@cortexkit/opencode-openai-auth 0.7.2 → 0.9.0

package/dist/core/accounts.d.ts

@@ -1,330 +0,0 @@
-import { ACCOUNT_FILE_NAME, ACCOUNT_STATE_FILE_NAME, deriveStatePath, getAccountStatePath, getAccountStoragePath } from './account-paths';
-import type { ProviderQuotaFn, ProviderRefreshFn, QuotaWindowName } from './provider.ts';
-import { PRIMARY, SECONDARY } from './provider.ts';
-export { ACCOUNT_FILE_NAME, ACCOUNT_STATE_FILE_NAME, deriveStatePath, getAccountStatePath, getAccountStoragePath, };
-export type { QuotaWindowName };
-export { PRIMARY, SECONDARY };
-export type AccountQuotaWindow = {
-    usedPercent: number;
-    remainingPercent: number;
-    resetsAt?: string;
-    checkedAt: number;
-    windowMinutes?: number;
-};
-export interface OAuthQuotaSnapshot {
-    primary?: AccountQuotaWindow;
-    secondary?: AccountQuotaWindow;
-    resetCreditsAvailable?: number;
-    resetCreditsApplicable?: number;
-}
-export type AccountBase = {
-    id: string;
-    label?: string;
-    enabled?: boolean;
-    addedAt?: number;
-    lastUsed?: number;
-    /** Stable ChatGPT account identifier extracted from the OAuth token claims. */
-    accountId?: string;
-};
-export type AccountOperationError = {
-    message: string;
-    checkedAt: number;
-    nextRetryAt?: number;
-    retryCount?: number;
-    tokenHash?: string;
-};
-export type OAuthAccount = AccountBase & {
-    type: 'oauth';
-    access?: string;
-    refresh: string;
-    expires?: number;
-    lastRefreshedAt?: number;
-    lastRefreshError?: AccountOperationError;
-    lastQuotaRefreshError?: AccountOperationError;
-    quota?: OAuthQuotaSnapshot;
-};
-export type ApiKeyAccount = AccountBase & {
-    type: 'api';
-    apiKey?: string;
-    baseURL: string;
-    authHeader?: 'authorization-bearer' | 'x-api-key';
-};
-export type FallbackAccount = OAuthAccount | ApiKeyAccount;
-export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
-export declare function isApiKeyAccount(account: FallbackAccount): account is ApiKeyAccount;
-export declare function isValidApiBaseURL(value: string | undefined): boolean;
-export type RoutingMode = 'main-first' | 'fallback-first' | 'sticky-balanced';
-export type KillswitchThresholds = Partial<Record<QuotaWindowName | '5h' | '1w', number>>;
-export type KillswitchConfig = {
-    enabled?: boolean;
-    main?: KillswitchThresholds;
-    accounts?: Record<string, KillswitchThresholds>;
-};
-export interface ResetInFlight {
-    redeemRequestId: string;
-    creditId: string;
-    startedAt: number;
-}
-export interface ResetLastOutcome {
-    code: string;
-    at: number;
-    previousOutcome?: {
-        code: string;
-        at: number;
-    };
-}
-export interface ResetAccountState {
-    inFlight?: ResetInFlight | Record<string, unknown>;
-    lastOutcome?: ResetLastOutcome;
-    cooldownUntil?: number;
-}
-export type ResetStateByAccount = Record<string, ResetAccountState>;
-export type AccountStorage = {
-    version: 1;
-    main?: {
-        type: 'opencode';
-        provider: 'openai';
-    };
-    routing?: {
-        mode?: RoutingMode;
-    };
-    fallbackOn?: number[];
-    refresh?: {
-        enabled?: boolean;
-        intervalMinutes?: number;
-        refreshBeforeExpiryMinutes?: number;
-        mainLastRefreshError?: AccountOperationError;
-        mainRefreshLeaseId?: string;
-        mainRefreshLeaseUntil?: number;
-        mainRefreshLeaseTokenHash?: string;
-    };
-    quota?: {
-        enabled?: boolean;
-        checkIntervalMinutes?: number;
-        refreshEveryNRequests?: number;
-        minimumRemaining?: Partial<Record<QuotaWindowName | '5h' | '1w', number>>;
-        failClosedOnUnknownQuota?: boolean;
-        showToasts?: boolean;
-        mainQuota?: OAuthQuotaSnapshot;
-        mainQuotaCheckedAt?: number;
-        mainQuotaToken?: string;
-        mainLastQuotaApiError?: AccountOperationError;
-    };
-    reset?: ResetStateByAccount;
-    dump?: {
-        enabled?: boolean;
-    };
-    costZeroing?: {
