@modelprofile.com/authswitch-signin 10.4.0

package/dist_ts_signin/index.d.ts

@@ -0,0 +1,5 @@
+export * from './signin.interfaces.js';
+export * from './signin.protocol.js';
+export * from './signin.credential.js';
+export * from './signin.device.js';
+export * from './signin.grants.js';

package/dist_ts_signin/index.js

@@ -0,0 +1,6 @@
+export * from './signin.interfaces.js';
+export * from './signin.protocol.js';
+export * from './signin.credential.js';
+export * from './signin.device.js';
+export * from './signin.grants.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zaWduaW4vaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLG9CQUFvQixDQUFDIn0=

package/dist_ts_signin/plugins.d.ts

@@ -0,0 +1,2 @@
+import * as crypto from 'node:crypto';
+export { crypto };

package/dist_ts_signin/plugins.js

@@ -0,0 +1,4 @@
+// Node native modules
+import * as crypto from 'node:crypto';
+export { crypto };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NpZ25pbi9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLHNCQUFzQjtBQUN0QixPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUV0QyxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUMifQ==

package/dist_ts_signin/signin.credential.d.ts

@@ -0,0 +1,29 @@
+import { type IOpenAiTokenSet } from './signin.protocol.js';
+import type { IOpenAiAccountSummary, IOpenAiOAuthCredential, TOpenAiRefreshResult } from './signin.interfaces.js';
+/** A stored credential that is not a ChatGPT sign-in this package can read. It names no token. */
+export declare class OpenAiCredentialError extends Error {
+    constructor();
+}
+/**
+ * The token set a stored credential holds, with its ID-token claims. Throws `OpenAiCredentialError` for anything
+ * but a complete ChatGPT sign-in.
+ */
+export declare const openAiTokensOfCredential: (credential: IOpenAiOAuthCredential) => IOpenAiTokenSet;
+/** The credential a sign-in or refresh produced; one without an ID token is refused. */
+export declare const openAiCredentialOfTokens: (tokens: IOpenAiTokenSet, lastRefreshAt?: string) => IOpenAiOAuthCredential;
+/** What a credential's claims say about its account; no token. */
+export declare const summarizeOpenAiCredential: (credential: IOpenAiOAuthCredential) => IOpenAiAccountSummary;
+export interface IOpenAiRefreshCredentialOptions {
+    fetch?: typeof fetch;
+    /** Aborting it after the request was handed to fetch leaves the outcome unknown. */
+    signal?: AbortSignal;
+    now?: () => Date;
+}
+/**
+ * Sends one refresh-token grant for a credential and answers the rotated credential, or why there is none.
+ * A refresh that returned the same tokens, or no ID token, proves nothing about the grant it used and fails as
+ * `outcomeUnknown`. `requestOutcome: 'notSent'` is the only failure after which the same refresh token may be
+ * sent again: after any other the service may already have rotated it. `lastRefreshAt` rises strictly.
+ * Throws `OpenAiCredentialError` for a credential that is not a complete ChatGPT sign-in.
+ */
+export declare const refreshOpenAiCredential: (credential: IOpenAiOAuthCredential, options?: IOpenAiRefreshCredentialOptions) => Promise<TOpenAiRefreshResult>;

