/**
 * Pass #89: security-headers (category: security)
 *
 * Inspects HTTP response-header writes and handler presence to detect
 * clickjacking (CWE-1021) and CORS misconfiguration (CWE-346 / CWE-942).
 *
 * This pass does NOT use the taint source→sink machinery — it is a
 * call-site literal inspection problem, not a data-flow problem. It reads
 * `graph.ir.calls` and `graph.ir.types[].{annotations,methods[].annotations}`.
 *
 * Rule table is defined in `config-loader.ts` as `DEFAULT_HEADER_RULES`.
 * Adding a new rule there is enough to surface a finding — no pass code
 * changes are required.
 *
 * Supported header-write method names (cross-language):
 *   - Java:   setHeader, addHeader         (HttpServletResponse, HttpHeaders)
 *   - JS:     setHeader, set, header       (Express res.setHeader/set/header,
 *                                           Node http.ServerResponse)
 *   - Rust:   insert_header, insert        (Actix / Axum HeaderMap)
 *
 * Handler detection (heuristic, cross-language):
 *   - Java/Kotlin: annotations matching Controller|RequestMapping|GetMapping|...
 *   - JS/TS:       calls like app.get/post/put/..., router.get/..., server.use
 *   - Python:      decorators matching route|blueprint|api_view
 *   - Rust:        attribute macros matching get|post|put|delete|patch|route
 */
import type { CallInfo, SastFinding, CircleIR } from '../../types/index.js';
import type { HeaderRule } from '../../types/config.js';
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
import type { TypeHierarchyResolver } from '../../resolution/type-hierarchy.js';
export interface SecurityHeadersOptions {
    /** Override rule table (default: DEFAULT_HEADER_RULES). */
    rules?: HeaderRule[];
}
export interface SecurityHeadersPassResult {
    /** Whether the file was treated as an HTTP handler. */
    hasHandler: boolean;
    /** Headers written in the file (lowercased header name → call sites). */
    writtenHeaders: Map<string, CallInfo[]>;
}
export declare class SecurityHeadersPass implements AnalysisPass<SecurityHeadersPassResult> {
    readonly name = "security-headers";
    readonly category: "security";
    private readonly rules;
    constructor(options?: SecurityHeadersOptions);
    run(ctx: PassContext): SecurityHeadersPassResult;
}
/**
 * Detect CORS misconfigurations inherited through class hierarchy.
 *
 * When a parent servlet calls `setHeader("Access-Control-Allow-Origin", getXxx())`
 * with a virtual method as the value, child classes override that method to return
 * different values. Per-file analysis only sees the parent's call — the children
 * have 0 calls and produce 0 findings. This function resolves each child's
 * override return value and emits the appropriate CORS finding on the child file.
 */
export declare function checkInheritedCorsHeaders(fileAnalyses: Array<{
    file: string;
    analysis: CircleIR;
}>, typeHierarchy: TypeHierarchyResolver, sourceLines: Map<string, string[]>): SastFinding[];
//# sourceMappingURL=security-headers-pass.d.ts.map