/**
 * Key validation for `taleseal login --key`: one POST to /v1/tales with an empty JSON
 * body. 401 means the key is bad (refuse to store it). 400 or 422 means the key
 * authenticated and only the body was rejected — exactly what an empty body should earn
 * (the live server answers 422 for a JSON body that fails tale validation, 400/413 for
 * bodies it refuses earlier). Anything else is inconclusive (the server may be
 * unreachable or misbehaving); the caller stores the key anyway, with a warning.
 */
export type KeyValidation = {
    verdict: "valid";
} | {
    verdict: "invalid";
} | {
    verdict: "unknown";
    detail: string;
};
export declare function validateKey(baseUrl: string, apiKey: string, fetchFn?: typeof fetch): Promise<KeyValidation>;
/**
 * The browser handshake behind plain `taleseal login` (no --key): start a device login,
 * send the human to the approve page, poll until the key arrives. Device-flow shaped —
 * chosen over a localhost callback because agent runs live on SSH boxes and in containers,
 * where "approve on your laptop, key lands on the server" is the whole point.
 */
export interface DeviceStart {
    /** the poll secret — never displayed, never logged */
    device: string;
    /** the short human-match code, shown in the terminal AND on the approve page */
    code: string;
    /** the approve page URL to open */
    url: string;
    /** poll cadence in seconds */
    interval: number;
    /** handshake lifetime in seconds */
    expiresIn: number;
}
export declare function startDeviceLogin(baseUrl: string, name: string, fetchFn?: typeof fetch): Promise<DeviceStart>;
export type DevicePollResult = {
    status: "approved";
    key: string;
    email?: string;
} | {
    status: "expired";
};
/**
 * Polls until the handshake resolves. Network blips and 429s are ridden out (the server
 * deadline is the real clock); only an explicit "expired" or the local deadline ends it.
 */
export declare function pollDeviceLogin(baseUrl: string, start: DeviceStart, fetchFn?: typeof fetch, sleep?: (ms: number) => Promise<void>, now?: () => number): Promise<DevicePollResult>;
/** Best-effort browser launch; failure is fine — the URL is printed either way. */
export declare function openBrowser(url: string): void;