@bloodhound-rs/core 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @bloodhound-rs/core
 
+## 0.2.0
+
+### Minor Changes
+
+- 55094b9: Replace full/compact reports with Manifest v2, a typed Rust resource graph and unified pollution findings. CSS is discovered without scanning CSS rules. Fix global-alias writes, cleanup matching, finite dependency candidates, redirect/import-map context and UTF-16 location performance.
+
+  This is a breaking pre-1.0 API change: remove report/index/query, checkpoint/resume, JSONL, timing and adapter helpers; use scan/scanHtml/scanJs, version/defaults and dependencyMode instead. Migrate the Rollup/Rolldown plugin to v2 and add per-rule severity configuration.
+
+- 5bca92b: Accept HTML and JavaScript strings as source text and return a compact manifest by default. Use explicit file or URL source objects for loading, and `reportFormat: 'full'` for detailed reports and GlobalIndex. Resolve HTML bases and import maps automatically, and report missing bases for relative references in unnamed text.
+
+  Remove internal hashes and duplicate mutation findings from the default output, group coverage gaps with counts, and retain source locations, dependency edges, global modifications, DOM/CSS findings, and incomplete-scan status. Add JSON stdout examples with caller-owned persistence. Split Rust loading, scheduling, JavaScript analysis, markup parsing, and reporting into focused modules.
+
+### Patch Changes
+
+- 5bca92b: Handle large scan reports in GlobalIndex, report helpers, and checkpoint inputs by converting report collections record by record. Preserve per-record JSON depth and expansion limits, support large query outputs, and buffer report writes before atomically replacing the output file.
+- 55094b9: External `sourceMappingURL` references now consult `resourceMappings` before loading, so bundlers can supply in-memory source maps alongside in-memory chunks.
+- e814af8: Distribute native binaries as separate optional packages selected by operating system, CPU architecture, and Linux libc. Keep the core package limited to the generated loader, type declarations, and schemas.
+- 5bca92b: Add optional scan timing diagnostics for loading, analysis, record construction, dependency resolution, and report generation, with per-resource durations and JavaScript parser, semantic, and traversal breakdowns.
+- 55094b9: Keep scripts after self-closing SVG/MathML elements visible to HTML scanning, and exclude iframe/srcdoc child globals from recursive analysis. Detect bare global listener calls and pair removals by event and handler reference, independent of receiver, capture and conditions.
+
+  Use bundler source-map metadata for custom, inline and hidden maps. Include the Rollup plugin in Changesets preparation, package assembly and publishing, including plugin-only releases.
+
+- 5bca92b: Keep entry-path pagination stable across repeated queries and reject malformed release repository owners. Add automated Rust, SDK, and release-script regression coverage to CI.
+
 ## 0.1.1
 
 ### Patch Changes

package/README.md

@@ -1,164 +1,143 @@
 # @bloodhound-rs/core
 
-A Rust SDK for static analysis of browser resources. Rust exports the public methods directly, and napi-rs generates the npm loader and method declarations.
+A Rust-backed SDK that statically scans HTML and JavaScript for writes to shared globals, DOM insertion, and style injection. The result is a JSON-serializable Manifest v2 with source locations, dependency edges, severity, and a shortest entry-to-source chain. Input code is never executed.
 
-| Component                                                                    | Implementation              |
-| ---------------------------------------------------------------------------- | --------------------------- |
-| JavaScript parsing, scopes, aliases, and bounded evaluation                  | Rust + Oxc                  |
-| HTML extraction and CSS parsing                                              | Rust + html5gum / cssparser |
-| Fetching, import maps, recursive queues, budgets, cancellation, and recovery | Rust                        |
-| Global indexes, report diffs, reports, JSONL, and schema validation          | Rust                        |
-| npm loader and method declarations                                           | Generated by napi-rs        |
+CSS files and inline `<style>` blocks are discovered and listed. CSS selectors, custom properties, animations, keyframes, and CSS imports are not analyzed. Direct writes to document-level inline styles remain detectable.
 
