/**
 * Static analysis rule engine for npm package security scanning.
 *
 * Pure regex/string analysis — no network calls, no LLM. The engine registers
 * a set of {@link ScanRule} implementations and aggregates their findings into
 * a {@link StaticScanReport} with a numeric score and overall security level.
 */
import { ContentScanSummary, FindingCategory, ScanFinding, ScanRule, Severity, StaticScanReport } from './types.js';
import { RuleConfigManager } from './rule-config.js';
/** All built-in static analysis rules, in registration order. */
export declare const BUILTIN_RULES: readonly ScanRule[];
/** Ids of the built-in rules, used to label rule provenance. */
export declare const BUILTIN_RULE_IDS: ReadonlySet<string>;
/** A rule together with its effective (post-config) status. */
export interface RuleDescriptor {
    /** Stable unique identifier for the rule. */
    readonly id: string;
    /** Human-readable name of the rule. */
    readonly name: string;
    /** Description of what the rule detects. */
    readonly description: string;
    /** Effective severity (after config overrides). */
    readonly severity: Severity;
    /** Category assigned to findings produced by this rule. */
    readonly category: FindingCategory;
    /** Whether the rule is enabled (after config overrides). */
    readonly enabled: boolean;
    /** Whether the rule ships with the engine or was loaded from a plugin. */
    readonly source: 'builtin' | 'plugin';
}
/**
 * Static analysis engine that runs a set of {@link ScanRule}s against a
 * package's README and package.json and aggregates the findings into a
 * {@link StaticScanReport}.
 */
export declare class StaticAnalyzer {
    private readonly rules;
    private readonly config;
    /**
     * @param rules - Optional custom rule set. Defaults to all built-in rules.
     * @param config - Optional per-rule configuration manager whose overrides
     *   (enabled / severity) are applied at analysis time.
     */
    constructor(rules?: ScanRule[], config?: RuleConfigManager);
    /**
     * Register a rule at runtime. A rule with the same id replaces the existing
     * one (keeping its position in the registration order).
     *
     * @param rule - The rule to register.
     */
    registerRule(rule: ScanRule): void;
    /**
     * Remove a rule by id.
     *
     * @param ruleId - Id of the rule to remove.
     * @returns `true` if a rule was removed, `false` if no such rule exists.
     */
    unregisterRule(ruleId: string): boolean;
    /**
     * Describe every registered rule with its effective status.
     *
     * @returns Rule descriptors in registration order.
     */
    listRules(): RuleDescriptor[];
    /**
     * Run all enabled rules against the given README and package.json, aggregate
     * the findings, and compute a numeric score plus overall security level.
     *
     * Scoring starts at 100 and subtracts a per-finding weight based on severity:
     * critical=-25, high=-15, medium=-8, low=-3. The score is clamped to [0, 100].
     *
     * Overall level: score >= 80 → Safe, >= 50 → Suspicious, >= 20 → Dangerous,
     * else Unknown.
     *
     * @param readme - README content as a string (may be empty).
     * @param packageJson - Parsed package.json, if available.
     * @returns The aggregated static scan report.
     */
    analyze(readme: string, packageJson?: Record<string, unknown>, supplementalFindings?: readonly ScanFinding[], contentScan?: ContentScanSummary): StaticScanReport;
    /**
     * Map a numeric score to a {@link SecurityLevel}.
     *
     * @param score - Clamped score in [0, 100].
     * @returns The corresponding security level.
     */
    private levelFromScore;
}
//# sourceMappingURL=static-rules.d.ts.map