/**
 * BOM (Bill of Materials) analyzer — public API.
 *
 * Joins the LICENSES and DEP_VULNS capabilities by `package@version`
 * to produce one row per installed package with both license inventory
 * data (cols 1-9, 15) and per-package vulnerability rollup
 * (cols 11-13). Output formats:
 *
 *   - `formatBomReport(report)` — markdown summary for
 *     `.dxkit/reports/bom-<date>.md` and PR comments.
 *   - JSON via the CLI's `--json` flag (10h.3.9) — schema-versioned
 *     pass-through with the added summary + repo metadata.
 *   - XLSX via the shared converter (10h.3.9) — drop-in replacement
 *     for the customer's spreadsheet workflow with cols 11-13 filled.
 */
import type { BomReport } from './types';
export type { BomReport, BomEntry } from './types';
export type BomFilter = 'all' | 'top-level';
export interface AnalyzeBomOptions {
    verbose?: boolean;
    /** Row filter. `'all'` emits every package (default, no behavior change).
     *  `'top-level'` keeps only direct manifest deps; `byTopLevelDep`
     *  (which attributes transitive advisories to their parent) is
     *  computed on the unfiltered set so the rollup still answers
     *  "upgrading @loopback/cli resolves 29 advisories" even when the
     *  29 transitive rows themselves are hidden. Entries with
     *  `isTopLevel === false` are dropped; `undefined` passes through. */
    filter?: BomFilter;
}
export declare function analyzeBom(repoPath: string, options?: AnalyzeBomOptions): Promise<BomReport>;
/**
 * Row in the "This Week's Triage" section. Pure projection over the
 * flattened advisories sorted by riskScore desc — exposed for tests
 * so the one-line rationale logic is verifiable without a full report
 * fixture.
 */
export interface TriageRow {
    risk: number;
    id: string;
    packageAtVersion: string;
    rationale: string;
    fix: string;
}
/**
 * Build the triage list: top N advisories by riskScore across the
 * whole bom, each with a one-line rationale stitched from the
 * signals that drove the score. Filters out advisories below
 * `minRisk` so the section stays the "interesting" subset —
 * not every advisory the bom touched.
 *
 * Rationale is constructed left-to-right from the most decisive
 * signals: KEV > reachable > high CVSS > high EPSS, so the reader
 * can immediately see *why* this entry sits high. Examples:
 *
 *   - "KEV, reachable, CVSS 9.8"
 *   - "reachable, CVSS 4.8"
 *   - "CVSS 9.1" (transitive only, no reach/KEV signal)
 *
 * Pure function; exported for unit tests.
 */
export declare function buildTriageRows(report: BomReport, limit: number, minRisk: number): TriageRow[];
export declare function formatBomReport(report: BomReport, elapsed: string): string;
//# sourceMappingURL=index.d.ts.map