/**
 * X-Ray NPM Package Inspector
 *
 * Downloads package metadata from registry.npmjs.org, analyses it for risk
 * signals, and optionally scans the tarball contents (Pro/deep scan).
 * Uses only Node.js built-ins (https module) — no new dependencies.
 */
import type { XRayResult } from './types.js';
/**
 * Decide whether another redirect hop may be followed. Returns the remaining
 * budget for the next hop, or `null` when the cap is exhausted. Pure + exported
 * so the redirect bound can be unit-tested without standing up a TLS server.
 */
export declare function nextRedirectBudget(redirectsLeft: number): number | null;
/**
 * Simple HTTPS GET returning the response body as a string.
 *
 * Bounds redirect following (max MAX_REDIRECTS hops) and applies a socket
 * timeout so a hostile / mis-configured registry cannot loop or hang us.
 */
export declare function httpsGet(url: string, redirectsLeft?: number): Promise<string>;
/**
 * A minimal readable-stream shape: emits `data` (Buffer), then `end`, or
 * `error`. Lets the decompressed-size guard be unit-tested against a tiny fake
 * stream without producing a real 100 MB tarball.
 */
export interface DecompressStream {
    on(event: 'data', listener: (chunk: Buffer) => void): unknown;
    on(event: 'end', listener: () => void): unknown;
    on(event: 'error', listener: (err: Error) => void): unknown;
    destroy?(err?: Error): unknown;
}
/**
 * Accumulate a decompressed stream into a single Buffer, aborting if the total
 * exceeds `maxBytes`. This is the gzip-bomb guard: a hostile .tgz can be tiny
 * on disk yet decompress to gigabytes, so we cap the INFLATED size, not just
 * the download. Pure (no fs/network) so it can be tested with a fake stream.
 */
export declare function collectDecompressed(stream: DecompressStream, maxBytes?: number): Promise<Buffer>;
/**
 * Inspect an npm package for hidden risk.
 *
 * @param packageName - npm package name (e.g. "lodash", "@scope/pkg")
 * @param deep - If true, downloads and scans the tarball (Pro feature)
 */
export declare function inspectNpmPackage(packageName: string, deep?: boolean): Promise<XRayResult>;
