/**
 * `ai-governance scan` subcommand — A-2.
 *
 * Runs the OWASP Agentic Top 10 scanner locally on the customer's machine.
 * Source code NEVER leaves the customer's box; only the structured
 * ScanReport + AgentManifest is emitted to stdout (and optionally POSTed
 * to the gov-server's push-receive endpoint).
 *
 * Replaces the legacy W-03 server-side Git-clone flow that violated
 * Locked Invariant 10 (push-receive only — we never call out to customer
 * infrastructure).
 *
 * Usage:
 *   ai-governance scan <dir>                      Print findings to stdout
 *   ai-governance scan <dir> --json               Emit machine-readable JSON
 *   ai-governance scan <dir> --upload             POST results to gov-server
 *   ai-governance scan <dir> --upload --endpoint <url>  Override gov-server URL
 *   ai-governance scan <dir> --agent-draft-id <uuid>    Pre-allocated draft ID
 *
 * Exit codes:
 *   0  scan ran successfully (findings reported but exit is still 0)
 *   1  scan ran, upload failed, or a fatal error occurred
 *   2  argument error
 *
 * Honors Locked Invariant 10: the scanner is a pure function on the
 * customer's manifest; the optional upload is a push-only fire-and-forget
 * call from the customer's box to /api/v1/onboarding/scan-results.
 *
 * @connexum/ai-governance  Phase A-2
 */
export declare function runScanCommand(args: string[]): Promise<number>;
//# sourceMappingURL=scan.d.ts.map