/**
 * A locally-persisted CLI session obtained via `pikku login` (the better-auth
 * device-authorization flow). Stored at `~/.pikku/session.json`, keyed by the
 * server's base URL so a single user can be logged into multiple pikku servers.
 *
 * `accessToken` is a better-auth session token — present it as
 * `Authorization: Bearer <accessToken>` (requires the `bearer` plugin on the
 * server). This is the HUMAN path; machine agents use scoped API keys
 * (`x-api-key`) instead and never read this file.
 */
export interface PikkuCliSession {
    baseURL: string;
    accessToken: string;
    tokenType: string;
    /** ISO timestamp; absent when the server did not report an expiry. */
    expiresAt?: string;
    user?: {
        id: string;
        email?: string | null;
        name?: string | null;
    };
    obtainedAt: string;
}
export declare const sessionFilePath: () => string;
/** Drop a trailing slash so `https://x/` and `https://x` share one entry. */
export declare const normalizeBaseURL: (url: string) => string;
/** Persist a session and mark it the current default target. */
export declare const saveSession: (session: PikkuCliSession) => Promise<string>;
/**
 * Load a stored session. With no `baseURL`, returns the current default. Returns
 * `null` if none is stored.
 */
export declare const loadSession: (baseURL?: string) => Promise<PikkuCliSession | null>;
/**
 * Remove a stored session (the given one, or the current default). Returns the
 * base URL that was removed, or `null` if nothing matched.
 */
export declare const clearSession: (baseURL?: string) => Promise<string | null>;
/** True when the session has a known expiry that is in the past. */
export declare const isSessionExpired: (session: PikkuCliSession, nowMs?: number) => boolean;