import { BotGuardConfig } from '../config';
/**
 * Watchdog tick — runs OUTSIDE the daemon (Windows scheduled task, every
 * 5 minutes) so machine health stays observable even when the daemon itself
 * is dead. Three jobs, all best-effort, never throws, exits 0:
 *
 *   1. Liveness: is the daemon RESPONSIVE — not merely "a pid exists"? A
 *      wedged daemon (stale alive-marker + silent verdict pipe) is recycled;
 *      a recycled pid (marker stale, no pipe endpoint at all) is treated as
 *      dead WITHOUT touching the unrelated process now holding that pid.
 *      Either way, detect + persist the unclean death post-mortem.
 *   2. Revival: relaunch a dead daemon (plain detached node — no shells).
 *   3. Beacon: report daemon state to the console so the dashboard can tell
 *      "daemon dead since 11:02" apart from "machine off".
 *
 * Shell-quiet by design: credential resolution NEVER attempts the DPAPI/
 * PowerShell decrypt here (this runs every 5 minutes — exactly the hourly-
 * PowerShell pattern that made EDRs kill us). On DPAPI-enrolled machines the
 * beacon goes out WITHOUT a shield key; the backend accepts it on a
 * constrained, rate-limited path that can only update watchdog liveness
 * fields of an already-enrolled machine.
 */
export interface WatchdogArgs {
    apiUrl?: string;
    shieldId?: string;
    shieldKey?: string;
}
export declare function watchdogCommand(args: WatchdogArgs, config: BotGuardConfig): Promise<void>;