import type { PreProgressRefusalObservation } from "@claudexor/schema";
import { CredentialGeneration } from "./credential-generation.js";
/**
 * The daemon's bounded, self-expiring memory of typed pre-progress refusals:
 * "this pool account's vendor session started for model M and ended in a
 * terminal refusal before any agent progress".
 *
 * The structural rotation already moves THAT run to a sibling without reading
 * the vendor's wording; without this memory the pool's deterministic order
 * puts the same refusing account first on every later unpinned run. A live
 * observation only ORDERS the pool for that requested model (INV-135): it never
 * excludes a row, never touches a pin or a usable bound account, and never
 * claims spent quota or a dead credential.
 *
 * Deliberately IN-MEMORY, like the ledgers beside it: a restart forgets every
 * mark and each account rediscovers its own refusal at the cost of one
 * rotation.
 *
 * Clearing contract:
 * 1. self-expiry — every row is stamped here with the one retention above;
 * 2. a served try — a later try on the same account and requested model that
 *    made agent progress or ended without an error clears that mark (`clear`);
 * 3. a credential-generation change voids the verdicts about the changed
 *    generation, at the unusable ledger's call sites: a login/logout clears the
 *    WHOLE ledger (`noteCredentialChange`), a control-API profile mutation
 *    clears PER SUBJECT (`clearSubject`). Neither waits for runs in flight, so
 *    each also moves the account's `generation`: a try binds it before its
 *    session spawns, and an outcome that arrives after a change neither
 *    recreates a voided mark nor clears the changed credential's newer one;
 * 4. while a login may be rewriting the harness's credential store (the
 *    daemon's setup-lifecycle window), the generation is NO number at all: a
 *    try bound inside the window, or one whose outcome lands inside it, is
 *    about a credential in flux and neither records nor clears (#363).
 */
export declare class PreProgressRefusalLedger {
    private readonly now;
    private readonly mutating;
    readonly credentials: CredentialGeneration;
    private rows;
    constructor(now?: () => Date, mutating?: (harnessId: string) => boolean, credentials?: CredentialGeneration);
    /** Validate and stamp, newest-wins per (subject, requested model). */
    record(value: Omit<PreProgressRefusalObservation, "observed_at" | "expires_at">): void;
    /** Every un-expired observation (the read side of account resolution). */
    live(): readonly PreProgressRefusalObservation[];
    /** The account served this requested model again: its mark is stale. */
    clear(harnessId: string, profileId: string, requestedModel: string | null): void;
    /** The account's credential generation: it moves only when a credential
     * change voids the account's verdicts, never with evidence or expiry. */
    generation(harnessId: string, profileId: string): number;
    /** Credential generation changed wholesale (login/logout): every verdict
     * about the old generation is void. */
    noteCredentialChange(): void;
    /** ONE account's credential changed (a control-API profile mutation): only
     * ITS verdicts are void, across every requested model. */
    clearSubject(harnessId: string, profileId: string): void;
    private prune;
}
//# sourceMappingURL=pre-progress-refusal-ledger.d.ts.map