/**
 * CVE rule scaffolding (Season 3, S3-1).
 *
 * Turns a "package X is vulnerable in [introduced, fixed)" advisory into a
 * review-ready `cve-versions.ts` rule object + a version-range test stub, so the
 * daily intel pipeline drafts rules instead of just reporting gaps. The output is
 * a DRAFT for human review + the normal gate/corpus validation — never
 * auto-committed (the hard-won "never auto-commit untested rules" rule stands).
 *
 * 0-FP-leaning by default: the generated pin matcher only accepts exact / `=`
 * pins (a `^`/`~` range usually resolves to the fixed patch and is left for the
 * reviewer to add where the range spans minors). Pure + deterministic.
 */
/**
 * Regex fragment matching a semver version string in [introduced, fixed).
 * Handles the shapes CVE advisories use: single version, a patch range within a
 * minor, a minor range within a major, and from-zero. Multi-major ranges get a
 * best-effort pattern (flagged for review by the scaffold).
 */
export declare function versionRangeRegex(introduced: string, fixed: string): string;
export interface AdvisoryInput {
    ruleId: string;
    pkg: string;
    introduced: string;
    fixed: string;
    cve?: string;
    ghsa?: string;
    severity: string;
    summary: string;
}
/**
 * Build a review-ready cve-versions.ts rule object + a matching test stub for an
 * advisory. Returns source strings to paste (after review) — NOT auto-applied.
 */
export declare function scaffoldCveRule(a: AdvisoryInput): {
    rule: string;
    test: string;
};