/**
 * A cached **control-plane session** — the human principal's bearer, minted by
 * the loopback-PKCE flow (`run402 operator login --loopback`). Distinct from the
 * device-flow {@link OperatorSession} (read-only): this one carries `provenance`
 * (`loopback_pkce`) and `amr`. It authorizes most control-plane operations, but
 * since gateway v1.85/v1.87 it is NOT sufficient on its own for the high-stakes
 * writes `provision` / `deploy` / secrets — those additionally require a
 * passkey-fresh **operator approval** (`X-Run402-Write-Auth`, minted by
 * `run402 operator approve`; see {@link WriteAuthApproval}). Cached at the BASE
 * config dir (email/principal-scoped, shared across local named wallets), mode
 * 0600 — the token is as sensitive as the allowance key.
 *
 * Stored shape vs the gateway payload: the gateway returns a relative
 * `expires_in` (seconds); we persist the absolute `expires_at` (epoch ms) so a
 * cached session can be expiry-checked without knowing when it was written.
 */
export interface ControlPlaneSessionCache {
    control_plane_session_token: string;
    token_type: string;
    provenance: string;
    principal_id: string;
    amr: string[];
    /** Epoch ms when the session expires (issued_at + expires_in). */
    expires_at: number;
}
/** The token payload returned by `POST /agent/v1/control-plane/cli/token`. */
export interface ControlPlaneSessionTokenResponse {
    control_plane_session_token: string;
    token_type?: string;
    provenance?: string;
    principal_id?: string;
    amr?: string[];
    expires_in?: number;
}
/**
 * Path to the cached control-plane session: `{base}/control-plane-session.json`.
 * `RUN402_CONTROL_PLANE_SESSION_PATH` overrides for testing.
 */
export declare function getControlPlaneSessionPath(): string;
/**
 * Load the cached control-plane session. Returns `null` for the "no session"
 * cases (absent, unreadable, unparseable). Throws when the file parses as JSON
 * but the shape is wrong, so a corrupted cache surfaces a clear fix-it.
 */
export declare function readControlPlaneSession(path?: string): ControlPlaneSessionCache | null;
/** Persist a control-plane session atomically (temp-file + rename), mode 0600. */
export declare function saveControlPlaneSession(data: ControlPlaneSessionCache, path?: string): void;
/** Delete the cached control-plane session — local half of `operator logout`. Idempotent. */
export declare function clearControlPlaneSession(path?: string): void;
/** Whether a cached session is past its usable life (with a small skew buffer). */
export declare function isControlPlaneSessionExpired(session: ControlPlaneSessionCache, nowMs?: number, skewMs?: number): boolean;
/** Read the cached session and return it only if still usable; `null` if absent or expired. */
export declare function loadLiveControlPlaneSession(path?: string, nowMs?: number): ControlPlaneSessionCache | null;
/** Map a gateway token payload (relative `expires_in`) into the cached shape (absolute `expires_at`). */
export declare function controlPlaneSessionFromTokenResponse(resp: ControlPlaneSessionTokenResponse, nowMs?: number): ControlPlaneSessionCache;
//# sourceMappingURL=control-plane-session.d.ts.map