-        enabled?: boolean;
-    };
-    killswitch?: KillswitchConfig;
-    logging?: {
-        level?: string;
-    };
-    cachekeep?: {
-        enabled?: boolean;
-        subagents?: boolean;
-        sustain?: boolean;
-        /** Clock-hour window start (0-23, inclusive) — keeps cachekeep idle warming
-         *  inside `[startHour, endHour)` local hours. Omit to warm unconditionally. */
-        startHour?: number;
-        /** Clock-hour window end (0-23, exclusive) — must differ from startHour
-         *  to be honored; an unset or equal hour falls back to "always warm". */
-        endHour?: number;
-    };
-    /** Stable ChatGPT account identifier of the main account (extracted from OAuth token). */
-    mainAccountId?: string;
-    accounts: FallbackAccount[];
-};
-export declare function isCostZeroingEnabled(storage: Pick<AccountStorage, 'costZeroing'>): boolean;
-export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
-export type AccountRuntimeState = {
-    version: 1;
-    main?: {
-        quota?: OAuthQuotaSnapshot;
-        quotaCheckedAt?: number;
-        quotaToken?: string;
-        lastQuotaApiError?: AccountOperationError;
-        lastRefreshError?: AccountOperationError;
-        refreshLeaseId?: string;
-        refreshLeaseUntil?: number;
-        refreshLeaseTokenHash?: string;
-    };
-    accounts?: Record<string, AccountRuntimeEntry>;
-};
-export type AccountStateSaveScope = {
-    mainQuota?: boolean;
-    mainRefresh?: boolean;
-    accounts?: true | string[];
-};
-export type AccountManagerOptions = {
-    now?: () => number;
-    fetchImpl?: typeof fetch;
-    configPath?: string;
-    onFallbackStorageChanged?: () => void;
-    /** Provider token-refresh function (constructor-injected). */
-    refreshFn?: ProviderRefreshFn;
-    /** Provider quota-fetch function (constructor-injected, OPTIONAL wham/usage supplement). */
-    fetchQuotaFn?: ProviderQuotaFn;
-    /** QuotaManager instance for unified cache (constructor-injected). */
-    quotaManager?: import('./quota-manager.ts').QuotaManager;
-};
-export type AccountRefreshError = {
-    accountId: string;
-    message: string;
-};
-export declare class AccountRemovedDuringRefreshError extends Error {
-    readonly code = "ACCOUNT_REMOVED_DURING_REFRESH";
-    constructor(accountId: string);
-}
-export declare const DEFAULT_KILLSWITCH_THRESHOLDS: {
-    primary: number;
-    secondary: number;
-};
-export declare function isSafeResetAccountKey(accountKey: string): boolean;
-/**
- * The set of account ids present in the CONFIG file (the authoritative account
- * roster). Returns null when the config is absent or unreadable/malformed, so
- * callers can fall back to non-pruning behavior rather than risk wiping live
- * state. The config never holds secrets (see accountConfig), so reading it here
- * is safe. Reads are lock-free but the file is written atomically, so a
- * concurrent write is seen as either the complete old or complete new file.
- *
- * Trims and skips blank ids per the rule in collectConfigRosterIds above.
- */
-export declare function readConfigRosterIds(path: string): Promise<Set<string> | null>;
-export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
-export declare function saveAccounts(storage: AccountStorage, path?: string): Promise<void>;
-/**
- * Read-modify-write the account store atomically under the save lock.
- *
- * Unlike saveAccounts (which UNION-merges the incoming accounts with the latest
- * on-disk set so concurrent ADDS from another process are never lost), this
- * reads the freshest state under the lock and writes the mutator's result
- * AUTHORITATIVELY — no union. That is required for structural edits (remove,
- * reorder): a union cannot express a deletion (the removed id reappears from
- * `latest`) or a reordering (the union is seeded latest-first). Because the
- * mutator runs against freshly-read state under the lock, an add committed by a
- * concurrent process is still visible to it and preserved.
