/**
 * cognium-dev #256 — same-file argument-type resolver.
 *
 * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
 * argument form and miss argument indirection:
 *
 *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
 *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
 *      where `templateClass` is a `Class<T>` parameter.
 *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
 *      matches `new ProcessBuilder(Arrays.asList(...))` but not
 *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
 *      `List<String>`.
 *
 * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
 * resolve the effective type of an argument that is either:
 *   - a bare identifier (parameter or field name), or
 *   - a method-call expression (callee name).
 *
 * Same-file only — locals declared inside method bodies and cross-file
 * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
 * same-method-parameter / same-class-static-callee, so this scope suffices.
 *
 * Design guarantee: both resolvers return null liberally. A null return
 * flows to the existing gate's default-dangerous behavior (sink fires) —
 * so any resolver bug regresses gracefully to current (over-firing)
 * behavior, never to false-negative.
 */
import type { TypeInfo } from '../types/index.js';
/**
 * Resolve the declared type of a bare-identifier argument (parameter or
 * field) visible at `callInMethod` scope.
 *
 * Lookup order:
 *   1. Parameters of the enclosing method (matching `callInMethod`).
 *   2. Fields of the enclosing type (any visibility).
 *   3. If enclosing type not found, scan ALL types' method params + fields
 *      (best-effort for top-level functions or method-name collisions).
 *
 * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
 * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
 */
export declare function resolveIdentifierType(name: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
/**
 * Resolve the declared return type of a same-file method invoked by
 * `calleeName`. Accepts a bare callee name (as extracted into
 * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
 *
 * Preference order:
 *   1. Method on the enclosing type matching `callInMethod`.
 *   2. Method on any type in the file (static call `MyClass.foo()` case).
 *
 * Overload handling: if the enclosing type has multiple methods with the
 * same name, returns the first one whose `return_type` is non-null. Full
 * overload resolution would need argument-expression typing that we don't
 * have; ambiguity is rare in practice and biases toward null (which
 * flows to the current default-dangerous behavior).
 */
export declare function resolveCallReturnType(calleeName: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
/**
 * true when the raw type string represents a Java `Class` type (any bound):
 * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
 *
 * NEVER matches:
 *   - `Class.forName(x)` — that's a call expression, not a declared type;
 *      lookups against `ir.types` won't find it (JDK reflection isn't
 *      user code).
 *   - `getClass()` return type — for the same reason.
 *   - Raw types missing generic bounds are Jackson-safe in the same way
 *     as the generic form: a bare `Class` param still has a compile-time
 *     type identity, so we accept it.
 */
export declare function isBoundedClassType(rawType: string | null): boolean;
/**
 * true when the raw type resolves to a container shape that
 * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
 * elements to `fork(2)` directly, no shell interpolation:
 *
 *   - `List<String>` (any parameterization narrower than `Object`)
 *   - `ArrayList<String>`, `LinkedList<String>`
 *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
 *   - `String[]`, `String ...` (varargs)
 *   - Fully qualified variants: `java.util.List<String>`, etc.
 *
 * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
 * arbitrary element types that could carry non-String content the JVM
 * would `.toString()` unsafely.
 */
export declare function isArgvContainerType(rawType: string | null): boolean;
//# sourceMappingURL=arg-type-resolver.d.ts.map