/**
 * The identity-provider half of a credential. Present only for sessions
 * established by signing in, which are refreshed rather than minted, and
 * self-contained so a credential written against one tenant is never
 * refreshed against another.
 */
export type RefreshableSession = {
    refreshToken: string;
    /** Epoch milliseconds at which `accessToken` stops being accepted. */
    expiresAt: number;
    domain: string;
    clientId: string;
};
export type StoredCredentials = {
    accessToken: string;
    workspaceUuid?: string;
    baseUrl?: string;
    /** Absent for API tokens, which never expire and cannot be refreshed. */
    session?: RefreshableSession;
};
/**
 * The path a read resolves to: the primary location when writable, otherwise
 * the fallback if it exists. A stale credential at an unwritable primary path
 * (left over from a previous environment) must not shadow a fresh credential
 * the current session just saved to the fallback.
 */
export declare function getCredentialsPath(): string;
export declare function getConfigDir(): string;
export declare function loadCredentials(): StoredCredentials | undefined;
/**
 * Whether there is any credential to act with: the env token, or a session on
 * disk. Deliberately not `getConfig()`, which resolves the whole auth config
 * and exits the process on a workspace conflict — callers here are deciding
 * whether to *offer* something, and must never terminate.
 *
 * Lives beside `loadCredentials` for the reason at the top of this file: both
 * bins ask this question, and it had already drifted into two copies that
 * answered an unreadable credentials file differently.
 */
export declare function isSignedIn(): boolean;
export declare function saveCredentials(credentials: StoredCredentials): void;
/**
 * Thrown when a credential outlives `clearCredentials`: the file could not be
 * deleted and a read still resolves to it. Signing out has to fail loudly here
 * rather than report success, because the surviving file goes on authenticating
 * as the identity the caller asked to forget.
 */
export declare class CredentialsNotClearedError extends Error {
    /** The credential files left on disk. */
    readonly paths: string[];
    constructor(paths: string[]);
}
export declare function clearCredentials(): boolean;
//# sourceMappingURL=credentials.d.ts.map