export type ScanSeverity = 'high' | 'medium';
export interface ScanFinding {
    plugin: string;
    severity: ScanSeverity;
    file: string;
    rule: string;
    detail: string;
}
/** Every finding for one plugin directory; empty when the plugin runs nothing on install. */
export declare function scanPluginDir(plugin: string, root: string): ScanFinding[];
export declare const formatScanFinding: (f: ScanFinding) => string;
export interface ScanGate {
    /** Plugins with a high finding that were not accepted: their install must not run. */
    blocked: string[];
    /** Plugins with a high finding that --accept-risk let through. */
    accepted: string[];
    findings: ScanFinding[];
}
/** Applies §2.2: a high finding blocks, unless the plugin is named in acceptRisk. */
export declare function gateScan(findings: readonly ScanFinding[], acceptRisk: ReadonlySet<string>): ScanGate;
/** `--accept-risk a,b` or repeated: plugin names (or ids) to install past a high scan finding (ADR-509 §2.2). */
export declare function acceptRiskFrom(flags: Record<string, unknown>): string[];
//# sourceMappingURL=scan.d.ts.map