/**
 * Every lockfile spelling a JavaScript package manager writes. One of these
 * being committed is what makes two installs resolve to the same tree.
 */
export declare const LOCKFILES: readonly string[];
/**
 * Whether a dependency spec resolves to whatever is newest at install time
 * rather than to a version something was validated against.
 *
 * Four families are recognized, and the narrowness of each is deliberate — every
 * over-eager rule here fails a correctly configured repository:
 *
 * - **Local protocols** resolve inside the repository and never float.
 * - **Registry aliases** (`npm:left-pad@latest`) hide the real spec behind the
 *   alias, so the part after the version separator is re-tested.
 * - **Repository clones** (`github:acme/widget`, `git+https://…/x.git`) float
 *   unless anchored to a `#<sha|tag>` revision, because the branch tip moves
 *   under the install. An archive URL (`…/widget-1.2.3.tgz`) is NOT a clone: it
 *   names one built artifact and is treated as pinned.
 * - **Plain ranges** float only when they name no version at all. A `>=` floor
 *   in `overrides` is the recommended way to force a patched transitive
 *   dependency, so ranges are otherwise left alone.
 * @param spec - The declared spec text
 * @returns True when the spec floats
 */
export declare function isFloatingSpec(spec: string): boolean;
/** What reading the manifest established. */
export type ManifestOutcome = {
    readonly kind: "ok";
    readonly manifest: Record<string, unknown>;
} | {
    readonly kind: "unassessable";
    readonly reason: string;
};
/**
 * Read and parse `package.json`, distinguishing "absent" from "unparseable" so
 * the SKIP reason can say which one happened.
 * @param root - Repository root
 * @returns The parsed manifest, or the reason it cannot be assessed
 */
export declare function readManifest(root: string): Promise<ManifestOutcome>;
/** One declared dependency spec, flattened out of the manifest blocks. */
export interface DependencySpec {
    readonly manifestPath: string;
    readonly block: string;
    readonly name: string;
    readonly spec: string;
}
/**
 * Flatten every versioned manifest block into one list of specs.
 * @param manifest - Parsed `package.json`
 * @param manifestPath - Repo-relative manifest path the specs came from
 * @returns Every declared spec across the versioned blocks
 */
export declare function collectSpecs(manifest: Record<string, unknown>, manifestPath?: string): readonly DependencySpec[];
/**
 * Find the committed lockfile, if any.
 * @param root - Repository root
 * @returns The lockfile name, or null when none is committed
 */
export declare function findLockfile(root: string): Promise<string | null>;
/**
 * Find where the repository audits its dependency tree: a CI job, a git hook, a
 * lefthook declaration, or an update bot.
 * @param root - Repository root
 * @returns The repo-relative path of the first gate found, or null
 */
export declare function findAuditGate(root: string): Promise<string | null>;
/**
 * Find where the repository installs dependencies in a way that must honor the
 * committed lockfile.
 * @param root - Repository root
 * @returns The repo-relative path of the first enforcing install gate found, or null
 */
export declare function findLockfileInstallGate(root: string): Promise<string | null>;
//# sourceMappingURL=doctor-readiness-supply-chain-scan.d.ts.map