- *
- * The mutator may edit `current` in place and return it, or return a new
- * storage object. Returning undefined means "no change" and still rewrites the
- * freshly-read state (a harmless idempotent write).
- *
- * Load-time drop preservation: if normalizeAccount (called inside
- * normalizeStorage) rejects an account whose id IS in the raw config roster,
- * the previous behavior would erase that id silently on the next write. This
- * function now carries the dropped raw entry through to the written config
- * verbatim, so the on-disk state always matches the operator's intent (an
- * account they added, even if temporarily un-loadable, stays in their list
- * until they deliberately remove it).
- *
- * Removal seam: when the caller knows they are removing an id (e.g. the CLI
- * `remove` command) and that id may be load-dropped — in which case the
- * mutator cannot find it in `current.accounts` to splice it — the caller can
- * pass `options.allowDrop: [id]`. Ids in `allowDrop` are NOT preserved; the
- * mutator's splice still no-ops on a dropped id, but the absence of
- * preservation completes the removal end-to-end.
- */
-export declare function mutateAccounts(mutate: (current: AccountStorage) => AccountStorage | undefined, path?: string, options?: {
-    allowDrop?: readonly string[];
-}): Promise<AccountStorage>;
-export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
-export declare function shouldFallbackStatus(status: number, storage: AccountStorage | null): boolean;
-export declare function quotaSnapshotPassesPolicy(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, now?: number): boolean;
-export declare function isKillswitchEnabled(storage: AccountStorage | null): boolean;
-export declare function getKillswitchThresholdsForAccount(storage: AccountStorage | null, accountId?: string): {
-    primary: number;
-    secondary: number;
-};
-export declare function killswitchPassesPolicy(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, accountId?: string, now?: number): boolean;
-export declare function killswitchRetryAfterSeconds(mainQuota: OAuthQuotaSnapshot | undefined, fallbackAccounts: Array<{
-    accountId: string;
-    quota?: OAuthQuotaSnapshot;
-}>, now: number, storage: AccountStorage | null): number;
-/**
- * Migrate an existing single-slot token into the multi-account store.
- *
- * Reads the existing token via the caller-provided `getAuth` (the ONLY
- * read path — there is no `client.auth.get`). If a token exists and the
- * config file is NOT yet an account store (content discriminator), seeds
- * it as the primary OAuth account.
- *
- * Idempotent: a second run is a no-op because the content discriminator
- * will already match.
- *
- * Tolerates expired/revoked tokens (migrates them; refresh handles validity).
- *
- * Guards against first-run races with the same save-lock order used by
- * structural account mutations.
- */
-export declare function migrateIfNeeded(existingToken: {
-    type: 'oauth';
-    access: string;
-    refresh: string;
-    expires: number;
-} | undefined, path?: string): Promise<void>;
-export declare function getQuotaCheckIntervalMs(storage: AccountStorage | null): number;
-export declare function getRefreshIntervalMs(storage: AccountStorage | null): number;
-export declare class FallbackAccountManager {
-    private readonly now;
-    private readonly fetchImpl;
-    private readonly configPath;
-    private readonly refreshPromises;
-    private refreshTimer;
-    private quotaTimer;
-    readonly quotaManager: import('./quota-manager.ts').QuotaManager | null;
-    private readonly onFallbackStorageChanged;
-    private readonly options;
-    constructor(options?: AccountManagerOptions);
-    /**
-     * Seed QuotaManager from persisted account.quota if no cache entry exists
-     * yet. Prevents unnecessary API calls when the on-disk snapshot is fresh.
-     */
-    private seedFallbackQuota;
-    load(): Promise<AccountStorage | null>;
-    save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
-    startBackgroundRefresh(): void;
-    stopBackgroundRefresh(): void;
-    getUsableFallbackAccounts(existingStorage?: AccountStorage | null): Promise<OAuthAccount[]>;
-    /**
-     * Stamp `lastUsed` on a served account.