package/dist_ts_signin/signin.credential.js

@@ -0,0 +1,78 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+import { OpenAiAuthError, parseOpenAiTokenClaims, refreshOpenAiTokens, } from './signin.protocol.js';
+/** A stored credential that is not a ChatGPT sign-in this package can read. It names no token. */
+export class OpenAiCredentialError extends Error {
+    constructor() {
+        super('The OpenAI credential is invalid.');
+        this.name = 'OpenAiCredentialError';
+    }
+}
+/**
+ * The token set a stored credential holds, with its ID-token claims. Throws `OpenAiCredentialError` for anything
+ * but a complete ChatGPT sign-in.
+ */
+export const openAiTokensOfCredential = (credential) => {
+    if (credential === null || typeof credential !== 'object' || credential.kind !== 'chatgptOAuth'
+        || credential.providerId !== 'openai' || typeof credential.accessToken !== 'string' || !credential.accessToken
+        || typeof credential.refreshToken !== 'string' || !credential.refreshToken
+        || typeof credential.idToken !== 'string' || !credential.idToken) {
+        throw new OpenAiCredentialError();
+    }
+    try {
+        return { accessToken: credential.accessToken, refreshToken: credential.refreshToken, idToken: credential.idToken,
+            claims: parseOpenAiTokenClaims(credential.idToken) };
+    }
+    catch {
+        throw new OpenAiCredentialError();
+    }
+};
+/** The credential a sign-in or refresh produced; one without an ID token is refused. */
+export const openAiCredentialOfTokens = (tokens, lastRefreshAt) => {
+    if (!tokens.idToken)
+        throw new OpenAiCredentialError();
+    return { kind: 'chatgptOAuth', providerId: 'openai', accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken, idToken: tokens.idToken,
+        ...(lastRefreshAt === undefined ? {} : { lastRefreshAt }) };
+};
+/** What a credential's claims say about its account; no token. */
+export const summarizeOpenAiCredential = (credential) => {
+    const claims = openAiTokensOfCredential(credential).claims;
+    return {
+        providerId: 'openai', authKind: 'chatgptOAuth',
+        ...(claims.chatgptAccountId ? { accountId: claims.chatgptAccountId } : {}),
+        ...(claims.email ? { email: claims.email } : {}),
+        ...(claims.chatgptPlanType ? { plan: claims.chatgptPlanType } : {}),
+    };
+};
+/**
+ * Sends one refresh-token grant for a credential and answers the rotated credential, or why there is none.
+ * A refresh that returned the same tokens, or no ID token, proves nothing about the grant it used and fails as
+ * `outcomeUnknown`. `requestOutcome: 'notSent'` is the only failure after which the same refresh token may be
+ * sent again: after any other the service may already have rotated it. `lastRefreshAt` rises strictly.
+ * Throws `OpenAiCredentialError` for a credential that is not a complete ChatGPT sign-in.
+ */
+export const refreshOpenAiCredential = async (credential, options = {}) => {
+    const input = openAiTokensOfCredential(credential);
+    try {
+        const refreshed = await refreshOpenAiTokens(input, { fetch: options.fetch, signal: options.signal });
+        if ((refreshed.accessToken === input.accessToken && refreshed.refreshToken === input.refreshToken)
+            || !refreshed.idToken) {
+            return { success: false, credential, errorCode: 'REFRESH_FAILED', requestOutcome: 'outcomeUnknown' };
+        }
+        const previous = credential.lastRefreshAt === undefined ? 0 : Date.parse(credential.lastRefreshAt);
+        const now = (options.now ?? (() => new Date()))().getTime();
+        const lastRefreshAt = new Date(Math.max(now, Number.isFinite(previous) ? previous + 1 : now)).toISOString();
+        const next = openAiCredentialOfTokens(refreshed, lastRefreshAt);
+        return { success: true, credential: next, account: summarizeOpenAiCredential(next) };
+    }
+    catch (error) {
+        return {
+            success: false, credential,
+            errorCode: options.signal?.aborted ? 'ABORTED' : 'REFRESH_FAILED',
+            requestOutcome: error instanceof OpenAiAuthError ? error.requestOutcome ?? 'outcomeUnknown' : 'outcomeUnknown',
