/**
 * Pass: weak-random (CWE-330, category: security)
 *
 * Pattern pass — flags use of non-cryptographic pseudo-random generators.
 * The vulnerability is the *choice of RNG*, not data flow: `new Random()`
 * is always a weak generator regardless of how its output is used.
 *
 * We flag PRNG construction / direct PRNG calls. Mirrors gosec G404 and
 * Bandit B311 behaviour: any use is reported and the developer is expected
 * to triage non-security uses (game RNG, jitter, simulation) as accepted.
 *
 * Detection per language:
 *   Java:
 *     - `new Random()` / `new Random(seed)`
 *     - `Math.random()`
 *     - `ThreadLocalRandom.current().nextX()` (also non-CSPRNG)
 *     - `new SplittableRandom(...)`
 *   Python:
 *     - `random.random()` / `random.randint(...)` / `random.choice(...)` /
 *       `random.uniform(...)` / `random.shuffle(...)` / `random.getrandbits(...)` /
 *       `random.sample(...)` / `random.choices(...)` / `random.randrange(...)` /
 *       `random.seed(...)`
 *   JavaScript / TypeScript:
 *     - `Math.random()`
 *   Go:
 *     - `math/rand` package calls — `rand.Int()`, `Intn()`, `Float64()`, etc.
 *       (Note: we check the bare receiver `rand`; the `crypto/rand` package
 *       is typically aliased on import to disambiguate.)
 *
 * Aligned with: gosec G404, Bandit B311, OWASP Benchmark `weakrand` category.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface WeakRandomResult {
    findings: Array<{
        line: number;
        language: string;
        api: string;
    }>;
}
export declare class WeakRandomPass implements AnalysisPass<WeakRandomResult> {
    readonly name = "weak-random";
    readonly category: "security";
    run(ctx: PassContext): WeakRandomResult;
    private fixFor;
    private detect;
    /**
     * Returns true when `math/rand` is the active `rand` identifier in this
     * file (i.e. `math/rand` imported unaliased; `crypto/rand` is either not
     * imported or imported under an alias).
     */
    private goMathRandIsActive;
}
//# sourceMappingURL=weak-random-pass.d.ts.map