export type GuardScanResult = {
    ok: boolean;
    blocked: string[];
    warnings: string[];
};
export interface DownloadAndScanResult {
    ok: boolean;
    downloadedTo?: string;
    bytesWritten?: number;
    errors: string[];
    warnings: string[];
}
export declare class SecurityDownloadGuard {
    private blockedPatterns;
    validateUrl(url: string): GuardScanResult;
    scanFileList(paths: string[]): GuardScanResult;
    scanExtractedDir(rootDir: string): GuardScanResult;
    /**
     * Story 9.1 — fetch a URL into a quarantine directory and run the
     * existing scan pipeline before letting the caller move into `.catalog/`.
     *
     * Returns DownloadAndScanResult. Never throws. Caller is responsible
     * for moving `downloadedTo` into its final home after inspecting the
     * result.
     *
     * v1.4 supports single-file fetch only (markdown, YAML, JSON). Archive
     * unpacking (zip / tar) is deferred to v1.5 — for v1.4, sources serve
     * one manifest per import and we just trust the response body.
     */
    downloadAndScan(url: string, targetDirOpt?: string, opts?: {
        timeoutMs?: number;
        maxBytes?: number;
    }): Promise<DownloadAndScanResult>;
}