+            ...(error instanceof OpenAiAuthError && error.status !== undefined ? { responseStatus: error.status } : {}),
+            ...(error instanceof OpenAiAuthError && error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),
+        };
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmluLmNyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zaWduaW4vc2lnbmluLmNyZWRlbnRpYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsMkpBQTJKO0FBRTNKLE9BQU8sRUFDTCxlQUFlLEVBQUUsc0JBQXNCLEVBQUUsbUJBQW1CLEdBQzdELE1BQU0sc0JBQXNCLENBQUM7QUFLOUIsa0dBQWtHO0FBQ2xHLE1BQU0sT0FBTyxxQkFBc0IsU0FBUSxLQUFLO0lBQzlDO1FBQ0UsS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7UUFDM0MsSUFBSSxDQUFDLElBQUksR0FBRyx1QkFBdUIsQ0FBQztJQUN0QyxDQUFDO0NBQ0Y7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFVBQWtDLEVBQW1CLEVBQUU7SUFDOUYsSUFBSSxVQUFVLEtBQUssSUFBSSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLGNBQWM7V0FDMUYsVUFBVSxDQUFDLFVBQVUsS0FBSyxRQUFRLElBQUksT0FBTyxVQUFVLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxDQUFDLFVBQVUsQ0FBQyxXQUFXO1dBQzNHLE9BQU8sVUFBVSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWTtXQUN2RSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ25FLE1BQU0sSUFBSSxxQkFBcUIsRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPO1lBQzlHLE1BQU0sRUFBRSxzQkFBc0IsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztJQUN6RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsTUFBTSxJQUFJLHFCQUFxQixFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ2hELENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLE1BQXVCLEVBQUUsYUFBc0IsRUFBMEIsRUFBRTtJQUNsSCxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87UUFBRSxNQUFNLElBQUkscUJBQXFCLEVBQUUsQ0FBQztJQUN2RCxPQUFPLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxNQUFNLENBQUMsV0FBVztRQUNsRixZQUFZLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDMUQsR0FBRyxDQUFDLGFBQWEsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLENBQUM7QUFDaEUsQ0FBQyxDQUFDO0FBRUYsa0VBQWtFO0FBQ2xFLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsVUFBa0MsRUFBeUIsRUFBRTtJQUNyRyxNQUFNLE1BQU0sR0FBRyx3QkFBd0IsQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDM0QsT0FBTztRQUNMLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGNBQWM7UUFDOUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEQsR0FBRyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxlQUFlLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0tBQ3BFLENBQUM7QUFDSixDQUFDLENBQUM7QUFTRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxLQUFLLEVBQUUsVUFBa0MsRUFDOUUsVUFBMkMsRUFBRSxFQUFpQyxFQUFFO0lBQ2hGLE1BQU0sS0FBSyxHQUFHLHdCQUF3QixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ25ELElBQUksQ0FBQztRQUNILE1BQU0sU0FBUyxHQUFHLE1BQU0sbUJBQW1CLENBQUMsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQ3JHLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxLQUFLLEtBQUssQ0FBQyxXQUFXLElBQUksU0FBUyxDQUFDLFlBQVksS0FBSyxLQUFLLENBQUMsWUFBWSxDQUFDO2VBQzdGLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3hCLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLENBQUM7UUFDdkcsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ25HLE1BQU0sR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDNUQsTUFBTSxhQUFhLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUM1RyxNQUFNLElBQUksR0FBRyx3QkFBd0IsQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFDaEUsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUseUJBQXlCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztJQUN2RixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU87WUFDTCxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVU7WUFDMUIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLGdCQUFnQjtZQUNqRSxjQUFjLEVBQUUsS0FBSyxZQUFZLGVBQWUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLGNBQWMsSUFBSSxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCO1lBQzlHLEdBQUcsQ0FBQyxLQUFLLFlBQVksZUFBZSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLGNBQWMsRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRyxHQUFHLENBQUMsS0FBSyxZQUFZLGVBQWUsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDdEgsQ0FBQztJQUNKLENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts_signin/signin.device.d.ts

