/**
 * BOM analyzer data-gather. Joins LICENSES + DEP_VULNS via the
 * existing capability gather functions — no new tool invocation logic
 * (CLAUDE.md rule 2). The gather just calls each, then walks both
 * result sets to build a per-package join keyed by `package@version`.
 */
import type { DepVulnSummary } from '../security/types';
import type { DepVulnFinding, LicensesResult } from '../../languages/capabilities/types';
import type { BomEntry, BomTopLevelRollup } from './types';
/**
 * Compare two version strings as semver triples. Strips a leading
 * 'v' (Go-pack convention) and compares dot-separated numeric
 * components. Falls back to lexicographic comparison when either
 * input isn't a parseable triple — preserves a deterministic
 * ordering for non-semver versions (e.g. cargo's "0.10.55+echo.1").
 */
export declare function compareSemver(a: string, b: string): number;
/** Highest version in `versions` per compareSemver. Returns the input
 *  unchanged when only one version is supplied. */
export declare function maxSemver(versions: string[]): string;
/**
 * Tier-1 resolution proposal derived purely from `fixedVersion`
 * data shipped by each pack's depVulns provider. Per checkpoint §9:
 *   - no vulns → empty
 *   - every vuln has fixedVersion → "PROPOSAL: Upgrade to <maxFix> (resolves N)"
 *   - some vuln lacks fixedVersion → "No fix available — evaluate replacement"
 *
 * Higher tiers (10h.4 Snyk, 10h.6 osv-scanner fix) populate
 * `upgradeAdvice` directly on each finding; the bom render layer
 * picks the richest available value per package.
 */
export declare function deriveTier1Resolution(vulns: DepVulnFinding[]): string;
/**
 * Build the per-top-level-dep rollup from a flat list of entries.
 * Walks every advisory under every entry; increments the counter for
 * each top-level the advisory lists (a vuln reachable from two
 * top-levels increments both, matching Snyk's grouping semantics).
 *
 * Entries with no topLevelDep attribution contribute nothing — the
 * rollup is best-effort based on what each pack populates. Pure
 * function; unit-testable.
 */
export declare function buildByTopLevelDep(entries: BomEntry[]): Record<string, BomTopLevelRollup>;
/**
 * Join LICENSES + DEP_VULNS by (package, version). Strategy:
 *   - Primary index: package@version. Both LicenseFinding and
 *     DepVulnFinding usually carry both — match exact.
 *   - Fallback: package only. DepVulnFindings without
 *     installedVersion fall back to package-name match against
 *     the licenses list (joins to the single matching version
 *     when unambiguous, all matching versions when not).
 *
 * License-only packages emit BomEntry with empty `vulns`. Vuln-only
 * packages (rare — license scanner gap) emit a row with empty
 * license fields and `joinedFromBoth: false` so the detailed report
 * can flag the gap.
 */
export interface BomGatherResult {
    entries: BomEntry[];
    toolsUsed: string[];
    toolsUnavailable: string[];
}
/**
 * Both pre-gathered envelopes are optional. The override pattern lets
 * the analyzer layer hand BoM a canonical inventory + advisory set
 * built once at repo-root, so the gather pipeline never re-walks the
 * tree from a different cwd (the root cause of cross-consumer drift
 * on the same logical metric — e.g. licenses-vs-BoM package count
 * diverging on a deep C# monorepo because two walks visited two
 * different subsets of csproj files).
 *
 * `depVulnsOverride`: shared dep-vuln set across nested callers.
 *   Pre-fix BoM called `gatherDepVulns(absRoot)` per sub-root, and
 *   the csharp pack's gather was cwd-sensitive — at a sub-root with
 *   a stale `obj/project.assets.json` it returned 0 advisories via
 *   dotnet, while at repo-root with no `.csproj` it correctly fell
 *   back to `osv-scanner-nuget-direct` and surfaced them. Override +
 *   the pack-layer cwd-invariance work closed that gap.
 *
 * `licensesOverride`: pre-gathered canonical license inventory.
 *   When set, the gather skips its own `gatherLicensesResult(cwd)`
 *   call and uses the override directly. `null` (a deliberate
 *   "license inventory exists but is empty / unavailable") is
 *   distinguished from `undefined` ("gather it yourself") — the
 *   canonical analyzer-layer caller always passes the cached
 *   envelope shape verbatim.
 */
export declare function gatherBomEntries(cwd: string, options?: {
    depVulnsOverride?: DepVulnSummary;
    licensesOverride?: LicensesResult | null;
}): Promise<BomGatherResult>;
//# sourceMappingURL=gather.d.ts.map