/**
 * Vulnerability Scanner — scans current and recommended dependencies for
 * known security vulnerabilities using the OSV database.
 *
 * Unlike Snyk/Dependabot which only scan existing deps, Next-Unicorn also
 * scans recommended replacement libraries before adoption — preventing
 * "upgrade into a vulnerability" scenarios.
 *
 * Requirements: 10.1, 10.2, 10.3, 10.4, 10.5, 10.6
 */
import type { RecommendedChange, VulnSeverity } from '../schemas/output.schema.js';
import type { VulnerabilityClient, VulnerabilityRecord } from './osv-client.js';
export type VulnTarget = 'current' | 'recommended' | 'both';
export interface VulnScanInput {
    /** Current project dependencies: name -> version */
    currentLibraries: Record<string, string>;
    /** Recommended libraries from the pipeline */
    recommendedChanges: RecommendedChange[];
    /** Which deps to scan */
    target: VulnTarget;
    /** Default ecosystem to use when workspace info is unavailable */
    defaultEcosystem: string;
    /** Minimum severity to include in results */
    minimumSeverity?: VulnSeverity;
}
export interface VulnFinding {
    /** "current" = existing dep, "recommended" = library we're suggesting */
    source: 'current' | 'recommended';
    packageName: string;
    installedVersion: string;
    ecosystem: string;
    vulnerability: VulnerabilityRecord;
    /** If a fix exists, the version to upgrade to */
    fixAvailable: string | null;
    /** If source is "recommended", index into recommendedChanges[] */
    recommendationIndex?: number;
}
export interface VulnScanResult {
    findings: VulnFinding[];
    summary: {
        totalDepsScanned: number;
        currentDepsScanned: number;
        recommendedDepsScanned: number;
        critical: number;
        high: number;
        medium: number;
        low: number;
        fixable: number;
        unfixable: number;
    };
    /** true if VulnerabilityClient was unreachable */
    serviceUnavailable: boolean;
}
/**
 * Scan dependencies for known vulnerabilities.
 *
 * Flow:
 * 1. Build query list from currentLibraries + recommendedChanges
 * 2. Batch-query OSV via VulnerabilityClient
 * 3. Filter by minimumSeverity
 * 4. Build VulnFinding[] with fix suggestions
 * 5. Compute summary statistics
 */
export declare function scanVulnerabilities(input: VulnScanInput, client: VulnerabilityClient): Promise<VulnScanResult>;
//# sourceMappingURL=vulnerability-scanner.d.ts.map