import { type AuthStorage, type CachedCredentialHealth, type CachedUsageReport, type CredentialInventoryRecord } from "@gajae-code/ai/core";
import type { Settings } from "../config/settings";
/** A redacted usage observation attached to an account row. */
export interface AccountUsageCache extends CachedUsageReport {
}
/** Safe account health state used by presentation surfaces. */
export interface AccountHealthCache extends CachedCredentialHealth {
}
export type AccountInventorySource = "stored" | "env" | "config" | "runtime";
/** Fixed presentation classification for a persisted disabled credential. */
export type AccountInventoryDisabledCause = "auth_failure" | "user_removed" | "duplicate" | "replaced" | "unknown";
export interface AccountInventoryCapabilities {
    canCheck: boolean;
    canPin: boolean;
    canRemove: boolean;
    hasCachedUsage: boolean;
}
export interface AccountInventoryRouting {
    /** True when this row is the session's last recorded stored credential. */
    active: boolean;
    /** True when this source is the effective source for the provider/session. */
    selected: boolean;
    marker: "active" | "selected" | "available";
}
/**
 * Payload-free account row for renderers. This type deliberately has no
 * AuthCredential, API-key bytes, access token, refresh token, or raw usage.
 */
export interface AccountInventoryRow {
    /** Stable, non-secret presentation id. */
    id: string;
    /** Numeric storage id when this is a persisted row. */
    credentialId?: number;
    provider: string;
    credentialKind: "oauth" | "api_key";
    source: AccountInventorySource;
    sourceLabel: string;
    identityLabel: string | null;
    /** OAuth identity is intentionally limited to safe labels from inventory. */
    oauthIdentity?: {
        label: string;
    };
    disabled: boolean;
    disabledCause: AccountInventoryDisabledCause | null;
    health: AccountHealthCache;
    usage?: AccountUsageCache;
    capabilities: AccountInventoryCapabilities;
    routing: AccountInventoryRouting;
}
export interface AccountInventorySnapshot {
    generatedAt: number;
    generation: number;
    rows: AccountInventoryRow[];
}
export interface AccountInventoryInput {
    authStorage: AuthStorage;
    modelRegistry?: {
        getAvailable?: () => Array<{
            provider: string;
        }>;
        getProviderBaseUrl?: (provider: string) => string | undefined;
    };
    sessionId?: string;
    provider?: string;
    nowMs?: number;
}
export interface AccountInventoryCheckResult {
    rowId: string;
    provider: string;
    credentialId?: number;
    ok: boolean | null;
    reason?: string;
}
/** Build a redacted, cache-only account snapshot. This function never probes. */
export declare function buildAccountInventorySnapshot(input: AccountInventoryInput): AccountInventorySnapshot;
/** Short alias used by command/report callers. */
export declare const buildAccountInventory: typeof buildAccountInventorySnapshot;
/**
 * Run the explicit sequential checker and return a fresh redacted snapshot.
 * AuthStorage.checkCredentials performs stored-row probes sequentially; the
 * synthetic API-key probes below are also intentionally sequential.
 */
export declare function checkAccountInventory(input: AccountInventoryInput): Promise<AccountInventorySnapshot>;
export declare const checkAccountInventorySnapshot: typeof checkAccountInventory;
/** Clear a global persistent pin only after its selected credential was removed. */
export declare function clearPersistentPinForRemovedRows(settings: Pick<Settings, "commitAtomicBatchWithCurrent">, provider: string, inventory: readonly CredentialInventoryRecord[], removedIds: readonly number[]): Promise<boolean>;