import type { TalosCredentialStore } from "./runtime-credential.js";
/**
 * Render the "User identity" block. The interactive PKCE login runs every
 * session; this shows the cached token's subject and expiry, if any.
 */
export declare function printUserIdentitySection(): void;
/**
 * Render the actor-bound runtime credential used by this harness. The status
 * command only reads credentials; enrollment remains a session-start action.
 */
export declare function printAgentIdentitySection(harness: string, credentialStore?: TalosCredentialStore): Promise<void>;
/**
 * Child credentials are keyed by session, type, and stable spawn id in the OS
 * credential store. That store has no portable enumeration API, so status
 * reports the active model rather than pretending the retired DCR config is
 * the current set of sub-agents.
 */
export declare function printSubAgentIdentitiesSection(harness: string): void;
/**
 * Render the "Permissions" block: the deny posture, the namespace, and the
 * allowed/blocked state of the harness's built-in tool catalog.
 *
 * The network probe runs only when a project URL is configured *and* a user
 * identity is available (cached PKCE tokens or `ORY_USER_SUBJECT_ID`). When it
 * runs, the reported **Mode is read live from the project** in the same pass, so
 * this line answers "what would a tool call do right now?" rather than echoing a
 * cache that is only refreshed at session start. On every other path the last
 * cached value is reported, annotated as such.
 */
export declare function printPermissionsSection(binName: string, harness: string): Promise<void>;
export interface StatusCommandOptions {
    /** Display title — typically the harness's human-friendly name, e.g. "Claude Code". */
    title: string;
    /**
     * Optional renderer for the "Hooks & plugin" section. Each harness owns
     * the layout for its plugin-specific registration data (extension dir,
     * marketplace plugin ID, hook script path, etc.). May be async — some
     * harnesses have to reach the network to report what will actually load.
     */
    printPluginSection?: () => void | Promise<void>;
}
/**
 * Compose the unified `status` output for a plugin CLI. Sections render
 * in this order: title → configuration → user identity → agent identity
 * → sub-agent identities → permissions → hooks & plugin → environment →
 * recent activity from the unified activity/debug log.
 *
 * Each section degrades gracefully — Agent Security not connected
 * mode, and empty token caches all surface as inline "n/a" lines rather
 * than aborting the command.
 */
export declare function runStatusCommand(binName: string, harness: string, options: StatusCommandOptions): Promise<void>;