import { type TokenBlob } from "./token-store.js";
/** Google revokes a refresh token after six months without use. */
export declare const REFRESH_INACTIVITY_LIMIT_DAYS = 180;
/** How much of the inactivity clock must remain before an account is merely
 *  `ok`. Thirty days is the window in which an operator can still act. */
export declare const REFRESH_EXPIRING_THRESHOLD_DAYS = 30;
export type RefreshStatus = "ok" | "expiring" | "expired";
export interface AccountAuditRow {
    accountId: string;
    email: string;
    refreshTtlDays: number;
    status: RefreshStatus;
}
/**
 * Classify one token blob against the inactivity clock.
 *
 * A blob holding NO refresh token is `expired` with zero days regardless of how
 * recently it was written: it works until the access token lapses, about an hour
 * out, and then dies. Reporting it as `ok` because `lastRefresh` is recent would
 * be precisely the false all-clear this audit exists to prevent.
 */
export declare function classifyRefresh(blob: TokenBlob, nowMs: number): {
    refreshTtlDays: number;
    status: RefreshStatus;
};
/**
 * Every connected Google account under every account, classified.
 *
 * An unreadable blob is skipped rather than thrown: one corrupt store must never
 * blind the audit to every other account. It is not reported as a row because it
 * has no TTL to report — `google-account-list` is the surface that already
 * distinguishes `unreadable` from healthy.
 */
export declare function auditConnectedAccounts(accountsDir: string, nowMs: number): AccountAuditRow[];
/**
 * One audit cycle: a line per connected account, then a heartbeat.
 *
 * The heartbeat fires on EVERY cycle, including cycles that find nothing. An
 * audit that has stopped running would otherwise be indistinguishable from an
 * audit reporting all-clear, and the standing absence of this line over more
 * than one interval is the documented signal that the audit is not running.
 */
export declare function runAccountAudit(accountsDir: string, nowMs: number, emit: (line: string) => void): AccountAuditRow[];
//# sourceMappingURL=account-audit.d.ts.map