/**
 * CredentialManualLevers — the detective-control bookkeeping for the manual swap/set-default
 * levers (spec §2.4 manual levers + §0.g force budget). Machine-local, in-memory, pure.
 *
 * The levers stay agent-callable (single-operator autonomy directive), so the control is
 * DETECTIVE + structural + non-suppressible, not a PIN gate:
 *   - per-PAIR cooldown      — a manual swap respects the per-pair cooldown by default; `force:true`
 *                              overrides it, and the override is FLAGGED in the audit + notification.
 *   - force budget (§0.g)    — the `force:true` bypass carries its OWN bounded budget:
 *                              `maxForcedManualSwapsPerWindow`. Exhaustion refuses further FORCED
 *                              manual swaps until the window rolls — `force` is not the one uncapped
 *                              bypass left in the spec. A non-forced swap is never blocked by it.
 *
 * Every guard here makes "no safe action available" a SURFACED refusal (a named reason returned to
 * the caller), never a silent drop and never an unbounded retry (§0.g(c)).
 */
export interface CredentialManualLeversDeps {
    /** Per-pair cooldown ms (≥1× poll interval). */
    pairCooldownMs?: number;
    /** §0.g force budget: max FORCED manual swaps per window. */
    maxForcedPerWindow?: number;
    /** §0.g force budget window length ms. */
    forcedWindowMs?: number;
    now?: () => number;
}
/** A cooldown/budget verdict — allow, or a named refusal (surfaced, never silent). */
export type LeverVerdict = {
    allowed: true;
    forced: boolean;
} | {
    allowed: false;
    reason: string;
    code: 'pair-cooldown' | 'force-budget-exhausted';
};
export declare class CredentialManualLevers {
    private readonly pairCooldownMs;
    private readonly maxForcedPerWindow;
    private readonly forcedWindowMs;
    private readonly now;
    /** pairKey → last actuation epoch ms. */
    private readonly lastActuation;
    /** Forced-swap timestamps within the rolling window. */
    private forcedTimestamps;
    constructor(deps?: CredentialManualLeversDeps);
    /**
     * Evaluate whether a manual swap of (slotA, slotB) may proceed. `force` overrides the per-pair
     * cooldown BUT is itself bounded by the force budget. Read-only — call `recordSwap` after a
     * swap actually commits so the cooldown/budget advance only on real actuation.
     */
    evaluateSwap(slotA: string, slotB: string, force: boolean): LeverVerdict;
    /** Record an actually-committed swap: advances the pair cooldown and (if forced) the budget. */
    recordSwap(slotA: string, slotB: string, forced: boolean): void;
    /** Forced swaps remaining in the current window (for observability). */
    forcedBudgetRemaining(): number;
    private pruneForcedWindow;
}
//# sourceMappingURL=CredentialManualLevers.d.ts.map