import { type ScanSource } from "./vendor-host-url.js";
export declare const CODE_FILE_PATTERN: RegExp;
export declare function isCodeFile(file: string): boolean;
/**
 * Where a URL literal sits. Used only for REPORTING — the pass/fail decision is
 * position-independent on purpose, so a syntactic form nobody enumerated here
 * still cannot hide a URL.
 */
export type UrlLiteralPosition = "parameter default" | "object property" | "class field" | "variable initializer" | "fallback operand" | "ternary branch" | "call argument" | "return value" | "literal";
/**
 * A vendor domain written into a string literal, whether or not it forms a URL.
 *
 * The URL-shaped checks are value-dependent: they have to reconstruct what the
 * program will produce, and every reconstruction is a finite set of cases that
 * an attacker can step outside of (`.concat`, `.slice`, `.replace`, a `const`
 * referenced by name, a JSON blob parsed at runtime). This check is
 * value-INDEPENDENT: the vendor's own domain has to appear somewhere in the
 * bytes for the program to reach the vendor, so looking for the domain as a
 * token catches every assembly trick at once.
 *
 * It is a denylist, so it says nothing about a vendor domain nobody has listed —
 * that case is what the URL allowlist is for. The two are deliberately different
 * shapes because they fail in different directions.
 */
export type CodeFindingKind = 
/** Host resolves to a domain we operate. */
"vendor-host"
/** Host resolves to a domain that is not on APPROVED_CODE_HOSTS. */
 | "unapproved-host"
/** The TLD is supplied by code, so no host can be certified. */
 | "undeterminable-host"
/** The file could not be parsed, so its contents were never inspected. */
 | "unparsable"
/** The bytes could not be decoded as text, so they were never inspected. */
 | "undecodable"
/** A vendor domain appears in a string literal, in any form. */
 | "vendor-domain-token";
export interface CodeUrlFinding {
    file: string;
    line: number;
    kind: CodeFindingKind;
    /** True only for `kind === "vendor-host"`. */
    vendor: boolean;
    url?: string;
    host?: string;
    domain?: string;
    position?: UrlLiteralPosition;
    detail?: string;
}
/**
 * Every absolute URL a source file can statically produce, found by folding
 * string expressions and walking the AST — never by matching a syntactic shape.
 *
 * Failure to read the file is itself reported. A scanner that returns "clean"
 * for a file it could not parse is worse than no scanner, because it converts an
 * unknown into a certification. One stray byte used to do exactly that.
 */
export declare function findCodeUrlLiterals(file: string, content: string): CodeUrlFinding[];
/**
 * STRONG check over packed executable code.
 *
 * Every finding is a refusal to certify, not only a bad host: an unreadable or
 * unparsable code file is reported, because silence about a file nobody read is
 * indistinguishable from silence about a clean file.
 */
export declare function findDisallowedCodeUrls(sources: Iterable<ScanSource>): CodeUrlFinding[];