@@ -0,0 +1,56 @@
+import { type IOpenAiAuthOptions } from './signin.protocol.js';
+import type { IOpenAiDevicePrompt, IOpenAiLoginResult } from './signin.interfaces.js';
+/**
+ * A device sign-in that any process can continue after a restart. It is a secret: its `deviceAuthId` with its
+ * `userCode` complete the sign-in, so it is stored sealed, like a credential, and deleted once it is done.
+ */
+export interface IOpenAiDeviceSignInState {
+    verificationUrl: string;
+    userCode: string;
+    deviceAuthId: string;
+    intervalSeconds: number;
+    /** When the device code was issued, ISO 8601. */
+    issuedAt: string;
+    /** When the device code stops being accepted: fifteen minutes after `issuedAt`, as Codex tells the person. */
+    expiresAt: string;
+}
+/** What the person signing in is shown, with the time the code expires. */
+export interface IOpenAiDeviceSignInPrompt extends IOpenAiDevicePrompt {
+    expiresAt: string;
+}
+export interface IOpenAiDeviceSignInStart {
+    prompt: IOpenAiDeviceSignInPrompt;
+    state: IOpenAiDeviceSignInState;
+}
+/**
+ * What one poll found:
+ * - `pending`: not approved yet; poll again at `nextPollAt` at the earliest.
+ * - `expired`: the code is past `expiresAt`; nothing was sent. Start a new sign-in.
+ * - `approved`: the person approved it; `result` holds the credential. The state is spent.
+ */
+export type TOpenAiDeviceSignInPoll = {
+    status: 'pending';
+    nextPollAt: string;
+} | {
+    status: 'expired';
+} | {
+    status: 'approved';
+    result: IOpenAiLoginResult;
+};
+export interface IOpenAiDeviceSignInOptions extends IOpenAiAuthOptions {
+    now?: () => Date;
+}
+/**
+ * Starts a device sign-in and returns what to show the person and the state to keep. The code lives fifteen
+ * minutes from the moment it was requested; `issuedAt` is taken before the request, so `expiresAt` never
+ * outlives the code.
+ */
+export declare const startOpenAiDeviceSignIn: (options?: IOpenAiDeviceSignInOptions) => Promise<IOpenAiDeviceSignInStart>;
+/**
+ * Asks once whether the person approved the sign-in, and on approval exchanges it for the credential. A state
+ * past `expiresAt` answers `expired` without a request. One request is bounded by the time the code has left
+ * and by thirty seconds. The authorization the service answers is single-use: poll one state from one caller
+ * at a time, and after `approved`, or after a failure of the exchange, start a new sign-in rather than polling
+ * the same state again. Failures are `OpenAiAuthError`s with fixed messages.
+ */
+export declare const pollOpenAiDeviceSignIn: (state: IOpenAiDeviceSignInState, options?: IOpenAiDeviceSignInOptions) => Promise<TOpenAiDeviceSignInPoll>;

