/**
 * Semgrep integration — static code-pattern scanning.
 *
 * The `semgrepProvider` is registered in `GLOBAL_CAPABILITIES.codePatterns`
 * (src/languages/capabilities/global.ts). Semgrep runs once per repo with
 * a union of rulesets from every active language pack's `semgrepRulesets`
 * declaration plus the baseline `p/security-audit` OWASP ruleset.
 *
 * The provider does not run if no rulesets resolve (pure C# or similar
 * repos today — their pack declares `semgrepRulesets: []`). Adding
 * rulesets in future is purely declarative: a pack lists them, this
 * provider picks them up via `detectActiveLanguages(cwd)`.
 */
import type { CapabilityProvider } from '../../languages/capabilities/provider';
import type { CodePatternsResult } from '../../languages/capabilities/types';
/**
 * Outcome union — same discriminated-kind shape as the other wrappers.
 * Lets the capability provider collapse to `CodePatternsResult | null`
 * and lets future report decompositions show meaningful
 * `toolsUnavailable` reasons.
 */
export type CodePatternsGatherOutcome = {
    kind: 'success';
    envelope: CodePatternsResult;
} | {
    kind: 'unavailable';
    reason: string;
};
/**
 * Map semgrep's severity + impact to the project's four-tier model.
 * Priority: rule metadata `impact` (most meaningful — rule authors
 * tier by business impact) → fall back to semgrep's `severity`.
 */
/**
 * Normalize semgrep's `metadata.cwe` into a single CWE identifier.
 *
 * Why: semgrep rule authors write `cwe:` in YAML as either a scalar
 * (`cwe: "CWE-295: Improper Certificate Validation"`) or a list
 * (`cwe: ["CWE-295: ..."]`). Both shapes pass through semgrep's JSON
 * output unchanged. Pre-fix this code did `metadata?.cwe?.[0]` which
 * silently returned the first *character* of the scalar form (e.g.
 * "C" for "CWE-295: ..."). D094 surfaced this on `bypass-tls-
 * verification` rule output.
 */
export declare function extractCwe(cwe: string | string[] | undefined): string;
/**
 * Single source of truth for the semgrep invocation. Consumed by
 * `semgrepProvider` (capability dispatcher).
 *
 * Failure-mode honesty: when semgrep doesn't produce a parseable
 * report, the returned `reason` distinguishes between:
 *   - timeout (we hit our wall-clock budget — the customer probably
 *     wants to install nothing and instead either prune the scan
 *     scope via `.dxkit-ignore` or bump the timeout)
 *   - non-zero exit with a captured stderr first line (semgrep
 *     itself complained — surface its complaint)
 *   - the historical fallback "no output" (rare now; means stderr
 *     was empty AND exit was zero AND the report file was missing)
 *
 * Pre-fix every failure collapsed to "no output," masking
 * resource-contention deaths (parallel jscpd + graphify + semgrep
 * on a 700-file repo OOM-killing the youngest), timeouts, and
 * config-parse errors with the same useless string. Switched to
 * runDetached so we capture stderr + exit code + timeout signal
 * separately, and so the wall-clock-deadline kill cleans up
 * grandchildren (semgrep's internal worker pool).
 */
export declare function gatherSemgrepResult(cwd: string): Promise<CodePatternsGatherOutcome>;
/**
 * Capability-shaped provider. Registered in
 * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES.codePatterns`.
 */
export declare const semgrepProvider: CapabilityProvider<CodePatternsResult> & {
    gatherOutcome(cwd: string): Promise<CodePatternsGatherOutcome>;
};
//# sourceMappingURL=semgrep.d.ts.map