/**
 * Pass: mass-assignment (CWE-915, category: security)
 *
 * Pattern pass — flags code paths that splat an HTTP request bag (form /
 * body / query / json) directly into a domain-object constructor or update
 * helper without an allow-list. This complements the taint-based
 * `mass_assignment` SinkType which catches `Object.assign(user, req.body)`
 * via the regular sink matcher; this pass catches the *syntactic spread /
 * kwargs* forms that aren't a discrete call argument.
 *
 * Detection per language:
 *   Python:
 *     - `Model(**request.form)`
 *     - `Model(**request.json)` / `**request.get_json()`
 *     - `Model(**request.args)` / `**request.values`
 *     - `Model.objects.create(**request.X)` (Django ORM)
 *     - `Model.objects.update(**request.X)`
 *   JavaScript / TypeScript:
 *     - `{ ...req.body }`, `{ ...req.query }`, `{ ...req.params }`
 *     - `{ ...request.body }`, `{ ...ctx.request.body }` (Koa)
 *     - `await Model.create({ ...req.body })`
 *     - `await user.update({ ...req.body })`
 *
 * Severity: high (direct privilege escalation vector).
 * Issue: #86, Sprint 6.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface MassAssignmentResult {
    findings: Array<{
        line: number;
        language: string;
        pattern: string;
        snippet: string;
    }>;
}
export declare class MassAssignmentPass implements AnalysisPass<MassAssignmentResult> {
    readonly name = "mass-assignment";
    readonly category: "security";
    run(ctx: PassContext): MassAssignmentResult;
}
//# sourceMappingURL=mass-assignment-pass.d.ts.map