export interface TokenCredentials {
    accessToken: string;
    refreshToken: string;
    /** Unix epoch ms when accessToken expires */
    expiresAt: number;
    /** Legacy apiKey, kept during Wave 4 grace window */
    apiKey?: string;
    version: 2;
}
export declare function storeCredentials(creds: TokenCredentials): Promise<void>;
export declare function loadCredentials(): Promise<TokenCredentials | null>;
/**
 * Clear the stored JWT session (access token, refresh token, expiry) from
 * all storage locations. Mirrors clearApiKey() in config/index.ts, which
 * only handles the legacy apiKey field — a JWT session needs its own clear
 * path since the two credential schemes live in different fields/keyring
 * accounts (SMI-4402 v2 schema vs. the pre-existing apiKey flow).
 *
 * The config-file read-modify-write is guarded by the same cross-process
 * lock + atomic rename `saveConfig()` uses (config-atomic-write.ts,
 * SMI-5531) — a bare readConfigFile()/writeFileSync() here could lose a
 * concurrent writer's update between the read and the write (PR review
 * finding, SMI-6235).
 *
 * @returns Result indicating which storage locations were cleared and any errors
 */
export declare function clearCredentials(): Promise<{
    success: boolean;
    source: string;
    error?: string;
}>;
export declare function refreshAccessToken(refreshToken: string): Promise<TokenCredentials | null>;
//# sourceMappingURL=token-credentials.d.ts.map