/**
 * Default firewall rule seeder.
 *
 * The `firewall_rules` table starts empty in production. The defence
 * pipeline's PATTERN_GROUPS catch most threats inline (instruction
 * injection, hidden instructions, etc.), but seeding the table with
 * built-in rules makes them visible in the dashboard and gives operators
 * a place to disable, edit, or extend them.
 *
 * Built-in rows are marked `built_in=1` and excluded from the user
 * `MAX_RULES=25` cap (see custom-rules/store.ts). They are evaluated
 * regardless of license tier — the Pro `custom_firewall_rules` gate
 * applies only to user-added rules with `built_in=0`.
 *
 * Idempotent: running the seeder again is a no-op when built-in rules
 * are already present. Operators wanting to re-seed after a built-in
 * update should `DELETE FROM firewall_rules WHERE built_in = 1` first.
 */
import type Database from 'better-sqlite3';
export declare function seedDefaultFirewallRules(db: Database.Database): void;
export declare function listBuiltInRuleNames(): string[];
