/**
 * npm registry per-package metadata fetch.
 *
 * Populates `LicenseFinding.releaseDate` (xlsx col 10 — Component
 * Release Date, D006) by querying
 *   `GET https://registry.npmjs.org/<pkg>`
 * and reading the `time[<version>]` ISO-8601 string for the exact
 * installed version. Falls back to `time.modified` when the exact
 * version isn't listed (extremely rare; usually means the installed
 * version is a legacy tag the registry re-hoisted).
 *
 * Design mirrors `osv.ts` / `epss.ts`:
 *   - Session-scoped cache keyed on package name (one HTTP call per
 *     package regardless of how many versions are installed).
 *   - AbortSignal.timeout keeps the analyzer from hanging.
 *   - Fetcher injectable for tests.
 *   - Graceful degradation — every IO failure maps to "no date",
 *     and `releaseDate` stays unset on the finding.
 *
 * Concurrency: `enrichReleaseDates` runs per-package fetches with a
 * bounded pool so a 1700-package bom doesn't fire 1700 simultaneous
 * sockets. Default pool size is tuned for the npm CDN's behavior.
 */
/** Shape of the fetcher — swapped in tests to avoid real network. */
export type NpmRegistryFetcher = (pkg: string) => Promise<Map<string, string> | null>;
/**
 * Fetch release dates for a set of `(package, version)` pairs from
 * the npm registry. Returns a map keyed by `package@version` →
 * ISO-8601 date string. Missing entries (unknown package, version
 * not in registry's `time`, network failure) are absent from the
 * map — callers treat absence as "date unknown" and leave
 * `releaseDate` unset on the LicenseFinding.
 *
 * Caches per-package responses so multiple versions of the same
 * package cost one HTTP call.
 */
export declare function enrichReleaseDates(pairs: ReadonlyArray<{
    package: string;
    version: string;
}>, fetcher?: NpmRegistryFetcher, concurrency?: number): Promise<Map<string, string>>;
/** Test-only — reset the process cache between tests. */
export declare function __clearNpmRegistryCache(): void;
//# sourceMappingURL=npm-registry.d.ts.map