/**
 * Build stamp — the CLI version that generated a planted guard artifact.
 *
 * The profile/rc/autorun guard scripts are COPIES of CLI detection logic
 * written to disk at install time. Without a stamp, a fleet CLI self-update
 * ships new detection logic but every machine keeps running the old planted
 * script forever (rules JSON refreshes carry rules, never logic). Each
 * builder embeds this stamp in a comment; the telemetry-cycle refresh
 * rewrites any artifact whose stamp differs from the running build.
 */
export declare const GUARD_BUILD_MARKER = "fcd-guard-build:";
export declare function guardBuildStamp(): string;
/** True when a planted guard artifact was generated by a DIFFERENT CLI build. */
export declare function guardArtifactStale(filePath: string): boolean;
/** Atomic write — a torn guard script would break every new shell that sources it. */
export declare function writeGuardArtifact(filePath: string, content: string, mode?: number): void;
/** Blast-severity levels (shellfirm-style). Drives per-severity console policy. */
export type ShellGuardSeverity = 'critical' | 'high' | 'medium' | 'low';
export interface ShellGuardRule {
    id: string;
    category: string;
    severity: ShellGuardSeverity;
    /** Regex compiled with IgnoreCase in BOTH .NET (PowerShell) and JS (cmd/posix). */
    pattern: string;
    reason: string;
    source: 'builtin' | 'custom';
    /**
     * Per-rule enforcement action from the console (Local Safety). Absent =
     * 'block'. 'warn' → yellow notice, the command still runs (like monitor
     * mode, but for this one rule). 'mask' is meaningless for a typed command
     * and degrades to block.
     */
    action?: 'block' | 'warn';
}
interface ShellGuardRulesFile {
    updatedAt: string;
    mode: 'block' | 'monitor';
    rules: ShellGuardRule[];
}
/** Write (or rewrite) the ruleset the profile guard loads at shell startup. */
export declare function writeShellGuardRules(): ShellGuardRulesFile;
/** The active ruleset in memory (builtins minus dashboard-disabled + org custom). */
export declare function activeShellGuardRules(): ShellGuardRule[];
export interface ShellGuardMatch {
    rule: ShellGuardRule;
    /** The command segment that matched (chained commands are split on ; & |). */
    segment: string;
}
/**
 * Evaluate a typed command line WITHOUT executing it — the dry-run classifier
 * behind `shell-guard-check`. Uses the exact same rules + JS regex engine as the
 * live cmd/posix checkers (equivalent to .NET for these patterns). Also splits
 * chained commands (`a && del /s c:\`) and tests each segment, so combinations
 * are caught even when the dangerous part is not first.
 *
 * Returns ALL matches (one per matched segment/rule), first-match-per-segment.
 */
export declare function evaluateShellCommand(line: string, rules?: ShellGuardRule[]): ShellGuardMatch[];
/**
 * Opportunistic rules/mode refresh — called from the telemetry flush cycle so a
 * console mode flip or new custom rule reaches interactive shells within ~30s.
 * No-op unless the guard is installed. Never throws.
 */
export declare function refreshShellGuardRules(): void;
/**
 * The user's Documents folder from the shell-folder registry entry — the one
 * place that knows about OneDrive/folder redirection. reg.exe is a plain
 * system utility (not a scripting engine), so EDRs that block powershell.exe
 * do not block this.
 */
export declare function resolveDocumentsFolder(): string;
export interface ShellGuardStatus {
    supported: boolean;
    installed: boolean;
    profiles: Array<{
        engine: string;
        profilePath: string;
        installed: boolean;
    }>;
    rulesPresent: boolean;
    ruleCount?: number;
    mode?: string;
}
/** Probe whether the profile guard is installed. Read-only, never throws. */
export declare function getShellGuardStatus(): ShellGuardStatus;
/** Lightweight boolean for the telemetry heartbeat / discovery report. */
export declare function isShellGuardInstalled(): boolean;
export interface InstallShellGuardArgs {
    /** 'false' to skip writing profile entries (rules + script only). */
    profiles?: string;
}
/** `fullcourtdefense install-shell-guard` — enable the interactive PowerShell guard. */
export declare function installShellGuardCommand(args?: InstallShellGuardArgs): Promise<void>;
/** `fullcourtdefense uninstall-shell-guard` — remove the guard from all profiles. */
export declare function uninstallShellGuardCommand(): Promise<void>;
export {};