import { type PluginVerification } from '../plugins/marketplace-trust/signature.js';
import { type ModPlugin } from './install.js';
import { type ReadFs } from './plugin-resolve.js';
/**
 * Scan each plugin the clone carries. Returns the plugin ids whose install must
 * not run, each with the reason; prints every finding; records --accept-risk.
 */
export declare function scanBeforeInstall(root: string, clone: string | null, plugins: readonly ModPlugin[], acceptRisk: ReadonlySet<string>, fs?: ReadFs, 
/** Lines already printed / overrides already recorded by an earlier scan in the same run (scanned before enabling, then again after the clone refresh). */
seen?: Set<string>): {
    blocked: Map<string, string>;
};
/** Verify the clone's ruflo plugins and write the status file; prints one line per non-verified plugin. */
export declare function verifyAndRecord(configDir: string, clone: string | null, names: readonly string[], home?: string): PluginVerification[];
export interface SignatureFinding {
    name: string;
    status: 'pass' | 'warn';
    message: string;
    fix?: string;
}
/**
 * `ruflo mods doctor` (§2.1): one finding per ruflo mod plugin from its clone
 * and install-cache signatures; writes the status file the mod's trust gate
 * reads. `modified` / `bad-signature` warn: they are enforced only under
 * modTrust: refuse-risky, since a local checkout is always modified.
 */
export declare function signatureFindings(configDir: string, clone: string | null, names: readonly string[], home?: string): SignatureFinding[];
//# sourceMappingURL=install-trust.d.ts.map