import type { ExternalAnalyzerResults } from "audit-tools/shared";
/**
 * Minimal SARIF 2.1.0 shape for CodeQL dataflow queries. Only the fields needed
 * to recover source→sink file edges from `codeFlows` are typed; everything is
 * optional so a partial / malformed report degrades rather than throwing.
 */
interface SarifArtifactLocation {
    uri?: string;
}
interface SarifLocation {
    physicalLocation?: {
        artifactLocation?: SarifArtifactLocation;
    };
}
interface SarifThreadFlowLocation {
    location?: SarifLocation;
}
interface SarifThreadFlow {
    locations?: SarifThreadFlowLocation[];
}
interface SarifCodeFlow {
    threadFlows?: SarifThreadFlow[];
}
interface SarifResult {
    ruleId?: string;
    codeFlows?: SarifCodeFlow[];
}
interface SarifRun {
    results?: SarifResult[];
}
export interface CodeqlSarif {
    runs?: SarifRun[];
}
/**
 * Normalize a CodeQL SARIF dataflow report into language-neutral graph edges:
 * for each result's code flow, emit one `source-file → sink-file` edge from the
 * first to the last thread-flow location whose file paths differ. CodeQL's
 * dataflow queries already model taint propagation, so the first/last locations
 * are the source and sink; downstream the graph extractor resolves the URIs
 * against the repo path lookup.
 *
 * Degrades to an empty edge list on any malformed / missing SARIF field and
 * never throws; `normalizeGenericExternalEdges` dedupes + sorts for determinism.
 */
export declare function normalizeCodeqlSarif(input: CodeqlSarif): ExternalAnalyzerResults;
export {};
//# sourceMappingURL=codeql.d.ts.map