-Results describe static accesses and potential issues. They do not prove that code executed or modified runtime state. The scanner never executes the code it analyzes.
-
-## Build
-
-Requires Node.js 22+, pnpm 10.20.0, Rust 1.97+, and the platform's C/C++ build tools.
-
-```sh
-pnpm install --frozen-lockfile
-pnpm build
-pnpm typecheck
-cargo check --locked
-```
-
-`napi build` generates `dist/index.js`, `dist/index.d.ts`, and a platform-specific `.node` file from the exports in `native/src/lib.rs`. `src/types.ts` defines data structures such as reports and emits only `dist/types.d.ts`, with no runtime code. Loading fails if the native binary is missing.
-
-## Local examples
-
-Run from the repository root:
+## Install
 
 ```sh
-pnpm build
-pnpm example
-pnpm example:html
+pnpm add @bloodhound-rs/core
 ```
 
-| Command             | Example                                                                                                                    | Report                             |
-| ------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
-| `pnpm example`      | Scan JavaScript and query global reads, writes, and potential conflicts                                                    | `outputs/example/report.json`      |
-| `pnpm example:html` | Discover the HTML base URL, import map, inline and external scripts, and styles, then recursively scan module dependencies | `outputs/example-html/report.json` |
-
-The examples import the SDK by package name and read local source files without executing them or making network requests. After building, either example can be run independently.
+Requires Node.js 22+. Keep optional dependencies enabled so the native package for the current platform is installed. Supported targets are macOS arm64/x64, Linux glibc arm64/x64, and Windows x64. Linux musl is not supported.
 
 ## SDK
 
 ```ts
-import { scanJs, scanHtml, scanResource, GlobalIndex } from '@bloodhound-rs/core';
-
-const report = await scanJs('./dist/app.js', {
-  scriptMode: 'classic',
-  executionEnvironment: 'window',
-  dependencyMode: 'recursive',
-  scopeKey: 'release-page',
-  versions: { scmId: 'artifact-revision' },
-  jsonlPath: './scan.jsonl',
+import { scan, scanHtml, scanJs, defaults, version } from '@bloodhound-rs/core';
+
+const manifest = await scanHtml(htmlText, {
+  resourceUrl: 'https://example.com/page.html',
+  budgets: { maxResources: 200, timeoutMs: 60_000 },
 });
 
-const page = await scanHtml('https://example.com/page.html');
+for (const finding of manifest.findings) {
+  const source = manifest.sources.find((s) => s.id === finding.source);
+  console.log(finding.severity, finding.rule, finding.target, source?.chain, finding.location);
+}
 
-const single = await scanResource(
-  {
-    kind: 'js',
-    source: {
-      type: 'content',
-      resourceUrl: 'https://example.com/app.js',
-      content: 'globalThis.sharedConfig = {};',
-    },
-  },
-  { scriptMode: 'module', executionEnvironment: 'window' },
-);
+await scanJs('window.shared = 1', { scriptMode: 'module' });
+await scanHtml({ type: 'file', path: './page.html' });
+await scanHtml({ type: 'url', url: 'https://example.com/page.html' });
+await scan([{ kind: 'js', source: { type: 'file', path: './app.js' }, scriptMode: 'module' }]);
 
-const index = new GlobalIndex(report);
-for (const target of index.findTargets(['sharedConfig'], 'global-object')) {
-  console.log(index.sources(target.targetId));
-  console.log(index.entryPaths(target.targetId, { limit: 20 }));
-}
-console.log(index.conflicts());
+process.stdout.write(JSON.stringify(manifest) + '\n');
 ```
 
-`scan(entries, options)` accepts multiple entry points in one analysis. `scanResource` scans only the specified resource while still recording dependency edges. String inputs represent file paths or HTTP(S) / file URLs. Use `type: 'content'` for source text. Scan CSS with `scanResource({ kind: 'css', source })` or `scan`.
+Strings always mean source text. File paths and URLs use explicit source objects. Content sources accept `{ type: 'content', content, resourceUrl? }`. Supply a logical URL or `baseUrl` to resolve relative references in supplied text. Absolute dependencies and inline scripts can be scanned without a URL.
 
-`defaults()` returns a plain object containing the default budgets and version information.
+`scan`, `scanHtml`, and `scanJs` return the same `Promise<Manifest>`. JavaScript defaults to `classic`; choose `module` for ESM. HTML script tags determine their own mode. Recursive scanning is the default. `dependencyMode: 'single'` analyzes entries only and lists their dependencies without following them, including inline HTML scripts.
 
