/**
 * MyBatisAnnotationSqlSinkPass — cognium-dev #241 Java
 *
 * Detects SQL injection sinks on MyBatis annotation-driven Mapper interface
 * methods. MyBatis distinguishes two placeholder syntaxes in `@Select` /
 * `@Update` / `@Insert` / `@Delete` (and their `*Provider` variants):
 *
 *   - `#{name}` — JDBC PreparedStatement parameter binding. SAFE.
 *   - `${name}` — raw string interpolation into the SQL string. **SQLi.**
 *
 * The taint-matcher's YAML sink registry (`configs/sinks/sql.yaml`) covers
 * standard Mapper method names (insert/update/select-wildcard/delete) via a
 * generic `mybatis_mapper_call` discovery marker, but cannot inspect the
 * contents of an annotation string. Custom method names (`findByName`,
 * `getUserById`) with `${}` interpolation therefore fall through both the
 * name-based Mapper matcher and any downstream SQLi flow generator.
 *
 * This pass closes that gap. For every Java interface whose method carries
 * a MyBatis SQL annotation containing at least one `${varname}`, the pass
 * records the tainted parameter positions (correlated to `@Param("name")`
 * annotations or MyBatis positional convention `${param1}` / `${0}`), then
 * walks `graph.calls` for call sites targeting those Mapper methods and
 * emits a synthetic `sql_injection` (CWE-89) `TaintSink` at each match.
 *
 * The synthetic sinks are pushed onto the `TaintMatcherResult.sinks` list
 * so `SinkFilterPass` (which merges taint-matcher + language-sources) and
 * downstream flow generators pick them up without any registry changes.
 *
 * Pipeline slot: runs after `LanguageSourcesPass` and before
 * `SinkFilterPass` so the synthetic sinks are visible to the four-stage
 * FP-elimination filter and to `TaintPropagationPass` / `InterproceduralPass`.
 *
 * Language scope: Java only. Non-Java files short-circuit at run().
 *
 * Kill switch: opt out via `disabledPasses: ['mybatis-annotation-sql-sink']`.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface MyBatisAnnotationSqlSinkResult {
    /** Number of annotated Mapper methods with `${}` interpolation found. */
    annotatedMethodCount: number;
    /** Number of synthetic `sql_injection` sinks added. */
    addedSinkCount: number;
    /** Number of declaration-site `SastFinding`s emitted. */
    declarationFindingCount: number;
}
export declare class MyBatisAnnotationSqlSinkPass implements AnalysisPass<MyBatisAnnotationSqlSinkResult> {
    readonly name = "mybatis-annotation-sql-sink";
    readonly category: "security";
    run(ctx: PassContext): MyBatisAnnotationSqlSinkResult;
}
//# sourceMappingURL=mybatis-annotation-sql-sink-pass.d.ts.map