-     *
-     * This runs on the request path after a response is already in hand, and
-     * `lastUsed` is telemetry: nothing reads it to make a routing, quota, or
-     * killswitch decision. The WHOLE operation is therefore best-effort, read
-     * included — loadAccounts deliberately rethrows anything that is not ENOENT so
-     * corruption surfaces to callers that must act on it, and a store lock shared
-     * by every session in the host process can legitimately time out under a burst
-     * of concurrent turns. Neither may reach this caller: it would discard a
-     * successful, already-billed provider response to record a timestamp. Losing
-     * the stamp costs nothing a later turn cannot redo.
-     *
-     * Contrast refreshAccount, whose save persists rotated tokens and MUST
-     * propagate: dropping it silently would strand a refresh and invalidate the
-     * account's credentials.
-     */
-    markUsed(account: FallbackAccount): Promise<void>;
-    accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null): boolean;
-    /**
-     * Return the account with its quota overlaid from the unified QuotaManager
-     * cache (token-bound) when available, so quota-policy decisions use the same
-     * source of truth as the staleness check. Falls back to the stored
-     * account.quota when no manager is wired or the cache has no entry.
-     */
-    private quotaPolicyAccount;
-    refreshDueAccounts(): Promise<void>;
-    refreshQuotaForDueAccounts(): Promise<void>;
-    refreshQuotaForAllAccounts(options?: {
-        force?: boolean;
-    }): Promise<{
-        storage: AccountStorage | null;
-        errors: AccountRefreshError[];
-    }>;
-    refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
-        force?: boolean;
-    }): Promise<OAuthAccount>;
-    private waitForConcurrentFallbackRefresh;
-    private refreshAccountNow;
-    refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<void>;
-}

package/dist/core/atomic-write.d.ts

@@ -1 +0,0 @@
-export declare function writeJsonAtomic(path: string, value: unknown): Promise<void>;

package/dist/core/background-quota-refresh.d.ts

@@ -1,46 +0,0 @@
-import { type RefreshAllQuotaDeps, type RefreshAllQuotaResult } from './refresh-all-quota';
-export declare const BACKGROUND_QUOTA_REFRESH_INTERVAL_MS: number;
-export declare const BACKGROUND_QUOTA_REFRESH_JITTER_MS = 30000;
-export declare const BACKGROUND_QUOTA_FRESHNESS_MS: number;
-export declare const BACKGROUND_QUOTA_REFRESH_LOCK_NAME = "bg-quota-refresh";
-export declare const BACKGROUND_QUOTA_REFRESH_LOCK_TTL_MS = 120000;
-type TimerHandle = ReturnType<typeof setInterval>;
-interface BackgroundQuotaRefreshOptions {
-    setIntervalFn?: (callback: () => void, intervalMs: number) => TimerHandle;
-    clearIntervalFn?: (timer: TimerHandle) => void;
-    random?: () => number;
-    onError?: (error: unknown) => void;
-}
-type RefreshAllQuotaFn = (deps: RefreshAllQuotaDeps) => Promise<RefreshAllQuotaResult[]>;
-type BackgroundLockHandle = {
-    release: () => Promise<void>;
-};
-export type BackgroundLockAcquirer = () => Promise<BackgroundLockHandle | null>;
-/**
- * Acquire the cross-process lock that serializes the background refresh.
- * `renew` re-arms the TTL on an interval until release(), so a serial pass that
- * outlasts the TTL (a fleet of accounts each costing a token refresh plus a
- * wham fetch) never lets the lock expire mid-run — an expiry would let a second
- * process start a concurrent refresh. Overrides exist so tests can drive the
- * renewal with a mock clock and a fast interval.