-For JavaScript entry points, provide `scriptMode` and `executionEnvironment` explicitly. Missing values remain `unknown` and produce coverage gaps. HTML derives script modes from element attributes and defaults to the Window environment. Workers and iframes use separate scopes.
+## Findings
 
-## HTML discovery and optional context
+| Rule                   | Examples                                                                        | Default severity |
+| ---------------------- | ------------------------------------------------------------------------------- | ---------------- |
+| `global-write`         | `window.config = …`, classic top-level `var`, sloppy implicit globals           | warning          |
+| `document-write`       | `document.body.className = …`, document attributes                              | warning          |
+| `builtin-mutation`     | `Array.prototype.x = …`, `Object.assign = …`                                    | error            |
+| `host-api-override`    | `window.fetch = …`, `history.pushState = …`                                     | error            |
+| `dom-insertion`        | `document.body.appendChild(…)`, selected element insertion, `document.write(…)` | warning          |
+| `style-injection`      | injected `<style>` or stylesheet `<link>`, adopted stylesheets                  | warning          |
+| `document-style-write` | `document.body.style.overflow = …`                                              | warning          |
+| `global-listener`      | `window.addEventListener(…)`, document listeners                                | warning          |
+| `html-global-style`    | `<html style="…">`, `<body style="…">`                                          | info             |
 
-A typical HTML scan needs only a file path or URL:
+Ordinary element `style=` attributes in SSR markup are not findings. Expected browser state changes such as `document.title`, `document.cookie`, and navigation are excluded. A severity label is a default consumer policy, not proof that code is harmful.
 
-```ts
-const report = await scanHtml('./page.html');
-```
+An inserted node is suppressed when it is removed later in the same straight-line block, or inside a returned cleanup function. A listener is suppressed when the same file contains a removal with the same event and handler reference. Conditions, source order, receiver and capture do not affect listener pairing. Handler aliases and arguments passed to local helpers are resolved; matching an event alone is insufficient. Inline anonymous callbacks remain outside the listener rule, and `once`/`signal` options count as their own removal mechanisms. Pairing does not prove that teardown executes.
+
+The scan follows scripts belonging to the current document. Iframe and `srcdoc` references are listed as `not-followed / iframe-isolated-global`; their child documents and scripts are not loaded or analyzed. SVG/MathML contents are skipped with a coverage gap, and ordinary HTML after a self-closing foreign element remains eligible for scanning.
 
-The scanner reads `<base href>`, `<script type="importmap">`, script `src` and `type` attributes, stylesheet links, and inline content, then follows module dependencies. Import maps and resource lists already present in the HTML need no additional arguments. The scanner does not execute scripts or discover page state created only at runtime.
+## Manifest v2
 
-Use the following options when the input lacks page context or resources need to be loaded from local files:
+| Field                             | Meaning                                                                              |
+| --------------------------------- | ------------------------------------------------------------------------------------ |
+| `schemaVersion`, `scannerVersion` | Format and scanner versions                                                          |
+| `status`                          | `completed`, `partial`, `failed`, or `cancelled`                                     |
+| `dependencyMode`                  | `single` or `recursive`                                                              |
+| `summary`                         | Source, finding, severity, dependency and gap counts; bytes and scan duration        |
+| `entries`                         | Entry source IDs, in request order                                                   |
+| `sources`                         | Logical URL, kind, mode, status, hash, referrers and shortest source chain           |
+| `findings`                        | Rule, severity, target, operation, confidence, location, snippet and optional detail |
+| `dependencies`                    | Source/target IDs, specifier, URL, status, reason and discovery location             |
+| `gaps`                            | Coverage limits grouped by source and reason, with occurrence counts                 |
 
-| Option                           | Purpose                                                                                                                                                  |
-| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `importMap` / `importMapBaseUrl` | Supply the original page's module mappings and resolution base when scanning JavaScript separately                                                       |
-| `resourceUrl`                    | Supply the original online URL when scanning an offline file                                                                                             |
-| `baseUrl`                        | Supply a document base when the input lacks one. A valid HTML `<base>` is read automatically                                                             |
-| `resourceMappings`               | Map resolved resource URLs to local files or source text, such as build artifacts that have not been deployed. This is separate from the HTML import map |
+Lines are 1-based, columns are 0-based UTF-16 units. Inline findings use fragment-relative coordinates; `source.inline` gives their origin in the parent. For a first-line finding, add the origin column; for later lines, use the finding column unchanged. The bundler plugin performs this conversion automatically. Source maps optionally add `location.original`.
 
