import type { OAuthProvider } from "@arnilo/prism";
export interface OpenAICodexOAuthOptions {
    readonly clientId?: string;
    readonly fetch?: typeof fetch;
    readonly authorizeUrl?: string;
    readonly tokenUrl?: string;
    readonly deviceCodeUrl?: string;
    readonly redirectUri?: string;
    readonly scope?: string;
    /** Test seam: override wall clock for device-code expiry. */
    readonly now?: () => number;
    /** Test seam: override poll delay between device-code token requests. */
    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
}
export declare const openAICodexOAuthProvider: OAuthProvider;
/**
 * RFC 7636 PKCE code verifier: 43-128 chars from the unreserved set.
 * base64url(32 random bytes) yields exactly 43 chars, all unreserved.
 */
export declare function createPkceVerifier(bytes?: number): string;
/** S256 code challenge: base64url(SHA-256(verifier)). */
export declare function computeS256Challenge(verifier: string): string;
export declare function createOpenAICodexOAuthProvider(options?: OpenAICodexOAuthOptions): OAuthProvider;