import type { CodeUrlFinding } from "./vendor-host-code-scan.js";
import type { ScanSource, VendorHostFinding } from "./vendor-host-url.js";
export interface PackedFs {
    existsSync: (path: string) => boolean;
    statSync: (path: string) => {
        isFile: () => boolean;
    };
    readFileSync: (path: string) => Buffer;
}
/**
 * Read every file in the published package as a scan source.
 *
 * Driven by the packer's own file list rather than by walking `src/`: the `files`
 * negation globs mean the repository and the published tarball are different
 * sets of bytes, and the tarball is what a user installs.
 *
 * Bytes that will not decode are recorded as `undecodable` rather than skipped.
 * Skipping is how a single NUL byte makes a whole file invisible to a scanner.
 */
export declare function readPackedSources(packedFiles: readonly string[], root: string, fs: PackedFs, joinPath: (...parts: string[]) => string): ScanSource[];
export interface EntryPointCoverage {
    path: string;
    packed: boolean;
    read: boolean;
    certified: boolean;
}
/** Every path a consumer can `require`/`import`/execute, from package.json. */
export declare function declaredEntryPoints(manifest: unknown): string[];
/**
 * Anti-vacuity, per entry point.
 *
 * A global "we scanned more than N files" is satisfiable by files that have
 * nothing to do with the code under test: on an unbuilt tree the skill corpus
 * alone cleared the old threshold while `bin/`, `dist/` and everything they are
 * built from went unscanned. Coverage has to be asserted against the specific
 * artifacts a consumer runs.
 */
export declare function checkEntryPointCoverage(manifest: unknown, packedFiles: readonly string[], scanned: ReadonlyMap<string, {
    certified: boolean;
}>): EntryPointCoverage[];
export declare function uncoveredEntryPoints(coverage: readonly EntryPointCoverage[]): EntryPointCoverage[];
export declare function formatFindings(findings: ReadonlyArray<VendorHostFinding | CodeUrlFinding>): string;