/**
 * @fileoverview I/O helpers for SkillInstallationService (GitHub fetch, file writes)
 * @module @skillsmith/core/services/skill-installation.io
 * @see SMI-4745: domain-driven split to stay under the 500-line CI gate
 */
import type { ScannerOptions, ScanReport } from '../security/index.js';
export { writeInstallFiles, type WriteInstallResult } from './skill-installation.io.write.js';
export declare function assertNotEncrypted(content: string, filePath: string): void;
export declare function fetchFromGitHub(owner: string, repo: string, filePath: string, branch?: string): Promise<string>;
export declare function checkForModifications(skillPath: string, installedAt: string): Promise<boolean>;
export interface OptionalInstallFilesResult {
    /** Validation warnings from config.json (surfaced as install tips). */
    configWarnings: string[];
    /**
     * SMI-5359 Gap-1: non-doc optional files whose security scan failed.
     * A non-empty list MUST reject the install BEFORE any file is written.
     */
    failedScans: Array<{
        file: string;
        report: ScanReport;
    }>;
    /** Validated optional files to write only AFTER the install gate passes. */
    filesToWrite: Array<{
        filename: string;
        content: string;
    }>;
}
/**
 * SMI-5359 Gap-1 / SMI-5422 Phase 1: fetch + scan the optional install files
 * WITHOUT writing them. The caller runs this BEFORE writeInstallFiles, rejects
 * on any `failedScans`, and only then writes `filesToWrite` (so a malicious
 * optional file can never leave a partially-installed skill on disk).
 *
 * Per-file policy (see skill-installation.policy.ts for the authoritative spec):
 *   doc          – scan failure is a silent skip (FP control H6).
 *   config       – hard-reject on scan failure (pre-existing behaviour).
 *   structured   – hard-reject on scan failure, all trust tiers.
 *   package-json – KEY-LEVEL: only lifecycle-hook script values are scanned.
 *                  A package.json with no lifecycle hooks is never rejected.
 *
 * A fetch/404 error is always a silent skip (NOT a scan failure).
 *
 * Phase 3 follow-up: directory-glob scanning (e.g. scripts/*.sh) is out of
 * scope here — fetchFromGitHub fetches by exact path only.
 */
export declare function fetchAndScanOptionalFiles(owner: string, repo: string, basePath: string, branch: string, skillId: string, scannerOptions: ScannerOptions | null): Promise<OptionalInstallFilesResult>;
//# sourceMappingURL=skill-installation.io.d.ts.map