/**
 * CliMainReflectionSuppressPass — cognium-dev #162 Option B
 *
 * Drops Java reflection `code_injection` sinks in files that look like
 * a fat-jar CLI tool's own artifact — files that ship a `main(String[])`
 * entry point AND carry no web-framework entry-point signal anywhere
 * in the file. The `main(String[])` on the same compilation unit *is*
 * the trust boundary; the caller is the OS shell that invoked the jar.
 *
 * Motivation (from the ticket):
 *
 *     // antlr/tool/.../TestRig.java — 5 reflection sinks reported HIGH
 *     public static void main(String[] args) throws Exception {
 *         TestRig testRig = new TestRig(args);
 *         ...
 *     }
 *     public void process() throws Exception {
 *         String lexerName = grammarName + "Lexer";
 *         ClassLoader cl = Thread.currentThread().getContextClassLoader();
 *         Class<? extends Lexer> lexerClass =
 *             cl.loadClass(lexerName).asSubclass(Lexer.class);   // sink
 *         Constructor<? extends Lexer> lexerCtor =
 *             lexerClass.getConstructor(CharStream.class);
 *         Lexer lexer = lexerCtor.newInstance((CharStream)null);  // sink
 *         ...
 *     }
 *
 * This is documented behaviour of ANTLR's `TestRig` developer CLI —
 * same shape as `javac`, `java -jar`, `python -m`. The tool's whole
 * purpose is "give me a grammar name from the command line and I'll
 * run it." Blocked 5/49 HIGH FPs in the top-100 Java harness.
 *
 * ## Signal
 *
 * Language MUST be Java. Per-file signal (all must hold):
 *
 *   1. Some type in the file declares a `main(String[])` method
 *      (matches `looksLikeMainMethod` in `entry-point-detection.ts`).
 *   2. NO type in the file carries a Tier-1 class-level web-framework
 *      annotation (`@RestController`, `@Controller`, `@Service`,
 *      `@Component`, `@Path`, `@WebServlet`, `@ServerEndpoint`,
 *      `@FeignClient`, `@Repository`).
 *   3. NO method in the file carries a Tier-1 method-level
 *      web-framework annotation (Spring `@*Mapping`, `@KafkaListener`,
 *      `@JmsListener`, JAX-RS `@GET/@POST/…`, `@Scheduled`, `@Path`,
 *      `@DataBoundConstructor`/`@DataBoundSetter`).
 *   4. NO type in the file extends a Tier-1 supertype (HttpServlet,
 *      GenericServlet, Filter, HandlerInterceptor, CommandLineRunner,
 *      SimpleChannelInboundHandler, etc.).
 *
 * ## Action
 *
 * When the signal fires, drop from the `SinkFilterResult.sinks` list
 * (the authoritative sink array consumed by `TaintPropagationPass` and
 * folded into `taint.sinks` by `analyzer.ts`) every sink whose
 * `type === 'code_injection'` AND `method` is a Java reflection
 * / ClassLoader surface method. The gate does NOT touch other
 * `code_injection` shapes: ScriptEngine.eval / GroovyShell.evaluate /
 * SpEL `parseExpression` remain flagged in CLI tools because they
 * evaluate scripts (a genuinely dangerous CLI misuse), not just class
 * names.
 *
 * ## Pipeline slot
 *
 * Runs after `SinkSemanticsPass` (so its curated-registry drops have
 * already fired) and before `TaintPropagationPass` (so the flow
 * generators never see the dropped sinks). Emits no findings.
 *
 * ## Pillar I / safety
 *
 * - Pure per-file heuristic; no LLM, no filesystem, no config knobs.
 * - False-negative-safe: any web-framework signal in the file
 *   (annotation OR supertype OR Tier-1 method annotation) disables
 *   the gate. Recall preserved for `@RestController` classes,
 *   `HttpServlet` subclasses, Netty handlers, Jenkins plugins, and
 *   Kafka/JMS listeners that happen to also expose a `main`.
 * - Reflection-only: `Runtime.exec`, `ProcessBuilder.start`,
 *   `Statement.execute`, `ObjectInputStream.readObject`, SpEL,
 *   Groovy, ScriptEngine — all unaffected.
 * - Java-only: non-Java sources fall through untouched.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface CliMainReflectionSuppressResult {
    /** Whether the fat-jar CLI signal fired for this file. */
    cliMainSignal: boolean;
    /** Number of reflection `code_injection` sinks dropped. */
    droppedCount: number;
}
export declare class CliMainReflectionSuppressPass implements AnalysisPass<CliMainReflectionSuppressResult> {
    readonly name = "cli-main-reflection-suppress";
    readonly category: "security";
    run(ctx: PassContext): CliMainReflectionSuppressResult;
}
//# sourceMappingURL=cli-main-reflection-suppress-pass.d.ts.map