/**
 * DeserializationSafetyGatePass — cognium-dev #258
 *
 * Drops `deserialization` sinks whose surrounding library configuration
 * renders them non-exploitable. Java-only in the MVP scope; runs after
 * `SinkSemanticsPass` (so upstream registry gates have already fired)
 * and before `TaintPropagationPass` (so flow generators never see the
 * dropped sinks).
 *
 * Three sub-gates:
 *
 *   Gate A — Fastjson `*_noneautotype` build (manifest-based).
 *     Reads `AnalyzerOptions.dependencyContext.java.pomXml`, resolves
 *     the effective Fastjson coordinate, and drops
 *     `JSON.parseObject` / `JSON.parse` deserialization sinks when the
 *     version literally matches the hardened classifier — UNLESS the
 *     file itself re-enables autotype via `setAutoTypeSupport(true)`
 *     (in which case the pinned build's protection is defeated and the
 *     sink continues to fire).
 *
 *   Gate B — Jackson polymorphism not enabled (in-file scan).
 *     `ObjectMapper.readValue(json, targetType)` is safe on Jackson
 *     ≥ 2.10 unless the file enables polymorphic type handling via
 *     `enableDefaultTyping` / `activateDefaultTyping` or applies
 *     `@JsonTypeInfo` somewhere. When none of those signals appear in
 *     the file, drop `ObjectMapper.readValue` deserialization sinks.
 *
 *   Gate C — SnakeYAML `SafeConstructor` (in-file scan).
 *     `new Yaml(new SafeConstructor())` gives a Yaml instance whose
 *     `.load(...)` cannot instantiate arbitrary classes. When the file
 *     builds any Yaml with SafeConstructor, drop `Yaml.load` /
 *     `Yaml.loadAs` / `Yaml.loadAll` deserialization sinks.
 *
 * Each sub-gate is defensive: on missing signal it defaults to *do
 * not drop* (the sink continues to fire). So a resolver bug can only
 * ever regress toward the current over-firing behaviour, never toward
 * a false negative.
 *
 * See `docs/PASSES.md` for the canonical pass registry entry.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
import type { DependencyContext } from '../../analyzer.js';
export interface DeserializationSafetyGateResult {
    /** Sinks dropped by Gate A (Fastjson noneautotype). */
    droppedFastjson: number;
    /** Sinks dropped by Gate B (Jackson polymorphism not enabled). */
    droppedJackson: number;
    /** Sinks dropped by Gate C (SnakeYAML SafeConstructor). */
    droppedSnakeYaml: number;
    /** Sinks dropped by Gate D (Python PyYAML ≥ 6.0 default-safe). */
    droppedPyYaml: number;
}
export declare class DeserializationSafetyGatePass implements AnalysisPass<DeserializationSafetyGateResult> {
    private readonly dependencyContext?;
    readonly name = "deserialization-safety-gate";
    readonly category: "security";
    constructor(dependencyContext?: DependencyContext | undefined);
    run(ctx: PassContext): DeserializationSafetyGateResult;
}
//# sourceMappingURL=deserialization-safety-gate-pass.d.ts.map