package/dist_ts_signin/signin.device.js

@@ -0,0 +1,85 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+import { exchangeOpenAiDeviceAuthorization, OPENAI_DEVICE_CODE_LIFETIME_MS, OpenAiAuthError, pollOpenAiDeviceCodeOnce, requestOpenAiDeviceCode, } from './signin.protocol.js';
+import { openAiCredentialOfTokens, summarizeOpenAiCredential } from './signin.credential.js';
+const MAX_STATE_STRING_BYTES = 4096;
+const REQUEST_TIMEOUT_MS = 30_000;
+const invalidState = () => new OpenAiAuthError('OpenAI device sign-in state is invalid.', { requestOutcome: 'notSent' });
+const isBoundedString = (value) => typeof value === 'string' && value.length > 0 && Buffer.byteLength(value, 'utf8') <= MAX_STATE_STRING_BYTES;
+const timeOf = (value) => {
+    if (typeof value !== 'string')
+        return NaN;
+    const time = Date.parse(value);
+    return Number.isFinite(time) && new Date(time).toISOString() === value ? time : NaN;
+};
+/**
+ * Checks a stored state before anything is sent with it: a malformed one (its shape, or a window longer than the
+ * fifteen minutes a code lives) is refused. Only shape and window are checked, not where the state came from.
+ */
+const readState = (state) => {
+    if (state === null || typeof state !== 'object' || !isBoundedString(state.verificationUrl)
+        || !isBoundedString(state.userCode) || !isBoundedString(state.deviceAuthId)
+        || !Number.isSafeInteger(state.intervalSeconds) || state.intervalSeconds < 1 || state.intervalSeconds > 300) {
+        throw invalidState();
+    }
+    const issuedAt = timeOf(state.issuedAt);
+    const expiresAt = timeOf(state.expiresAt);
+    if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt
+        || expiresAt - issuedAt > OPENAI_DEVICE_CODE_LIFETIME_MS) {
+        throw invalidState();
+    }
+    return { issuedAt, expiresAt };
+};
+/**
+ * Starts a device sign-in and returns what to show the person and the state to keep. The code lives fifteen
+ * minutes from the moment it was requested; `issuedAt` is taken before the request, so `expiresAt` never
+ * outlives the code.
+ */
+export const startOpenAiDeviceSignIn = async (options = {}) => {
+    const now = options.now ?? (() => new Date());
+    const issuedAt = now().getTime();
+    const deviceCode = await requestOpenAiDeviceCode(options);
+    const state = {
+        verificationUrl: deviceCode.verificationUrl,
+        userCode: deviceCode.userCode,
+        deviceAuthId: deviceCode.deviceAuthId,
+        intervalSeconds: deviceCode.intervalSeconds,
+        issuedAt: new Date(issuedAt).toISOString(),
+        expiresAt: new Date(issuedAt + OPENAI_DEVICE_CODE_LIFETIME_MS).toISOString(),
+    };
+    return {
+        prompt: { flow: 'device', verificationUrl: state.verificationUrl, userCode: state.userCode, expiresAt: state.expiresAt },
+        state,
+    };
+};
+/**
+ * Asks once whether the person approved the sign-in, and on approval exchanges it for the credential. A state
+ * past `expiresAt` answers `expired` without a request. One request is bounded by the time the code has left
+ * and by thirty seconds. The authorization the service answers is single-use: poll one state from one caller
+ * at a time, and after `approved`, or after a failure of the exchange, start a new sign-in rather than polling
+ * the same state again. Failures are `OpenAiAuthError`s with fixed messages.
+ */
+export const pollOpenAiDeviceSignIn = async (state, options = {}) => {
+    const { expiresAt } = readState(state);
+    const now = options.now ?? (() => new Date());
+    const remaining = expiresAt - now().getTime();
+    if (remaining <= 0)
+        return { status: 'expired' };
+    const poll = await pollOpenAiDeviceCodeOnce({
+        verificationUrl: state.verificationUrl, userCode: state.userCode,
+        deviceAuthId: state.deviceAuthId, intervalSeconds: state.intervalSeconds,
+    }, { fetch: options.fetch, signal: options.signal, timeoutMs: Math.min(remaining, REQUEST_TIMEOUT_MS) });
+    if (poll.status === 'pending') {
+        const nextPollAt = Math.min(now().getTime() + state.intervalSeconds * 1000, expiresAt);
+        return { status: 'pending', nextPollAt: new Date(nextPollAt).toISOString() };
+    }
+    const tokens = await exchangeOpenAiDeviceAuthorization(poll.authorization, { fetch: options.fetch, signal: options.signal });
+    let credential;
+    try {
