/**
 * Cross-pack upgrade-plan resolver — Phase 10h.6.4.
 *
 * Runs after every pack has contributed its Tier-1/Tier-2 dep-vuln
 * findings and the per-pack Tier-2 fix tools (osv-scanner fix in TS,
 * pip-audit's fix_versions in Python, cargo-audit's patched[] in Rust)
 * have stamped `upgradePlan` on whichever findings they could. This
 * resolver fills the gaps in two passes:
 *
 *   Pass 1 — plan reconciliation. osv-scanner's structured output
 *   frequently lists multiple advisories under one patch (e.g. a single
 *   `vitest ^2 → ^3` bump patches both vite + esbuild CVEs). Only the
 *   advisories in `patches[]` get stamped by 10h.6.1's enricher because
 *   it keys on (package, version, id). If another producer (npm-audit's
 *   default output, Snyk later) emits a finding for an advisory that
 *   ALSO appears in some plan's `patches[]` but with a different
 *   package/version tuple, the reconciliation pass stamps it too.
 *
 *   Pass 2 — transitive free-text parse. npm-audit emits free-text
 *   `upgradeAdvice` like `"Upgrade @loopback/cli to 7.0.1 [major]
 *   (transitive fix)"` on transitive advisories. That string is
 *   structured data trapped in a string; this pass parses it into a
 *   proper `upgradePlan` when no better one is available. Conservative:
 *   only activates when `upgradeAdvice` matches the exact transitive-
 *   fix template the TS pack emits. Future producers that emit the
 *   same shape benefit automatically.
 *
 * Purity: mutates findings in place (stamps `upgradePlan`) and returns
 * a count of additions. Never overwrites an existing plan — the
 * per-pack producers are authoritative.
 */
import type { DepVulnFinding } from '../../languages/capabilities/types';
/** Result summary — useful for tests and for the security/gather caller
 *  that wants to log how much reconciliation actually happened. */
export interface ResolverStats {
    reconciled: number;
    fromFreeText: number;
}
/**
 * Run the resolver over a flat finding set. Mutates in place; returns
 * per-pass counts. Idempotent — re-running on the same set after
 * resolver-stamping yields zero additions.
 */
export declare function resolveTransitiveUpgradePlans(findings: DepVulnFinding[]): ResolverStats;
/**
 * Pass 1 — for every advisory id listed in any existing plan's
 * `patches[]`, ensure the matching finding (if any, by id only) carries
 * the same `upgradePlan`. Case-insensitive id matching matches the
 * osv-scanner-fix planKey convention.
 *
 * Exported for test coverage.
 */
export declare function reconcileUpgradePlans(findings: DepVulnFinding[]): number;
/**
 * Pass 2 — derive `upgradePlan` from the npm-audit-style transitive-fix
 * `upgradeAdvice` free-text template. Activates only when the string
 * matches exactly and no structured plan exists. Outputs a
 * single-advisory plan (patches = [finding.id]) since the free-text
 * template doesn't carry cross-advisory rollup.
 *
 * Exported for test coverage.
 */
export declare function stampFromFreeTextAdvice(findings: DepVulnFinding[]): number;
//# sourceMappingURL=upgrade-plan-resolver.d.ts.map