/**
 * Codex (OpenAI ChatGPT) OAuth + identity helpers.
 *
 * Mirrors the role of `anthropicOAuth.ts` for the Codex pool engine. Codex signs
 * in with a ChatGPT account (PKCE OAuth against auth.openai.com) and talks to the
 * ChatGPT backend Responses API. The proxy pools multiple ChatGPT accounts, so it
 * needs to: import an existing `~/.codex/auth.json`, refresh access tokens, and
 * derive the per-account `chatgpt-account-id` the backend requires.
 *
 * Constants verified against Codex CLI 0.144.4.
 */
import type { CodexImportedCredential } from "../types/index.js";
export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
export declare const CODEX_AUTH_URL = "https://auth.openai.com/oauth/authorize";
export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
export declare const CODEX_REVOKE_URL = "https://auth.openai.com/oauth/revoke";
export declare const CODEX_REDIRECT_URI = "http://localhost:1455/auth/callback";
export declare const CODEX_DEFAULT_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
export declare const CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
export declare const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
export declare const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
export declare const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
export declare const CODEX_VERSION = "0.144.4";
export declare const CODEX_USER_AGENT = "codex_cli_rs/0.144.4 (external; neurolink-proxy)";
export declare const CODEX_ORIGINATOR = "codex_cli_rs";
/** Decode the ChatGPT account id, plan type, and expiry from an access token. */
export declare function decodeCodexAccessToken(accessToken: string): {
    accountId?: string;
    planType?: string;
    expiresAt?: number;
};
/** Decode the account email from an id token (best-effort, for the label). */
export declare function decodeCodexEmail(idToken?: string): string | undefined;
/**
 * The chatgpt-account-id the backend requires for a given access token.
 * Prefer the value stored on the account; fall back to decoding the JWT so a
 * rotated token always carries a coherent account id.
 */
export declare function resolveCodexAccountId(accessToken: string, storedAccountId?: string): string | undefined;
/**
 * Import an existing Codex credential from `~/.codex/auth.json` (or a custom
 * path). This is the verified, robust login path: the user logs into Codex
 * normally, then imports the current account into the proxy pool.
 */
export declare function importCodexAuthFile(authFilePath?: string): Promise<CodexImportedCredential>;
/**
 * Refresh a Codex access token. Verified: POST form-urlencoded to
 * auth.openai.com/oauth/token with grant_type=refresh_token and the Codex
 * client id. Returns a fresh credential (access + rotated refresh token).
 */
export declare function refreshCodexToken(refreshToken: string, options?: {
    timeoutMs?: number;
}): Promise<CodexImportedCredential>;
/**
 * Whether a {@link refreshCodexToken} failure means the refresh token itself is
 * no longer usable, as opposed to the request never getting a verdict.
 *
 * Only the authorization server rejecting the grant is permanent. A 5xx, a
 * timeout, or a DNS failure says nothing about the credential, and treating
 * those as permanent disables a working account — which `auth cleanup` then
 * deletes.
 */
export declare function isPermanentCodexRefreshFailure(error: unknown): boolean;
/**
 * Whether an imported credential's access token is expired (or within the
 * buffer window) and should be refreshed before use.
 */
export declare function codexTokenNeedsRefresh(expiresAt: number | undefined, bufferMs?: number): boolean;