import type { Coverage } from '../analyzers/tools/coverage';
import type { DepVulnFinding, SeverityCounts } from './capabilities/types';
import type { LanguageSupport } from './types';
export declare function parseCoberturaXml(raw: string, sourceFile: string, cwd: string): Coverage | null;
/**
 * Pure parser for `dotnet list package --vulnerable --include-transitive
 * --format json`. Extracted from the gather function so it can be
 * unit-tested without a real .NET SDK on the dev machine (10h.5
 * release-time validation runs the full pipeline). Returns null when
 * the input is malformed; otherwise returns counts + findings ready
 * for downstream alias enrichment + top-level attribution.
 *
 * Both top-level and transitive packages are iterated. Top-level
 * findings carry `topLevelDep = [self]` (they ARE manifest deps);
 * transitive findings emit with `topLevelDep` unset — the gather
 * function then fills it from `project.assets.json` if available.
 * Leaving attribution unset on transitives when assets.json is absent
 * matches Python's venv-missing behavior: degrade gracefully rather
 * than invent false parents.
 */
export declare function parseDotnetVulnerableOutput(raw: string): {
    counts: SeverityCounts;
    findings: DepVulnFinding[];
} | null;
/**
 * Pure parser for `obj/project.assets.json`. Extracts the forward
 * dep graph keyed by package name (collapsing versions — same as
 * TS/Go/Rust packs) plus the set of top-level (direct manifest)
 * package names across every target framework declared in `project`.
 *
 * Multi-framework projects: graphs are merged across target
 * frameworks into a single name-level edge map. Top-level set is
 * the union of declared direct deps across frameworks. This
 * over-attributes slightly if a package is direct in netstandard2.0
 * but transitive in net8.0 — it gets listed as a top-level — but the
 * simplification beats per-framework multi-reporting complexity.
 */
export declare function parseProjectAssetsJson(raw: string): {
    topLevels: string[];
    edges: Map<string, Set<string>>;
} | null;
/**
 * BFS the parsed asset graph to produce a per-package-name index of
 * its top-level ancestors. Mirrors `buildTsTopLevelDepIndex` /
 * `buildRustTopLevelDepIndex` in shape and semantics; attribution is
 * coarse (name-level) and unions across multiple reachable parents.
 */
export declare function buildCsharpTopLevelDepIndex(parsed: {
    topLevels: ReadonlyArray<string>;
    edges: ReadonlyMap<string, ReadonlySet<string>>;
}): Map<string, string[]>;
/**
 * Locate every `obj/project.assets.json` under cwd (NuGet's lockfile
 * equivalent, created by `dotnet restore`). Unlike the shared
 * `findMatchingRecursive`, we can't skip `obj/` — that's where the
 * file lives. Walks up to `maxDepth` levels to cover solutions with
 * multiple nested projects.
 *
 * Phase 10h.6.7 (closes D003): earlier revisions returned only the
 * first match, so multi-project solutions got transitive attribution
 * from one project's graph, missing vulns reachable only through
 * siblings. `loadCsharpTopLevelDepIndex` now calls this and merges
 * every returned graph before BFS.
 *
 * Exported for test coverage.
 */
export declare function findAllProjectAssetsJson(cwd: string): string[];
/**
 * Locate every `.csproj` reachable from cwd within `maxDepth` levels.
 * D025f (2.4.7): the direct-parsing fallback iterates this list when
 * `dotnet list package` can't produce output (D036: cwd is a parent
 * of the actual project files, dotnet has no way to pick one).
 *
 * Skips standard non-source dirs (node_modules / bin / obj /
 * TestResults / packages). Unlike `findAllProjectAssetsJson` (which
 * needs `obj/`), this walk's targets sit in project root directories
 * so the obj-skip is fine.
 *
 * Exported for test coverage.
 */
export declare function findAllCsprojFiles(cwd: string): string[];
/**
 * Merge multiple `project.assets.json` parse results into a single
 * graph. `topLevels` unions across projects; `edges` unions the
 * adjacency sets — if project A lists `Newtonsoft.Json` → `Foo` and
 * project B lists `Newtonsoft.Json` → `Bar`, the merged graph shows
 * both children. Run BFS against the union so advisories reachable
 * through any project's dep graph get attribution.
 *
 * Exported for test coverage.
 */
export declare function mergeAssetParses(parses: ReadonlyArray<{
    topLevels: string[];
    edges: Map<string, Set<string>>;
}>): {
    topLevels: string[];
    edges: Map<string, Set<string>>;
};
/**
 * Discover the repo's COMMITTED `packages.lock.json` files. NuGet writes
 * one next to each project (`<ProjectDir>/packages.lock.json`) when lock
 * files are enabled (`RestorePackagesWithLockFile` / CI restore), and it
 * records the FULL resolved transitive tree with pinned versions — the
 * exact input osv-scanner needs for transitive coverage. Anchored to the
 * `.csproj` discovery so it shares the canonical depth-unlimited walker.
 */
export declare function findRealPackagesLockFiles(cwd: string): string[];
/**
 * Capture C# `using` directives from source text, including
 * `using static Foo`, aliased (`using X = Foo.Bar`), and plain forms.
 * C# has no deterministic file-level resolver (namespaces aren't files),
 * so this is the only raw helper the imports capability needs. Exported
 * for unit tests.
 */
export declare function extractCsharpImportsRaw(content: string): string[];
export declare const csharp: LanguageSupport;
//# sourceMappingURL=csharp.d.ts.map