/** One `controllers:` candidate, already parsed by the caller's PURL parser.
 *  Taking parsed candidates rather than manifest text is deliberate: a second
 *  PURL grammar here would drift from the one the loader and `publish` use the
 *  moment a qualifier moves, and this decides what gets pushed to a registry. */
export interface ControllerCandidate {
    readonly packageName: string;
    readonly versionSpec: string;
    readonly type: string;
    /** The candidate's `local_path` qualifier, already resolved to an absolute
     *  path by the caller's parser — the package directory as the PURL states it,
     *  rather than as a directory-name convention guesses it. */
    readonly localPath?: string;
}
/** A `pkg:npm/<name>@<version>` controller candidate this module owns. */
export interface OwnedNpmPackage {
    readonly name: string;
    /** The version the manifest pins, which must be the module's own. */
    readonly pinnedVersion: string;
    readonly directory: string;
    readonly packageVersion: string;
}
/**
 * The npm packages this module's manifest names and this module's own directory
 * provides. A PURL naming someone else's package resolves from npm as usual and
 * is not returned.
 */
export declare function ownedNpmPackages(controllers: readonly ControllerCandidate[], moduleDir: string): OwnedNpmPackage[];
/**
 * Why this package cannot be published as it stands, or undefined.
 *
 * A module has ONE version, and a manifest that pins a different one is how the
 * old arrangement failed silently: the package kept moving with its module while
 * the PURL stayed behind, so consumers loaded a tarball years older than the
 * manifest describing it. Stated here rather than repaired, because which of the
 * three is wrong is the author's to say.
 */
export declare function describeVersionSkew(owned: OwnedNpmPackage, moduleVersion: string | undefined): string | undefined;
/**
 * Whether npm already has this exact version.
 *
 * An UNREACHABLE registry classifies nothing — the rule `publishedTeloVersions`
 * already follows. `npm view` exits non-zero both for a version that does not
 * exist and for a network or auth failure, and reading the second as the first
 * sends the command on to `npm publish`, where the real cause surfaces as npm's
 * message instead of this one. So only the E404 signal answers "not published";
 * anything else is rethrown with what was actually being asked.
 */
export declare function isPublished(name: string, version: string): Promise<boolean>;
export declare function publishPackage(owned: OwnedNpmPackage): Promise<void>;
//# sourceMappingURL=npm-controller-package.d.ts.map