- */
-export declare function acquireBackgroundRefreshLock(configPath: string, overrides?: {
-    now?: () => number;
-    renewIntervalMs?: number;
-}): Promise<BackgroundLockHandle | null>;
-export declare function refreshQuotaInBackground(deps: RefreshAllQuotaDeps, refreshFn?: RefreshAllQuotaFn, acquireLock?: BackgroundLockAcquirer): Promise<RefreshAllQuotaResult[]>;
-export declare class BackgroundQuotaRefresh {
-    private readonly setIntervalFn;
-    private readonly clearIntervalFn;
-    private readonly random;
-    private onError;
-    private run;
-    private timer;
-    private tickPromise;
-    private stopped;
-    constructor(options?: BackgroundQuotaRefreshOptions);
-    start(run: () => Promise<void>, onError?: ((error: unknown) => void) | undefined): void;
-    stop(): void;
-    isStopped(): boolean;
-}
-export {};

package/dist/core/backoff.d.ts

@@ -1,53 +0,0 @@
-export declare const NON_TRANSIENT_REFRESH_RETRY_DELAY_MS: number;
-export declare function isTransientRefreshError(error: unknown): boolean;
-export declare function isTransientQuotaError(error: unknown): boolean;
-export declare function hashRefreshToken(refreshToken: string): string;
-export declare function buildRefreshOperationError(input: {
-    error: unknown;
-    now: number;
-    refreshToken: string;
-    previous?: {
-        message: string;
-        checkedAt: number;
-        nextRetryAt?: number;
-        retryCount?: number;
-        tokenHash?: string;
-    };
-}): {
-    message: string;
-    checkedAt: number;
-    nextRetryAt: number;
-    retryCount: number;
-    tokenHash: string;
-};
-export declare function refreshBackoffActive(error: {
-    nextRetryAt?: number;
-    tokenHash?: string;
-} | undefined, refreshToken: string | undefined, now: number): boolean;
-export declare function formatRefreshBackoffMessage(error: {
-    message: string;
-    nextRetryAt?: number;
-}, now: number): string;
-export declare function buildQuotaOperationError(input: {
-    error: unknown;
-    now: number;
-    previous?: {
-        message: string;
-        checkedAt: number;
-        nextRetryAt?: number;
-        retryCount?: number;
-    };
-}): {
-    message: string;
-    checkedAt: number;
-    nextRetryAt: number;
-    retryCount: number;
-};
-export declare function quotaBackoffActive(error: {
-    nextRetryAt?: number;
-} | undefined, now: number): boolean;
-export declare function formatQuotaBackoffMessage(error: {
-    message: string;
-    nextRetryAt?: number;
-}, now: number): string;
-export declare function parseRetryAfter(value: string | undefined | null): number | undefined;

package/dist/core/cachekeep.d.ts

@@ -1,118 +0,0 @@
-import type { AccountStorage } from './accounts.ts';
-export type CacheKeepWindow = {
-    startHour: number;
-    endHour: number;
-};
-export interface Target {
-    bodyText: string;
-    accountId: string | undefined;
-    chatgptAccountId?: string;
-    route: 'main';
-    cacheExpiresAt: number;
-    ttlMs: number;
-    warmCount: number;
-    lastRealRequestAt: number;
-    lastWarmedAt?: number;
-    backoffUntil?: number;
-    replayHeaders: Record<string, string>;
-    isSubagent?: boolean;
-    is56: boolean;
-}
-export interface CacheKeepManagerOptions {
-    fetchImpl: typeof fetch;
-    getMainToken: () => Promise<string>;
-    refreshFallback: (accountId: string) => Promise<string>;
-    codexResponsesUrl: string;
-    logger: {
-        info: (msg: string, data?: unknown) => void;
-        warn: (msg: string, data?: unknown) => void;
-        debug: (msg: string, data?: unknown) => void;
-        error: (msg: string, data?: unknown) => void;
-    };
-    now: () => number;
-    ttlMs?: number;
-    leadMs?: number;
-    maxDurationMs?: number;
-    maxIdleWarmMs?: number;
-    maxSubagentIdleMs?: number;
-    tickIntervalMs?: number;
-    maxTargets?: number;
-    maxBytes?: number;
-    /** Returns the configured clock-hour window; undefined means always warm. */
-    getWindow?: () => CacheKeepWindow | undefined;
-    /** Returns whether main-agent targets bypass only the idle warm cap. */
-    getSustain?: () => boolean;
-}
-export interface CacheKeepStatus {
-    running: boolean;
-    tracked: number;
-    generatedAt: number;
-    startedAt: number | null;
-    maxIdleWarmMs: number;
-    maxSubagentIdleMs: number;
-    ttlMs: number;
