/**
 * Pure CI dependency-scan helpers extracted from the legacy `ci` CLI command.
 *
 * This module is intentionally free of CLI concerns: no `commander` option
 * parsing, no i18n (`t()`), no telemetry recording, and no console output.
 * The {@link NpmSafeEngine.ciScan} method composes these helpers with the
 * engine to produce a {@link CiReport}; rendering and exit-code mapping are
 * the caller's responsibility.
 *
 * @module scanner/ci-scan
 */
import { SecurityLevel } from './types.js';
/**
 * Severity ordering used for the failure gate: lower rank = more severe.
 *
 * Exported so the engine's `ciScan` method can evaluate the fail gate without
 * re-declaring this mapping.
 */
export declare const LEVEL_RANK: Readonly<Record<string, number>>;
/**
 * Display order of security levels (used for option help text in the CLI).
 */
export declare const LEVEL_ORDER: readonly string[];
/** A dependency name extracted from a manifest or lockfile. */
export interface Dependency {
    readonly name: string;
}
/** Per-package result within a {@link CiReport}. */
export interface PackageResult {
    readonly name: string;
    readonly exists: boolean;
    readonly version: string;
    readonly level: string;
    readonly score: number;
    readonly findingCount: number;
    readonly error?: string;
}
/** Aggregated CI scan report for a project directory. */
export interface CiReport {
    readonly dir: string;
    readonly scannedAt: string;
    readonly dependencyCount: number;
    readonly failLevel: string;
    readonly failed: boolean;
    readonly summary: Readonly<Record<string, number>>;
    readonly packages: readonly PackageResult[];
}
/** Options accepted by {@link NpmSafeEngine.ciScan}. */
export interface CiScanOptions {
    /** Project directory containing `package.json`. @default process.cwd() */
    readonly dir?: string;
    /** Fail when any dependency reaches this level. @default SecurityLevel.Dangerous */
    readonly failLevel?: SecurityLevel;
    /** Scan every dependency in `package-lock.json` (including transitive). */
    readonly lockfile?: boolean;
    /** Only scan `dependencies` (skip devDependencies). */
    readonly prod?: boolean;
    /** Download and inspect every dependency tarball. */
    readonly deep?: boolean;
    /** Optional external abort signal for cooperative cancellation. */
    readonly signal?: AbortSignal;
}
/**
 * Read direct dependencies (and optionally devDependencies) from a manifest.
 *
 * @param dir - Project directory containing a `package.json` file.
 * @param includeDev - When `true`, also include `devDependencies`.
 * @returns A list of dependency names (deduplicated, insertion-ordered).
 * @throws {Error} When `package.json` cannot be read or parsed.
 */
export declare function readDependencies(dir: string, includeDev: boolean): Dependency[];
/**
 * Read every package (including transitive dependencies) from a
 * `package-lock.json` (npm lockfile v2/v3 `packages` map, with a fallback to
 * the v1 `dependencies` tree). When `includeDev` is `false`, the result is
 * restricted to the direct `dependencies` declared in `package.json` (`--prod`).
 *
 * @param dir - Project directory containing a `package-lock.json` file.
 * @param includeDev - When `false`, restrict to `dependencies` from `package.json`.
 * @returns A list of dependency names (deduplicated).
 * @throws {Error} When `package-lock.json` cannot be read or parsed.
 */
export declare function readLockfileDependencies(dir: string, includeDev: boolean): Dependency[];
//# sourceMappingURL=ci-scan.d.ts.map