/**
 * CredentialRepointingLivetest — the §5 livetest battery as testable orchestration
 * (Step 10 of live credential re-pointing).
 *
 * Spec: docs/specs/live-credential-repointing-rebalancer.md §5 (livetest battery),
 * §0.c (E3/E4 live experiments), §2.8 (dogfood (d) — the §0.c residual).
 *
 * ── What this is ──
 * The livetest battery is the GATE for the dry-run → live promotion decision. It is
 * NOT part of the merge CI and it NEVER runs autonomously: it exchanges REAL OAuth
 * credentials between the operator's REAL subscription accounts, so executing it is an
 * enablement-time action the OPERATOR takes (with the agent), never a dark-build step.
 *
 * This module is the ORCHESTRATION + VERDICT logic for battery items (a) and (b) —
 * the automatable round-trip swaps — expressed over INJECTED dependencies so it is
 * fully unit-testable WITHOUT touching a keychain (the same fake-deps discipline the
 * CredentialSwapExecutor itself uses). Items (c) post-swap refresher correctness and
 * (d) the §0.c at-expiry residual (a deliberately-minted disposable grant) are
 * inherently manual/destructive and are surfaced as REQUIRED operator steps in the
 * report rather than auto-run — the harness reports them as pending, it does not fake
 * a pass.
 *
 * ── The load-bearing safety contract ──
 *   1. ARMED GUARD. `run()` REFUSES unless explicitly armed (the live entrypoint sets
 *      `armed` only behind an operator flag + the feature's own enable check). An
 *      unarmed run returns a `refused` report and performs ZERO swaps — so importing
 *      or unit-testing this module can never move a real credential.
 *   2. IDENTITY-VERIFIED ROUND TRIP. Every swap is verified by the identity oracle
 *      (NOT by `claude auth status`, disqualified in E4a as a lying oracle): after a
 *      swap the two slots' oracle identities must have EXCHANGED; after the swap-back
 *      they must be RESTORED to the originals. Any deviation fails the step.
 *   3. ALWAYS SWAP BACK. A round-trip leaves the world as it found it. If the forward
 *      swap's verification fails the harness still attempts the restoring swap and
 *      reports the residual state honestly (never silently leaves slots exchanged).
 *
 * This module performs NO IO of its own: it calls injected `swap` + `resolveIdentity`
 * functions. The live entrypoint wires those to the real CredentialSwapExecutor +
 * CredentialIdentityOracle; a unit test wires fakes.
 */
/** Identity of the account whose credential currently sits in a slot (oracle answer). */
export interface SlotIdentity {
    /** The owning account id/email per the identity oracle, or null when unresolvable. */
    accountId: string | null;
}
export interface CredentialRepointingLivetestDeps {
    /**
     * Executes a REAL staged swap of the credentials in slotA and slotB (the shipped
     * CredentialSwapExecutor.swap in live mode). Resolves on success; rejects on a
     * refusal/error (the harness records the rejection as a step failure).
     */
    swap: (slotA: string, slotB: string) => Promise<{
        ok: boolean;
        detail?: string;
    }>;
    /**
     * Resolves which account a slot's credential belongs to via the identity oracle
     * (GET /api/oauth/profile over the slot's blob — E4b). Returns `{ accountId: null }`
     * when the oracle is unavailable/uncertain (the harness treats null as a verify
     * failure, never a guess).
     */
    resolveIdentity: (slot: string) => Promise<SlotIdentity>;
}
/** A single battery step's verdict. */
export interface LivetestStepResult {
    step: string;
    passed: boolean;
    detail: string;
    /** Ordered observations (identities seen, swaps performed) for the operator report. */
    observations: string[];
}
/** The full battery report. */
export interface LivetestReport {
    armed: boolean;
    /** True only when armed AND every automated step passed AND no manual step is outstanding. */
    promotable: boolean;
    refusedReason?: string;
    steps: LivetestStepResult[];
    /** Items (c)/(d): inherently manual/destructive — listed, never auto-passed. */
    manualSteps: string[];
}
export interface CredentialRepointingLivetestOptions {
    /**
     * MUST be true to run any swap. The live entrypoint sets this only behind the
     * operator flag + the feature enable check. Default false ⇒ a strict no-op refusal.
     */
    armed?: boolean;
}
export declare class CredentialRepointingLivetest {
    private readonly swap;
    private readonly resolveIdentity;
    private readonly armed;
    constructor(deps: CredentialRepointingLivetestDeps, opts?: CredentialRepointingLivetestOptions);
    /** The §2.8 manual/destructive items — surfaced for the operator, never auto-run. */
    static readonly MANUAL_STEPS: readonly string[];
    /**
     * Battery items (a)/(b): an identity-verified swap round-trip between two slots.
     * Used for both an enrolled-home pair (a) and the default-home slot (b).
     * ALWAYS attempts to restore the original layout, even when the forward verify fails.
     */
    private roundTrip;
    /**
     * Runs the automatable battery (items a + b). REFUSES (zero swaps) unless armed.
     * @param enrolledPair two enrolled-home slots for item (a).
     * @param defaultSlotPair the default-home slot paired with an enrolled slot for item (b).
     */
    run(enrolledPair: {
        slotA: string;
        slotB: string;
    }, defaultSlotPair: {
        defaultSlot: string;
        enrolledSlot: string;
    }): Promise<LivetestReport>;
}
//# sourceMappingURL=CredentialRepointingLivetest.d.ts.map