export declare const defaultCodexAuthPath: () => string;
export interface CodexTokens {
    access_token: string;
    account_id?: string;
    id_token?: string;
    refresh_token?: string;
}
export interface CodexAuthFile {
    auth_mode?: string;
    last_refresh?: string;
    OPENAI_API_KEY?: string | null;
    tokens?: CodexTokens;
}
/** The only credential shape used by the rest of the package. */
export interface AuthCredentials {
    accessToken: string;
    accountId?: string;
    organization?: string;
    mode?: string;
    expiresAtMs?: number;
    lastRefresh?: string;
}
export interface CodexAuth extends AuthCredentials {
    mode: string;
    raw: CodexAuthFile;
    sourcePath: string;
}
export type AuthProvider = () => AuthCredentials | Promise<AuthCredentials>;
export type AuthInput = AuthCredentials | AuthProvider;
export interface CodexAuthProviderOptions {
    path?: string;
    /** Reject an already-expired JWT. Defaults to true. */
    rejectExpired?: boolean;
}
export declare function loadCodexAuth(path?: string, options?: Pick<CodexAuthProviderOptions, "rejectExpired">): Promise<CodexAuth>;
/** Re-reads the file for every request so Codex token rotation is picked up. */
export declare function createCodexAuthProvider(options?: CodexAuthProviderOptions): AuthProvider;
export declare function createApiKeyAuth(apiKey: string, options?: {
    organization?: string;
}): AuthCredentials;
export declare function resolveAuth(input?: AuthInput): Promise<AuthCredentials>;
export declare function authHeaders(auth: AuthCredentials): Record<string, string>;
export declare function describeAuth(auth: AuthCredentials & {
    sourcePath?: string;
}): string;
//# sourceMappingURL=auth.d.ts.map