import { BotGuardConfig } from '../config';
import { type ShellAuditReport } from './windowsAudit';
export type DiscoverSurface = 'mcp' | 'secrets' | 'agent-files' | 'posture';
export interface DiscoverArgs {
    type?: string;
    surface?: string;
    apiKey?: string;
    apiUrl?: string;
    json?: string;
    upload?: string;
    connectorName?: string;
    agentCiGate?: AgentCiGateUpload;
    extraPath?: string;
    deep?: string;
    /** Optional comma-separated dev roots (or "auto") to sweep for project MCP configs in OTHER repos. */
    scanRoot?: string;
    /** Allow deep stdio probing (process spawn) for servers found via --scan-root. Default: off. */
    deepRoots?: string;
    silent?: string;
    userEmail?: string;
    schedule?: string;
    unschedule?: string;
    scheduleHour?: string;
}
export interface AgentCiGateUpload {
    status: 'pass' | 'fail';
    score: number;
    failOn: string;
    findings: Array<{
        id: string;
        severity: string;
        category: string;
        title: string;
        detail: string;
        filePath?: string;
        remediation: string;
    }>;
    mcpServers: Array<{
        name: string;
        source: string;
        filePath: string;
        direct: boolean;
        protectedGateway: boolean;
        riskSignals: string[];
    }>;
    uploadedAt: string;
    ci?: {
        provider?: string;
        repository?: string;
        ref?: string;
        sha?: string;
        runId?: string;
        runUrl?: string;
        workflow?: string;
        job?: string;
    };
}
export interface DesktopDiscoveryHost {
    machineId: string;
    hostname: string;
    platform: string;
    user: string;
    scannedAt: string;
    probeMode: 'config' | 'deep';
    /** Windows-only: PowerShell audit coverage (ScriptBlock Logging + Transcription). */
    shellAudit?: ShellAuditReport;
    /** Windows-only: EDR/AV products detected on this machine (read-only service probe). */
    securityAgents?: string[];
    /** True when the scan ran on an ephemeral CI runner (GitHub Actions, GitLab, etc.) — not a user machine. */
    isCi?: boolean;
}
/**
 * Which credential is missing and the most likely reason — diagnosability for
 * remote fleet machines where only the daemon-captured stderr is visible.
 * Notably distinguishes "DPAPI-protected key present but undecryptable"
 * (PowerShell blocked by EDR / broken profile) from "never enrolled".
 */
export declare function describeMissingUploadCreds(config: BotGuardConfig, creds: {
    apiKey?: string;
    shieldId?: string;
    shieldKey?: string;
}): string;
export declare function discoverCommand(args: DiscoverArgs, config: BotGuardConfig): Promise<void>;
/** Upload-only discover — used after install-mcp-gateway --upload. */
export declare function runDiscoverUpload(args: {
    apiKey?: string;
    apiUrl?: string;
    userEmail?: string;
    silent?: boolean;
    connectorName?: string;
    agentCiGate?: AgentCiGateUpload;
}, config: BotGuardConfig): Promise<void>;