/**
 * **Sign-in session** credential provider (gateway v1.78). Carries a
 * `control_plane_session` bearer so the whole SDK authenticates as the person's
 * principal — the token is accepted everywhere a SIWX wallet is, so `r.org.*`,
 * `r.admin.transfers.*`, and `r.session.*` all act as that principal. A
 * `device`-grade session is read-only (`SESSION_READ_ONLY` on every mutation).
 *
 * Isomorphic — no Node APIs. Mint a session with `r.session.verifyEmail`
 * / `passkeyVerify` / the loopback-PKCE `exchangeCliToken`, then:
 *
 *   const r = run402({ credentials: controlPlaneSessionCredentials({ token }) });
 *   await r.orgs.whoami();           // resolves the principal + memberships
 *
 * High-stakes writes still require a fresh passkey — an `email`/`oauth` session
 * gets {@link StepUpRequiredError}; run the step-up ceremony
 * (`r.session.stepUpOptions`/`stepUpVerify`) and retry.
 *
 * This credential authenticates control-plane operations only; it carries no
 * project anon/service keys, so {@link CredentialsProvider.getProject} returns
 * null (project-key operations need the keystore/wallet).
 */
import type { CredentialsProvider } from "./credentials.js";
/** Brand marking a provider as control-plane-session-backed. */
export declare const CONTROL_PLANE_SESSION_CREDENTIALS: unique symbol;
export interface ControlPlaneSessionMarkedCredentialsProvider extends CredentialsProvider {
    readonly [CONTROL_PLANE_SESSION_CREDENTIALS]: true;
}
export interface ControlPlaneSessionCredentialsOptions {
    /** A `control_plane_session` bearer token. Provide this OR `getToken`. */
    token?: string;
    /**
     * Lazily resolve the current token (e.g. read a cache, or rotate via
     * `r.session.refresh`). Called before every authenticated request.
     */
    getToken?: () => string | Promise<string>;
}
/** True if `credentials` was created by {@link controlPlaneSessionCredentials}. */
export declare function isControlPlaneSessionCredentials(credentials: CredentialsProvider): credentials is ControlPlaneSessionMarkedCredentialsProvider;
/**
 * Build a {@link CredentialsProvider} that authenticates every request with a
 * `control_plane_session` bearer. Pass a static `token`, or a `getToken`
 * resolver for rotation.
 */
export declare function controlPlaneSessionCredentials(opts: ControlPlaneSessionCredentialsOptions): ControlPlaneSessionMarkedCredentialsProvider;
//# sourceMappingURL=control-plane-credentials.d.ts.map