/**
 * Auth credential inspector — reads from auth-service (single source of truth).
 *
 * Falls back to local accounts.json only if needed for token redaction tests.
 * Auth-service is always authoritative; reading local files risks showing
 * phantom credentials that no longer exist in the live vault.
 *
 * Token security (T4): accessToken and refreshToken fields are NEVER read
 * into variables used in output. Only safe fields are touched.
 */
import { type CredentialState } from '@olam/auth-logic';
import { EXIT_AUTH_NEEDS_ATTENTION } from '../exit-codes.js';
import type { AuthAccountSummary } from '@olam/core/src/auth/types.js';
interface AccountUsage {
    readonly requestCount5h: number;
    readonly last429At: string | null;
}
interface SafeAccount {
    readonly id: string;
    readonly accountLabel?: string;
    readonly expiresAt?: number;
    readonly rateLimited?: boolean;
    readonly rateLimitResetsAt?: string;
    readonly weeklyResetsAt?: string;
    readonly lastUsed?: string;
    readonly state?: CredentialState;
    readonly usage?: AccountUsage;
}
export declare function readAccountsFile(filePath: string): SafeAccount[];
export interface FormatResult {
    output: string;
    /**
     * 0 = healthy (a credential is picked).
     * EXIT_AUTH_NEEDS_ATTENTION (= 5) = no credential picked (all cooled-down,
     * disabled, or expired). Distinct from EXIT_PLERI_NOT_CONFIGURED (= 2)
     * — see `packages/cli/src/exit-codes.ts` for the CLI-wide registry.
     */
    exitCode: 0 | typeof EXIT_AUTH_NEEDS_ATTENTION;
}
export declare function formatAuthStatus(accounts: SafeAccount[], now?: number): FormatResult;
/**
 * Run `olam auth status`.
 *
 * @param getStatus - Injectable status fetcher for tests; defaults to AuthClient.status().
 */
export declare function runAuthStatus(getStatus?: () => Promise<{
    reachable: boolean;
    accounts: readonly AuthAccountSummary[];
}>): Promise<void>;
export {};
//# sourceMappingURL=auth-status.d.ts.map