/**
 * TaintPropagationPass
 *
 * Propagates taint through the DFG to find verified source-to-sink flows,
 * then supplements with three additional flow-detection strategies that the
 * DFG-based analysis may miss:
 *   - Array element flows (tainted array[idx] → sink)
 *   - Collection/iterator flows (list.get(), queue.poll(), etc.)
 *   - Direct parameter-to-sink flows (interprocedural parameter used at sink)
 *
 * Depends on: sink-filter, constant-propagation
 */
import type { TaintFlowInfo } from '../../types/index.js';
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface TaintPropagationPassResult {
    flows: TaintFlowInfo[];
}
export declare class TaintPropagationPass implements AnalysisPass<TaintPropagationPassResult> {
    readonly name = "taint-propagation";
    readonly category: "security";
    run(ctx: PassContext): TaintPropagationPassResult;
}
//# sourceMappingURL=taint-propagation-pass.d.ts.map