/**
 * Taint Propagation Engine
 *
 * Tracks taint through variable assignments, method returns, and field accesses
 * using the DFG (Data Flow Graph) to find precise source-to-sink paths.
 */
import type { DFG, DFGDef, DFGChain, CallInfo, TaintSource, TaintSink, TaintSanitizer } from '../types/index.js';
import { CodeGraph } from '../graph/index.js';
/**
 * Optional context used by checkSanitized to widen its search from a single
 * line to the transitive reaching-def chain of the tainted use.
 *
 * cognium-dev #238 — sanitizer-credit failure.
 */
export interface SanitizerCheckCtx {
    /** DFG def id of the tainted use at the sink. */
    startDefId: number;
    /** graph.chainsByToDef — backward chain index. */
    chainsByToDef: ReadonlyMap<number, DFGChain[]>;
    /** graph.defById — def id → DFGDef lookup. */
    defById: ReadonlyMap<number, DFGDef>;
    /** Max hops for the backward walk. Default 32. */
    maxHops?: number;
}
/**
 * Represents a tainted variable at a specific point in the code.
 */
export interface TaintedVariable {
    variable: string;
    defId: number;
    line: number;
    sourceType: string;
    sourceLine: number;
    confidence: number;
}
/**
 * Represents a taint flow from source to sink.
 */
export interface TaintFlow {
    source: TaintSource;
    sink: TaintSink;
    path: TaintFlowStep[];
    sanitized: boolean;
    sanitizer?: TaintSanitizer;
    confidence: number;
}
/**
 * A step in the taint flow path.
 */
export interface TaintFlowStep {
    variable: string;
    line: number;
    type: 'source' | 'assignment' | 'use' | 'return' | 'field' | 'sink';
    description: string;
}
/**
 * Result of taint propagation analysis.
 */
export interface TaintPropagationResult {
    taintedVars: TaintedVariable[];
    flows: TaintFlow[];
    reachableSinks: Map<TaintSink, TaintSource[]>;
}
/**
 * Propagate taint through the dataflow graph.
 *
 * Accepts either a CodeGraph (preferred) or the legacy (dfg, calls, ...) signature
 * for backward compatibility with existing call sites and tests.
 */
export declare function propagateTaint(graphOrDfg: CodeGraph | DFG, callsOrSources: CallInfo[] | TaintSource[], sourcesOrSinks: TaintSource[] | TaintSink[], sinksOrSanitizers: TaintSink[] | TaintSanitizer[], sanitizersArg?: TaintSanitizer[]): TaintPropagationResult;
/**
 * Analyze method returns to propagate taint through return values.
 */
export declare function analyzeMethodReturns(dfg: DFG, calls: CallInfo[], taintedVars: TaintedVariable[]): TaintedVariable[];
/**
 * Calculate confidence score for a taint flow.
 */
export declare function calculateFlowConfidence(flow: TaintFlow): number;
/**
 * Get summary statistics for taint propagation.
 */
export declare function getTaintStats(result: TaintPropagationResult): {
    totalTaintedVars: number;
    totalFlows: number;
    flowsBySinkType: Map<string, number>;
    avgConfidence: number;
};
//# sourceMappingURL=taint-propagation.d.ts.map