/**
 * Shapes of audit responses: what travels to the client and what declares it.
 *
 * The type and the schema live side by side on purpose. The client checks
 * what arrives against what was declared and, on a mismatch, returns a
 * protocol error instead of the answer — so the schema is not a description
 * of intent but a promise that must match the type line for line.
 */
import type { Tool } from '@modelcontextprotocol/sdk/types.js';
import type { DuEntry } from '../utils/du-lines.js';
import { type Legend } from './legend.js';
type OutputSchema = NonNullable<Tool['outputSchema']>;
/**
 * Overview sections. A missing field means "section not requested": an empty
 * value in an unselected section would otherwise read as a fact about the server.
 */
export interface BaselineResult {
    hostname?: string;
    uptime?: string;
    date_utc?: string;
    os?: string;
    kernel?: string;
    disk?: Array<{
        filesystem: string;
        size: string;
        used: string;
        avail: string;
        pct: number;
        mount: string;
    }>;
    memory?: {
        total: string;
        used: string;
        free: string;
        available: string;
    };
    load?: string;
    net?: {
        listeners: Array<{
            proto: string;
            address: string;
            pid_program: string;
        }>;
        interfaces: string[];
    };
    ssh?: {
        port: string;
        permit_root_login: string;
        password_auth: string;
        pubkey_auth: string;
    };
    services?: {
        failed: string[];
        running_count: number;
    };
    /** `null` — the section was requested, there is no docker on the server; field absent — not requested */
    docker?: {
        containers: Array<{
            id: string;
            image: string;
            status: string;
            names: string;
        }>;
        df: string;
    } | null;
    /** Each firewall has three outcomes: absent, not allowed to look, checked */
    firewall?: {
        ufw: {
            status: 'not_installed' | 'no_access' | 'read';
            active?: boolean;
            text: string;
        };
        iptables: {
            status: 'not_installed' | 'no_access' | 'read';
            rules?: number;
        };
    };
    updates?: {
        upgradable: number;
        reboot_required: boolean;
    };
    /**
     * Sections that had nothing to check them with: the command is absent from
     * the server, or it returned nothing. An empty section and an unchecked
     * section look the same ("disk:" with no rows, "listeners (0)") but mean
     * different things — without this list the report would announce a lack of
     * data as a lack of problems.
     */
    unavailable: string[];
    red_flags: {
        critical: string[];
        warning: string[];
        ok: string[];
    };
    legend: Legend;
}
/**
 * Certificate check result.
 *
 * `null` in a field means "could not be read", not "the certificate lacks
 * this". The schema allows it wherever the type allows it: otherwise an
 * unread certificate — an ordinary outcome for a server without TLS — would
 * reach the client as a protocol error.
 */
export interface TlsCheckResult {
    domain: string;
    port: number;
    not_after: string | null;
    days_until_expiry: number | null;
    san_includes_hostname: boolean | null;
    san_text: string;
    issuer: string | null;
    renew_hook_configured: boolean | null;
    renew_hook_evidence: string;
}
/**
 * Disk usage broken down.
 *
 * A section that could not be measured is named in `unavailable` instead of
 * arriving empty: an empty list of largest entries and a directory that was
 * never read look identical, and one of them is a lack of data, not a lack of
 * problems. `null` in `docker` or `journald` means the server has neither —
 * that is an answer, not a gap.
 */
export interface DiskBreakdownResult {
    filesystems: Array<{
        filesystem: string;
        type: string;
        size: string;
        used: string;
        avail: string;
        pct: number;
        mount: string;
    }>;
    largest: Array<{
        path: string;
        entries: DuEntry[];
    }>;
    var_log: DuEntry[];
    cache: DuEntry[];
    docker: string | null;
    journald: string | null;
    /** Directories du was not allowed to look into — the list above is short by them */
    unreadable: string[];
    unavailable: string[];
}
/**
 * State of one service.
 *
 * `checked` is the only outcome where the fields below carry a measurement.
 * `no_systemd` — there was nobody to ask on that server; `no_unit` — the
 * server answered that no such service exists. Both leave the fields `null`,
 * because a service that was not measured must not read as a service that is
 * stopped.
 */
export interface ServiceStatusResult {
    unit: string;
    outcome: 'checked' | 'no_systemd' | 'no_unit';
    legend: Legend;
    enabled: string | null;
    active_state: string | null;
    sub_state: string | null;
    restart: string | null;
    restart_after: string | null;
    status_head: string;
    recent_log: string;
}
type ServiceOutcome = 'checked' | 'no_systemd' | 'no_unit';
/**
 * Words this baseline used, explained: a firewall nobody was allowed to read
 * looks in the report exactly like one that filters nothing.
 */
export declare function baselineLegend(firewall: BaselineResult['firewall']): Legend;
/** The one word that says whether anything below it was measured at all */
export declare function serviceLegend(outcome: ServiceOutcome): Legend;
export declare const BASELINE_OUTPUT_SCHEMA: OutputSchema;
export declare const TLS_CHECK_OUTPUT_SCHEMA: OutputSchema;
export declare const DISK_BREAKDOWN_OUTPUT_SCHEMA: OutputSchema;
export declare const SERVICE_STATUS_OUTPUT_SCHEMA: OutputSchema;
export {};