/**
 * Which package names a lockfile pins (change: add-phantom-reference-findings).
 *
 * A dependency added to a manifest but never installed is a reference that resolves nowhere at
 * build time: the manifest declares it, the lockfile does not pin it, and CI fails on a clean
 * install. The check needs one question answered per ecosystem — "does this lockfile pin a package
 * of this name?" — so each reader returns the NAME SET only. Versions, integrity hashes, and
 * resolution trees are deliberately not modelled.
 *
 * Every reader is pure and returns `null` when it cannot understand the file, because
 * "this lockfile pins nothing" and "this lockfile could not be read" lead a reader to opposite
 * conclusions, and only the first may produce a finding.
 */
import type { PackageEcosystem } from './external-packages.js';
/** The lockfiles each ecosystem's manifests are paired with, in the order they are looked for. */
export declare const ECOSYSTEM_LOCKFILES: Readonly<Record<PackageEcosystem, readonly string[]>>;
/**
 * Compare two package names of one ecosystem as the ecosystem itself does: Python distribution
 * names are case-insensitive with `-`, `_` and `.` equivalent (PEP 503), and Cargo crate names are
 * written with `-` in a manifest and `_` in a `use` path. npm and Go names are exact.
 */
export declare function normalizePackageName(ecosystem: PackageEcosystem, name: string): string;
/**
 * The package names a lockfile pins, or `null` when the file is not a lockfile this reader
 * understands or could not be parsed. `lockfileName` is the file's base name.
 */
export declare function pinnedNames(lockfileName: string, text: string): Set<string> | null;
/**
 * Whether a lockfile's pin set covers a package. Go is a prefix match, because an import path
 * (`github.com/x/y/pkg/sub`) is longer than the module path the lockfile pins (`github.com/x/y`);
 * the other ecosystems compare normalized names.
 */
export declare function pinsPackage(ecosystem: PackageEcosystem, pins: ReadonlySet<string>, name: string): boolean;
//# sourceMappingURL=lockfile-pins.d.ts.map