Prefer SSO OAuth PKCE for CPA minting and sync latest accounts.

Switch CPA export to SSO→Authorization Code with referrer=grok-build, keep device-code as optional fallback, and capture new register/auth artifacts.

oidc_mint/__init__.py

@@ -1,23 +1,40 @@
-"""OIDC 设备码铸造包：为免费 Grok Build 账号铸造 access/refresh/id token。
+"""OIDC 铸造包：为免费 Grok Build 账号铸造 access/refresh/id token。
 
-仅保留铸造所需的三块：
-  - oauth_device：xAI 设备码授权 + 轮询 token
-  - browser_confirm：独立 Chromium 完成设备码确认
-  - proxyutil：代理解析
+优先路径（2026-07 起）：
+  - oauth_code：SSO cookie → Authorization Code + PKCE（referrer=grok-build）
+
+兼容路径：
+  - oauth_device + browser_confirm：设备码授权（通常无 referrer，可能不可用）
 
 输出成什么格式（CPA / 其它）由上层的 cpa_export 负责，这里不掺和。
 """
 
 from .browser_confirm import mint_with_browser, shutdown_mint_browsers
+from .oauth_code import (
+    CLIENT_ID as CODE_CLIENT_ID,
+    GROK_REFERRER,
+    OAuthCodeError,
+    SCOPE as CODE_SCOPE,
+    mint_from_sso,
+    normalize_sso_cookie,
+    sso_to_token,
+)
 from .oauth_device import CLIENT_ID, SCOPE, OAuthDeviceError
 from .proxyutil import resolve_proxy, set_runtime_proxy
 
 __all__ = [
     "mint_with_browser",
     "shutdown_mint_browsers",
+    "mint_from_sso",
+    "sso_to_token",
+    "normalize_sso_cookie",
     "CLIENT_ID",
     "SCOPE",
+    "CODE_CLIENT_ID",
+    "CODE_SCOPE",
+    "GROK_REFERRER",
     "OAuthDeviceError",
+    "OAuthCodeError",
     "resolve_proxy",
     "set_runtime_proxy",
 ]