/**
 * Reject a user-controlled value before it is placed in a Windows `cmd /c` argv.
 * `cmd.exe` re-parses + expands its arguments, so `C:\tmp & calc.exe` would chain a
 * second command and `%PATH%` would expand during an `--apply` flow. POSIX argv is
 * handed to spawn WITHOUT a shell, so callers apply this guard only on Windows.
 * Fail closed with a stable code.
 */
export declare function assertNoCmdInjection(value: string, label: string): void;