+        credential = openAiCredentialOfTokens(tokens);
+    }
+    catch {
+        throw new OpenAiAuthError('OpenAI auth response is missing id_token.', { requestOutcome: 'outcomeUnknown' });
+    }
+    return { status: 'approved', result: { credential, account: summarizeOpenAiCredential(credential) } };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbmluLmRldmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NpZ25pbi9zaWduaW4uZGV2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLDJKQUEySjtBQUUzSixPQUFPLEVBQ0wsaUNBQWlDLEVBQUUsOEJBQThCLEVBQUUsZUFBZSxFQUFFLHdCQUF3QixFQUM1Ryx1QkFBdUIsR0FDeEIsTUFBTSxzQkFBc0IsQ0FBQztBQUM5QixPQUFPLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUc3RixNQUFNLHNCQUFzQixHQUFHLElBQUksQ0FBQztBQUNwQyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sQ0FBQztBQTBDbEMsTUFBTSxZQUFZLEdBQUcsR0FBb0IsRUFBRSxDQUN6QyxJQUFJLGVBQWUsQ0FBQyx5Q0FBeUMsRUFBRSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0FBRWhHLE1BQU0sZUFBZSxHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQzFELE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxzQkFBc0IsQ0FBQztBQUU5RyxNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBVSxFQUFFO0lBQ3hDLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtRQUFFLE9BQU8sR0FBRyxDQUFDO0lBQzFDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDL0IsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7QUFDdEYsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUErQixFQUEyQyxFQUFFO0lBQzdGLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQztXQUNyRixDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQztXQUN4RSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxJQUFJLEtBQUssQ0FBQyxlQUFlLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxlQUFlLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDOUcsTUFBTSxZQUFZLEVBQUUsQ0FBQztJQUN2QixDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4QyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzFDLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxTQUFTLElBQUksUUFBUTtXQUNqRixTQUFTLEdBQUcsUUFBUSxHQUFHLDhCQUE4QixFQUFFLENBQUM7UUFDM0QsTUFBTSxZQUFZLEVBQUUsQ0FBQztJQUN2QixDQUFDO0lBQ0QsT0FBTyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsQ0FBQztBQUNqQyxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsS0FBSyxFQUMxQyxVQUFzQyxFQUFFLEVBQ0wsRUFBRTtJQUNyQyxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sUUFBUSxHQUFHLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2pDLE1BQU0sVUFBVSxHQUFHLE1BQU0sdUJBQXVCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDMUQsTUFBTSxLQUFLLEdBQTZCO1FBQ3RDLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZTtRQUMzQyxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVE7UUFDN0IsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZO1FBQ3JDLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZTtRQUMzQyxRQUFRLEVBQUUsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsV0FBVyxFQUFFO1FBQzFDLFNBQVMsRUFBRSxJQUFJLElBQUksQ0FBQyxRQUFRLEdBQUcsOEJBQThCLENBQUMsQ0FBQyxXQUFXLEVBQUU7S0FDN0UsQ0FBQztJQUNGLE9BQU87UUFDTCxNQUFNLEVBQUUsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFO1FBQ3hILEtBQUs7S0FDTixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxFQUN6QyxLQUErQixFQUMvQixVQUFzQyxFQUFFLEVBQ04sRUFBRTtJQUNwQyxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZDLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUM7SUFDOUMsTUFBTSxTQUFTLEdBQUcsU0FBUyxHQUFHLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQzlDLElBQUksU0FBUyxJQUFJLENBQUM7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELE1BQU0sSUFBSSxHQUFHLE1BQU0sd0JBQXdCLENBQUM7UUFDMUMsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1FBQ2hFLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWSxFQUFFLGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZTtLQUN6RSxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM5QixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxHQUFHLEtBQUssQ0FBQyxlQUFlLEdBQUcsSUFBSSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZGLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO0lBQy9FLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDN0gsSUFBSSxVQUFVLENBQUM7SUFDZixJQUFJLENBQUM7UUFBQyxVQUFVLEdBQUcsd0JBQXdCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQ3RELE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxlQUFlLENBQUMsMkNBQTJDLEVBQUUsRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUN2SCxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztBQUN4RyxDQUFDLENBQUMifQ==

