export interface StoredSession {
    sessionCode: string;
    agentToken: string;
}
/** OS-protected storage for the reusable agent token (desktop safeStorage). */
export interface TokenVault {
    isAvailable(): boolean;
    encrypt(plaintext: string): Buffer;
    decrypt(ciphertext: Buffer): string;
}
export type SessionStoreContext = string | {
    configDir?: string;
    tokenVault?: TokenVault;
};
/**
 * Load the persisted session — the write target first, then (under the env
 * override) the locations an earlier install used. Null if none has one.
 */
export declare function loadSession(ctx?: SessionStoreContext): StoredSession | null;
/** Persist the session to the write target, falling back to the user dir. */
export declare function saveSession(session: StoredSession, ctx?: SessionStoreContext): void;
/**
 * Remove the persisted session from every location we read from (best-effort) —
 * a copy left in an inherited directory would be read back on the next start.
 */
export declare function clearSession(ctx?: SessionStoreContext): void;
/** Write the one-shot rotate marker (forces a new code on next startup). */
export declare function writeRotateMarker(ctx?: SessionStoreContext): void;
/**
 * If the rotate marker exists in ANY location we read, delete it and return true.
 * Used at startup to decide whether to force a brand-new code (change-code path)
 * vs re-assert the existing one (reboot/restart path). Scanning the inherited
 * locations too is what makes a `change-code` invoked without the env override
 * still rotate the live code instead of silently marking a directory nobody reads.
 */
export declare function consumeRotateMarker(ctx?: SessionStoreContext): boolean;