/**
 * Standardized Threat Cloud pipeline commands.
 *
 *   atr tc sync        Push repo rules → TC (updates metrics + website)
 *   atr tc pull        Pull confirmed TC rules → repo (validate + write)
 *   atr tc crystallize Send missed attacks → TC LLM → new proposals
 *   atr tc status      Show TC state (rules, proposals, threats)
 *
 * All commands are idempotent and safe to run repeatedly.
 * CI workflows call these same commands — no ad-hoc scripts.
 *
 * @module agent-threat-rules/cli/tc-pipeline
 */
export declare function cmdTCSync(options: Record<string, string | undefined>): Promise<void>;
/** The tags.category enum in spec/atr-schema.yaml: the only directories a pulled rule may go in. */
export declare const TC_PULL_CATEGORIES: ReadonlySet<string>;
export type PulledRulePlan = {
    readonly ok: true;
    readonly id: string;
    readonly category: string;
    readonly slug: string;
    readonly filePath: string;
} | {
    readonly ok: false;
    readonly reason: string;
};
/**
 * Decide where a rule fetched from Threat Cloud may be written. The endpoint's
 * response is untrusted, and the id and category become a file name and a
 * directory, so both must have a form a real rule can have. Fields are read
 * from the parsed YAML: a regex over the text picks up `subcategory:` keys in
 * compliance blocks before the rule's own tags.
 */
export declare function planPulledRule(content: string, rulesDir: string): PulledRulePlan;
export declare function cmdTCPull(options: Record<string, string | undefined>): Promise<void>;
export declare function cmdTCCrystallize(options: Record<string, string | undefined>): Promise<void>;
export declare function cmdTCStatus(options: Record<string, string | undefined>): Promise<void>;
//# sourceMappingURL=tc-pipeline.d.ts.map