@juspay/neurolink
Version:
The pipe layer of an AI nervous system: one interface connecting provider neurons to your application, across three inference types — generate, stream and decide. `decide` returns typed, calibrated judgements from a non-generative model (~400ms, ~$0.00002
69 lines (68 loc) • 3.76 kB
TypeScript
/**
* Codex (OpenAI ChatGPT) OAuth + identity helpers.
*
* Mirrors the role of `anthropicOAuth.ts` for the Codex pool engine. Codex signs
* in with a ChatGPT account (PKCE OAuth against auth.openai.com) and talks to the
* ChatGPT backend Responses API. The proxy pools multiple ChatGPT accounts, so it
* needs to: import an existing `~/.codex/auth.json`, refresh access tokens, and
* derive the per-account `chatgpt-account-id` the backend requires.
*
* Constants verified against Codex CLI 0.144.4.
*/
import type { CodexImportedCredential } from "../types/index.js";
export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
export declare const CODEX_AUTH_URL = "https://auth.openai.com/oauth/authorize";
export declare const CODEX_TOKEN_URL = "https://auth.openai.com/oauth/token";
export declare const CODEX_REVOKE_URL = "https://auth.openai.com/oauth/revoke";
export declare const CODEX_REDIRECT_URI = "http://localhost:1455/auth/callback";
export declare const CODEX_DEFAULT_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
export declare const CODEX_BACKEND_BASE_URL = "https://chatgpt.com/backend-api/codex";
export declare const CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
export declare const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
export declare const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
export declare const CODEX_VERSION = "0.144.4";
export declare const CODEX_USER_AGENT = "codex_cli_rs/0.144.4 (external; neurolink-proxy)";
export declare const CODEX_ORIGINATOR = "codex_cli_rs";
/** Decode the ChatGPT account id, plan type, and expiry from an access token. */
export declare function decodeCodexAccessToken(accessToken: string): {
accountId?: string;
planType?: string;
expiresAt?: number;
};
/** Decode the account email from an id token (best-effort, for the label). */
export declare function decodeCodexEmail(idToken?: string): string | undefined;
/**
* The chatgpt-account-id the backend requires for a given access token.
* Prefer the value stored on the account; fall back to decoding the JWT so a
* rotated token always carries a coherent account id.
*/
export declare function resolveCodexAccountId(accessToken: string, storedAccountId?: string): string | undefined;
/**
* Import an existing Codex credential from `~/.codex/auth.json` (or a custom
* path). This is the verified, robust login path: the user logs into Codex
* normally, then imports the current account into the proxy pool.
*/
export declare function importCodexAuthFile(authFilePath?: string): Promise<CodexImportedCredential>;
/**
* Refresh a Codex access token. Verified: POST form-urlencoded to
* auth.openai.com/oauth/token with grant_type=refresh_token and the Codex
* client id. Returns a fresh credential (access + rotated refresh token).
*/
export declare function refreshCodexToken(refreshToken: string, options?: {
timeoutMs?: number;
}): Promise<CodexImportedCredential>;
/**
* Whether a {@link refreshCodexToken} failure means the refresh token itself is
* no longer usable, as opposed to the request never getting a verdict.
*
* Only the authorization server rejecting the grant is permanent. A 5xx, a
* timeout, or a DNS failure says nothing about the credential, and treating
* those as permanent disables a working account — which `auth cleanup` then
* deletes.
*/
export declare function isPermanentCodexRefreshFailure(error: unknown): boolean;
/**
* Whether an imported credential's access token is expired (or within the
* buffer window) and should be refreshed before use.
*/
export declare function codexTokenNeedsRefresh(expiresAt: number | undefined, bufferMs?: number): boolean;