future, `resolveCredentials("openai")` serves the OpenAI API key instead of
+     * the ChatGPT plan sign-in (when both are configured) — the plan stays the
+     * preferred credential and is retried automatically once the mark
      * lapses. Persisted to auth.json so a restart (or another gg-app window)
      * doesn't burn a request rediscovering the same exhausted window. No-op if
      * nothing is stored under `storageKey`.
@@ -577,7 +622,7 @@ declare function signInWithClaudeCode(auth: Pick<AuthStorage, "setClaudeCodeLogi
 /** Sign out of Claude Code and drop the marker. The marker goes even if `claude auth logout` fails. */
 declare function signOutOfClaudeCode(auth: Pick<AuthStorage, "clearClaudeCodeLogin">, opts?: ClaudeCodeRunOptions): Promise<void>;
 
-type SubscriptionUsageProvider = "anthropic" | "openai" | "moonshot";
+type SubscriptionUsageProvider = "anthropic" | "moonshot";
 /** Providers whose usage endpoint we call with a token. Claude reports its own (claude-code/usage.ts). */
 type FetchedSubscriptionUsageProvider = Exclude<SubscriptionUsageProvider, "anthropic">;
 interface SubscriptionUsageWindow {
@@ -605,11 +650,11 @@ interface FetchSubscriptionUsageOptions {
     now?: () => number;
 }
 /**
- * Fetch subscription quota windows with an already-resolved OAuth credential.
+ * Fetch plan quota windows with an already-resolved plan credential.
  * Tokens stay server-side: callers expose only the normalized percentages and
  * reset timestamps to their UI.
  */
-declare function fetchSubscriptionUsage(provider: FetchedSubscriptionUsageProvider, credentials: Pick<OAuthCredentials, "accessToken" | "accountId">, options?: FetchSubscriptionUsageOptions): Promise<SubscriptionUsageSnapshot>;
+declare function fetchSubscriptionUsage(provider: FetchedSubscriptionUsageProvider, credentials: Pick<OAuthCredentials, "accessToken" | "baseUrl">, options?: FetchSubscriptionUsageOptions): Promise<SubscriptionUsageSnapshot>;
 
 /** The parts of the SDK's `rate_limit_event.rate_limit_info` the usage meter reads. */
 interface ClaudeCodeRateLimitInfo {
@@ -679,19 +724,41 @@ declare function detectXiaomiTokenPlanBaseUrl(apiKey: string, options?: {
     timeoutMs?: number;
 }): Promise<string | undefined>;
 
+/**
+ * Kimi Code plan keys come from the Kimi Code Console and work on the host
+ * that issued them: `api.kimi.com` (kimi.com accounts) or `api.kimi.ai`
+ * (kimi.ai accounts). The other host rejects the key as invalid.
+ */
+declare const KIMI_CODE_DEFAULT_BASE_URL = "https://api.kimi.com/coding/v1";
+declare const KIMI_CODE_OVERSEAS_BASE_URL = "https://api.kimi.ai/coding/v1";
+/**
+ * The Kimi Code base URL for the host that issued `apiKey`, found by asking
+ * both. Undefined when neither gives a clear answer (offline, timeouts);
+ * callers then use {@link KIMI_CODE_DEFAULT_BASE_URL} and may ask again later.
+ */
+declare function detectKimiCodeBaseUrl(apiKey: string, options?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<string | undefined>;
+/** True if `baseUrl` is a Kimi Code plan endpoint (either host). */
+declare function isKimiCodingEndpoint(baseUrl: string | undefined): boolean;
+
 type AuthMethod = "oauth" | "apikey";
 /**
- * One API-key option for a provider that splits auth across multiple distinct
- * endpoints/credentials (currently only Xiaomi: Token Plan vs. API Credits).
- * Each variant stores under its own auth.json key so a user can hold both at
- * once — the model registry picks which one a given model resolves via
- * `getAuthStorageKeys()`.
+ * One API-key option for a provider that takes two kinds of key: a plan key
+ * (the user's subscription) and a pay-per-token key. Each variant stores under
+ * its own auth.json key so a user can hold both at once; the model registry
+ * picks which one a model resolves via `getAuthStorageKeys()`.
