import { DataFlowPolicy, DataFlowPolicyConfig } from "./types.js";

//#region src/dataflow/policy.d.ts

/**
 * Build a {@link DataFlowPolicy} from config.
 *
 * Decision procedure for a sink call:
 * 1. `mode === 'off'` or the tool is not a sink → `allow`.
 * 2. Arguments carry untrusted content verbatim → `untrusted-to-sink`.
 * 3. Else, if `derivedTaint: 'strict'` and untrusted content has entered
 *    the run → `derived-untrusted-to-sink` (paraphrase-robust).
 * 4. Else, if `guardTrifecta` (default on) and both untrusted **and**
 *    secret-tier content have entered the run → `lethal-trifecta`.
 * 5. No tainted flow → `allow`.
 * 6. A tainted flow into a `declassifySinks` sink → `declassify` (audited,
 *    allowed). Otherwise `'shadow'` → `flag` (audited, allowed),
 *    `'enforce'` → `block`.
 *
 * @stable
 */
declare function createDataFlowPolicy(config: DataFlowPolicyConfig): DataFlowPolicy;
//#endregion
export { createDataFlowPolicy };
//# sourceMappingURL=policy.d.ts.map