-## Offline pages and local resource mappings
+CSS dependency edges use `not-followed` with `reason: 'css-not-analyzed'`. CSS dependencies do not create analyzed source records. An explicit `kind: 'css'` entry is loaded and listed with no findings. Unloaded or unparseable JavaScript produces unresolved edges and coverage gaps.
 
-`resourceUrl` is the logical resource address, and `baseUrl` is the document base. External module dependencies resolve against the module URL, while inline module dependencies resolve against the document base. Browser module resolution does not search Node.js package directories or infer file extensions.
+## Offline scans, limits and cancellation
 
 ```ts
-const report = await scanHtml('./page.html', {
-  resourceUrl: 'https://example.com/page.html',
+const controller = new AbortController();
+const manifest = await scanJs('import "./shared.js";', {
+  scriptMode: 'module',
+  resourceUrl: 'https://example.com/app.js',
+  access: { protocols: [] },
   resourceMappings: {
-    'https://example.com/assets/app.js': {
-      type: 'file',
-      path: './artifacts/app.js',
-    },
+    'https://example.com/shared.js': { type: 'content', content: 'window.shared = 1;' },
   },
-  access: { fileRoots: ['./artifacts', '.'], hosts: ['example.com'] },
+  sourceMaps: true,
+  signal: controller.signal,
 });
 ```
 
-HTTP fetching uses Rust's `reqwest`. `requestHeaders` groups headers by destination `host[:port]`. After a redirect, the scanner checks access permissions again and selects headers for the new host. Use `proxy` to configure a proxy. Authentication settings are excluded from reports and checkpoint configuration and must be supplied again when resuming.
+`resourceMappings` supplies content or local files for resolved URLs, including source maps. `access` can restrict schemes, hosts and file roots. `requestHeaders` is keyed by host and optional port. Redirects are checked at every hop. URLs with embedded credentials are rejected.
 
-## Output and recovery
+`excludeUrls` takes regex source strings (Rust regex syntax, no lookaround) such as `['/vendor/', '\\.min\\.js($|\\?)']`. A recursively discovered dependency whose resolved logical URL matches is not loaded or analyzed. It stays visible in `dependencies` as `not-followed` with `reason: 'excluded'` and creates no source record. If an entry itself matches, the scan rejects instead of returning an empty manifest. Inline scripts are not matched.
 
-| API or option                                        | Output                                                                                        |
-| ---------------------------------------------------- | --------------------------------------------------------------------------------------------- |
-| `Report`                                             | resources, analysisInstances, references, globalTargets, globalAccesses, findings, unresolved |
-| `jsonlPath`                                          | JSONL written by Rust as resources are processed                                              |
-| `reportPath`                                         | A JSON report written by Rust                                                                 |
-| `indexArtifact(report)`                              | A standalone versioned index                                                                  |
-| `adaptReport(report, 'build' / 'page', metadata)`    | A report adapted for build or page integrations                                               |
-| `diffReports(before, after)`                         | Added and removed items, plus changes to items that can be matched uniquely                   |
-| `runtimeCandidates(report, evidence)`                | Static candidate sources, without treating them as confirmed runtime behavior                 |
-| `checkpointPath` / `resumeScan(checkpoint, options)` | Save completed records and the pending queue, then fetch and validate inputs again on resume  |
+`defaults().budgets` reports resource count, byte, depth, AST-step, candidate, concurrency and timeout limits. Workers each load then analyze one resource; their count is `min(concurrency, analysisConcurrency)`. Cancellation is cooperative. A blocking network request can take up to its request timeout to return. Budget stops and unknown dynamic dependencies remain visible in the manifest.
 
-JSONL records update entities by ID. A reference is emitted again when its target analysis instance completes. `resetAnalysis` indicates an updated cross-module summary: consumers first remove that instance's previous accesses, findings, unresolved items, and outgoing edges, then accept the new records. The final `summary` records scan status and coverage statistics. A file without a `summary` indicates that the scan did not finish normally.
+The scanner tracks local aliases, IIFE parameters, finite string candidates and browser import maps. It does not infer arbitrary function results or cross-module exported values. Worker environments, foreign HTML content and late import maps currently produce explicit coverage gaps. See [supported behavior and limits](docs/support.md).
 