  */
 interface ApiKeyVariant {
     /** Storage key in auth.json (distinct from `value` when multiple variants exist). */
     key: string;
     /** Display label, e.g. "Token Plan" or "API Credits". */
     label: string;
+    /** `plan` bills the user's subscription; `payg` bills per token. */
+    kind: "plan" | "payg";
+    /** What the user spends with this key, e.g. "Uses your Kimi Code plan." */
+    billing: string;
     /** Base URL stored alongside this variant's credential. */
     baseUrl?: string;
 }
@@ -709,17 +776,12 @@ interface AuthProviderMeta {
     /** Fixed base URL stored alongside an API key (e.g. Xiaomi's token plan). */
     apiKeyBaseUrl?: string;
     /**
-     * When a provider's API-key auth splits across multiple endpoints, the
-     * choices to present (in order). The first variant is the default. Absent
-     * for every provider with a single API-key credential.
+     * When a provider takes both a plan key and a pay-per-token key, the choices
+     * to present (in order). The first variant is the default.
      */
     apiKeyVariants?: ApiKeyVariant[];
-    /**
-     * Per-method guidance overrides. Only providers whose methods differ in
-     * billing/entitlement (the dual-auth ones) need these; everything else is
-     * described generically by {@link describeAuthMethods}.
-     */
-    methodDetails?: Partial<Record<AuthMethod, AuthMethodMeta>>;
+    /** What each method means for this provider (billing, when to pick it). */
+    methodDetails: Partial<Record<AuthMethod, AuthMethodMeta>>;
 }
 /**
  * What one auth method means for a provider, so both UIs can answer "which do I
@@ -727,7 +789,7 @@ interface AuthProviderMeta {
  */
 interface AuthMethodMeta {
     method: AuthMethod;
-    /** Button/row label, e.g. "Sign in with Grok (SuperGrok / X Premium)". */
+    /** Button/row label, e.g. "Continue with ChatGPT". */
     label: string;
     /** What the user spends on this method. */
     billing: string;
@@ -736,13 +798,18 @@ interface AuthMethodMeta {
     /** Prerequisite the user must already have, if any. */
     requires?: string;
 }
+/**
+ * What a model needs when it runs only on some of its provider's keys (Kimi
+ * K2.8 Preview on a Kimi Code plan key, MiMo UltraSpeed on API Credits), named
+ * by the variants' labels. Undefined for a model any of the provider's keys runs.
+ */
+declare function requiredKeyLabel(provider: string, storageKeys: string[]): string | undefined;
 /** Every provider a user can connect right now, in login-screen order. */
 declare const AUTH_PROVIDERS: AuthProviderMeta[];
 declare function getAuthProvider(value: string): AuthProviderMeta | undefined;
 /**
- * Per-method guidance for a provider, in resolution order. Providers with a
- * single method get a generic description; the dual-auth ones (Kimi, Grok) carry
- * explicit `methodDetails` because the choice changes what the user is billed.
+ * Per-method guidance for a provider, in resolution order. Every provider
+ * carries `methodDetails`; the generic fallback only covers a missing entry.
  */
 declare function describeAuthMethods(provider: string): AuthMethodMeta[];
 /**
@@ -760,120 +827,61 @@ declare function generatePKCE(): Promise<{
     challenge: string;
 }>;
 
-declare function loginOpenAI(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
-declare function refreshOpenAIToken(refreshToken: string): Promise<OAuthCredentials>;
-
-declare function loginGemini(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
-declare function refreshGeminiToken(refreshToken: string): Promise<OAuthCredentials>;
-
-/**
- * Kimi Code OAuth — Device Authorization Grant (RFC 8628).
- *
- * Mirrors MoonshotAI/kimi-code's managed-auth flow. Three form-encoded
- * POST endpoints against the OAuth host (default `https://auth.kimi.com`):
- *
- *  - `/api/oauth/device_authorization` (client_id)           → device + user code
- *  - `/api/oauth/token` (grant_type=device_code)             → poll until authorized
- *  - `/api/oauth/token` (grant_type=refresh_token)           → refresh access token
- *
- * Unlike Anthropic/OpenAI/Gemini (browser-redirect PKCE), this is a
- * device-code/poll flow: we show the user a URL + code, they authorize in a
- * browser on any device, and we poll for the token.
