export interface WinPathResult {
    success: boolean;
    /** True when `dir` was already the first PATH entry (no write performed). */
    alreadyPresent?: boolean;
    error?: string;
}
/**
 * Compute the new User PATH from the RAW (unexpanded) current value. Pure and
 * OS-independent — the single source of truth for the prepend/dedup logic.
 *
 * Idempotent: returns `{ changed: false }` (value unchanged, verbatim) when
 * `dir` is already the first `;`-split entry. Otherwise removes every existing
 * occurrence of `dir` and prepends it, dropping empty segments — matching POSIX
 * `export PATH="${dir}:$PATH"`. `%VAR%` segments are preserved verbatim (never
 * expanded), which is the #308 regression this fix targets.
 */
export declare function computeNewUserPath(currentRaw: string, dir: string): {
    changed: boolean;
    value: string;
};
/**
 * Decide whether to write the User PATH back as REG_EXPAND_SZ (ExpandString) vs
 * REG_SZ (String). Pure — testable on any host.
 *
 * True (expandable) when the original value was already ExpandString, when the
 * raw value contains a `%VAR%` reference, or when `Path` was absent (default to
 * ExpandString — Windows' native Path type). Only a plain String value with no
 * `%` stays REG_SZ. `originalKind` is the .NET RegistryValueKind name
 * (`ExpandString`/`String`/…) or `null`/`Absent` when `Path` had no value.
 */
export declare function shouldWriteExpandable(originalKind: string | null, rawValue: string): boolean;
/**
 * Prepend `dir` to the Windows User PATH. Idempotent: a no-op when `dir` is
 * already first; moves it to the front when it exists but is positioned later
 * (e.g. appended by an older install) so it overrides conflicting entries.
 *
 * Reads the RAW registry value (preserving `%VAR%` and the REG_EXPAND_SZ type),
 * computes the new value in TS via `computeNewUserPath`, and only writes when
 * the value actually changes — preserving the original value type and
 * broadcasting WM_SETTINGCHANGE. `dir` and the computed value are passed via env
 * vars so they are never interpolated into the script text.
 */
export declare function prependToWindowsUserPath(dir: string): WinPathResult;
/**
 * The effective PowerShell execution policy (e.g. `Restricted`, `RemoteSigned`),
 * or null if it can't be determined (PowerShell missing / errored).
 */
export declare function getEffectiveExecutionPolicy(): string | null;
/**
 * Whether a policy blocks running unsigned local `.ps1` scripts — which is what
 * npm and agents-cli generate (`npm.ps1`, `agents.ps1`). Under these the bare
 * `agents` / `npm` commands fail in PowerShell with a security error even when
 * on PATH. Pure — testable on any host.
 */
export declare function blocksLocalScripts(policy: string | null): boolean;
/**
 * Resolve the npm global-bin directory (where the generated `agents` /
 * `agents.cmd` launchers live, and where npm expects PATH to point) from the
 * package entrypoint. On Windows npm places bin launchers directly in the
 * prefix root, so the bin dir is the prefix itself.
 *
 * entry = `<prefix>/node_modules/@phnx-labs/agents-cli/dist/index.js` → `<prefix>`
 */
export declare function npmGlobalBinFromEntry(entryJsPath: string): string;
