import { LocalSafetyCustomBlock, LocalSafetyRuleAction, LocalSafetyScanOptions } from './commands/deterministicGuard';
export interface LocalSafetySnapshot {
    policyHash: string;
    disabledBuiltInItemIds: string[];
    /** Built-in items with a NON-default enforcement action (absent = 'block'). */
    itemActions?: Record<string, LocalSafetyRuleAction>;
    customBlocks: LocalSafetyCustomBlock[];
    /** Org-managed trusted script paths — content scanning skipped under these. */
    trustedScriptPaths?: string[];
    updatedAt?: string;
}
export interface LocalSafetySnapshotInput {
    apiUrl: string;
    shieldId: string;
    shieldKey?: string;
    developerName: string;
    machineName: string;
    expectedPolicyHash?: string;
    timeoutMs?: number;
    /**
     * Hot-path caller on a monitor/shadow machine: any cached snapshot wins
     * immediately (even stale / hash-mismatched) — the resident daemon owns
     * refreshes, the developer never pays the fetch timeout. Enforce callers
     * keep the normal TTL + bounded-fetch behavior.
     */
    preferCached?: boolean;
}
/**
 * The identity the IDE hooks use for their snapshot cache key. The daemon
 * warms the SAME cache file on its poll so hook processes always find a fresh
 * snapshot on disk and never pay the fetch timeout. Must stay byte-identical
 * to the hook's `developerId()` fallback chain.
 */
export declare function hookSnapshotIdentity(): {
    developerName: string;
    machineName: string;
};
export declare function clearLocalSafetySnapshotCache(input: Pick<LocalSafetySnapshotInput, 'apiUrl' | 'shieldId' | 'developerName' | 'machineName'>): void;
/**
 * Remove EVERY Local Safety snapshot cache file, regardless of the identity
 * that keyed it. Used on (re-)enrollment and explicit policy refresh: cache
 * files are keyed by sha1(apiUrl|shieldId|developer|machine), so after a
 * shield/identity change a targeted unlink can miss files written under an
 * old key — leaving a stale (possibly enforcing) snapshot for whichever
 * surface still resolves that old identity.
 */
export declare function clearAllLocalSafetySnapshotCaches(): void;
export declare function loadLocalSafetySnapshot(input: LocalSafetySnapshotInput): Promise<LocalSafetySnapshot | undefined>;
export declare function snapshotToScanOptions(snapshot: LocalSafetySnapshot | undefined, extra?: Pick<LocalSafetyScanOptions, 'cwd' | 'inspectScripts'>): LocalSafetyScanOptions;