-    leadMs: number;
-    sustain: boolean;
-    window?: CacheKeepWindow;
-    targets: Array<{
-        sessionKey: string;
-        accountId: string | undefined;
-        route: 'main';
-        cacheExpiresAt: number;
-        lastRealRequestAt: number;
-        lastWarmedAt?: number;
-        backoffUntil?: number;
-        bodyBytes: number;
-    }>;
-}
-export interface KeepwarmCapture {
-    sessionKey: string;
-    bodyText: string;
-    replayHeaders: Record<string, string>;
-    isSubagent: boolean;
-}
-export declare function buildKeepwarmCapture(input: {
-    enabled: boolean;
-    includeSubagents: boolean;
-    headers: Headers;
-    body: unknown;
-}): KeepwarmCapture | undefined;
-export declare function getCacheKeepWindow(storage: AccountStorage | null): CacheKeepWindow | undefined;
-export declare function isWithinCacheKeepWindow(window: CacheKeepWindow | undefined, now?: Date): boolean;
-export declare function buildKeepwarmBody(bodyText: string): string;
-export declare function ttlForModel(bodyText: string, defaultTtlMs: number): number;
-export declare class CacheKeepManager {
-    private readonly targets;
-    private readonly fetchImpl;
-    private readonly getMainToken;
-    private readonly refreshFallback;
-    private readonly codexResponsesUrl;
-    private readonly log;
-    private readonly now;
-    private readonly ttlMs;
-    private readonly leadMs;
-    private readonly maxIdleWarmMs;
-    private readonly maxSubagentIdleMs;
-    private readonly tickIntervalMs;
-    private readonly maxTargets;
-    private readonly maxBytes;
-    private readonly getWindow?;
-    private readonly getSustain?;
-    private timer;
-    private startedAt;
-    private totalBytes;
-    private tickInFlight;
-    private disposed;
-    private abortController;
-    private logPayload;
-    constructor(options: CacheKeepManagerOptions);
-    track(sessionKey: string, bodyText: string, accountId: string | undefined, chatgptAccountId?: string, replayHeaders?: Record<string, string>, isSubagent?: boolean): void;
-    private isGpt56Subagent;
-    private pruneStale;
-    start(): void;
-    stop(): void;
-    remove(sessionKey: string): void;
-    status(): CacheKeepStatus;
-    tick(): Promise<void>;
-    private prewarm;
-}

package/dist/core/oauth.d.ts

@@ -1,138 +0,0 @@
-export declare const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-export declare const ISSUER = "https://auth.openai.com";
-export declare const OAUTH_PORT = 1455;
-export declare const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000;
-export declare const USER_AGENT = "cortexkit-opencode-openai-auth/0.7.2";
-export declare const RESERVED_ACCOUNT_ID = "main";
-export declare const RESERVED_ACCOUNT_ID_ERROR = "\"main\" is a reserved account id; choose a different label.";
-export interface PkceCodes {
-    verifier: string;
-    challenge: string;
-}
-export declare function base64UrlEncode(buffer: ArrayBuffer): string;
-export declare function generatePKCE(): Promise<PkceCodes>;
-export interface IdTokenClaims {
-    chatgpt_account_id?: string;
-    email?: string;
-    organizations?: Array<{
-        id: string;
-    }>;
-    'https://api.openai.com/auth'?: {
-        chatgpt_account_id?: string;
-    };
-}
-export declare function parseJwtClaims(token: string): IdTokenClaims | undefined;
-export declare function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined;
-export interface TokenResponse {
-    id_token: string;
-    access_token: string;
-    refresh_token: string;
-    expires_in?: number;
-}
-export declare function extractAccountId(tokens: TokenResponse): string | undefined;
-export declare function isReservedAccountId(value: string | undefined): boolean;
-export declare function assertFallbackAccountIdAllowed<T extends string | undefined>(value: T): T;
-export declare function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string): string;
-export declare function exchangeCodeForTokens(code: string, redirectUri: string, pkce: PkceCodes): Promise<TokenResponse>;
-export declare function escapeHtml(value: string): string;
