export interface RefFinding {
    filePath: string;
    line: number;
    code: "EXTERNAL-DOMAIN" | "HTTP-NOT-HTTPS" | "PIPE-TO-SHELL" | "SCRIPT-NO-SRI" | "FILE-READ-ERROR";
    message: string;
}
/**
 * Load a known-domains file. Lines starting with # are comments, blank lines
 * are ignored. Entries may be bare domains (e.g. "microsoft.com") or
 * path-scoped (e.g. "github.com/dotnet/runtime").
 */
export declare function loadKnownDomains(filePath: string): Promise<string[]>;
/**
 * Check whether a URL belongs to a known domain.
 *
 * Bare domains match the host or any subdomain (e.g. "microsoft.com" matches
 * "learn.microsoft.com"). Path-scoped entries require the URL hostname to
 * match the configured host and the pathname to match the configured prefix
 * exactly or be followed by `/`.
 */
export declare function isKnownDomain(url: string, knownDomains: readonly string[]): boolean;
/** Check whether a URL is a local address (localhost, 127.0.0.1, wildcard). */
export declare function isLocalUrl(url: string): boolean;
/** Check whether a URL uses http:// but should use https://. */
export declare function isHttpNotHttps(url: string): boolean;
/**
 * Scan a single file for reference issues.
 */
export declare function scanFile(filePath: string, knownDomains: readonly string[], knownDomainsLabel?: string): Promise<RefFinding[]>;
export declare function scanContent(content: string, filePath: string, knownDomains: readonly string[], knownDomainsLabel?: string): RefFinding[];
/**
 * Discover scannable files under the given directories.
 * Finds SKILL.md, *.agent.md, and references/*.md files recursively.
 */
export declare function discoverScannableFiles(directories: readonly string[]): Promise<string[]>;
/**
 * Scan all provided files and return aggregated findings.
 */
export declare function scanFiles(filePaths: readonly string[], knownDomains: readonly string[], knownDomainsLabel?: string): Promise<RefFinding[]>;
//# sourceMappingURL=reference-scanner.d.ts.map