/**
 * Pure JSON serialiser for `olam auth list --json` (local vault path).
 *
 * Kept separate from the command action so the wire contract is
 * unit-testable without an AuthClient round-trip (mirrors `renderPsJson`
 * in ps.ts and `renderWorldList` in list.ts).
 *
 * WHY this exists: credential-vault health is exactly the precondition an
 * agent/script driver must check before dispatching Claude work — the
 * "all credentials cooled down" failure mode is a documented operational
 * concern (see `npm run audit:credentials`). The human table is colorized
 * and reflows per terminal width, so screen-scraping it is brittle. This
 * gives drivers a stable, color-free shape: a top-level `healthy` flag
 * (is any credential pickable right now?), the next cooldown reset, and a
 * per-account row carrying the fields needed to reason about rotation.
 *
 * Token security: this serialiser only ever touches the safe summary
 * fields. accessToken / refreshToken are never present on
 * AuthAccountSummary and are never emitted.
 */
import { nextCooldownReset } from '@olam/auth-logic';
/**
 * Serialise the local auth-service account summaries to the stable
 * `--json` wire shape. `now` is injectable for deterministic tests.
 */
export function renderAuthListJson(accounts, now = Date.now()) {
    const rows = accounts.map((a) => ({
        id: a.id,
        label: a.accountLabel ?? a.id,
        state: a.state ?? 'unknown',
        tokenValid: a.tokenValid,
        expiresIn: a.expiresIn,
        rateLimited: a.rateLimited,
        rateLimitResetsAt: a.rateLimitResetsAt ?? null,
        weeklyResetsAt: a.weeklyResetsAt ?? null,
        requestCount5h: a.usage?.requestCount5h ?? 0,
        last429At: a.usage?.last429At ?? null,
    }));
    const payload = {
        count: rows.length,
        healthy: rows.some((r) => r.state === 'active'),
        nextResetAt: nextCooldownReset(accounts, now),
        accounts: rows,
    };
    return JSON.stringify(payload);
}
//# sourceMappingURL=auth-list-json.js.map