package/dist_ts_signin/signin.grants.d.ts

@@ -0,0 +1,195 @@
+import type { IOpenAiLoginResult, IOpenAiOAuthCredential } from './signin.interfaces.js';
+/**
+ * The state of a stored grant:
+ * - `active`: its tokens are usable and refreshed when due. `retryAt` is set after a refresh that was never sent.
+ * - `refresh_uncertain`: a refresh may have been sent. The refresh token may already be spent, so it is never
+ *   sent again; the attempt either commits the rotated tokens or, once `attempt.expiresAt` passed, the grant
+ *   needs a new sign-in.
+ * - `reauth_required`: only a new sign-in brings the grant back.
+ */
+export type TOpenAiGrantState = 'active' | 'refresh_uncertain' | 'reauth_required';
+/**
+ * Why a grant needs a new sign-in:
+ * - `refresh_failed`: a refresh was sent and did not produce tokens (refused, or its outcome is unknown);
+ * - `refresh_interrupted`: a refresh may have been sent and its attempt ended without an answer;
+ * - `identity_changed`: a refresh answered for another workspace or user.
+ */
+export type TOpenAiGrantReauthReason = 'refresh_failed' | 'refresh_interrupted' | 'identity_changed';
+/**
+ * One grant as the store keeps it. The store seals `credential` at rest and hands the record back unchanged;
+ * everything else is credential-free.
+ */
+export interface IOpenAiGrantRecord {
+    /** Rises by one with every change of the record; `compareAndSet` and `remove` compare it. */
+    revision: number;
+    /** Rises by one with every new access token; a provider's 401 names the generation it rejected. */
+    generation: number;
+    state: TOpenAiGrantState;
+    credential: IOpenAiOAuthCredential;
+    /** The ChatGPT workspace the grant acts in; a refresh that states another is refused. */
+    accountId: string;
+    /** The ChatGPT user the grant was signed in as; a refresh that states another is refused. */
+    userId: string;
+    isFedrampAccount: boolean;
+    /** When the current access token expires, ISO 8601. */
+    accessExpiresAt: string;
+    /** When the current tokens were issued, by the sign-in or the last refresh, ISO 8601. */
+    refreshedAt: string;
+    /** After a refresh that was never sent: the earliest time to try again. */
+    retryAt: string | null;
+    retryCount: number;
+    /** While `refresh_uncertain`: the attempt that may have sent the refresh token, and when it is given up. */
+    attempt: {
+        id: string;
+        expiresAt: string;
+    } | null;
+    /** While `reauth_required`: why. */
+    reauthReason: TOpenAiGrantReauthReason | null;
+}
+/**
+ * Where grants live, supplied by the caller. Every write names the revision it read, so two processes that act on
+ * one grant cannot both win: `compareAndSet` and `remove` must compare and write in one atomic step, as a
+ * database's conditional update does. A store keeps `credential` sealed at rest and never logs it.
+ */
+export interface IOpenAiGrantStore {
+    load(grantId: string): Promise<IOpenAiGrantRecord | null>;
+    /** Stores a new grant; `conflict` when one exists under the id. */
+    create(grantId: string, record: IOpenAiGrantRecord): Promise<'stored' | 'conflict'>;
+    /** Replaces the grant only while it is still at `expectedRevision`. */
+    compareAndSet(grantId: string, expectedRevision: number, next: IOpenAiGrantRecord): Promise<'stored' | 'conflict'>;
+    /** Deletes the grant only while it is still at `expectedRevision`; `conflict` when it moved or is gone. */
+    remove(grantId: string, expectedRevision: number): Promise<'removed' | 'conflict'>;
+}
+/** Access for one request: what FlexHarness's ChatGPT connection takes, with the generation it belongs to. */
+export interface IOpenAiGrantAccess {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+    expiresAt: string;
+    generation: number;
+}
+export interface IOpenAiGrantResolveOptions {
+    /** Stops waiting. A refresh already sent keeps running to its end, so its outcome is recorded. */
+    signal?: AbortSignal;
+    /** The generation the provider just rejected with 401; the grant is refreshed if it is still the current one. */
+    rejectedGeneration?: number;
+    /** How long the access must stay valid, in milliseconds (at most one hour). Defaults to one minute. */
+    minValidityMs?: number;
+}
+/** What a caller may show about a grant: no token. */
+export interface IOpenAiGrantStatus {
+    revision: number;
+    generation: number;
+    state: TOpenAiGrantState;
+    reauthReason: TOpenAiGrantReauthReason | null;
+    accountId: string;
+    isFedrampAccount: boolean;
+    plan: string | null;
+    accessExpiresAt: string;
+    refreshedAt: string;
+    retryAt: string | null;
+}
+/**
+ * What the service said about revoking a removed grant:
+ * - `confirmed`: it revoked the grant's current refresh token;
+ * - `unconfirmed`: it revoked the stored token, but a refresh may have replaced it at the service before;
+ * - `failed`: it did not confirm the revocation. The sign-in may still be valid at the service.
+ */
+export type TOpenAiGrantRevocation = 'confirmed' | 'unconfirmed' | 'failed';
