/**
 * Auth store — persists CLI authentication tokens for gateway mode.
 *
 * Tokens are stored in ~/.supen/auth.json with restrictive permissions.
 */
export interface AuthData {
    access_token: string;
    refresh_token: string;
    expires_at: number;
    user?: {
        email: string;
        id: string;
    };
    gateway_url: string;
}
/**
 * Load stored auth data. Returns null if not logged in.
 */
export declare function loadAuth(): AuthData | null;
/**
 * Save auth data to disk with restrictive permissions.
 */
export declare function saveAuth(data: AuthData): void;
/**
 * Clear stored auth data (logout).
 */
export declare function clearAuth(): void;
/**
 * Check if a token is expired or will expire within 5 minutes.
 */
export declare function isTokenExpired(data: AuthData): boolean;
/**
 * Get a valid access token, or null if not logged in / expired.
 * Does NOT attempt auto-refresh — callers that need refresh should use
 * the GatewayTransport which handles it.
 */
export declare function getToken(): string | null;