import type { Config } from '../config/schema.js';
/** Bump when risk copy or terms change; users must re-accept. */
export declare const CURRENT_TUNNEL_CONSENT_VERSION = "2026-05";
/** Bump when Tailscale Serve risk copy changes. */
export declare const CURRENT_TAILSCALE_CONSENT_VERSION = "2026-05-serve";
export declare function hasValidTailscaleConsent(config: Config): boolean;
export declare function buildTailscaleConsentRecord(): {
    version: string;
    acceptedAt: string;
};
export declare const TUNNEL_CONSENT_REQUIRED_CODE = "TUNNEL_CONSENT_REQUIRED";
export declare class TunnelConsentError extends Error {
    readonly code = "TUNNEL_CONSENT_REQUIRED";
    constructor(message: string);
}
export type TunnelConsentState = {
    valid: boolean;
    consentRequired: boolean;
    acceptedAt: string | null;
    acceptedVersion: string | null;
    currentVersion: string;
    canAutoStart: boolean;
};
export declare function hasValidTunnelConsent(config: Config): boolean;
export declare function getTunnelConsentState(config: Config): TunnelConsentState;
/** Gate tunnel start and autostart paths. */
export declare function assertTunnelMayStart(config: Config): void;
export declare function assertTunnelAutoStartAllowed(config: Config): void;
export declare function buildTunnelConsentRecord(): NonNullable<Config['tunnel']>['consent'];
/** Short risk summary for CLI (keep in sync with web i18n). */
export declare const TUNNEL_RISK_SUMMARY_LINES: readonly ["Starting remote access exposes your gateway on the public internet via frp.xopc.ai.", "A public URL exposes the gateway authentication surface to the internet.", "Traffic is proxied through third-party infrastructure; use a strong token and stop the tunnel when not needed."];