/**
 * Post-login execute credential contract.
 *
 * `apiclaw auth login` writes session_token to ~/.apiclaw.toml.
 * POST /v1/execute reads that same value and sends it as X-APIClaw-Session.
 * Do not send api_key as the session header. Do not ask the user to paste
 * a token into chat. Do not POST /v1/execute with an empty session header.
 */
import type { PendingLogin } from "./cli-auth-redeem.js";
export declare const EXECUTE_SESSION_TOML_KEY = "session_token";
export declare const EXECUTE_SESSION_HEADER = "X-APIClaw-Session";
export declare class UnsignedExecuteError extends Error {
    readonly code = "not_signed_in";
    readonly pendingLoginUrl: string | null;
    constructor(pendingLoginUrl?: string | null);
}
export type ExecuteSession = {
    ok: true;
    token: string;
    headers: Record<string, string>;
} | {
    ok: false;
    reason: "not_signed_in";
    pendingLoginUrl: string | null;
};
export declare function usableSessionToken(token: string | null | undefined): string | null;
export declare function executeSessionHeaders(sessionToken: string): Record<string, string>;
export declare function readExecuteSessionToken(): string | null;
export declare function readExecuteSessionHeaders(): Record<string, string> | null;
export declare function requireExecuteSession(): ExecuteSession;
/**
 * Resolve headers for a managed execute. Missing or empty
 * X-APIClaw-Session is a local refusal — never a gateway POST.
 */
export declare function resolveExecuteAuthHeaders(provided?: Record<string, string>): Record<string, string>;
export declare function writePendingLogin(pending: PendingLogin): void;
export declare function writePendingLoginUrl(browserUrl: string): void;
export declare function readPendingLogin(): PendingLogin | null;
export declare function readPendingLoginUrl(): string | null;
export declare function clearPendingLoginUrl(): void;
//# sourceMappingURL=execute-auth.d.ts.map