/**
 * SSH batch command builder for server auditing.
 * Produces 3 tiered batches with ---SECTION:NAME--- named separators.
 * Parsers locate their output by section name, not integer index.
 */
import type { PluginRegistryEntry } from "../../plugin/registry.js";
export type BatchTier = "fast" | "medium" | "slow" | "plugin";
export interface BatchDef {
    tier: BatchTier;
    command: string;
}
export declare const BATCH_TIMEOUTS: Record<BatchTier, number>;
/**
 * Build a single batch section containing every loaded plugin's checks,
 * each wrapped in an isolated heredoc-fed bash subshell.
 * Returns null when no loaded plugin has any checks.
 *
 * Section format: ---SECTION:PLUGIN:<pluginName>:<checkId>---
 * Each check body runs in a fresh bash interpreter (state isolation)
 * fed via single-quoted heredoc (no expansion, no quote-balancing).
 */
export declare function buildPluginBatchSection(registry: ReadonlyMap<string, PluginRegistryEntry>): string | null;
/**
 * Build 3 tiered SSH batch commands for server auditing.
 *
 * Batch 1 (fast):   SSH, Firewall, Updates, Auth, Accounts, Boot, Scheduling, Banners, TLS Hardening, HTTP Security Headers, WAF & Reverse Proxy — config reads (30s timeout)
 * Batch 2 (medium): Docker, Network, Logging, Kernel, Services, Time, MAC, Memory,
 *                   CloudMeta, Backup, ResourceLimits, IncidentReady, DNS — active probes (60s timeout)
 * Batch 3 (slow):   Filesystem, Crypto, FileIntegrity, Malware, Secrets, SupplyChain — find commands (120s timeout)
 *
 * Each section is preceded by an ---SECTION:NAME--- named separator.
 * Parsers route by section name, not integer index.
 */
export declare function buildAuditBatchCommands(platform: string, pluginRegistry?: ReadonlyMap<string, PluginRegistryEntry>): BatchDef[];
//# sourceMappingURL=commands.d.ts.map