export type StartedSignIn = {
    deviceCode: string;
    userCode: string;
    /** Carries the code, so nobody types it. */
    approveUrl: string;
    expiresInSeconds: number;
    intervalSeconds: number;
};
/** RFC 8628 §3.2: the floor, and the default when none is served. */
export declare const DEFAULT_INTERVAL_SECONDS = 5;
/** The install id goes with the request: the approving browser may be on a phone and cannot know which machine asked. */
export declare const startSignIn: (api: string, installId: string, client: string, name: string) => Promise<StartedSignIn>;
export type PollOutcome = {
    type: "token";
    token: string;
    claimed: number | undefined;
} | {
    type: "pending";
} | {
    type: "slow_down";
    intervalSeconds: number | undefined;
} | {
    type: "denied";
} | {
    type: "expired";
};
export declare const pollSignIn: (api: string, deviceCode: string) => Promise<PollOutcome>;
/**
 * Must match the app's hash. Duplicated on purpose: asking the app for ours
 * would put the install id in a URL.
 */
export declare const installHash: (installId: string) => string;
/** `unknown`: this machine has no install id to look up. */
export type MachineState = "linked" | "revoked" | "unlinked" | "unknown";
export type SignInCheck = {
    type: "live";
    machine: MachineState;
} | {
    type: "rejected";
}
/** The app could not be asked; says nothing about the credential. */
 | {
    type: "unknown";
    why: string;
};
/**
 * `/api/machines` also answers whether this machine is linked. A store without
 * accounts reads as `unknown`, never as a revoked credential.
 */
export declare const checkSignIn: (api: string, token: string, ourInstallId: string | undefined) => Promise<SignInCheck>;
/** Undefined on any failure: the sign-in already succeeded and the email is only for the greeting. */
export declare const whoAmI: (api: string, token: string) => Promise<string | undefined>;
/**
 * Unlike `whoAmI`, keeps a dead token (`ended`) apart from an unreachable store
 * (`unknown`), which the sign-in flow will report itself.
 */
export type Session = {
    type: "active";
    email: string;
} | {
    type: "ended";
} | {
    type: "unknown";
};
export declare const checkSession: (api: string, token: string) => Promise<Session>;
export type SignOut = "ended" | "already" | {
    type: "unreachable";
    why: string;
};
/**
 * Ends the session and leaves the machine linked (`DELETE /api/machines/{id}`
 * would unlink it). Unreachable is not thrown: the caller forgets the token
 * locally either way.
 */
export declare const endSession: (api: string, token: string) => Promise<SignOut>;
//# sourceMappingURL=account.d.ts.map