/**
 * Bounded, in-memory inspection of npm package tarballs.
 *
 * Archives are never extracted to disk. The parser enforces compressed,
 * uncompressed, entry-count, per-file, and total-text limits before applying a
 * compact set of high-signal source rules.
 */
import { FindingCategory, Severity, type ContentScanSummary, type ScanFinding } from './types.js';
export declare const DEFAULT_MAX_UNPACKED_BYTES: number;
export declare const DEFAULT_MAX_ARCHIVE_ENTRIES = 5000;
export declare const DEFAULT_MAX_FILE_BYTES: number;
export declare const DEFAULT_MAX_SCANNED_BYTES: number;
export interface PackageContentScanOptions {
    readonly integrity?: string;
    readonly shasum?: string;
    readonly maxUnpackedBytes?: number;
    readonly maxEntries?: number;
    readonly maxFileBytes?: number;
    readonly maxScannedBytes?: number;
}
export interface PackageContentScanResult {
    readonly findings: readonly ScanFinding[];
    readonly summary: ContentScanSummary;
}
/** Public metadata for the rules that only run during an opt-in content scan. */
export declare const CONTENT_SCAN_RULES: readonly [{
    readonly id: "content-integrity-mismatch";
    readonly name: "Tarball integrity mismatch";
    readonly description: "Published integrity metadata does not match the downloaded tarball.";
    readonly severity: Severity.Critical;
    readonly category: FindingCategory.KnownMalicious;
}, {
    readonly id: "content-archive-invalid";
    readonly name: "Invalid package archive";
    readonly description: "The package tarball cannot be safely decompressed or parsed.";
    readonly severity: Severity.High;
    readonly category: FindingCategory.Informational;
}, {
    readonly id: "content-archive-path";
    readonly name: "Unsafe archive path";
    readonly description: "An archive entry attempts to escape the package root.";
    readonly severity: Severity.Critical;
    readonly category: FindingCategory.KnownMalicious;
}, {
    readonly id: "content-archive-link";
    readonly name: "Escaping archive link";
    readonly description: "A symbolic or hard link targets a path outside the package root.";
    readonly severity: Severity.High;
    readonly category: FindingCategory.KnownMalicious;
}, {
    readonly id: "content-native-binary";
    readonly name: "Bundled native or executable content";
    readonly description: "The published archive contains native, executable, or WebAssembly files.";
    readonly severity: Severity.Low;
    readonly category: FindingCategory.BinaryDownload;
}, {
    readonly id: "content-remote-shell";
    readonly name: "Remote content piped to a shell";
    readonly description: "Published source downloads remote content and passes it to a command shell.";
    readonly severity: Severity.Critical;
    readonly category: FindingCategory.InstallScript;
}, {
    readonly id: "content-obfuscated-exec";
    readonly name: "Obfuscated dynamic code execution";
    readonly description: "Published source combines encoded payloads with dynamic execution.";
    readonly severity: Severity.High;
    readonly category: FindingCategory.CodeObfuscation;
}, {
    readonly id: "content-network-exec";
    readonly name: "Network and process execution";
    readonly description: "The same published file performs network access and child-process execution.";
    readonly severity: Severity.High;
    readonly category: FindingCategory.BinaryDownload;
}, {
    readonly id: "content-process-exec";
    readonly name: "Process execution capability";
    readonly description: "Published runtime source imports or invokes child-process functionality.";
    readonly severity: Severity.Medium;
    readonly category: FindingCategory.SuspiciousDep;
}, {
    readonly id: "content-sensitive-network";
    readonly name: "Sensitive environment access with networking";
    readonly description: "Published source reads sensitive environment data and performs network access.";
    readonly severity: Severity.High;
    readonly category: FindingCategory.SensitiveExposure;
}, {
    readonly id: "content-scan-incomplete";
    readonly name: "Incomplete package-content scan";
    readonly description: "Configured safety limits prevented the entire archive from being inspected.";
    readonly severity: Severity.Medium;
    readonly category: FindingCategory.Informational;
}, {
    readonly id: "content-scan-unavailable";
    readonly name: "Package-content scan unavailable";
    readonly description: "The published tarball could not be downloaded or inspected.";
    readonly severity: Severity.Medium;
    readonly category: FindingCategory.Informational;
}];
/** Analyze a downloaded npm `.tgz` without extracting it to disk. */
export declare function analyzePackageTarball(archive: Buffer, options?: PackageContentScanOptions): PackageContentScanResult;
//# sourceMappingURL=package-content.d.ts.map