import { SecurityFinding, DepVulnSummary, Severity } from './types';
import { type SecurityAggregate } from './aggregator';
import type { DepVulnResult } from '../../languages/capabilities/types';
/**
 * Secrets are a global capability: one scanner (gitleaks today) runs once
 * per repo and the dispatcher aggregates its envelope through the SECRETS
 * descriptor. Exclusions + suppressions are already applied inside the
 * provider (see tools/gitleaks.ts), so this layer only maps the envelope
 * into the SecurityFinding shape used by the security report.
 */
export declare function gatherSecrets(cwd: string): Promise<{
    findings: SecurityFinding[];
    toolUsed: string | null;
}>;
export declare function gatherFileFindings(cwd: string): SecurityFinding[];
/**
 * D045 (2.4.7): surface TLS-bypass idioms as first-class
 * `SecurityFinding[]` entries with file:line attribution. Each pack
 * declares its language-specific patterns via
 * `LanguageSupport.tlsBypassPatterns` (D034); this gather runs the
 * unioned alternation across every registered pack's source
 * extensions and emits one finding per matching line.
 *
 * Architecture note (why this is independent of semgrep): semgrep's
 * `p/security-audit` ruleset does not include per-language TLS-bypass
 * idioms (`ServerCertificateValidationCallback`,
 * `DangerousAcceptAnyServerCertificateValidator`,
 * `InsecureSkipVerify: true`, `danger_accept_invalid_certs`,
 * `TrustAllX509TrustManager`, `OpenSSL::SSL::VERIFY_NONE`, etc.). The
 * registry-driven per-pack patterns ARE the source of truth for these
 * checks; both the health-side `tlsDisabledCount` metric and the
 * standalone vuln-scan Code Findings table flow through the same
 * patterns. False-positive rate is near zero — these are tight
 * class/method tokens, not loose word matches.
 *
 * Pre-D045 the .NET WinForms benchmark surfaced `tlsDisabledCount: 1` in
 * `gatherGenericMetrics` (via `countTlsBypassLines`), but the
 * standalone vuln scan's Code Findings table reported `_Sources:
 * (none)_` with all zeros — the count never reached the standalone
 * scan because TLS-bypass wasn't a first-class finding source. This
 * gather closes that gap.
 *
 * Severity assignment: `high`. CWE: 295 (Improper Certificate
 * Validation).
 *
 * Empty patterns array → returns []. Empty grep output → returns [].
 * Both are legitimate "no TLS-bypass idioms in this codebase" states.
 */
/**
 * G_v4_7 (2.4.7): route TLS-bypass discovery through the canonical
 * walker + per-file in-process line scan. Eliminates the `grep -rnEf`
 * shell path (no maxBuffer ceiling, no per-finding shell escaping).
 * D074 closure: skip comment lines so a commented-out
 * `// NODE_TLS_REJECT_UNAUTHORIZED=0` no longer renders as a HIGH
 * SecurityFinding (the platform vuln-scan false-positive class).
 *
 * `includeTests: true` preserves pre-migration scope — TLS-bypass
 * idioms inside test fixtures were detected before; still are.
 */
export declare function gatherTlsBypassFindings(cwd: string): SecurityFinding[];
/**
 * Code-pattern findings are a global capability: the CODE_PATTERNS
 * dispatcher routes to `semgrepProvider` (tools/semgrep.ts) which
 * applies exclusions, suppressions, and the low-confidence filter
 * internally. This layer only reshapes the envelope into
 * `SecurityFinding[]` for the security report.
 */
export declare function gatherCodePatterns(cwd: string): Promise<{
    findings: SecurityFinding[];
    toolUsed: string | null;
}>;
/**
 * Aggregates dependency vulnerabilities across every active language pack
 * via the capability dispatcher. Replaces the prior hardcoded `npm audit`
 * implementation that silently ignored Python/Go/Rust/C# deps.
 *
 * Returns `EMPTY_DEP_VULNS` when no active pack exposes a depVulns
 * provider, or when every provider returned null (no tool installed
 * / nothing to audit).
 */
/**
 * Shared primitive for availability-aware dep-vuln aggregation. Used by
 * both `gatherDepVulns` (standalone scan + BoM, with enrichment) and
 * `gatherCapabilityReport` in health.ts (no enrichment). Bypassing the
 * dispatcher is the whole point — the dispatcher's `gather()` path
 * collapses every non-success outcome to null, which makes the scorer
 * blind to "tool unavailable" vs "no findings" (the F4
 * customer-credibility lie observed on the .NET WinForms benchmark).
 * Calling `gatherOutcome` directly preserves
 * the discriminant, then we aggregate via the existing DEP_VULNS
 * descriptor's aggregator.
 *
 * Returned envelope is null only when NO success outcomes occurred;
 * `available` is false when at least one active pack returned
 * `unavailable`. `no-manifest` outcomes do NOT degrade availability —
 * polyglot repos where one pack activates but has nothing to scan are
 * a clean "we checked, found nothing here" state.
 */
export declare function gatherDepVulnsWithAvailability(cwd: string): Promise<{
    envelope: DepVulnResult | null;
    available: boolean;
    unavailableReason: string;
}>;
export declare function gatherDepVulns(cwd: string): Promise<DepVulnSummary>;
/**
 * Build the canonical `SecurityAggregate` from inputs available to the
 * health analyzer. Re-uses the capability envelopes already gathered by
 * `gatherCapabilityReport` (no double-shells — dispatcher cache hits
 * are free), additionally invoking the two finders not represented in
 * the capability layer (TLS-bypass-registry walk, file findings for
 * private keys + `.env`-in-git).
 *
 * D086 closure foundation: health's `scoreSecurityDimension` reads
 * from this aggregate via `c.securityAggregate?.codeBySeverity`,
 * which is the SAME field the standalone vuln-scan reads after C1.2.
 * Two consumers, one source — no drift possible.
 */
export declare function buildSecurityAggregateForHealth(cwd: string, secrets: {
    tool: string;
    findings: ReadonlyArray<{
        severity: Severity;
        rule: string;
        title?: string;
        file: string;
        line: number;
    }>;
} | undefined, codePatterns: {
    tool: string;
    findings: ReadonlyArray<{
        severity: Severity;
        rule: string;
        title: string;
        file: string;
        line: number;
        cwe: string;
    }>;
} | undefined, depVulnsEnvelope: DepVulnResult | undefined, depVulnsAvailable: boolean, depVulnsUnavailableReason: string): Promise<SecurityAggregate>;
//# sourceMappingURL=gather.d.ts.map