/** The subset of a `secrets.get` event this heuristic reads. */
export interface SecretGetRecord {
    /** Bundle name the read targeted. */
    bundle?: string;
    /** Where the value came from: `agent` (broker hit) / `session` (durable
     *  unlock) are SILENT; anything else hit the keychain and thus prompted. */
    source?: string;
}
export interface PromptedBundle {
    name: string;
    /** Number of prompting (keychain) reads in the window. */
    count: number;
}
/**
 * From recent `secrets.get` records, find bundles read often enough via the
 * keychain (i.e. NOT served silently by the broker or a durable session) to be
 * worth unlocking once. A bundle currently `held` is already silent, so it is
 * excluded; the caller further drops `never`/no-ACL bundles (which never prompt,
 * so unlocking them is a no-op).
 *
 * @param records recent `secrets.get` events (any order)
 * @param held    bundle names the broker currently holds (silent reads)
 * @param opts.minReads minimum prompting reads to surface a bundle (default 3)
 */
export declare function frequentlyPromptedBundles(records: SecretGetRecord[], held: Set<string>, opts?: {
    minReads?: number;
}): PromptedBundle[];