-Use `AbortSignal` for cancellation. Rust checks the cancellation flag and stops enqueueing resources, reading downloads, and starting further analysis. Blocking network calls are bounded by `resourceTimeoutMs`. Cancellation is checked after an individual Oxc parse returns. Resuming validates all entry points and context again before reusing results.
+## Rollup / Rolldown
 
-Checkpoints preserve access restrictions, resource mappings, and source map settings. Resume options can explicitly override them. Callers must supply authentication headers and proxy settings again. When resuming an older checkpoint that lacks these settings, provide them in the resume options.
+```js
+import { bloodhound } from '@bloodhound-rs/rollup-plugin';
 
-```ts
-const controller = new AbortController();
-const pending = scanJs('./app.js', {
-  scriptMode: 'module',
-  executionEnvironment: 'window',
-  signal: controller.signal,
-  checkpointPath: './checkpoint.json',
-});
-// controller.abort();
-const report = await pending;
+export default {
+  input: 'src/main.js',
+  output: { dir: 'dist', format: 'es', sourcemap: 'hidden' },
+  plugins: [
+    bloodhound({
+      allowGlobals: ['window.__APP_VERSION__'],
+      rules: { 'host-api-override': 'error', 'builtin-mutation': 'error' },
+    }),
+  ],
+};
 ```
 
-## Packaging and releases
+The plugin scans emitted HTML or entry chunks in memory, follows bundle dependencies, emits `bloodhound.manifest.json`, and maps diagnostics back to original sources. It runs offline by default. See the [plugin documentation](packages/rollup-plugin/README.md).
+
+## Manifest Playground
+
+Run `pnpm playground` in this repository and open `http://127.0.0.1:4173`. Drop a Manifest v2 JSON file to explore findings, source files, dependency relationships and coverage gaps. Group by rule/type, file, URL folder or entry dependency tree; select any record to see its snippet, location and related files.
+
+The viewer processes files locally in the browser. It displays the manifest's evidence and does not infer missing listener cleanup or business application ownership. See the [Playground documentation](playground/README.md) for navigation, build commands and interpretation.
+
+## Development and migration
 