- *
- * After login the issued token is used against the managed coding API
- * (`https://api.kimi.com/coding/v1`, distinct from the `api.moonshot.ai`
- * API-key endpoint) via `Authorization: Bearer <access_token>`. We persist
- * that base URL on the credential so the runtime routes there automatically.
- */
-
-/** Managed coding API base URL the issued OAuth token is used against. */
-declare function kimiCodeBaseUrl(): string;
-/**
- * Headers the Kimi For Coding API requires on every model request. The
- * managed endpoint gates access to recognized coding agents: requests must
- * carry a `kimi_code_cli` platform identity and matching `User-Agent`, or the
- * server rejects with "only available for Coding Agents". Attach these to the
- * inference client's default headers whenever the Kimi OAuth token is used.
- */
-declare function kimiCodingHeaders(): Record<string, string>;
-/**
- * True if `baseUrl` targets the Kimi For Coding managed endpoint (the URL
- * persisted on Kimi OAuth credentials). Callers use this to decide whether to
- * attach `kimiCodingHeaders()` — the Moonshot API-key path uses a different
- * host and must NOT receive the coding-agent identity headers.
- */
-declare function isKimiCodingEndpoint(baseUrl: string | undefined): boolean;
+/** The scope that lets GG Coder use the user's ChatGPT plan. */
+declare const CHATGPT_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+/** Responses API base for ChatGPT plan inference. */
+declare const CHATGPT_PLAN_BASE_URL = "https://api.openai.com/v1";
+/** Where users review and limit what GG Coder may use of their plan. */
+declare const CHATGPT_USAGE_URL = "https://chatgpt.com/settings/usage";
+declare const CHATGPT_PLAN_NOT_ENABLED_MESSAGE = "ChatGPT plan use isn't enabled for GG Coder. Allow Use your ChatGPT plan, or add an OpenAI API key.";
+/** A sign-in that worked but can't be used to bill the user's ChatGPT plan. */
+declare class ChatGPTPlanNotEnabledError extends Error {
+    constructor();
+}
+interface ChatGPTLoginOptions {
+    /** Defaults to `~/.gg/openai-host-id`. */
+    hostIdFile?: string;
+    /** Defaults to `~/.gg/openai-chatgpt-client.json`. */
+    registrationFile?: string;
+    /** The current sign-in, if any: its ID token skips the account picker. */
+    previous?: Pick<OAuthCredentials, "idToken">;
+}
+/** This machine's stable `ext_agent_host_id`, created on first use. */
+declare function getChatGPTHostId(file?: string): Promise<string>;
 /**
- * Drive the Kimi device-code flow end-to-end. Shows the verification URL +
- * user code via callbacks, opens the browser, and polls until the user
- * authorizes (or a 15-minute local timeout elapses).
+ * Continue with ChatGPT. Registers GG Coder for this ChatGPT account on first
+ * use (the user names and approves it in the browser), then reuses the issued
+ * client ID. Throws {@link ChatGPTPlanNotEnabledError} when the user signed in
+ * but didn't allow plan use.
  */
-declare function loginKimi(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
-/** Exchange a refresh token for a fresh Kimi access token. */
-declare function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials>;
-
+declare function loginChatGPT(callbacks: OAuthLoginCallbacks, options?: ChatGPTLoginOptions): Promise<OAuthCredentials>;
 /**
- * Grok (xAI) subscription OAuth — Device Authorization Grant (RFC 8628).
- *
- * Two form-encoded POST endpoints against xAI's OIDC issuer (`https://auth.x.ai`,
- * advertised by its `/.well-known/openid-configuration`):
- *
- *  - `/oauth2/device/code` (client_id + scope)          → device + user code
- *  - `/oauth2/token` (grant_type=device_code)           → poll until authorized
- *  - `/oauth2/token` (grant_type=refresh_token)         → refresh access token
- *
- * Like Kimi (and unlike Anthropic/OpenAI/Gemini's browser-redirect PKCE) this is
- * a device-code/poll flow: show a URL + code, the user authorizes in a browser on
- * any device, we poll for the token. Deliberately chosen over the loopback PKCE
- * variant because xAI pins the Grok-CLI client's redirect to
- * `http://127.0.0.1:56121/callback` — a fixed port we cannot rebind if it's busy,
- * and unreachable from a container/SSH session. Device code has neither problem.
