/**
 * SSH batch command builder for evidence collection.
 * Produces a single batched command with ---SEPARATOR--- delimiters between sections.
 * Section order is deterministic — parsers index into split output by EVIDENCE_SECTION_INDICES.
 */
import { type SshCommand } from "../utils/sshCommand.js";
/** Deterministic section indices for parsers to locate their output */
export declare const EVIDENCE_SECTION_INDICES: {
    readonly FIREWALL: 0;
    readonly AUTH_LOG: 1;
    readonly PORTS: 2;
    readonly SYSLOG: 3;
    readonly SYSINFO: 4;
    readonly DOCKER_PS: 5;
    readonly DOCKER_LOGS: 6;
};
/** Options controlling which evidence sections to include */
export interface EvidenceBuildOptions {
    noDocker?: boolean;
    noSysinfo?: boolean;
}
/**
 * Return the ordered list of output filenames matching the sections
 * that buildEvidenceBatchCommand will produce for the same arguments.
 * Callers use this instead of static EVIDENCE_SECTION_INDICES to map
 * split output positions to filenames.
 */
export declare function getEvidenceSectionFilenames(platform: string, options?: EvidenceBuildOptions): string[];
/**
 * Build a single batched SSH command for evidence collection.
 *
 * Sections are separated by `---SEPARATOR---`.
 * Use getEvidenceSectionFilenames() with the same arguments to map
 * split output positions to filenames.
 *
 * Base sections (always included unless opted out):
 *   FIREWALL (0), AUTH_LOG (1), PORTS (2), SYSLOG (3), SYSINFO (4)
 *
 * Docker sections (only for coolify/dokploy platforms, unless noDocker):
 *   DOCKER_PS (5), DOCKER_LOGS (6)
 */
export declare function buildEvidenceBatchCommand(platform: string, lines: number, options?: EvidenceBuildOptions): SshCommand;
//# sourceMappingURL=evidenceCommands.d.ts.map