/**
 * SinkSemanticsPass — cognium-dev #139 Tier A
 *
 * Consults a curated `<ClassName>#<methodName>` → `real_class` +
 * `overrides` registry (`configs/sink-semantics.json`) and drops
 * sinks whose emitted `SinkType` label disagrees with the registry's
 * declared real-behavior classification.
 *
 * Motivation: the taint-matcher's `configs/sinks/*.yaml` patterns
 * often use method-only matches (no class filter) which produce FPs
 * when unrelated classes happen to share a method name. Canonical
 * example:
 *
 *     public byte[] get(byte[] key) {
 *       return connection.executeCommand(commandObjects.get(key));
 *     }
 *
 * The `executeCommand` pattern in `configs/sinks/command.yaml` has no
 * `class` filter, so `Jedis.executeCommand(...)` — Redis wire-protocol
 * serialization — is flagged as `command_injection`. The registry
 * fixes this by listing `Jedis#executeCommand → drop
 * command_injection` (with `real_class: db_protocol` as a documenting
 * label).
 *
 * The gate is deliberately narrow (~8 seed entries as of 3.144.0);
 * each entry is class-scoped so `Runtime.exec`, `ProcessBuilder.start`,
 * `Statement.execute`, `Class.forName`, and `Method.invoke` remain
 * unaffected. Unresolved receivers (`sink.class === undefined`) fall
 * through — the gate is false-negative-safe.
 *
 * Pipeline slot: runs after `SinkFilterPass` (so unrelated FP
 * suppressions have already fired) and before `TaintPropagationPass`
 * (so the flow generators never see the dropped sinks).
 *
 * Tier B (speculative verifier on disagreements) is explicitly OUT
 * of scope for circle-ir. Any speculative-verification layer belongs
 * in cognium-ai / circle-ir-ai; results from that layer can be
 * promoted to Tier A registry entries by hand.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface SinkSemanticsResult {
    /** Number of sinks dropped by the registry gate this run. */
    droppedCount: number;
    /** Number of registry entries loaded (0 = gate inactive). */
    registrySize: number;
}
export declare class SinkSemanticsPass implements AnalysisPass<SinkSemanticsResult> {
    readonly name = "sink-semantics";
    readonly category: "security";
    run(ctx: PassContext): SinkSemanticsResult;
}
//# sourceMappingURL=sink-semantics-pass.d.ts.map