/**
 * EDR / antivirus presence probe (Windows).
 *
 * Detects which endpoint-security products run on a fleet machine so the
 * console can explain machine-side interference (blocked PowerShell, killed
 * daemons, quarantined installs) instead of showing a bare "stale" badge.
 *
 * Deliberately shell-quiet: detection is read-only `reg.exe query` of known
 * service keys — the same benign mechanism the posture probe already uses.
 * NO PowerShell/WMI (spawning those is exactly the behavior EDRs flag).
 * Results are cached in-process; the probe re-runs at most every 6 hours.
 */
export interface SecurityAgentsReport {
    /** Human-readable product names detected on this machine. */
    products: string[];
    checkedAt: string;
}
/** Windows service name → product label. Service keys are stable across versions. */
export declare const KNOWN_SECURITY_SERVICES: Record<string, string>;
/**
 * Pure core — service-existence check is injectable for offline tests.
 * Returns undefined on non-Windows platforms (field omitted from payloads).
 */
export declare function detectSecurityAgents(serviceExists?: (service: string) => boolean, platform?: NodeJS.Platform): SecurityAgentsReport | undefined;
/** Cached probe for periodic callers (daemon heartbeat every 5 min must not re-spawn reg.exe each tick). */
export declare function getSecurityAgentsReport(): SecurityAgentsReport | undefined;