/**
 * SourceSemanticsPass — cognium-dev #138
 *
 * Tags every entry in `graph.ir.taint.sources` with three optional
 * booleans (`constant`, `spi`, `demoPath`) that downstream passes use
 * to drop or downgrade false-positive taint flows:
 *
 *   Filter 1 — Constant folding
 *     `String API_KEY = "abc";` / `static final String KEY = "abc";` /
 *     `String v = SomeEnum.VALUE;` → `constant = true`.
 *     A compile-time constant string cannot carry attacker-controlled
 *     data, so it is dropped for every taint sink type. The
 *     hardcoded-credential rule continues to fire (that is precisely
 *     the point of that rule).
 *
 *   Filter 2 — SPI (Service Provider Interface)
 *     `ServiceLoader.load(Plugin.class)` /
 *     `ServiceLoader.loadInstalled(...)` / `ServiceLoader.stream(...)` /
 *     `Class.forName(name)` co-located with a
 *     `.getResources("META-INF/services/…")` lookup within ±30 lines
 *     of the same method → `spi = true`. SPI-loaded values are
 *     provider-controlled configuration, not attacker input.
 *
 *   Filter 3 — Demo path
 *     Path components matching `demo`, `example(s)`, `samples`,
 *     `integration-tests`, or `integration_tests` (case-insensitive)
 *     → `demoPath = true` on every source in the file. This tag is
 *     never used to drop flows — `scan-secrets-pass` consumes it to
 *     downgrade hardcoded-credential findings on demo paths from
 *     `high` → `info` and `warning/error` → `note`.
 *
 * This pass is a pure source-tagger: it never emits SAST findings and
 * never removes sources from `graph.ir.taint.sources`. All
 * consumption is downstream (findings.ts, taint-propagation-pass,
 * scan-secrets-pass).
 *
 * Consumption policy is documented on the `TaintSource` type
 * (`src/types/index.ts`) and in `findings.ts:sourceSemanticsAllowed`.
 *
 * Pipeline slot: runs after `LanguageSourcesPass` (so the full source
 * list is available) and before `TaintPropagationPass` (so the tags
 * are visible to flow generation).
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
/**
 * Path-component regex used by both this pass (source tagging) and
 * `scan-secrets-pass` (severity downgrade). Matches when any path
 * segment equals one of the demo/example/samples/integration-tests
 * tokens, case-insensitive. A bare filename like `DemoParser.java`
 * does NOT match (no leading or trailing path separator).
 */
export declare const DEMO_PATH_RE: RegExp;
export interface SourceSemanticsResult {
    /** Number of sources tagged with `constant = true`. */
    constantCount: number;
    /** Number of sources tagged with `spi = true`. */
    spiCount: number;
    /** Number of sources tagged with `demoPath = true`. */
    demoPathCount: number;
}
export declare class SourceSemanticsPass implements AnalysisPass<SourceSemanticsResult> {
    readonly name = "source-semantics";
    readonly category: "security";
    run(ctx: PassContext): SourceSemanticsResult;
}
//# sourceMappingURL=source-semantics-pass.d.ts.map