 ```sh
-pnpm pack
+pnpm install --frozen-lockfile
+pnpm build
+pnpm test
+pnpm example
+pnpm example:html
+pnpm example:rollup
+pnpm example:rolldown
 ```
 
-Local packaging builds the native binary and type declarations and includes `dist/`, schemas, and the available platform `.node` files. `.github/workflows/release.yml` uses Changesets to manage versions, build multiple platforms, publish PR beta versions, and publish stable releases from the main branch. Run `pnpm changeset` for changes that require a release. See [Releasing](docs/releasing.md) for account and npm Trusted Publishing configuration. Linux builds target glibc; musl binaries are not provided. Local validation does not establish that all platform builds pass.
+The build needs Rust 1.97+ for Oxc 0.154.0. [Architecture](docs/technical-design.md), [tests](docs/testing.md), [verification](docs/verification.md), and [release process](docs/releasing.md) describe the implementation and checks.
 
-See [Support](docs/support.md) for capabilities and limitations, [Technical design](docs/technical-design.md) for the design, and [Verification](docs/verification.md) for local validation evidence.
+Manifest v2 replaces the previous full/compact reports. Global mutations now appear in `findings`; use `status` instead of `scanStatus`, and `gaps` for analysis coverage. The old query/index, checkpoint/resume, report adapters, runtime-candidate helpers, timings, and JSONL APIs are removed. Use `dependencyMode: 'single'` instead of `scanResource`. `version()` replaces the old version helpers. This is a breaking API change.

package/dist/index.d.ts

@@ -1,46 +1,35 @@
-/* Generated by napi-rs. Do not edit. */
-import type { ScanEntry, ScanOptions, Source, Checkpoint, Report, Target, GlobalAccess, AnalysisInstance, Resource, Budgets } from './types.js';
-export * from './types.js';
 /**
- * Which binding artifact the generated loader actually loaded: `'native'` for
- * a native addon, otherwise the `platformArchABI` of the WASI flavor. Every
- * flavor napi-rs can build is listed, because `NAPI_RS_NATIVE_LIBRARY_PATH`
- * can point the loader at a WASI artifact this package does not build itself.
+ * `@bloodhound-rs/core` — static scanner for global-environment pollution.
+ *
+ * Give it an HTML page or a JavaScript file (as text, a file path, or a URL)
+ * and it returns a `Manifest` describing every write to the global object,
+ * `document`, builtin prototypes and host APIs, every imperative DOM or
+ * style insertion, and the resource chain that led to each one.
+ *
+ * All scanning, loading and resolution run in Rust on a worker thread. The
+ * functions here only shape arguments and parse the returned JSON.
  */
-export declare const __napiBindingTarget: 'native' | 'wasm32-wasi' | 'wasm32-wasip1'
-
-export declare class GlobalIndex {
-  constructor(report: Report)
-  get report(): Report
-  findTargets(pathSegments: Array<string>, namespace?: string | undefined | null, scopeKey?: string | undefined | null): Target[]
-  sources(targetId: string): { access: GlobalAccess; analysis: AnalysisInstance; resource: Resource }[]
-  accesses(analysisId: string): GlobalAccess[]
-  resourceAccesses(resourceId: string): GlobalAccess[]
-  entryPaths(targetId: string, options?: { limit?: number; offset?: number; maxVisits?: number }): { paths: { entryAnalysisId: string; analysisIds: string[]; referenceIds: string[] }[]; truncated: boolean; nextOffset: number }
-  conflicts(): { targetId: string; accessIds: string[]; analysisIds: string[]; valueTypes: string[]; certainty: 'static-candidate' }[]
-  resolveUnbound(): { targetId: string; candidates: string[]; certainty: 'static-candidate' }[]
-}
-
-export declare function adaptReport(report: Report, type: 'build' | 'page', metadata?: Record<string, unknown>): Record<string, unknown>
-
-export declare function defaults(): { budgets: Budgets; versions: Record<string, string> }
-
-export declare function diffReports(before: Report, after: Report): { added: GlobalAccess[]; removed: GlobalAccess[]; changed: { before: GlobalAccess; after: GlobalAccess }[] }
-
-export declare function engineVersion(): string
-
-export declare function indexArtifact(report: Report, reportId?: string): Pick<Report, 'indexSchemaVersion' | 'scopeKey' | 'entryAnalysisIds' | 'resources' | 'analysisInstances' | 'references' | 'globalTargets' | 'globalAccesses' | 'findings' | 'unresolved'> & { reportId: string }
-
-export declare function resumeScan(checkpoint: Checkpoint, options?: ScanOptions): Promise<Report>
-
-export declare function runtimeCandidates(report: Report, input: { resourceUrl?: string; contentHash?: string; line?: number; column?: number; pathSegments?: string[] }): { accessId: string; attribution: 'static_candidate' }[]
-
-export declare function scan(entries: ScanEntry[], options?: ScanOptions): Promise<Report>
-
-export declare function scanHtml(input: Source | string, options?: ScanOptions): Promise<Report>
-
-export declare function scanJs(input: Source | string, options?: ScanOptions): Promise<Report>
-
-export declare function scanResource(entry: ScanEntry, options?: ScanOptions): Promise<Report>
-
-export declare function validateReport(report: unknown): asserts report is Report
+import type { Budgets, Manifest, ScanEntry, ScanOptions, Source } from './types.js';
+export type * from './types.js';
+/** Scans any number of entries and returns one manifest. */
+export declare function scan(entries: ScanEntry[], options?: ScanOptions): Promise<Manifest>;
+/**
+ * Scans an HTML document. A string is treated as page source; supply
+ * `options.resourceUrl` so relative script URLs resolve.
+ */
+export declare function scanHtml(input: Source | string, options?: ScanOptions): Promise<Manifest>;
+/**
+ * Scans a JavaScript resource. A string is treated as source text. Set
+ * `options.scriptMode` to `'module'` for ESM; the default is `'classic'`.
+ */
+export declare function scanJs(input: Source | string, options?: ScanOptions): Promise<Manifest>;
+/** Scanner, parser and manifest schema versions. */
+export declare function version(): {
+    scanner: string;
+    parser: string;
+    schema: number;
+};
+/** The budgets applied when `options.budgets` is omitted. */
+export declare function defaults(): {
+    budgets: Budgets;
+};