import type { Config } from '../config/schema.js';
/** Bump when risk copy or terms change; users must re-accept. */
export declare const CURRENT_TUNNEL_CONSENT_VERSION = "2026-05";
/** Bump when Tailscale Serve risk copy changes. */
export declare const CURRENT_TAILSCALE_CONSENT_VERSION = "2026-05-serve";
export declare function hasValidTailscaleConsent(config: Config): boolean;
export declare function buildTailscaleConsentRecord(): {
    version: string;
    acceptedAt: string;
};
export declare const TUNNEL_CONSENT_REQUIRED_CODE = "TUNNEL_CONSENT_REQUIRED";
export declare class TunnelConsentError extends Error {
    readonly code = "TUNNEL_CONSENT_REQUIRED";
    constructor(message: string);
}
export type TunnelConsentState = {
    valid: boolean;
    consentRequired: boolean;
    acceptedAt: string | null;
    acceptedVersion: string | null;
    currentVersion: string;
    canAutoStart: boolean;
};
export declare function hasValidTunnelConsent(config: Config): boolean;
export declare function getTunnelConsentState(config: Config): TunnelConsentState;
/** Gate tunnel start and autostart paths. */
export declare function assertTunnelMayStart(config: Config): void;
export declare function assertTunnelAutoStartAllowed(config: Config): void;
export declare function buildTunnelConsentRecord(): NonNullable<Config['tunnel']>['consent'];
/** Short risk summary for CLI (keep in sync with web i18n). */
export declare const TUNNEL_RISK_SUMMARY_LINES: readonly ["Starting remote access exposes your gateway on the public internet via frp.xopc.ai.", "Anyone with the public URL or pairing QR may use your gateway Bearer token.", "Traffic is proxied through third-party infrastructure; use a strong token and stop the tunnel when not needed."];