import { z } from "zod";
import { type SshCommand } from "../utils/sshCommand.js";
export interface GuardStateEntry {
    installedAt: string;
    cronExpr: string;
}
export interface GuardStartResult {
    success: boolean;
    error?: string;
    hint?: string;
}
export interface GuardStopResult {
    success: boolean;
    error?: string;
    hint?: string;
}
export interface GuardStatusResult {
    success: boolean;
    isActive: boolean;
    lastRunAt?: string;
    breaches: string[];
    logTail: string;
    installedAt?: string;
    error?: string;
}
export declare const GUARD_CRON_EXPR = "*/5 * * * *";
export declare const GUARD_SCRIPT_PATH = "/root/kastell-guard.sh";
export declare const GUARD_LOG_PATH = "/var/log/kastell-guard.log";
export declare const GUARD_METRICS_PATH = "/var/lib/kastell/metrics.json";
export declare const GUARD_MARKER = "# kastell-guard";
export declare const GUARD_AUDIT_STALENESS_MS: number;
export declare const SCORE_DROP_WARNING_THRESHOLD = 5;
export declare const SCORE_DROP_CRITICAL_THRESHOLD = 10;
export declare const guardStateEntrySchema: z.ZodObject<{
    installedAt: z.ZodString;
    cronExpr: z.ZodString;
}, z.core.$strip>;
export declare function getGuardStates(): Record<string, GuardStateEntry>;
export declare function saveGuardState(serverName: string, entry: GuardStateEntry): void;
export declare function removeGuardState(serverName: string): void;
export declare function buildDeployGuardScriptCommand(): SshCommand;
export declare function buildInstallGuardCronCommand(): SshCommand;
export declare function buildListGuardCronCommand(): SshCommand;
export declare function buildRemoveGuardCronCommand(): SshCommand;
export declare function buildGuardStatusCommand(): SshCommand;
export declare function startGuard(ip: string, serverName: string): Promise<GuardStartResult>;
export declare function stopGuard(ip: string, serverName: string): Promise<GuardStopResult>;
export declare function dispatchGuardBreaches(serverName: string, breaches: string[]): Promise<void>;
/**
 * Check for audit score drops between the two most recent local snapshots.
 * Sends a warning notification for 5-9pt drops, critical for 10+pt drops.
 * Skips if fewer than 2 snapshots exist or the most recent is older than 24h.
 */
export declare function checkAuditScoreDrop(serverName: string, serverIp: string): Promise<void>;
export declare function guardStatus(ip: string, serverName: string): Promise<GuardStatusResult>;
//# sourceMappingURL=guard.d.ts.map