/** * Non-executable source-line gate. * * Defensive utility for circle-ir + downstream consumers (cognium-ai). * A "source" whose line number points at an import, package, comment, * annotation-only line, or a compile-time constant declaration cannot * legitimately host a runtime taint source — no HTTP parameter, cookie, * DB read, or user-controlled variable can be introduced by such a * line. When we see one, it is either: * * 1. an LLM enrichment hallucination (cognium-dev#250 root cause) — * circle-ir-ai's `discoverSourcesForLanguage` step occasionally * returns fabricated `additionalSources` at the top of the file, * 2. a static-detector regression that resolved a source line to a * wrong AST node, or * 3. a caller bug — some external consumer passed a synthetic * TaintSource with an obviously-wrong line. * * In all three cases, dropping the source is correct: any resulting * finding is a fabricated flow that would fail human review anyway. * * This module is intentionally regex-only (no AST dependency) so it can * run at any pipeline stage — including after enrichment, before finding * emission — and is fast enough to invoke per-source without measurable * overhead. */ /** * Return true when the given 1-based line number in `sourceCode` cannot * host a runtime taint source under the given language. * * Returns false (permissive) when: * - `line` is out of range (defensive; callers should already have valid lines) * - the language is unrecognized * - the line's content genuinely looks executable */ export declare function isNonExecutableSourceLine(sourceCode: string, line: number, language: string): boolean; //# sourceMappingURL=non-executable-lines.d.ts.map