/**
 * Read with `||`, never `??`: the Action sets it to "" when no token was
 * given, since Actions cannot omit an `env` key conditionally.
 */
export declare const TOKEN_ENV = "PR_LENS_TOKEN";
export declare const authPath: (env: Record<string, string | undefined>, api: string) => string | undefined;
export type Credential = {
    token: string;
    signedInAt: string | undefined;
};
/**
 * An unreadable file is kept apart from a missing one and never deleted here:
 * it may hold a working token. Only `auth logout` removes it.
 */
export type CredentialRead = {
    type: "credential";
    path: string;
    credential: Credential;
} | {
    type: "none";
} | {
    type: "unreadable";
    path: string;
    why: string;
};
export declare const readCredential: (env: Record<string, string | undefined>, api: string) => Promise<CredentialRead>;
/** Every failure answers undefined, so a push never starts failing over an account. */
export declare const readToken: (env: Record<string, string | undefined>, api: string) => Promise<string | undefined>;
/**
 * For account commands, which must tell an unreadable file apart from being
 * signed out rather than advise signing in again.
 */
export declare const requireToken: (env: Record<string, string | undefined>, api: string) => Promise<string>;
export declare const writeCredential: (env: Record<string, string | undefined>, api: string, token: string, now: string) => Promise<string>;
/**
 * The only place that removes the file, readable or not. No read first: a
 * sign-in from another shell in between would be thrown away unseen.
 */
export declare const forgetCredential: (env: Record<string, string | undefined>, api: string) => Promise<boolean>;
//# sourceMappingURL=auth.d.ts.map