/**
 * Pass: cache-no-vary (CWE-524, category: security)
 *
 * Pattern pass — flags HTTP handlers that set a *shared-cacheable*
 * `Cache-Control` directive (`public` or implicit-public + positive `max-age`)
 * **AND** read authenticated or user-scoped state (cookies / Authorization
 * header / session), **AND** do not set `Vary: Cookie` / `Vary: Authorization`.
 *
 * In that configuration a shared cache (CDN, reverse proxy, ISP cache) keys
 * the response by URL only and is free to serve user A's body to user B —
 * the canonical CWE-524 leak.
 *
 * Languages: JavaScript / TypeScript (Express-style `res.setHeader` etc.),
 * Python (Flask / Django / FastAPI), Go (`net/http`, gin), Java (Servlet /
 * Spring).
 *
 * Trigger mode: strict + auth-qualifier. Skips:
 *   - `Cache-Control: private` / `no-store` / `no-cache`
 *   - `max-age=0` (effectively non-cacheable)
 *   - Handlers with no auth/session/cookie read
 *   - Handlers that set `Vary: Cookie|Authorization|*`
 *   - Test files (`*.test.*`, `*.spec.*`, `__tests__/`, `tests/`)
 *
 * Closes: cognium-dev #96 L91.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface CacheNoVaryResult {
    findings: Array<{
        line: number;
        language: string;
        handler: string | null;
        cacheValue: string;
    }>;
}
export declare class CacheNoVaryPass implements AnalysisPass<CacheNoVaryResult> {
    readonly name = "cache-no-vary";
    readonly category: "security";
    run(ctx: PassContext): CacheNoVaryResult;
}
//# sourceMappingURL=cache-no-vary-pass.d.ts.map