/**
 * PM-oriented derived signals for bom renderers (2.3.2).
 *
 * Pure helpers that project raw finding fields into categorical
 * signals a non-technical reviewer can sort/filter/decide on without
 * domain expertise:
 *
 *   - `licenseClass(licenseType)` — SPDX-id → permissive / copyleft-
 *     weak / copyleft-strong / proprietary / unknown. Lets a PM
 *     filter the inventory for "anything I need a lawyer to sign off".
 *
 *   - `stalenessTier(releaseDate)` — ISO date → fresh (< 1y) / aging
 *     (1–3y) / stale (≥ 3y). Lets a PM see deps that may no longer
 *     be maintained without knowing semver or npm-registry API.
 *
 *   - `effortEstimate(entry)` — packs the entry's upgrade path into
 *     trivial / moderate / major / blocked. Derived from
 *     installedVersion → fixedVersion semver delta or "no fix available".
 *     Helps scope sprint commitments.
 *
 * These deliberately live OUTSIDE `capabilities/types.ts` so the
 * finding types stay the analyzer contract and these are strictly
 * rendering helpers. If downstream consumers later need them in the
 * JSON output, they can be promoted to type fields in a minor bump.
 */
import type { BomEntry } from './types';
export type LicenseClass = 'permissive' | 'copyleft-weak' | 'copyleft-strong' | 'proprietary' | 'unknown';
/**
 * Classify a license string from a `LicenseFinding`. Accepts raw SPDX
 * ids, compound expressions (`"MIT OR Apache-2.0"` — classifies by the
 * first recognised token), and human-readable variants. Unrecognised
 * input returns `'unknown'` so the caller can surface the raw string
 * for human review.
 */
export declare function licenseClass(licenseType: string | undefined): LicenseClass;
export type StalenessTier = 'fresh' | 'aging' | 'stale' | 'unknown';
/**
 * Classify package freshness from an ISO-8601 release date. Threshold
 * picked for PM sensibility: "< 1 year" is current, "1–3 years" starts
 * getting stale, "≥ 3 years" warrants a "still maintained?" conversation.
 *
 * `now` is injectable so tests don't drift over time.
 */
export declare function stalenessTier(releaseDate: string | undefined, now?: Date): StalenessTier;
export type EffortEstimate = 'trivial' | 'moderate' | 'major' | 'blocked';
/**
 * Estimate the effort to remediate a vulnerable package.
 *
 *   - `blocked`: no advisory has a `fixedVersion` → requires a drop-in
 *     replacement or living-with-it exception.
 *   - `trivial`: every advisory's fix is a patch-version bump (same
 *     major+minor). Low-risk npm install away.
 *   - `moderate`: fix is a minor-version bump (same major). API-additive;
 *     contract-stable but light testing warranted.
 *   - `major`: fix is a major-version bump. Potential breaking changes;
 *     read the changelog before committing.
 *
 * Extracts semver by numeric parse of the first three dotted components
 * (strips a leading `v` Go-style). Non-parseable or multi-vuln mixtures
 * escalate to the highest effort tier seen.
 */
export declare function effortEstimate(entry: BomEntry): EffortEstimate;
//# sourceMappingURL=pm-signals.d.ts.map