import type { StoredConnectTokenIdentity } from "./connect-store.js";
/**
 * `unavailable` means the check could not run (database or identity-authority
 * error, or organization tables that don't exist yet). It is neither answer:
 * callers must refuse the request with a retryable error, and must not revoke
 * anything on it.
 */
export type CredentialOrgMembership = "member" | "not-member" | "unavailable";
export declare function checkCredentialOrgMembership(input: {
    orgId: string;
    email: string | undefined;
    storedConnectToken?: StoredConnectTokenIdentity;
    /** This app's public origin; federated orgs need it to reach the identity authority. */
    requestOrigin?: string;
}): Promise<CredentialOrgMembership>;
/**
 * `retired`: an email change moved this account off the credential's subject
 * address after the credential was signed. `unavailable` means the same as for
 * membership: refuse with a retryable error.
 */
export type CredentialEmailRetirement = "current" | "retired" | "unavailable";
export declare function checkCredentialEmailRetirement(input: {
    email: string;
    /** The credential's `iat`, in seconds; absent counts as signed before. */
    issuedAt: number | undefined;
}): Promise<CredentialEmailRetirement>;