/**
 * osv-scanner fix — Tier-2 upgrade-plan enricher for the TypeScript pack.
 *
 * `npm audit` (Tier-1, typescript pack's primary dep-vuln source) produces
 * per-advisory findings with `fixedVersion` and, for transitive advisories,
 * a free-text `upgradeAdvice` like "Upgrade vitest to 4.1.5 [major]
 * (transitive fix)". That's good for humans reading markdown but leaves
 * autonomous upgrade bots to re-parse the string.
 *
 * `osv-scanner fix --format json --manifest <pkg.json> --lockfile <lock>`
 * produces a structured plan: for each proposed patch, which top-level
 * package to bump (`packageUpdates[]`) and which advisories it would
 * resolve (`fixed[]`). This module wraps that call and stamps the
 * structured result onto each matching `DepVulnFinding.upgradePlan` —
 * the typed sibling to the free-text `upgradeAdvice` that 10h.6.6 added.
 *
 * Degradation: if osv-scanner isn't installed, runs fine but returns
 * zero enrichments. The underlying npm-audit flow populates
 * `upgradeAdvice` either way. Downstream consumers that want the
 * structured form check `upgradePlan` presence.
 */
import type { DepVulnFinding, DepVulnUpgradePlan } from '../../languages/capabilities/types';
/**
 * Run osv-scanner against a TypeScript project and return a map keyed on
 * the `(package, installedVersion, advisoryId)` tuple → upgradePlan. Caller
 * iterates findings and copies the plan onto each match.
 *
 * Returns an empty map when:
 *   - osv-scanner binary is not available (tool missing — soft-fail)
 *   - package.json or package-lock.json is absent (osv-scanner fix needs both)
 *   - osv-scanner exits with parse-breaking output (log and degrade)
 *
 * Never throws. `gatherTsDepVulnsResult` calls this unconditionally and
 * treats the empty map as "no enrichment available".
 *
 * **TEMP-DIR ISOLATION (10k.1.5b fix — discovered during 2.4.5 pre-ship
 * regression):** osv-scanner v2's `fix` subcommand invokes `npm install`
 * internally to compute upgrade patches. That `npm install` MUTATES the
 * cwd's node_modules — wipes it then reinstalls (often with
 * `--legacy-peer-deps` fallback if the project's deps don't resolve
 * cleanly). On dxkit's own repo this caused subsequent dxkit subcommand
 * invocations to crash with `Cannot find module 'hosted-git-info'`
 * because osv-scanner's reinstall left an incomplete tree. On
 * a large reference repo (~800MB node_modules) the reinstall happened to
 * succeed but still mutated state silently — a long-standing data-mutation
 * bug shipped since 2.4.0 and only caught when a pre-ship regression ran
 * reports back-to-back on dxkit's own repo and tripped the chain.
 *
 * Mitigation: we copy `package.json` + `package-lock.json` to a fresh
 * temp dir, run osv-scanner there, and discard the temp dir afterward.
 * Output JSON identifies advisories by `(package, version, id)` tuples
 * which are independent of cwd, so the upgrade-plan map we return is
 * unchanged. The caller's project gets read-only treatment.
 */
export declare function gatherOsvScannerFixPlans(cwd: string): Promise<Map<string, DepVulnUpgradePlan>>;
/**
 * Parse raw `osv-scanner fix --format json` stdout into a plan-lookup map.
 *
 * The command prefixes JSON with a warning line when it falls back to
 * `npm install --legacy-peer-deps` (seen on 2026-04-24's dxkit sample
 * capture); skip anything before the first `{`. On parse failure,
 * returns an empty map rather than throwing — enrichment is best-effort.
 *
 * Exported for test coverage.
 */
export declare function parseOsvScannerFixOutput(raw: string): Map<string, DepVulnUpgradePlan>;
/**
 * Stamp upgradePlan on every finding with a matching `(package,
 * installedVersion, id)` tuple in the provided plan map. In-place;
 * finds with no matching plan are left unchanged. Idempotent.
 */
export declare function enrichWithUpgradePlans(findings: DepVulnFinding[], plans: Map<string, DepVulnUpgradePlan>): number;
/** Shared key between plan-map construction and finding lookup.
 *
 *  GHSA/CVE/SNYK IDs are case-insensitive per their respective specs but
 *  producers disagree in practice — npm-audit emits uppercase
 *  (`GHSA-W5HQ-...`), osv-scanner emits lowercase (`GHSA-w5hq-...`).
 *  Lowercasing the ID component keeps plan lookups hit-or-miss-free when
 *  the two merge. Package names in npm are already lowercase; version
 *  strings have no case. */
export declare function planKey(pkg: string, version: string, advisoryId: string): string;
//# sourceMappingURL=osv-scanner-fix.d.ts.map