/**
 * Embedded Identifier Extraction (Phase 2 — identification engine, deep rung)
 *
 * Scans a plugin JAR's *contents* for distribution-channel identifiers that
 * stores and authors embed in the binary:
 *
 * - SpigotMC premium purchase watermarks
 *   (`premium.php?user_id=…&resource_id=N&nonce=…`) — store-injected into
 *   every premium download; 11/74 of the measured fleet carry one, and they
 *   are exactly the paid plugins that are hardest to identify any other way.
 * - Author-embedded update-checker URLs (`update.php?resource=N`,
 *   `api.spiget.org/v2/resources/N`).
 * - Store / repo resource URLs (spigotmc.org, polymart.org / voxel.shop,
 *   builtbybit.com, groupez.dev, modrinth.com, github.com).
 * - UNRESOLVED premium placeholders (`%%__RESOURCE__%%`, `%%__POLYMART__%%`)
 *   — literal tokens the store injector never filled in. They prove
 *   "premium-store build" with NO resource id (identifier 'unknown',
 *   method 'premium-marker', confidence 0.3 — review-only, never assigned).
 *
 * Most of these strings live inside DEFLATE-compressed `.class` entries, so a
 * raw-byte grep is not enough: every text-bearing zip entry is decompressed
 * and stream-scanned. The raw file head/tail (which covers the zip comment —
 * the EOCD comment sits at the very end of the file) is also scanned, since
 * some watermarks live there uncompressed.
 *
 * PERFORMANCE: this is a full decompression of the JAR (bounded by the caps
 * below) — orders of magnitude costlier than the central-directory-only
 * metadata pass in scanner.ts. The mitigation is the LAZY-RUNG CONTRACT:
 * callers invoke {@link extractEmbeddedIdentity} only for plugins that are
 * still unidentified after the cheap rungs (hash lookup, pom.properties,
 * website hint), and should cache results keyed by the JAR's hash.
 *
 * PRIVACY RULE (absolute): premium watermarks embed the BUYER's user id,
 * download nonce, and (Polymart) license keys. Those values are parsed only
 * to locate the resource id and are discarded in-memory — they must never be
 * persisted, logged, returned, or included in error/detail strings. Only
 * `{channel, identifier}` ever leaves this module. Regexes capture nothing
 * but the resource id / slug; full match text is never stored.
 *
 * @since v2.13.0 (Phase 2 — identification engine)
 */
import type { IdentificationEvidence } from './identification-types.js';
/**
 * Extract distribution-channel identifiers embedded in a JAR's contents.
 *
 * LAZY RUNG: callers invoke this only for plugins still unidentified after
 * the cheap rungs — it fully decompresses the JAR (see module doc for cost
 * and caps). This module performs NO wiring into the scan pipeline itself.
 *
 * Returns up to {@link MAX_EVIDENCE_PER_JAR} evidence records, deduped by
 * `(channel, identifier)` and sorted by confidence (descending; channel then
 * identifier as deterministic tiebreakers). Multiple channels may be returned
 * — the identification ladder ranks them.
 *
 * @throws {FilesystemError} when the JAR file cannot be read at all. A file
 *   that is readable but not a valid zip is NOT an error: its raw head/tail
 *   bytes are still scanned and any evidence found there is returned.
 */
export declare function extractEmbeddedIdentity(jarPath: string): Promise<IdentificationEvidence[]>;
//# sourceMappingURL=embedded-identifier.d.ts.map