- *
- * The issued token is used against the Grok CLI's chat proxy
- * (`https://cli-chat-proxy.grok.com/v1`, distinct from the `api.x.ai` API-key
- * endpoint) — that is the surface the `grok-cli:access` scope grants, and it
- * bills against the user's SuperGrok / X Premium subscription instead of metered
- * API credits. We persist that base URL on the credential so the runtime routes
- * there automatically; `grokCliHeaders()` supplies the client identity the proxy
- * requires (attached centrally in gg-ai's `xai` transport).
- *
- * Caveats worth knowing, both observed in the wild and surfaced to users rather
- * than hidden here:
- *  - The client id below is xAI's public Grok-CLI desktop client (no secret).
- *    Every third-party implementation reuses it; xAI has not published a
- *    partner-client program, so subscription OAuth is a best-effort path.
- *  - xAI gates proxy access by subscription tier. A perfectly valid login can
- *    still be refused at inference time, which is exactly why `xai` keeps its
- *    API-key method as a fallback (see AuthStorage's dual-auth resolution).
- */
-
-/** Grok CLI chat-proxy base URL the issued OAuth token is used against. */
-declare function grokCliBaseUrl(): string;
-/**
- * Headers the Grok CLI chat proxy requires on every model request. It serves
- * only recognized Grok-CLI clients: without the token-auth marker and a client
- * version it refuses the request. `modelId` populates the model-override header
- * the proxy uses to route a request to the entitled model.
- *
- * Attach these ONLY to the proxy — the `api.x.ai` API-key path must not receive
- * them (see {@link isGrokCliEndpoint}).
+ * Model ids the signed-in ChatGPT account may use on its plan, from the same
+ * `/v1/models` catalog OpenAI tells apps to build their picker from. Hidden
+ * entries (`visibility` other than "list") are left out.
  */
-declare function grokCliHeaders(modelId?: string): Record<string, string>;
+declare function fetchChatGPTPlanModels(accessToken: string, fetchFn?: typeof fetch): Promise<string[]>;
+/** The callback query from a pasted URL or query string, or undefined for anything else. */
+declare function parseCallbackInput(input: string): URLSearchParams | undefined;
 /**
- * True if `baseUrl` targets the Grok CLI chat proxy (the URL persisted on Grok
- * OAuth credentials). Callers use this to decide whether to attach
- * {@link grokCliHeaders} and whether a usage/permission rejection should fall
- * back to the xAI API key.
+ * Renew the plan token with the issued client ID. The response replaces the
+ * access token, its expiry, the granted scopes and the rotating refresh token.
  */
-declare function isGrokCliEndpoint(baseUrl: string | undefined): boolean;
+declare function refreshChatGPTToken(creds: Pick<OAuthCredentials, "refreshToken" | "clientId">): Promise<OAuthCredentials>;
 /**
- * Drive the Grok device-code flow end-to-end. Shows the verification URL + user
- * code via callbacks, opens the browser, and polls until the user authorizes or
- * the device code expires (deadline set by the server).
+ * End the renewable session on sign-out. True when OpenAI confirmed it; callers
+ * clear local tokens either way and say so when it wasn't confirmed.
  */
-declare function loginXai(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
-/** Exchange a refresh token for a fresh Grok access token. */
-declare function refreshXaiToken(refreshToken: string): Promise<OAuthCredentials>;
+declare function revokeChatGPTSignIn(creds: Pick<OAuthCredentials, "refreshToken" | "clientId">, options?: {
+    attempts?: number;
+    backoffMs?: number;
+}): Promise<boolean>;
+/** Check the ID token's RS256 signature against OpenAI's JWKS, then iss, aud, exp and nonce. */
+declare function verifyIdToken(idToken: string, expected: {
+    clientId: string;
+    nonce: string;
+    now?: number;
+}): Promise<Record<string, unknown>>;
 
 /**
  * Minimal Telegram Bot API client using raw fetch().
