import { BotGuardConfig } from '../config';
/** Clients with a dedicated install-*-mcp-gateway command. */
export type GatewayClient = 'cursor' | 'claude-code' | 'claude-desktop' | 'codex' | 'gemini-cli' | 'windsurf' | 'vscode';
export declare const ALL_GATEWAY_CLIENTS: GatewayClient[];
export interface McpGatewayArgs {
    mcpCommand?: string;
    mcpArgs?: string;
    /** Remote MCP server URL (Streamable HTTP / SSE) — alternative to --mcp-command. */
    mcpUrl?: string;
    /** Optional JSON object of extra HTTP headers for the remote MCP (e.g. auth). */
    mcpHeaders?: string;
    agentName?: string;
    agentClient?: string;
    developerName?: string;
    shieldId?: string;
    shieldKey?: string;
    apiUrl?: string;
    environment?: string;
    userObjective?: string;
    authority?: string;
    approvalMode?: string;
    approvalTimeoutMs?: string;
    approvalPollMs?: string;
    scanResponse?: string;
    failClosed?: string;
}
export interface InstallCursorMcpGatewayArgs extends McpGatewayArgs {
    project?: string;
    serverName?: string;
}
export interface InstallClaudeCodeMcpGatewayArgs extends McpGatewayArgs {
    scope?: string;
    serverName?: string;
}
export interface InstallClaudeDesktopMcpGatewayArgs extends McpGatewayArgs {
    configPath?: string;
    serverName?: string;
}
export interface InstallVscodeMcpGatewayArgs extends McpGatewayArgs {
    project?: string;
    serverName?: string;
}
export interface InstallCodexMcpGatewayArgs extends McpGatewayArgs {
    project?: string;
    serverName?: string;
}
export interface InstallGeminiMcpGatewayArgs extends McpGatewayArgs {
    project?: string;
    serverName?: string;
}
export interface InstallWindsurfMcpGatewayArgs extends McpGatewayArgs {
    serverName?: string;
}
export interface InstallMcpGatewayArgs extends McpGatewayArgs {
    clients?: string;
    cursorProject?: string;
    claudeCodeScope?: string;
    serverName?: string;
    upload?: string;
    apiKey?: string;
}
/**
 * How the gateway reaches the real MCP server: spawn a local process (stdio)
 * or speak Streamable HTTP/SSE to a remote URL. Both flow through the exact
 * same policy enforcement in McpGatewayServer.
 */
export type DownstreamSpec = {
    kind: 'stdio';
    command: string;
    args: string[];
} | {
    kind: 'http';
    url: string;
    headers?: Record<string, string>;
};
export declare function mcpGatewayCommand(args: McpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installCursorMcpGatewayCommand(args: InstallCursorMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installMcpGatewayCommand(args: InstallMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export interface ProtectAllArgs extends McpGatewayArgs {
    dryRun?: string;
    config?: string;
    clients?: string;
}
export interface McpProtectionInspection {
    servers: number;
    protectedServers: number;
    stalePathServers: number;
}
/** Read-only protection/path verification shared by daemon integrity checks. */
export declare function inspectMcpProtectionFile(file: string): McpProtectionInspection;
export interface GatewayIdentityHealResult {
    file: string;
    server: string;
    from: string;
    to: string;
}
/**
 * SELF-HEAL for the policy-identity contract. Scans MCP client config files (JSON and Codex
 * TOML) for FCD-gateway-wrapped servers whose baked-in `--agent-name` is a stale generic
 * `<developer>-<client>` default, and rewrites it to `<developer>-<server>` so dashboard
 * policies targeting the MCP server (`agentName contains <server>`) match at runtime.
 *
 * Runs automatically from `discover` and `protect-all`, so a customer machine with configs
 * written by an old CLI version converges to the correct identity without manual edits.
 */
export declare function healGatewayAgentIdentities(files: string[], dryRun?: boolean): GatewayIdentityHealResult[];
export declare function protectAllTargetFiles(extra?: string, allowedClientKeys?: Set<string>): Array<{
    path: string;
    source: string;
    clientKey: string;
}>;
export declare function protectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;
export declare function unprotectAllCommand(args: ProtectAllArgs, config: BotGuardConfig): Promise<void>;
export declare function installClaudeCodeMcpGatewayCommand(args: InstallClaudeCodeMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installClaudeDesktopMcpGatewayCommand(args: InstallClaudeDesktopMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installCodexMcpGatewayCommand(args: InstallCodexMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installGeminiMcpGatewayCommand(args: InstallGeminiMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installWindsurfMcpGatewayCommand(args: InstallWindsurfMcpGatewayArgs, config: BotGuardConfig): Promise<void>;
export declare function installVscodeMcpGatewayCommand(args: InstallVscodeMcpGatewayArgs, config: BotGuardConfig): Promise<void>;