import type { DepVulnFinding, DepVulnGatherOutcome, SeverityCounts } from '../../languages/capabilities/types';
import type { LanguageId } from '../../types';
/**
 * Pure parser for osv-scanner v2.x JSON output, scoped to a single
 * ecosystem. Other ecosystems are filtered out so polyglot repos
 * don't double-count: each pack handles its own ecosystem (typescript
 * → npm, python → PyPI, kotlin/java → Maven, ruby → RubyGems, etc.).
 *
 * The ecosystem parameter is matched against the OSV record's
 * `package.ecosystem` field verbatim — use the exact strings OSV
 * emits (`'Maven'`, `'RubyGems'`, `'PyPI'`, `'npm'`, `'Go'`, etc.).
 *
 * Returns counts + findings + the raw OSV vuln records for downstream
 * CVSS resolution. Exported for unit tests.
 */
export declare function parseOsvScannerFindings(raw: string, ecosystem: string, packId?: LanguageId): {
    counts: SeverityCounts;
    findings: DepVulnFinding[];
    vulnsForCvss: Array<{
        primaryId: string;
        embeddedCvss: number | null;
        aliases: string[];
    }>;
};
/**
 * Single source of truth for osv-scanner-driven dep-vuln gathering.
 * Caller supplies:
 *   - cwd: project root
 *   - source: pack id for envelope attribution (currently reserved —
 *     see note at end of function)
 *   - ecosystem: OSV ecosystem string (`'Maven'`, `'RubyGems'`, ...)
 *   - manifestCandidates: ordered list of manifest filenames to probe.
 *     First existing one is passed via `--lockfile`. Lockfiles
 *     preferred over higher-level manifests (kotlin: gradle.lockfile
 *     before pom.xml; ruby: Gemfile.lock).
 *
 * `scan source --lockfile <path>` is the v2.x form. JSON output to
 * stdout. Exit code is non-zero when findings exist — we ignore the
 * exit code and parse the JSON regardless (run() already swallows
 * non-zero exits cleanly via execSync's catch).
 *
 * CVSS alias-fallback: osv-scanner ships CVSS vectors when present,
 * but advisory data quality varies by ecosystem — some carry only
 * `database_specific.severity` strings. resolveCvssScores looks up
 * via CVE alias when the primary record lacks a vector.
 */
export declare function gatherOsvScannerDepVulnsResult(cwd: string, packId: LanguageId, ecosystem: string, manifestCandidates: string[]): Promise<DepVulnGatherOutcome>;
//# sourceMappingURL=osv-scanner-deps.d.ts.map