@@ -1050,4 +1058,4 @@ interface AutoUpdater {
 }
 declare function createAutoUpdater(config: AutoUpdateConfig): AutoUpdater;
 
-export { AUTH_PROVIDERS, type ApiKeyVariant, type AuthMethod, type AuthMethodMeta, type AuthProviderMeta, AuthStorage, type AutoUpdateConfig, type AutoUpdater, CLAUDE_CODE_AUTH_KEY, CLAUDE_CODE_AUTH_MARKER, CLAUDE_CODE_MANIFEST, type ClaudeCodeAuthStatus, type ClaudeCodeInstallProgress, type ClaudeCodeManifest, type ClaudeCodePlatformAsset, type ClaudeCodeRateLimitInfo, type ClaudeCodeRunOptions, type ClaudeCodeRuntimeOptions, type ClaudeCodeSignInOptions, DEFAULT_LOCAL_ENDPOINTS, type DiscoverOptions, type DiscoveryResult, type DualAuthProvider, type EnsureClaudeCodeOptions, FALLBACK_CONTEXT_WINDOW, type FetchedSubscriptionUsageProvider, GEMINI_API_KEY, GEMINI_API_KEY_BASE_URL, type InlineButton, LOCAL_API_KEY_PLACEHOLDER, LOCAL_AUTH_KEY_PREFIX, type LocalEndpoint, type LocalEndpointKind, type LocalEndpointProbe, type LocalModel, type LogLevel, MINIMAX_CN_BASE_URL, MINIMAX_GLOBAL_BASE_URL, MOONSHOT_OAUTH_KEY, ModelInfo, NotLoggedInError, type OAuthCredentials, type OAuthLoginCallbacks, OPENROUTER_DEFAULT_BASE_URL, PLAN_MODE_THINKING_CAP, type ParsedOpenRouterCatalog, type ProbeOptions, type ProgressCallback, SubscriptionUsageError, type SubscriptionUsageProvider, type SubscriptionUsageSnapshot, type SubscriptionUsageWindow, TelegramBot, type TelegramConfig, type TelegramMessage, type TelegramUpdate, type TelegramVoiceMessage, XAI_OAUTH_KEY, XIAOMI_CREDITS_KEY, XIAOMI_TOKEN_PLAN_BASE_URLS, authPriorityNote, clampThinkingForPlanMode, claudeCodeAuthStatus, claudeCodeBinaryPath, claudeCodeCallbackUrl, claudeCodeConfigDir, claudeCodeEnv, claudeCodeHome, claudeCodePlatformKey, clearClaudeCodeUsage, clearLocalDiscoveryCache, closeLogger, createAutoUpdater, decodeOggOpus, describeAuthMethods, detectMiniMaxBaseUrl, detectXiaomiTokenPlanBaseUrl, discoverLocalModels, downmixToMono, dualAuthProvider, dualAuthProviderByOAuthKey, endpointRoot, ensureClaudeCodeBinary, fetchSubscriptionUsage, findProbedModel, formatClaudeCodeInstallProgress, formatLocalModelId, generatePKCE, getAuthProvider, getLowestThinkingLevel, getNextThinkingLevel, getSessionId, getSupportedThinkingLevels, grokCliBaseUrl, grokCliHeaders, isClaudeCodeAuthMarker, isGrokCliEndpoint, isKimiCodingEndpoint, isLegacyClaudeOAuth, isLocalModelId, isLoggerOpen, isModelLoaded, isThinkingLevelSupported, kimiCodeBaseUrl, kimiCodingHeaders, localAuthStorageKey, localModelShortName, log, loginClaudeCode, loginGemini, loginKimi, loginOpenAI, loginXai, logoutClaudeCode, mergeClaudeCodeRateLimit, oauthStorageKey, ollamaServedContext, openLog, parseLocalModelId, parseOpenRouterCatalog, probeEndpoint, providerStorageKeys, readClaudeCodeUsage, readStoredBaseUrlSync, recordClaudeCodeRateLimit, refreshGeminiToken, refreshKimiToken, refreshOpenAIToken, refreshXaiToken, registerLogCleanup, resample, resolveClaudeCodeBinary, setProgressCallback, signInWithClaudeCode, signOutOfClaudeCode, toModelInfo, transcribeVoice, withFileLock };