-export declare const HTML_SUCCESS = "<!doctype html>\n<html>\n  <head>\n    <title>CortexKit OpenAI Auth - Authorization Successful</title>\n    <style>\n      body {\n        font-family:\n          system-ui,\n          -apple-system,\n          sans-serif;\n        display: flex;\n        justify-content: center;\n        align-items: center;\n        height: 100vh;\n        margin: 0;\n        background: #131010;\n        color: #f1ecec;\n      }\n      .container {\n        text-align: center;\n        padding: 2rem;\n      }\n      h1 {\n        color: #f1ecec;\n        margin-bottom: 1rem;\n      }\n      p {\n        color: #b7b1b1;\n      }\n    </style>\n  </head>\n  <body>\n    <div class=\"container\">\n      <h1>Authorization Successful</h1>\n      <p>You can close this window and return to OpenCode.</p>\n    </div>\n    <script>\n      setTimeout(() => window.close(), 2000)\n    </script>\n  </body>\n</html>";
-export declare const HTML_ERROR: (error: string) => string;
-export interface PendingOAuth {
-    pkce: PkceCodes;
-    state: string;
-    resolve: (tokens: TokenResponse) => void;
-    reject: (error: Error) => void;
-}
-export declare function flowCleanup(state: string): void;
-export declare function startOAuthServer(): Promise<{
-    port: number;
-    redirectUri: string;
-}>;
-export declare function stopOAuthServer(): void;
-export declare function resetOAuthStateForTest(): void;
-export declare function waitForOAuthCallback(pkce: PkceCodes, state: string, timeoutMs?: number, signal?: AbortSignal): Promise<TokenResponse>;
-export interface DeviceAuthInit {
-    device_auth_id: string;
-    user_code: string;
-    interval: string;
-    expires_in?: number | string;
-}
-export declare function beginDeviceAuth(): Promise<{
-    deviceData: DeviceAuthInit;
-    url: string;
-    instructions: string;
-}>;
-export declare function completeDeviceAuth(deviceData: DeviceAuthInit, signal?: AbortSignal): Promise<TokenResponse>;
-/**
- * Minimal shape of a fallback OAuth account for ingestion. Matches the
- * fields used by upsertAccount and beginAccountLogin, compatible with
- * the full OAuthAccount type in accounts.ts.
- */
-export interface IngestAccount {
-    id: string;
-    label?: string;
-    type: 'oauth';
-    access?: string;
-    refresh: string;
-    expires?: number;
-    enabled: boolean;
-    addedAt: number;
-    lastUsed: number;
-    /**
-     * When the token was obtained. Stamped at login so a freshly added account
-     * carries a refresh marker — without it, the runtime-state merge cannot tell a
-     * rotated token from a stale one (both default to 0) and a concurrent stale
-     * save could roll the token back.
-     */
-    lastRefreshedAt?: number;
-    /** Stable ChatGPT account identifier from the OAuth token claims. */
-    accountId?: string;
-}
-export interface AccountStorageLike {
-    version: 1;
-    mainAccountId?: string;
-    accounts: IngestAccount[];
-}
-/**
- * Dedup by stable accountId first (strongest signal — same ChatGPT account
- * added twice with different labels must merge), then by id, then by label.
- * If found, merge-update preserving addedAt. Otherwise push.
- * Re-running `add --label work` is idempotent.
- *
- * Accepts the accounts array directly (not the whole storage object) to
- * avoid coupling to any particular storage shape.
- */
-export declare function upsertAccount<T extends {
-    id: string;
-    label?: string;
-    accountId?: string;
-    addedAt?: number;
-}>(accounts: T[], account: T): number;
-export interface BeginAccountLoginOptions {
-    label?: string;
-    headless?: boolean;
-    signal?: AbortSignal;
-}
-export interface BeginAccountLoginResult {
-    url: string;
-    instructions: string;
-    /** Resolves after the user completes the OAuth flow with a ready-to-ingest account. */
-    completion: Promise<IngestAccount>;
-}
-/**
- * Split-return OAuth flow entry point.
- *
- * Browser flow (default):
- *   1. Start OAuth server, generate PKCE, build authorize URL
- *   2. Return { url, instructions, completion } — url is ready immediately
- *   3. completion resolves after browser callback + token exchange
- *
- * Headless flow:
- *   1. Begin device auth
- *   2. Return { url, instructions, completion }
- *   3. completion polls device endpoint + exchanges for tokens
- *
- * The split return allows the TUI command to show the URL before the
- * (potentially 30-60s) wait, avoiding a deadlock.
- */
-export declare function beginAccountLogin(opts?: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;