export interface WindowsAuditStatus {
    /** False on non-Windows platforms (audit logging is a Windows feature). */
    supported: boolean;
    scriptBlockLogging: boolean;
    transcription: boolean;
    transcriptionPath?: string;
    checkedAt: string;
}
/** Shape reported to the backend (discovery host payload + heartbeat). */
export interface ShellAuditReport {
    platform: string;
    scriptBlockLogging: boolean;
    transcription: boolean;
    transcriptionPath?: string;
    /** Interactive PowerShell profile guard installed (real-time blocking of typed commands). */
    profileGuard?: boolean;
    checkedAt: string;
}
/** Probe current audit coverage. Read-only, no elevation needed, never throws. */
export declare function getWindowsAuditStatus(): WindowsAuditStatus;
/**
 * Compact status for the discovery host payload and telemetry heartbeat.
 * Returns undefined on non-Windows so the field is simply omitted.
 * Never throws — telemetry/discovery must not break on a probe failure.
 */
export declare function getShellAuditReport(): ShellAuditReport | undefined;
export interface AuditPreInstallSnapshot {
    capturedAt: string;
    scriptBlockLogging: {
        present: boolean;
        enableValue?: number;
    };
    transcription: {
        present: boolean;
        enableValue?: number;
        invocationHeader?: number;
        outputDirectory?: string;
    };
}
export declare function auditPreInstallSnapshotPath(): string;
/** Record the audit keys as they were BEFORE FCD changes them (first contact only). Best-effort, never throws. */
export declare function captureAuditPreInstallSnapshot(): void;
export interface EnableWindowsAuditResult {
    ok: boolean;
    status: WindowsAuditStatus;
    /** Human-readable outcome, printable as-is. */
    message: string;
    /** True when the user saw (and answered) a UAC elevation prompt. */
    promptShown: boolean;
}
/**
 * Disable ScriptBlock Logging + Transcription (removes the HKLM policy keys)
 * via one UAC prompt. Mirrors enableWindowsAudit's fail-open contract. If the
 * keys are enforced by GPO/Intune they will reappear on the next policy sync
 * — the message says so.
 */
export declare function disableWindowsAudit(): EnableWindowsAuditResult;
/**
 * Enable ScriptBlock Logging + Transcription via ONE UAC elevation prompt.
 * Skips silently when already fully enabled. Never throws; on any failure
 * (UAC declined, no admin, GPO conflict) returns ok=false with a warning
 * message — callers must treat that as non-blocking.
 */
export declare function enableWindowsAudit(): EnableWindowsAuditResult;
export interface TranscriptPruneResult {
    /** Files deleted in this run (age window). */
    pruned: number;
    /** Files deleted because the folder exceeded the size budget. */
    prunedBySize?: number;
    /** Set when pruning was skipped entirely (not enabled / foreign dir / non-Windows). */
    skipped?: string;
}
/** Retention window in days — env override for fleets that want tighter/looser. */
export declare function transcriptRetentionDays(): number;
/** Size budget in MB — env override (FCD_TRANSCRIPT_MAX_MB, floor 50MB). */
export declare function transcriptMaxMb(): number;
/**
 * Delete transcript files older than the retention window, then enforce the
 * size budget (oldest-first) on whatever survived. Never throws; locked/
 * in-use files (an open PowerShell session's live transcript) are skipped and
 * picked up on a later run. Empty date folders are removed.
 */
export declare function pruneTranscripts(maxAgeDays?: number, dirOverride?: string, maxTotalMb?: number): TranscriptPruneResult;
export interface WindowsAuditArgs {
    enable?: string;
    disable?: string;
}
/**
 * `fullcourtdefense windows-audit` — show (default) or enable (--enable)
 * Windows PowerShell audit coverage on this machine.
 */
export declare function windowsAuditCommand(args: WindowsAuditArgs): Promise<void>;