+export { AUTH_PROVIDERS, type ApiKeyVariant, type AuthMethod, type AuthMethodMeta, type AuthProviderMeta, AuthStorage, type AutoUpdateConfig, type AutoUpdater, CHATGPT_PLAN_BASE_URL, CHATGPT_PLAN_NOT_ENABLED_MESSAGE, CHATGPT_PLAN_SCOPE, CHATGPT_USAGE_URL, CLAUDE_CODE_AUTH_KEY, CLAUDE_CODE_AUTH_MARKER, CLAUDE_CODE_MANIFEST, type ChatGPTLoginOptions, ChatGPTPlanNotEnabledError, type ClaudeCodeAuthStatus, type ClaudeCodeInstallProgress, type ClaudeCodeManifest, type ClaudeCodePlatformAsset, type ClaudeCodeRateLimitInfo, type ClaudeCodeRunOptions, type ClaudeCodeRuntimeOptions, type ClaudeCodeSignInOptions, DEFAULT_LOCAL_ENDPOINTS, type DiscoverOptions, type DiscoveryResult, type DualAuthProvider, type EnsureClaudeCodeOptions, FALLBACK_CONTEXT_WINDOW, type FetchedSubscriptionUsageProvider, GEMINI_API_KEY, GEMINI_API_KEY_BASE_URL, type InlineButton, KIMI_CODE_DEFAULT_BASE_URL, KIMI_CODE_KEY, KIMI_CODE_OVERSEAS_BASE_URL, LOCAL_API_KEY_PLACEHOLDER, LOCAL_AUTH_KEY_PREFIX, type LocalEndpoint, type LocalEndpointKind, type LocalEndpointProbe, type LocalModel, type LogLevel, MINIMAX_CN_BASE_URL, MINIMAX_GLOBAL_BASE_URL, ModelInfo, NotLoggedInError, type OAuthCredentials, type OAuthLoginCallbacks, OPENAI_CHATGPT_KEY, OPENROUTER_DEFAULT_BASE_URL, PLAN_MODE_THINKING_CAP, type ParsedOpenRouterCatalog, type ProbeOptions, type ProgressCallback, RETIRED_SIGN_INS, type RetiredSignIn, SubscriptionUsageError, type SubscriptionUsageProvider, type SubscriptionUsageSnapshot, type SubscriptionUsageWindow, TelegramBot, type TelegramConfig, type TelegramMessage, type TelegramUpdate, type TelegramVoiceMessage, XIAOMI_CREDITS_KEY, XIAOMI_TOKEN_PLAN_BASE_URLS, apiKeyStorageKeys, authPriorityNote, clampThinkingForPlanMode, claudeCodeAuthStatus, claudeCodeBinaryPath, claudeCodeCallbackUrl, claudeCodeConfigDir, claudeCodeEnv, claudeCodeHome, claudeCodePlatformKey, clearClaudeCodeUsage, clearLocalDiscoveryCache, closeLogger, createAutoUpdater, decodeOggOpus, describeAuthMethods, detectKimiCodeBaseUrl, detectMiniMaxBaseUrl, detectXiaomiTokenPlanBaseUrl, discoverLocalModels, downmixToMono, dualAuthProvider, dualAuthProviderByOAuthKey, endpointRoot, ensureClaudeCodeBinary, fetchChatGPTPlanModels, fetchSubscriptionUsage, findProbedModel, formatClaudeCodeInstallProgress, formatLocalModelId, generatePKCE, getAuthProvider, getChatGPTHostId, getLowestThinkingLevel, getNextThinkingLevel, getSessionId, getSupportedThinkingLevels, isClaudeCodeAuthMarker, isKimiCodingEndpoint, isLegacyClaudeOAuth, isLocalModelId, isLoggerOpen, isModelLoaded, isThinkingLevelSupported, localAuthStorageKey, localModelShortName, log, loginChatGPT, loginClaudeCode, logoutClaudeCode, mergeClaudeCodeRateLimit, oauthStorageKey, ollamaServedContext, openLog, parseCallbackInput, parseLocalModelId, parseOpenRouterCatalog, probeEndpoint, providerStorageKeys, readClaudeCodeUsage, readStoredBaseUrlSync, recordClaudeCodeRateLimit, refreshChatGPTToken, registerLogCleanup, requiredKeyLabel, resample, resolveClaudeCodeBinary, revokeChatGPTSignIn, setProgressCallback, signInWithClaudeCode, signOutOfClaudeCode, storageKeyProvider, toModelInfo, transcribeVoice, verifyIdToken, withFileLock };