/**
 * Stored credential shape persisted to ~/.openephemeris/credentials.json.
 */
export interface StoredCredentials {
    access_token: string;
    refresh_token: string;
    /** ISO 8601 timestamp when the access_token expires. */
    expires_at: string;
    /** Supabase user ID. */
    user_id?: string;
    /** User email for display purposes. */
    user_email?: string;
    /** Timestamp when these credentials were created/refreshed. */
    updated_at: string;
}
/**
 * CredentialManager handles reading, writing, refreshing, and clearing
 * persisted OAuth credentials for the MCP server.
 */
export declare class CredentialManager {
    private cachedCredentials;
    private backendBaseURL;
    constructor(backendBaseURL?: string);
    /**
     * Load credentials from disk. Returns null if file doesn't exist or is invalid.
     */
    load(): StoredCredentials | null;
    /**
     * Save credentials to disk.
     */
    save(credentials: StoredCredentials): void;
    /**
     * Check whether the current access_token is expired (or nearly expired).
     */
    isExpired(credentials?: StoredCredentials | null): boolean;
    /**
     * Attempt to refresh the access token using the stored refresh_token.
     * Uses the Supabase GoTrue refresh endpoint directly.
     */
    refresh(): Promise<StoredCredentials | null>;
    /**
     * Fallback refresh via the web app's token refresh endpoint.
     */
    private refreshViaWebApp;
    /**
     * Get a valid access token, refreshing if necessary.
     * Returns null if no credentials exist or refresh fails.
     */
    getValidToken(): Promise<string | null>;
    /**
     * Delete stored credentials.
     */
    clear(): void;
    /**
     * Get display info about the current auth state.
     */
    getStatus(): {
        authenticated: boolean;
        email?: string;
        userId?: string;
        expiresAt?: string;
    };
    /** Path to the credentials file (for diagnostics). */
    static get credentialsPath(): string;
}