/**
 * Configuration loader for taint source/sink definitions
 *
 * Loads YAML configs from configs/sources/ and configs/sinks/
 */
import type { SourceConfig, SinkConfig, SinkSemanticsConfig, SinkSemanticsEntry, TaintConfig, SourcePattern, SinkPattern, SanitizerPattern, HeaderRule } from '../types/config.js';
/**
 * Parse YAML/JSON configuration content.
 * Uses JSON since the config files are actually JSON despite .yaml extension.
 */
export declare function parseConfig<T>(content: string): T;
/**
 * Load and merge multiple source configs.
 */
export declare function loadSourceConfigs(configs: SourceConfig[]): SourcePattern[];
/**
 * Load and merge multiple sink configs.
 */
export declare function loadSinkConfigs(configs: SinkConfig[]): {
    sinks: SinkPattern[];
    sanitizers: SanitizerPattern[];
};
/**
 * Load and merge sink-semantics registry entries from one or more
 * configs. Used by `SinkSemanticsPass` (cognium-dev #139 Tier A) to
 * drop sinks whose emitted `SinkType` label disagrees with the
 * registry's real-behavior classification.
 */
export declare function loadSinkSemanticsConfigs(configs: SinkSemanticsConfig[]): SinkSemanticsEntry[];
/**
 * Create a combined taint configuration from raw config contents.
 *
 * `sinkSemanticsContents` is optional to preserve backward
 * compatibility with existing callers; passing an empty array (or
 * omitting the argument) disables the sink-semantics gate.
 */
export declare function createTaintConfig(sourceContents: string[], sinkContents: string[], sinkSemanticsContents?: string[]): TaintConfig;
/**
 * Embedded default configurations (subset for standalone use).
 * Full configs should be loaded from files when available.
 */
export declare const DEFAULT_SOURCES: SourcePattern[];
export declare const DEFAULT_SINKS: SinkPattern[];
export declare const DEFAULT_SANITIZERS: SanitizerPattern[];
/**
 * Embedded default sink-semantics registry (cognium-dev #139 Tier A).
 * Mirrors `configs/sink-semantics.json` so the default gate is active
 * in browser/Node.js callers that never call `createTaintConfig`.
 *
 * Each entry maps a `<ClassName>#<methodName>` receiver signature to
 * the `SinkType` labels that should be dropped when the taint-matcher
 * emits that signature with a mismatched label. Class match is
 * simple-name and case-sensitive against `TaintSink.class`.
 */
export declare const DEFAULT_SINK_SEMANTICS: SinkSemanticsEntry[];
/**
 * Get the default taint configuration.
 */
export declare function getDefaultConfig(): TaintConfig;
/**
 * Default rule table for HTTP response security headers. Each rule is
 * evaluated against setHeader/addHeader calls and (for kind='missing')
 * against the absence of any such call on handler files.
 *
 * Covers clickjacking (CWE-1021) and CORS misconfiguration (CWE-346 /
 * CWE-942). Adding a new rule here is enough to surface a finding — no
 * pass code changes required.
 */
export declare const DEFAULT_HEADER_RULES: HeaderRule[];
//# sourceMappingURL=config-loader.d.ts.map