/**
 * Require-entry-path anchor (cognium-dev#234, ships 3.153.0).
 *
 * Post-pipeline, project-level helper that:
 *   1. Annotates high+critical (H+C) taint findings with an
 *      `entryPath[]` chain of methods traversed from a classified
 *      Tier-1 entry point (Spring MVC handler, JAX-RS resource,
 *      Servlet lifecycle method, Netty channel handler, `main(String[])`,
 *      …) down to the finding's sink method.
 *   2. Drops H+C findings under `application` / `server` / `cli` /
 *      `plugin` / `unknown` project profiles when the reverse-BFS
 *      conclusively returns no such chain — i.e. the finding lives on a
 *      method that no HTTP / RPC / lifecycle entry point in the scan can
 *      reach.
 *
 * # Why
 *
 * cognium-ai#189 §1 (2026-07 Tier-2 Java cohort — hutool, Sentinel,
 * plantuml, mockserver) surfaced 1942 H+C findings on hutool with
 * *zero* classified HTTP/RPC entry point and no reachable path from
 * `main`. #236 (source-side profile gate, 3.151.0) and #232
 * (sink-side profile gate, 3.152.0) each attacked the problem via
 * profile-conditional per-file drops, but both leave the residual
 * signal on files whose profile is `application/*` or `unknown` even
 * though the enclosing method is manifestly unreachable from any
 * classified boundary.
 *
 * This helper closes that hole: no entry point → no path from an
 * entry point → no H+C finding. Every remaining H+C finding under
 * `application/*` carries a demonstrable call chain from a real
 * boundary as evidence, materialised on `entryPath[]` for consumers
 * (CLI, SARIF, cognium-ai) to display.
 *
 * # Scope
 *
 * - Java + Python + JS/TS + Go + Bash (as of 3.166.0, #237). Rust /
 *   HTML / Vue / unknown languages pass through unchanged. The
 *   `SUPPORTED_LANGUAGES` set below controls language admission; the
 *   per-language safety guard (`entryPointKeysByLanguage.get(lang) === 0
 *   → keep`) preserves recall on library-only bundles where the
 *   classifier truly has no signal.
 * - Project-level only. Per-file `analyze()` never runs this helper —
 *   the reachability question is meaningful only across a full scan.
 * - Only H+C findings from taint passes are candidates for drop. Metric
 *   findings, `medium` / `low` taint findings, and findings without a
 *   resolved containing method are always preserved.
 *
 * # Interaction with #236 / #232
 *
 * Both #236 and #232 fire when `projectProfile` starts with `library/`:
 * the source / sink is dropped BEFORE the flow is materialised. This
 * helper therefore no-ops under `library/*` (an already-dropped flow
 * never reaches us) but still ANNOTATES findings with `entryPath[]`
 * whenever a chain is available, so downstream consumers can see the
 * anchor regardless of the drop decision.
 *
 * # Reference
 *
 * - cognium-dev#234 — this ticket.
 * - cognium-dev#128 — entry-point tier classifier.
 * - cognium-dev#236 (3.151.0) — source-side library-profile gate.
 * - cognium-dev#232 (3.152.0) — sink-side library-profile gate.
 * - cognium-ai#189  — Tier-2 Java cohort audit.
 * - `docs/ARCHITECTURE.md` ADR-010.
 */
import type { CircleIR, ProjectProfile } from '../types/index.js';
/** Rule identifier used for `disabledPasses` lookups. */
export declare const RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
export interface ApplyRequireEntryPathOptions {
    /**
     * Caller-resolved profile for each file. Same semantics as
     * `AnalyzerOptions.projectProfile`. When absent, the helper treats
     * every file as `'unknown'` — i.e. drops still apply.
     */
    projectProfile?: ProjectProfile | Map<string, ProjectProfile>;
    /**
     * Set of disabled pass ids (from `AnalyzerOptions.disabledPasses`).
     * If it contains `'require-entry-path'`, the helper is a full no-op
     * (no annotation, no drop).
     */
    disabledPasses?: ReadonlySet<string> | ReadonlyArray<string>;
}
/**
 * Apply the entry-path gate + annotation to every file's findings in
 * `fileAnalyses`, mutating each `analysis.findings` array in place.
 *
 * The mutation is idempotent — running twice produces the same result
 * (BFS is deterministic; annotation always overwrites prior fields
 * with the same values).
 */
export declare function applyRequireEntryPath(fileAnalyses: ReadonlyArray<{
    file: string;
    analysis: CircleIR;
}>, options?: ApplyRequireEntryPathOptions): void;
//# sourceMappingURL=require-entry-path.d.ts.map