/**
 * DFG Verifier - Track 2 validation using def-use chains
 *
 * Verifies that taint actually flows from source to sink by following
 * the data flow graph. This provides a more precise validation than
 * pattern matching alone.
 */
import type { DFG, DFGDef, CallInfo, TaintSource, TaintSink, TaintSanitizer } from '../types/index.js';
import { CodeGraph } from '../graph/index.js';
/**
 * Result of DFG verification
 */
export interface VerificationResult {
    verified: boolean;
    confidence: number;
    reason: string;
    path?: VerificationPath;
    alternativePaths?: number;
}
/**
 * A verified path through the DFG
 */
export interface VerificationPath {
    steps: VerificationStep[];
    length: number;
    hasDirectFlow: boolean;
}
/**
 * A step in the verification path
 */
export interface VerificationStep {
    defId: number;
    variable: string;
    line: number;
    kind: DFGDef['kind'];
    flowType: 'direct' | 'assignment' | 'call' | 'return' | 'field';
}
/**
 * Configuration for the verifier
 */
export interface VerifierConfig {
    maxDepth?: number;
    requireDirectFlow?: boolean;
    allowFieldFlows?: boolean;
}
/**
 * DFGVerifier - Verifies taint flows using def-use chains
 */
export declare class DFGVerifier {
    private graph;
    private sanitizers;
    private config;
    private sanitizerLines;
    constructor(graphOrDfg: CodeGraph | DFG, callsOrSanitizers: CallInfo[] | TaintSanitizer[], sanitizersOrConfig?: TaintSanitizer[] | VerifierConfig, config?: VerifierConfig);
    /**
     * Verify if taint flows from source to sink
     */
    verify(source: TaintSource, sink: TaintSink): VerificationResult;
    /**
     * Find a path from a definition to a sink using BFS
     */
    private findPath;
    /**
     * Check if a definition reaches a sink
     */
    private reachesSink;
    /**
     * Determine the type of flow between two definitions
     */
    private determineFlowType;
    /**
     * Select the best path from multiple candidates
     */
    private selectBestPath;
    /**
     * Check if any sanitizer is in the path
     */
    private checkSanitizers;
    /**
     * Calculate confidence based on path characteristics
     */
    private calculateConfidence;
    /**
     * Batch verify multiple source-sink pairs
     */
    verifyAll(sources: TaintSource[], sinks: TaintSink[]): Map<string, VerificationResult>;
    /**
     * Get verification statistics
     */
    getStats(results: Map<string, VerificationResult>): {
        total: number;
        verified: number;
        notVerified: number;
        sanitized: number;
        avgConfidence: number;
    };
}
/**
 * Convenience function to verify a single flow
 */
export declare function verifyTaintFlow(dfg: DFG, calls: CallInfo[], source: TaintSource, sink: TaintSink, sanitizers?: TaintSanitizer[], config?: VerifierConfig): VerificationResult;
/**
 * Format verification result for display
 */
export declare function formatVerificationResult(result: VerificationResult): string;
//# sourceMappingURL=dfg-verifier.d.ts.map