/**
 * Remote fetch — pull a repo's candidate files (all lexicons) from a git host so
 * the auditor can run on a URL, not just a local path. This is the ONLY audit
 * module that touches the network; the core stays pure.
 *
 * SSRF posture: only an allowlisted set of hosts is accepted; request URLs are
 * built from the parsed owner/repo (never a user-controlled host); redirects
 * are refused; and file count / size / total bytes / time are all capped.
 */
import type { AuditLexicon } from "./core.js";
export interface FetchOptions {
    /** Branch/tag/sha; defaults to the repo's default branch. */
    ref?: string;
    /** Server-side token (lifts rate limits). Never surfaced to callers. */
    token?: string;
    /** Max number of files to fetch (default 50). */
    maxFiles?: number;
    /** Max bytes for a single file; larger files are skipped (default 256 KiB). */
    maxBytesPerFile?: number;
    /** Max total bytes across all files; exceeding throws (default 2 MiB). */
    maxTotalBytes?: number;
    /** Per-request timeout in ms (default 10000). */
    timeoutMs?: number;
    /** Injectable fetch for testing. Defaults to the global fetch. */
    fetchImpl?: typeof fetch;
}
type HostKind = "github" | "forgejo" | "gitlab";
interface HostConfig {
    kind: HostKind;
    api: string;
    lexicon: AuditLexicon;
}
export declare class FetchError extends Error {
}
interface ParsedRepo {
    host: HostConfig;
    owner: string;
    repo: string;
}
/** Parse and validate a repo URL against the host allowlist (SSRF guard). */
export declare function parseRepoUrl(url: string): ParsedRepo;
/**
 * Fetch every candidate file in a repo (all lexicons), so a URL audit covers the
 * same ground as a local one. Returns raw {path, content}; classification (which
 * needs the lexicon plugins) is the caller's job via `classifyFiles`.
 */
export declare function fetchRepoFiles(url: string, opts?: FetchOptions): Promise<Array<{
    path: string;
    content: string;
}>>;
/**
 * Resolve an action ref (e.g. action="actions/checkout", ref="v4") to its
 * commit SHA via the GitHub API. Returns undefined on any failure — pinning
 * degrades gracefully to guidance. Actions are GitHub-hosted slugs, so this
 * queries api.github.com regardless of the audited repo's host.
 */
export declare function resolveActionSha(action: string, ref: string, opts?: {
    token?: string;
    fetchImpl?: typeof fetch;
    timeoutMs?: number;
}): Promise<string | undefined>;
interface ImageRef {
    registry: string;
    repository: string;
    tag: string;
}
/** Parse a Docker/OCI image reference. Returns undefined if already digested. */
export declare function parseImageRef(ref: string): ImageRef | undefined;
/**
 * Resolve a container image `name:tag` to its `sha256:...` digest via the OCI
 * registry v2 API (anonymous bearer-token challenge). Returns undefined on any
 * failure or for a non-allowlisted registry. The image ref is untrusted, so we
 * only ever contact allowlisted public registries (SSRF guard).
 */
export declare function resolveImageDigest(image: string, opts?: {
    fetchImpl?: typeof fetch;
    timeoutMs?: number;
}): Promise<string | undefined>;
/**
 * Resolve the audited repo's current commit SHA (best-effort) for the report
 * snapshot, so findings are anchored to an exact commit. Returns undefined on
 * any failure.
 */
export declare function resolveRepoCommit(url: string, opts?: {
    token?: string;
    fetchImpl?: typeof fetch;
    timeoutMs?: number;
}): Promise<string | undefined>;
export {};
//# sourceMappingURL=fetch.d.ts.map