export declare const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"; export declare const ISSUER = "https://auth.openai.com"; export declare const OAUTH_PORT = 1455; export declare const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000; export declare const USER_AGENT = "cortexkit-opencode-openai-auth/0.6.4"; export declare const RESERVED_ACCOUNT_ID = "main"; export declare const RESERVED_ACCOUNT_ID_ERROR = "\"main\" is a reserved account id; choose a different label."; export interface PkceCodes { verifier: string; challenge: string; } export declare function base64UrlEncode(buffer: ArrayBuffer): string; export declare function generatePKCE(): Promise; export interface IdTokenClaims { chatgpt_account_id?: string; email?: string; organizations?: Array<{ id: string; }>; 'https://api.openai.com/auth'?: { chatgpt_account_id?: string; }; } export declare function parseJwtClaims(token: string): IdTokenClaims | undefined; export declare function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined; export interface TokenResponse { id_token: string; access_token: string; refresh_token: string; expires_in?: number; } export declare function extractAccountId(tokens: TokenResponse): string | undefined; export declare function isReservedAccountId(value: string | undefined): boolean; export declare function assertFallbackAccountIdAllowed(value: T): T; export declare function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string): string; export declare function exchangeCodeForTokens(code: string, redirectUri: string, pkce: PkceCodes): Promise; export declare function escapeHtml(value: string): string; export declare const HTML_SUCCESS = "\n\n \n CortexKit OpenAI Auth - Authorization Successful\n \n \n \n

Authorization Successful

You can close this window and return to OpenCode.

\n \n \n"; export declare const HTML_ERROR: (error: string) => string; export interface PendingOAuth { pkce: PkceCodes; state: string; resolve: (tokens: TokenResponse) => void; reject: (error: Error) => void; } export declare function flowCleanup(state: string): void; export declare function startOAuthServer(): Promise<{ port: number; redirectUri: string; }>; export declare function stopOAuthServer(): void; export declare function resetOAuthStateForTest(): void; export declare function waitForOAuthCallback(pkce: PkceCodes, state: string, timeoutMs?: number, signal?: AbortSignal): Promise; export interface DeviceAuthInit { device_auth_id: string; user_code: string; interval: string; expires_in?: number | string; } export declare function beginDeviceAuth(): Promise<{ deviceData: DeviceAuthInit; url: string; instructions: string; }>; export declare function completeDeviceAuth(deviceData: DeviceAuthInit, signal?: AbortSignal): Promise; /** * Minimal shape of a fallback OAuth account for ingestion. Matches the * fields used by upsertAccount and beginAccountLogin, compatible with * the full OAuthAccount type in accounts.ts. */ export interface IngestAccount { id: string; label?: string; type: 'oauth'; access?: string; refresh: string; expires?: number; enabled: boolean; addedAt: number; lastUsed: number; /** * When the token was obtained. Stamped at login so a freshly added account * carries a refresh marker — without it, the runtime-state merge cannot tell a * rotated token from a stale one (both default to 0) and a concurrent stale * save could roll the token back. */ lastRefreshedAt?: number; /** Stable ChatGPT account identifier from the OAuth token claims. */ accountId?: string; } export interface AccountStorageLike { version: 1; mainAccountId?: string; accounts: IngestAccount[]; } /** * Dedup by stable accountId first (strongest signal — same ChatGPT account * added twice with different labels must merge), then by id, then by label. * If found, merge-update preserving addedAt. Otherwise push. * Re-running `add --label work` is idempotent. * * Accepts the accounts array directly (not the whole storage object) to * avoid coupling to any particular storage shape. */ export declare function upsertAccount(accounts: T[], account: T): number; export interface BeginAccountLoginOptions { label?: string; headless?: boolean; signal?: AbortSignal; } export interface BeginAccountLoginResult { url: string; instructions: string; /** Resolves after the user completes the OAuth flow with a ready-to-ingest account. */ completion: Promise; } /** * Split-return OAuth flow entry point. * * Browser flow (default): * 1. Start OAuth server, generate PKCE, build authorize URL * 2. Return { url, instructions, completion } — url is ready immediately * 3. completion resolves after browser callback + token exchange * * Headless flow: * 1. Begin device auth * 2. Return { url, instructions, completion } * 3. completion polls device endpoint + exchanges for tokens * * The split return allows the TUI command to show the URL before the * (potentially 30-60s) wait, avoiding a deadlock. */ export declare function beginAccountLogin(opts?: BeginAccountLoginOptions): Promise;