import type { ToolsetDefinition } from "../types.js";
/**
 * Normalize a PURL for duplicate-detection comparisons.
 *
 * PURL spec: `scheme:type/namespace/name@version?qualifiers#subpath`
 * We want two PURLs that describe the same package (ignoring version,
 * qualifiers, and subpath) to produce the same key.
 *
 * Approach:
 *   1. Drop the subpath (`#...`) and qualifiers (`?...`).
 *   2. Find the version separator `@`, but only if it appears AFTER the
 *      last `/` — this prevents mis-splitting on an encoded/unencoded `@`
 *      that might appear earlier in a namespace or qualifier value.
 *   3. Lowercase for case-insensitive match.
 *
 * Spec-compliant scoped npm purls encode the `@` in the namespace as `%40`
 * (e.g. `pkg:npm/%40angular/core@1.0.0`), so the last-slash heuristic is safe.
 */
export declare function normalizePurl(s: string): string;
/**
 * Chain of custody get returns a top-level JSON array. MCP harness_get declares an
 * output schema that requires structuredContent (objects only) — wrap as { items, total }.
 */
export declare function chainOfCustodyExtract(raw: unknown): Record<string, unknown>;
/** Presigned SBOM download URL — surface download_url to the user; do not fetch the blob. */
export declare function sbomDownloadExtract(raw: unknown): Record<string, unknown>;
export declare const scsToolset: ToolsetDefinition;
//# sourceMappingURL=scs.d.ts.map