export type CodexAuthMode = "api-key" | "chatgpt";
export type CodexAuthState = {
    readonly kind: "authenticated";
    readonly accountId?: string;
    readonly authMode: CodexAuthMode;
    readonly authPath: string;
    readonly codexHome: string;
    readonly lastRefresh?: string;
} | {
    readonly kind: "missing";
    readonly authPath: string;
    readonly codexHome: string;
} | {
    readonly kind: "invalid";
    readonly authPath: string;
    readonly codexHome: string;
    readonly reason: string;
};
export interface ReadCodexAuthStateOptions {
    readonly codexHome?: string;
}
export interface CodexApiKeyCredentials {
    readonly apiKey: string;
    readonly authPath: string;
    readonly codexHome: string;
    readonly kind: "api-key";
}
export interface CodexChatGptCredentials {
    readonly accessToken?: string;
    readonly accountId?: string;
    readonly authPath: string;
    readonly codexHome: string;
    readonly idToken?: string;
    readonly kind: "chatgpt";
    readonly lastRefresh?: string;
    readonly refreshToken?: string;
}
export type CodexAuthCredentials = CodexApiKeyCredentials | CodexChatGptCredentials;
/**
 * One read of the Codex login state: the reportable state view plus, when
 * authenticated, the credentials the transport uses. Both views derive from
 * the same parse and the same credential selection, so they cannot disagree.
 */
export interface CodexAuthSnapshot {
    readonly state: CodexAuthState;
    /** Set exactly when `state.kind` is `"authenticated"`. */
    readonly credentials?: CodexAuthCredentials;
}
export interface CodexRefreshedTokens {
    readonly accessToken: string;
    readonly accountId?: string;
    readonly idToken?: string;
    readonly refreshToken: string;
}
export declare function readCodexAuth(options?: ReadCodexAuthStateOptions): Promise<CodexAuthSnapshot>;
export declare function readCodexAuthCredentials(options?: ReadCodexAuthStateOptions): Promise<CodexAuthCredentials>;
export declare function parseCodexAuth(raw: string, input: {
    readonly authPath: string;
    readonly codexHome: string;
}): CodexAuthSnapshot;
export declare function writeCodexAuthCredentials(input: {
    readonly credentials: CodexChatGptCredentials;
    readonly now?: () => Date;
    readonly tokens: CodexRefreshedTokens;
}): Promise<CodexChatGptCredentials>;
export declare function assertCodexAuthStateAuthenticated(state: CodexAuthState): void;
export declare function readCodexJwtExpirationMs(token: string | undefined): number | undefined;
export declare function isFreshCodexAccessToken(accessToken: string | undefined, now: number): boolean;
export declare function extractCodexAccountIdFromToken(token: string | undefined): string | undefined;