+/**
+ * Why a grant cannot answer:
+ * - `not_found`: no grant under the id;
+ * - `reauth_required`: only a new sign-in brings it back (`reauthReason` says why);
+ * - `access_not_fresh`: the grant is intact, but the service could not renew it yet (`retryAt`);
+ * - `invalid_argument`, `invalid_record`: the caller's input or the stored record;
+ * - `aborted`: the caller's signal;
+ * - `contended`: the record kept changing under this call; try again.
+ */
+export type TOpenAiGrantErrorCode = 'not_found' | 'reauth_required' | 'access_not_fresh' | 'invalid_argument' | 'invalid_record' | 'aborted' | 'contended';
+/** A grant failure. Its message is fixed and names no token. */
+export declare class OpenAiGrantError extends Error {
+    readonly code: TOpenAiGrantErrorCode;
+    readonly details: {
+        reauthReason?: TOpenAiGrantReauthReason;
+        retryAt?: string;
+    };
+    constructor(code: TOpenAiGrantErrorCode, details?: {
+        reauthReason?: TOpenAiGrantReauthReason;
+        retryAt?: string;
+    });
+}
+export interface IOpenAiGrantManagerOptions {
+    store: IOpenAiGrantStore;
+    fetch?: typeof fetch;
+    now?: () => number;
+    /** How often a process polls a grant another process is refreshing. Defaults to 250 ms. */
+    waitIntervalMs?: number;
+}
+/**
+ * Keeps ChatGPT sign-ins usable for any number of processes that share one store: it answers current access for
+ * each request, refreshes the tokens when they are due or the provider rejected exactly the current generation,
+ * and never sends a refresh token whose outcome is unknown a second time. Within a process one refresh per grant
+ * runs at a time; across processes the store's compare-and-set on the revision decides, and a process that finds
+ * another's refresh in flight waits for its outcome. It holds no credential of its own: every call reads the
+ * store, and no error, status or return value carries a refresh or ID token.
+ */
+export declare class OpenAiGrantManager {
+    private readonly store;
+    private readonly fetcher;
+    private readonly now;
+    private readonly waitIntervalMs;
+    private readonly refreshes;
+    constructor(options: IOpenAiGrantManagerOptions);
+    /** The record a new sign-in starts: generation one, active. */
+    private recordOf;
+    private statusOf;
+    private load;
+    /** Stores the grant a device sign-in produced. Throws `OpenAiGrantError` `contended` when a grant exists under the id. */
+    create(grantId: string, result: IOpenAiLoginResult): Promise<IOpenAiGrantStatus>;
+    /**
+     * Replaces a grant with a new sign-in, over the revision the caller read: a grant that needs a new sign-in is
+     * repaired this way. The generation keeps rising, so a 401 of the old tokens cannot be mistaken for the new.
+     * The replaced tokens are not revoked.
+     */
+    replace(grantId: string, expectedRevision: number, result: IOpenAiLoginResult): Promise<IOpenAiGrantStatus>;
+    /** The grant's state without any token; `null` when there is none. */
+    status(grantId: string): Promise<IOpenAiGrantStatus | null>;
+    private isDue;
+    private wait;
+    /** Waits for a promise, or rejects `aborted` as soon as the signal fires; the promise runs on regardless. */
+    private awaitOrAbort;
+    /** Moves a record on over the revision it was read at; `false` when it moved meanwhile. */
+    private write;
+    /**
+     * Current access for one provider request. The access stays valid for `minValidityMs` at least; tokens that
+     * are due, or whose generation the provider just rejected, are refreshed first.
+     * Throws `OpenAiGrantError`: `reauth_required` when only a new sign-in helps, `access_not_fresh` when the
+     * service could not renew the tokens yet.
+     */
+    resolveAccess(grantId: string, options?: IOpenAiGrantResolveOptions): Promise<IOpenAiGrantAccess>;
+    /**
+     * Refreshes a grant that is due (by its access expiry or its age) and answers its state; one that is not due is
+     * left as it is. For a periodic job, so a sign-in that no request uses stays alive.
+     */
+    keepFresh(grantId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<IOpenAiGrantStatus | null>;
+    /**
+     * A record whose refresh may have been sent: this process waits for its own attempt; another process's attempt
+     * is waited for until the record moves on or the attempt's lease passes, and then the grant needs a new sign-in.
+     */
+    private settleAttempt;
+    /** One refresh per grant in this process; a caller that stops waiting leaves it running to its end. */
+    private refresh;
+    private performRefresh;
+    /**
+     * Removes a grant and then asks the service to revoke its refresh token. The grant is removed whatever the
+     * service answers; `revocation` says what it answered. `removed: false` when there was no grant.
+     */
+    remove(grantId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        removed: boolean;
+        revocation: TOpenAiGrantRevocation | null;
+    }>;
+}