import { BotGuardConfig } from '../config';
import { InstallAllArgs } from './installAll';
export interface OnboardArgs extends InstallAllArgs {
    /** Fleet enrollment token (or FCD_ENROLL_TOKEN env). Optional when already enrolled. */
    token?: string;
    /** Admin-facing friendly machine name (or FCD_MACHINE_NICKNAME env) shown in the console. */
    nickname?: string;
    /** Continue a persisted onboarding transaction. */
    resume?: string;
    /** Re-run completed install steps to repair changed machine state. */
    repair?: string;
    /** Report the transaction plan without changing local configuration. */
    dryRun?: string;
    /** Print the final transaction status as JSON. */
    json?: string;
    /** Do not enable optional self-healing protection. */
    noDaemon?: string;
    /** 'true' => skip the interactive trust disclosure (automation/MDM; the MSI consents via its own dialog). */
    acceptDisclosure?: string;
    /**
     * Requested enforcement mode (`--mode` / MSI `FCD_INSTALL_MODE`). The
     * control plane deliberately owns the machine's mode — every (re-)enrollment
     * starts in monitor and an admin promotes from the console. This flag is
     * accepted for compatibility but only ACKNOWLEDGED: a non-monitor request
     * prints an explicit note instead of being silently dropped, so an MDM
     * operator who set FCD_INSTALL_MODE=block learns where mode is actually set.
     */
    mode?: string;
}
/**
 * `fullcourtdefense onboard` — the one-command path from a fresh machine to a
 * verified protected machine:
 *
 *   1. connectivity check (backend ping)
 *   2. fleet enrollment (`login`) when a token is provided / not yet enrolled
 *   3. `install-all` (MCP gateways + IDE hooks + terminal guards + discovery)
 *   4. verification checklist with a green/red line per protection surface
 *
 * Exits non-zero when a required surface failed, so MDM scripts can gate on it.
 */
export declare function onboardCommand(args: OnboardArgs, config: BotGuardConfig): Promise<void>;